You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Loren Wilton <lw...@earthlink.net> on 2006/09/14 13:05:46 UTC
Gee, first time I've seen these headers in a received message! ;-)
I wonder what a "False-Spam-Checker" might be?
Loren
Return-Path: <Bi...@Earthlink.net>
Received: from lost.lost.hu ([212.52.166.101])
by mx-pigeons.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id
1gnDqV1li3Nl34g0
for <>; Wed, 13 Sep 2006 18:42:17 -0400 (EDT)
Received: (qmail 94721 invoked by uid 80); 13 Sep 2006 22:42:12 -0000
X-False-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
Lost.lost.hu
X-False-Spam-Level: **
X-False-Spam-Status: No, score=2.3 required=5.0 tests=AWL,BAYES_20,
HTML_IMAGE_ONLY_20,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
HTML_SHORT_LINK_IMG_3,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
NO_RECEIVED,NO_RELAYS autolearn=no version=3.1.1
Date: 13 Sep 2006 22:42:12 -0000
Message-ID: <20...@lost.lost.hu>
Subject: IMPORTANT: Alert about your Earthlink billing information on file
From: "Earthlink Billing Center" <Bi...@Earthlink.net>
Reply-To: "Earthlink Billing Center" <Bi...@Earthlink.net>
Re: Gee, first time I've seen these headers in a received message! ;-)
Posted by Chris <cp...@earthlink.net>.
On Thursday 14 September 2006 6:05 am, Loren Wilton wrote:
> I wonder what a "False-Spam-Checker" might be?
>
> Loren
>
>
> Return-Path: <Bi...@Earthlink.net>
> Received: from lost.lost.hu ([212.52.166.101])
> by mx-pigeons.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id
> 1gnDqV1li3Nl34g0
> for <>; Wed, 13 Sep 2006 18:42:17 -0400 (EDT)
> Received: (qmail 94721 invoked by uid 80); 13 Sep 2006 22:42:12 -0000
> X-False-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
> Lost.lost.hu
> X-False-Spam-Level: **
> X-False-Spam-Status: No, score=2.3 required=5.0 tests=AWL,BAYES_20,
> HTML_IMAGE_ONLY_20,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
> HTML_SHORT_LINK_IMG_3,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
> NO_RECEIVED,NO_RELAYS autolearn=no version=3.1.1
> Date: 13 Sep 2006 22:42:12 -0000
> Message-ID: <20...@lost.lost.hu>
> Subject: IMPORTANT: Alert about your Earthlink billing information on
> file From: "Earthlink Billing Center" <Bi...@Earthlink.net>
> Reply-To: "Earthlink Billing Center" <Bi...@Earthlink.net>
Not sure about that Loren, but I sent them a LART and actually got a reply:
Date: Thu, 14 Sep 2006 14:24:15 +0200 (CEST)
From: Smudo <sm...@smudo.hu>
X-X-Sender: smudo@Lost.lost.hu
To: Chris <cp...@earthlink.net>
Subject: Re: Spam report: (212.52.166.101) IMPORTANT: Alert about your
Earthlink billing information on file
In-Reply-To: <20...@cpollock>
Message-ID: <20...@Lost.lost.hu>
References: <20...@cpollock>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN;
charset=US-ASCII;
format=flowed
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=000;
X-UID: 196
X-Length: 6962
Thank you for your hint!
I found a program which send hunderds of mail in a very short time
using web interface (with stolen user access).
Now i've cleard everything, I hope not to gave you any inconvenience.
Best Regards,
K. R.
Headers from the one I got:
Status: U
Return-Path: <Bi...@Earthlink.net>
Received: from pop.earthlink.net [209.86.93.205]
by localhost with POP3 (fetchmail-6.2.5)
for cpollock@localhost (single-drop); Wed, 13 Sep 2006 17:45:46
-0500 (CDT)
Received: from lost.lost.hu ([212.52.166.101])
by mx-collie.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP
id 1gnDsm4FE3Nl36t0
for <cp...@earthlink.net>; Wed, 13 Sep 2006 18:43:46 -0400 (EDT)
Received: (qmail 43710 invoked by uid 80); 13 Sep 2006 22:43:19 -0000
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on Lost.lost.hu
X-Spam-Level: **
X-Spam-Status: No, score=2.1 required=5.0 tests=AWL,BAYES_05,
HTML_IMAGE_ONLY_20,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
HTML_SHORT_LINK_IMG_3,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
NO_RECEIVED,NO_RELAYS autolearn=no version=3.1.1
Date: 13 Sep 2006 22:43:19 -0000
Message-ID: <20...@lost.lost.hu>
To: cpollock@earthlink.net
Subject: IMPORTANT: Alert about your Earthlink billing information on file
Content-Type: text/HTML; charset="iso-8859-1"
From: "Earthlink Billing Center" <Bi...@Earthlink.net>
Reply-To: "Earthlink Billing Center" <Bi...@Earthlink.net>
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=000;
X-SenderIP: 212.52.166.101
X-ASN: ASN-8536
X-CIDR: 212.52.160.0/19
--
Chris
Re: Gee, first time I've seen these headers in a received message! ;-)
Posted by jdow <jd...@earthlink.net>.
That is one of my hacks in procmail. If mail comes in with SpamAssassin
headers I rewrite them to X-False-whatever. I used that for some
diagnostics. It was also part of one of the tricks I arranged when
spamd was failing on some messages with "full" or "rawbody". I looked
for markup and if I didn't see it I reran spamassassin. So just in case
I rewrote the headers of incoming messages if they had SpamAssassin
markups already.
{^_^}
----- Original Message -----
From: "Loren Wilton" <lw...@earthlink.net>
To: "SpamAssassin Users List" <us...@spamassassin.apache.org>
Sent: Thursday, September 14, 2006 04:05
Subject: Gee, first time I've seen these headers in a received message! ;-)
>I wonder what a "False-Spam-Checker" might be?
>
> Loren
>
>
> Return-Path: <Bi...@Earthlink.net>
> Received: from lost.lost.hu ([212.52.166.101])
> by mx-pigeons.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id
> 1gnDqV1li3Nl34g0
> for <>; Wed, 13 Sep 2006 18:42:17 -0400 (EDT)
> Received: (qmail 94721 invoked by uid 80); 13 Sep 2006 22:42:12 -0000
> X-False-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
> Lost.lost.hu
> X-False-Spam-Level: **
> X-False-Spam-Status: No, score=2.3 required=5.0 tests=AWL,BAYES_20,
> HTML_IMAGE_ONLY_20,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
> HTML_SHORT_LINK_IMG_3,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
> NO_RECEIVED,NO_RELAYS autolearn=no version=3.1.1
> Date: 13 Sep 2006 22:42:12 -0000
> Message-ID: <20...@lost.lost.hu>
> Subject: IMPORTANT: Alert about your Earthlink billing information on file
> From: "Earthlink Billing Center" <Bi...@Earthlink.net>
> Reply-To: "Earthlink Billing Center" <Bi...@Earthlink.net>