Sorry --
Here's the orginal email:
eturn-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 17743 invoked by alias); 23 Jul 2001 04:52:05 -0000
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 17739 invoked from network); 23 Jul 2001 04:52:04 -0000
Received: from quarantine1.messagelabs.com (195.216.16.211)
by mdialup92.dnvr.uswest.net with SMTP; 23 Jul 2001 04:52:04 -0000
Received: (qmail 3004 invoked by uid 0); 17 Jul 2001 12:45:32 -0000
Date: 17 Jul 2001 12:45:32 -0000
Message-ID: <[EMAIL PROTECTED]>
To: abuse@[206.196.128.6], postmaster@[206.196.128.6], abuse@[209.180.243.92],
postmaster@[209.180.243.92],
Subject: Hybris virus originating from your IP address
From: [EMAIL PROTECTED]
Content-Length: 1527
Lines: 37
Hi,
I work for an ISP, and we have detected the Hybris virus originating
in emails coming from your mail server. The emails have a forged
sender address, and therefore we are unable to contact the message
sender directly. I would therefore be grateful if you could trace
and contact the message sender from the original email headers
supplied below and politely inform them that they have a virus
infection, and ask them to stop sending the virus.
By the way, it is unlikely that the sender is aware that they are
sending these emails. This is part of the effect of the virus.
Please could you inform me of the result, using the email address
below (replying to this email using the reply button will cause your
email to go to an account which catches domains with no postmaster address)
Regards,
Alex Shipp
Virus Technologist
[EMAIL PROTECTED]
-------------------------------------------------
Our ref: 502982_995372476
Received: (qmail 6105 invoked from network); 17 Jul 2001 12:21:15 -0000
Received: from dnvrpop4.dnvr.uswest.net (206.196.128.6)
by server-12.tower-4.starlabs.net with SMTP; 17 Jul 2001 12:21:15 -0000
Received: (qmail 43445 invoked by uid 0); 17 Jul 2001 12:22:45 -0000
Received: from mdialup92.dnvr.uswest.net (HELO ea21i) (209.180.243.92)
by dnvrpop4.dnvr.uswest.net with SMTP; 17 Jul 2001 12:22:45 -0000
From: "Hahaha" <[EMAIL PROTECTED]>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VESDANSDIVCXEJ01MRGTAJ"
On Mon, Jul 23, 2001 at 05:10:51PM +0200, Johan Almqvist wrote:
> * David J Jackson <[EMAIL PROTECTED]> [010723 16:41]:
> > I got the following email claiming someone is using emails containing
> > vivrus from my domain ?pickedbeans.com? using a forged header? Does that
> > mean the mail is being routed threw my server?
>
> You forgot the attachment...
>
> -Johan
> --
> Johan Almqvist
> http://www.almqvist.net/johan/qmail/
