You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Robert Swan <rs...@nskinc.com> on 2006/12/04 18:25:16 UTC
SPAM Question
Q1. How does this e-mail end up in my mailbox, if the "To:" is someone
else (I am not morocco@nskinc.com), and how can I identify this with a
SPAM rule:
Q2. Is there a custom rule that triggers if someone sends from an ".ar"
domain server or some other foreign country server , we don't get e-mail
here from other counties ever.
Thanks in advance...
Received: by spam1.nskinc.com (Postfix, from userid 501)
id 26E7034D15F; Sat, 2 Dec 2006 02:23:15 -0500 (EST)
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on SPAM1
X-Spam-Level: **
X-Spam-Status: No, score=2.8 required=4.9
tests=BAYES_80,LOCAL_INVALID_PTR2,
UNPARSEABLE_RELAY autolearn=no version=3.1.7
Received: from 41EB3698 (unknown [80.227.13.12])
by spam1.nskinc.com (Postfix) with SMTP id F07C034CB3C;
Sat, 2 Dec 2006 00:30:41 -0500 (EST)
Received: from intrusive.uccor.edu.ar (HELO precis.uccor.edu.ar)
by linux.org (8.12.6/8.12.6/Debian-1) with ESMTP id
gBAApHtr083821
for <mo...@nskinc.com>; Fri, 01 Dec 2006 22:18:52 -0700
Message-Id: <20...@uccor.edu.ar>
Reply-To: "Your Mngr. linetmelisa" <Ro...@mail2world.com>
Date: Fri, 01 Dec 2006 23:22:52 -0600
From: "Mr. lizzie" <Ro...@mail2world.com>
To: <mo...@nskinc.com>
Subject: just like the real ones -Roxanne
Return-Path: Salvatore@keromail.com
X-OriginalArrivalTime: 02 Dec 2006 18:54:45.0462 (UTC)
FILETIME=[55648760:01C71643]
Robert
Peace he would say instead of goodbye....peace my brother.
Re: SPAM Question
Posted by Loren Wilton <lw...@earthlink.net>.
Gee, I thought these had been gone for weeks.
Write a rule for this:
Reply-To: "Your Mngr. linetmelisa" <Ro...@mail2world.com>
----- Original Message -----
From: Robert Swan
To: users@spamassassin.apache.org
Sent: Monday, December 04, 2006 9:25 AM
Subject: SPAM Question
Q1. How does this e-mail end up in my mailbox, if the "To:" is someone else (I am not morocco@nskinc.com), and how can I identify this with a SPAM rule:
Q2. Is there a custom rule that triggers if someone sends from an ".ar" domain server or some other foreign country server , we don't get e-mail here from other counties ever.
Thanks in advance.
Received: by spam1.nskinc.com (Postfix, from userid 501)
id 26E7034D15F; Sat, 2 Dec 2006 02:23:15 -0500 (EST)
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on SPAM1
X-Spam-Level: **
X-Spam-Status: No, score=2.8 required=4.9 tests=BAYES_80,LOCAL_INVALID_PTR2,
UNPARSEABLE_RELAY autolearn=no version=3.1.7
Received: from 41EB3698 (unknown [80.227.13.12])
by spam1.nskinc.com (Postfix) with SMTP id F07C034CB3C;
Sat, 2 Dec 2006 00:30:41 -0500 (EST)
Received: from intrusive.uccor.edu.ar (HELO precis.uccor.edu.ar)
by linux.org (8.12.6/8.12.6/Debian-1) with ESMTP id gBAApHtr083821
for <mo...@nskinc.com>; Fri, 01 Dec 2006 22:18:52 -0700
Message-Id: <20...@uccor.edu.ar>
Reply-To: "Your Mngr. linetmelisa" <Ro...@mail2world.com>
Date: Fri, 01 Dec 2006 23:22:52 -0600
From: "Mr. lizzie" <Ro...@mail2world.com>
To: <mo...@nskinc.com>
Subject: just like the real ones -Roxanne
Return-Path: Salvatore@keromail.com
X-OriginalArrivalTime: 02 Dec 2006 18:54:45.0462 (UTC) FILETIME=[55648760:01C71643]
Robert
Peace he would say instead of goodbye....peace my brother.
RE: SPAM Question
Posted by "Coffey, Neal" <nc...@langeveld.com>.
> Q1. How does this e-mail end up in my mailbox, if the "To:" is someone
> else (I am not morocco@nskinc.com)
It's a relic from the days when there were about 8 computers on the
Internet, and you personally knew the administrator of each of them.
(I'm exaggerating, but only slightly.)
There's "envelope" information, and "data" information. Think of it
like an actual letter in an envelope. I can write whatever I want on
the outside of the envelope, and it doesn't have to match the letter
inside.
It looks like this:
Connecting...
<< 220 mail.example.com ESMTP
>> HELO mail.local
<< 250 Ok
>> MAIL FROM:<no...@nowhere>
<< 250 Ok
>> RCPT TO:<re...@example.com>
<< 250 Ok
>> DATA
<< 354 Enter body of message, single . to quit
>> To: <so...@example.com>
>> From: <pr...@whitehouse.gov>
>> Subject: Impress your cabinet with a harder, longer joint chief of
staff!
>>
>> Jim-bob Billy-joe,
>>
>> The Federal Reserve Bank is performing a security audit, and we need
>> you to verify your social security number or you will lose your FDIC
>> insurance!
>> .
You get the idea... (got a little carried away, there)