Cami
Below are the two spams
The third is a listing of how a "Normal" email Appears...
If you can see how they did this I would really appreciate your advice
DonMath
*SPAM1 (that turned up in the in the spam trap account)*
------------------------------------------------------------------------
From [EMAIL PROTECTED] Sun Apr 6 19:08:16 2008
Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: by ultrae2.ultra-e.net (Postfix, from userid 505)
id 7722818585; Sun, 6 Apr 2008 19:08:16 +1000 (EST)
X-Greylist: Passed host: 67.198.199.149
Received: from mx5.letsgetmapping.net (mx5.letsgetmapping.NET [67.198.199.149])
by ultrae2.ultra-e.net (Postfix) with SMTP id 9B0101851B
for <[EMAIL PROTECTED]>; Sun, 6 Apr 2008 19:08:09 +1000 (EST)
X-Originating-IP: [67.198.199.149]
X-Originating-Email: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
To: moonsong <[EMAIL PROTECTED]>
Reply-To: "Etruscan" <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED]
Date: 6 Apr 2008 02:14:30 -0700
Message-ID: <[EMAIL PROTECTED]>
From: "David" <[EMAIL PROTECTED]>
Subject: 200k-250k a year Sla Moonsong 6 Apr 2008 02:14:30 -0700
MIME-Version: 1.0
Thread-Index: N200839h2I3wx61e89A0UB5jXZ00M==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6685
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-Priority: 3
X-MSMail-priority: Normal
X-OriginalArrivalTime: 6 Apr 2008 02:14:30 -0700 (UTC) | 0229EK30:01C80486 CST
Content-Type: text; charset=WINDOWS-1252
Content-Transfer-Encoding: 7BIT
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ultrae2.ultra-e.net
X-Spam-Level:
X-Spam-Status: No, score=0.3 required=3.9 tests=BAYES_50,INVALID_TZ_GMT,
MOONSONG_UEUSER autolearn=no version=3.0.0
Hi Sla Moonsong, 6 Apr 2008 02:14:30 -0700
No need to leave home to work -- This is one of the easiest ways to generate money.
------------------------------------------------------------------------
*
SPAM2 (that turned up in the in the spam trap account)*
------------------------------------------------------------------------
From [EMAIL PROTECTED] Sun Apr 6 05:53:24 2008
Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: by ultrae2.ultra-e.net (Postfix, from userid 505)
id C677A18585; Sun, 6 Apr 2008 05:53:24 +1000 (EST)
X-Greylist: Passed host: 72.37.207.58
Received: from mx1.generatingadrivetowardsexcellence.com
(mx1.generatingadrivetowardsexcellence.com [72.37.207.58])
by ultrae2.ultra-e.net (Postfix) with SMTP id 8D39B1851B
for <[EMAIL PROTECTED]>; Sun, 6 Apr 2008 05:53:19 +1000 (EST)
DKIM-Signature: v=1; a=rsa-sha1; c=simple;
d=generatingadrivetowardsexcellence.com;
h=message-id:from:to:subject:date:content-type;
q=dns/txt; s=s512; bh=MyKOaFc9YvyEhqaNtFCnjgAlHpY=;
b=rd/uWJUqVTMK+hQHajNJXLSXx0UhBltokfGXSpjIbdtXcZGdOgWvEMWagEVTCpZdgBckEMVLUk4Wwx6374hSbA==;
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple;
s=s512; d=generatingadrivetowardsexcellence.com;
b=gHChHwWMqYBTKAkuZ8BNBIBdzwWBnc6UCFtDb9qzG23JgkQHn2DDLVe9ZOUdyMsmspIODN7oarSEh68W0OS7NQ==;
Received: from mx1.generatingadrivetowardsexcellence.com [72.37.207.58] by
generatingadrivetowardsexcellence.com [72.37.207.58];
Fri, 4 Apr 2008 23:18:44 PST
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
X-Originating-IP: [72.37.207.58]
X-Originating-Email: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
From: Jobs Available <[EMAIL PROTECTED]>
Reply-To: Jobs Available <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: <[EMAIL PROTECTED]>
Subject: Process For Home Depot T oday, Inquire Within-05 Apr 2008 04:40:58
-0700
Date: Fri, 4 Apr 2008 23:18:44 PST
Errors-To: Jobs Available <[EMAIL PROTECTED]>
Thread-Index: MQmmmCsERUDXDSKMVhxhxTCkMGIPMd==
Routing-path: FcuVUogp.rEXPbbRKhoSEJQVIp=
X-Mailer: 3.5.0-32 [Feb 28 2008, 07:57:20]
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ultrae2.ultra-e.net
X-Spam-Level:
X-Spam-Status: No, score=-0.3 required=3.9 tests=BAYES_40,DATE_IN_PAST_12_24,
MOONSONG_UEUSER,PORN_URL_SEX autolearn=no version=3.0.0
Home Depot Processor Positions Available:
------------------------------------------------------------------------
*NORMAL EMAIL* (obscured)
------------------------------------------------------------------------
From [EMAIL PROTECTED] Mon Apr 7 22:37:12 2008
Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: by ultrae2.ultra-e.net (Postfix, from userid 505)
id 8258218585; Mon, 7 Apr 2008 22:37:12 +1000 (EST)
X-Greylist: Passed host: 999.168.53.112
Received: from mail.example.com.au (dsl-99-999.qld1.net.au [999.168.53.112])
by ultrae2.ultra-e.net (Postfix) with ESMTP id 3D47B1851B
for <[EMAIL PROTECTED]>; Mon, 7 Apr 2008 22:37:11 +1000 (EST)
Received: by mail.example.com.au (Postfix, from userid 501)
id 9E15C40135; Mon, 7 Apr 2008 23:03:28 +1000 (EST)
To: [EMAIL PROTECTED]
Subject: test subject
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 7 Apr 2008 23:03:28 +1000 (EST)
From: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ultrae2.ultra-e.net
X-Spam-Level:
X-Spam-Status: No, score=-0.4 required=3.9 tests=BAYES_05,NO_REAL_NAME
autolearn=no version=3.0.0
line 1
Cami Sardinha wrote:
[EMAIL PROTECTED] wrote:
Question
I set up a "spamtrap" address inside Policyd about 2 months ago...
It is my understanding that the 'spamtrap' email address
after it has been set up does **NOT** receive any futher emails!!!!
there are two(2) spams in that emailaddress INBOX this morning....
1) my current theory is that they sent in a "double" email (ie
two(2) spams inline as one(1) email)
[ because the local transfer header is missing in these
spamtrap emails ]
2) my system is compromised
I just would like strong a confirmation that "spamtrap" email address's
receive no new email!!
Spamtrap addresses should not receive mail normally.
If you post the headers of the message that slipped
through, it will allow some further insight/explanation.
Cami
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Register now and save $200. Hurry, offer ends at 11:59 p.m.,
Monday, April 7! Use priority code J8TLD2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
policyd-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/policyd-users
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Register now and save $200. Hurry, offer ends at 11:59 p.m.,
Monday, April 7! Use priority code J8TLD2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
policyd-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/policyd-users
