[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[cobalt-users] New Quality of SPAM ?

since yesterday im getting huge amounts (about 100/hour) of these emails
and spamassassin seems not to be able to identify them at high rates.
seems their sending spam with faked sender address to non existing
addresses ... which then bounces back to my catch-all account from the
valid server. most servers dont include the full headers, so unlike in
this example, you can see where the mail actually came from
any ideas how to get rid of those without blocking real mailer errors ?

-----------------------------------

Return-Path: <MAILER-DAEMON>
Received: from lmin15.st1.spray.net (lmin15.st1.spray.net
[212.78.202.216])
        by 191-31.access.witcom.de (8.10.2/8.10.2) with ESMTP id
h8D8dLS28312
        for <santiagodownsgg@xxxxxxxxxxx>; Sat, 13 Sep 2003 10:39:21
+0200
Received: by lmin15.st1.spray.net (Postfix)
        id 117D4761CB; Sat, 13 Sep 2003 10:39:18 +0200 (MEST)
Date: Sat, 13 Sep 2003 10:39:18 +0200 (MEST)
From: MAILER-DAEMON@xxxxxxxxx (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: santiagodownsgg@xxxxxxxxxxx
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
        boundary="F3D6B761B2.1063442358/lmin15.st1.spray.net"
Content-Transfer-Encoding: 8bit
Message-Id: <20030913083918.117D4761CB@xxxxxxxxxxxxxxxxxxxx>
X-Spam-Status: No, hits=2.5 required=5.0
        tests=HTML_10_20,HTML_IMAGE_ONLY_12,HTML_IMAGE_RATIO_12,
              HTML_MESSAGE
        version=2.55
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: =5d"!+=k!!!o="!noR!!

This is a MIME-encapsulated message.

--F3D6B761B2.1063442358/lmin15.st1.spray.net
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host lmin15.st1.spray.net.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

                        The Postfix program

<birgit.kargl@xxxxxxxx>: user unknown

--F3D6B761B2.1063442358/lmin15.st1.spray.net
Content-Description: Delivery error report
Content-Type: message/delivery-status

Reporting-MTA: dns; lmin15.st1.spray.net
Arrival-Date: Sat, 13 Sep 2003 10:39:16 +0200 (MEST)

Final-Recipient: rfc822; birgit.kargl@xxxxxxxx
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; user unknown

--F3D6B761B2.1063442358/lmin15.st1.spray.net
Content-Description: Undelivered Message
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit

Received: from stadtwerke-trier.de
(pcp03090104pcs.nrockv01.md.comcast.net [68.48.169.122])
        by lmin15.st1.spray.net (Postfix) with ESMTP id F3D6B761B2
        for <birgit.kargl@xxxxxxxx>; Sat, 13 Sep 2003 10:39:16 +0200
(MEST)
MIME-Version: 1.0
Message-ID: <2.2.32.2003091316390700ac7097@xxxxxxxxxxx>
Subject: =?iso-8859-1?b?UmU6U2lsZGVuYWZpbCBDaXRyYXRlICBmb3IgTGVzcw==?=
Date: Sat, 13 Sep 2003 16:39:07 +0000
To: birgit.kargl@xxxxxxxx
X-Mailer: Windows Eudora Pro Version 2.2 (32)
From: "Santiago Downs" <santiagodownsgg@xxxxxxxxxxx>
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<html><body>
<center><!--wupska1kjckkx1--><a
href="http://www.coolfee1.com/host/default.asp?ID=omni";><img
src="<br><br><a href=%L>Remove me</a>" height="270"
width="405"></a></center>
</html></body>


--F3D6B761B2.1063442358/lmin15.st1.spray.net--
-------------------------


--
Michael Gabriel

Frauensteiner Str.76
65199 Wiesbaden-Dotzheim
Hessen-Germany

Fon: +49 611 1842956
Fax: +49 611 1842957
Mobile: +49 178 6270001