You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris <cp...@earthlink.net> on 2006/02/02 03:41:24 UTC
X-eBay-MailTracker
Got to looking at one of the spams that fetchyahoo pulls down from my yahoo
account and noticed this:
X-eBay-MailTracker: 53365.727.5.36703
Anyone have an explanation for me? Both messages had the same numbers.
--
Chris
Registered Linux User 283774 http://counter.li.org
20:39:20 up 23 days, 2:25, 1 user, load average: 0.02, 0.17, 0.70
Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
Re: X-eBay-MailTracker
Posted by Loren Wilton <lw...@earthlink.net>.
It appears that Ebay inserts things like that into mails that it sends to
users under various conditions. The numbers seem to be the same for a
while, but change from time to time. I wasn't able to figure out any
obvious pattern to them.
So two explanations:
1. This is really legit ebay mail that you have decided is a spam.
2. This is a spam where someone is trying to make it look like legit ebay
mail.
Loren
Re: X-eBay-MailTracker
Posted by Chris <cp...@earthlink.net>.
On Thursday 02 February 2006 12:16 am, Loren Wilton wrote:
> Yep, forged. I see at least three things wrong with those headers to be
> valid ebay headers. With the rest of the header bits I'm pretty sure I'd
> see at least one more.
>
> Was this a phish or just a random spam?
>
> Loren
Random spam
--
Chris
Registered Linux User 283774 http://counter.li.org
05:53:32 up 23 days, 11:39, 1 user, load average: 0.95, 0.58, 0.27
Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
Re: X-eBay-MailTracker
Posted by Kelson <ke...@speed.net>.
Loren Wilton wrote:
> Yep, forged. I see at least three things wrong with those headers to be
> valid ebay headers. With the rest of the header bits I'm pretty sure I'd
> see at least one more.
Hmm, I wonder if this might be worth using as a spam sign. If you find
this header, but no sign of eBay elsewhere in the headers, add a point
or two.
Even better would be finding a way to correlate the numbers with the
other headers, looking for a valid X-eBay-MailTracker, but that assumes
that eBay actually bases them on something that can be verified, and not
just some internal counter. I checked my last few real messages from
eBay, and the only pattern I can see is that all my saved search notices
have the same number, which may mean "This is a saved search notice" or
it may mean "this is a notice for saved search #XYZ."
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: X-eBay-MailTracker
Posted by Loren Wilton <lw...@earthlink.net>.
Yep, forged. I see at least three things wrong with those headers to be
valid ebay headers. With the rest of the header bits I'm pretty sure I'd
see at least one more.
Was this a phish or just a random spam?
Loren
Re: X-eBay-MailTracker
Posted by Chris <cp...@earthlink.net>.
On Wednesday 01 February 2006 8:55 pm, jdow wrote:
> Forged?
> {^_^}
> ----- Original Message -----
> From: "Chris" <cp...@earthlink.net>
>
> Got to looking at one of the spams that fetchyahoo pulls down from my
> yahoo account and noticed this:
>
> X-eBay-MailTracker: 53365.727.5.36703
>
> Anyone have an explanation for me? Both messages had the same numbers.
Probably is, here's the headers:
X-YahooFilteredBulk: 219.249.93.214
X-Originating-IP: [219.249.93.214]
Return-Path: <is...@aacpc.com>
Authentication-Results: mta256.mail.mud.yahoo.com from=aacpc.com;
domainkeys=neutral (no sig)
Received: from 219.249.93.214 (HELO 4.79.181.15) (219.249.93.214) by
mta256.mail.mud.yahoo.com with SMTP; Wed, 01 Feb 2006 17:34:39 -0800
Received: from sj-besreco069 (sj-besreco558.sjc.ebay.com
[219.249.93.214]) by mx80.sjc.ebay.com (8.12.3/8.12.3) with ESMTP id
j8VJQsZg060077
219.249.93.214 is Korean ISP, or didn't I read the headers right?
--
Chris
Registered Linux User 283774 http://counter.li.org
21:04:55 up 23 days, 2:51, 1 user, load average: 0.27, 0.15, 0.23
Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Win98 error 008: Illegal copies of Microsoft software found on harddisk, and
the modem didn't respond to our attempts to call the FBI.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Re: X-eBay-MailTracker
Posted by jdow <jd...@earthlink.net>.
Forged?
{^_^}
----- Original Message -----
From: "Chris" <cp...@earthlink.net>
Got to looking at one of the spams that fetchyahoo pulls down from my yahoo
account and noticed this:
X-eBay-MailTracker: 53365.727.5.36703
Anyone have an explanation for me? Both messages had the same numbers.