This Junk mail that a customer of mine received have me somewhat confused and perplexed. customer x started to receive junkmail from customer y (they both know each other). The X-sender-ip IS a valid ip in our dial-up range and customer Y WAS logged in at this time these messages was sent.
When you look at the messages they are PURE spam with a url back to mailbits.com which have commercial purpose. Haven't had a chance to get hold of customer Y to see if they know or run any program by mailbits. Anyone ever heard anything similar before ?? Below is the headers of the message. Not X-Mailer is marked as DropFile 1.2 anybody heard about that ? I did a quick google search and didn't really come up with anything. So for now I simply got mail.mailbits.com blocked in our firewall for now :( Received: from mail.mailbits.com [199.106.236.85] by imail.fament.com with ESMTP (SMTPD32-7.07) id A74E5200F0; Wed, 03 Jul 2002 17:14:38 -0500 Received: by mail.mailbits.com (NPlex 5.5.021) id 3CBDAE7204F833F2 for [EMAIL PROTECTED]; Wed, 3 Jul 2002 18:10:56 -0400 Message-ID: <[EMAIL PROTECTED]> (added by [EMAIL PROTECTED]) X-Mailer: DropFile 1.2 X-Sender-IP: 208.189.27.35 Content-Type: text/html; charset="us-ascii" Date: Wed, 3 Jul 2002 18:13:07 -0500 From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: I'd like to introduce you to someone... X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [0.999996] X-Declude-Sender: [EMAIL PROTECTED] [199.106.236.85] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: This E-mail was sent from mail.mailbits.com. ([199.106.236.85]). X-Tests-Failed: HEUR10. X-Note: Total spam weight of this E-mail is 5. X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 296516739 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
