Received header of spam from phones

[jdebert <jd...@garlic.com>]

FYI, A Received header seen in spam from no-contract phones IP space for
a few years now:

Received: from [182.21.104.65][127.0.0.1] by [182.21.104.65][127.0.0.1]
  (SMTPD32); Tue, 2 Sep 2014 17:44:07 -0700

The pattern is consistent: the real IP in the first bracket, followed
by [127.0.0.1], then the server name (SMTP32). The other headers and
body change but this header always follows the same pattern.

This belongs to commercial spam, almost always about selling a spam
service for commercial advertising. The seller/source was in Florida
in the US and the originating IP's were almost always within the US but
I've been seeing more Euro and Asian IP's of late. And it's not limited
to no-contract only IP's. This may have evolved into a botnet.

There seems to be no rule for this yet. I've been rejecting these on
before-queue header checks so spamassassin hasn't seen them. I let some
through and spamassassin gave them scores less than 2.0.

jd

Re: Received header of spam from phones

[John Hardin <jh...@impsec.org>]

On Fri, 5 Sep 2014, jdebert wrote:

> FYI, A Received header seen in spam from no-contract phones IP space for
> a few years now:
>
> Received: from [182.21.104.65][127.0.0.1] by [182.21.104.65][127.0.0.1]
>  (SMTPD32); Tue, 2 Sep 2014 17:44:07 -0700
>
> The pattern is consistent: the real IP in the first bracket, followed
> by [127.0.0.1], then the server name (SMTP32). The other headers and
> body change but this header always follows the same pattern.

Rule added to sandbox. Thanks.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Ignorance doesn't make stuff not exist.               -- Bucky Katt
-----------------------------------------------------------------------
  12 days until the 227th anniversary of the signing of the U.S. Constitution