ob1db Posted February 25, 2004 Share Posted February 25, 2004 This is DUPLICATED from NG, mainly here for JT but feel free to weigh in if you have seen or know about this version: Almost every "blank" spam I get on my webmail is not in fact at all blank if you use the "message source" button to view the raw email. ALL of them I get have one thing in common: the subject, to, from, date, IN FACT EVERY HEADER FROM THE LAST RECEIVED LINE TO THE X-HEADERS ARE MERGED INTO THE LAST RECEIVED LINE !!! If you manually add the line returns to each header ("To", "From" etc.) the spam parses. (Does that constitute "material changes to spam ??) However, the last few days HALF these "blank" spams are seemingly full of RFC error messages, Bad RFC2822, which will NOT parse until all that junk is removed. I notice that all the X-headers wind up AFTER the garbled body: is it possible to webmail is doing this ? I don't so far see this in any Yahoo webmail, Note this example, Munged and shortened sample (full spams with and without RFC errors in .spam NG) (sorry if I am posting too much of the offending spam) Return-Path: <ifdclzezodh[at]atlaswebmail.com> Delivered-To: x Received: (qmail 27123 invoked from network); 21 Feb 2004 23:36:50 -0000 Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101) by blade4.cesmail.net with SMTP; 21 Feb 2004 23:36:50 -0000 Received: (qmail 29747 invoked from network); 21 Feb 2004 23:36:50 -0000 Received: from unix14.broadviewnet.net (HELO broadviewnet.net) (64.115.0.113) by mailgate.cesmail.net with SMTP; 21 Feb 2004 23:36:50 -0000 Received: (qmail 18805 invoked by uid 32008); 21 Feb 2004 23:36:50 -0000 Received: from unknown (HELO broadviewnet.net) (64.115.0.61) by unix14.broadviewnet.net with SMTP; 21 Feb 2004 23:36:50 -0000 Received: (qmail 1604 invoked by uid 32008); 21 Feb 2004 23:36:49 -0000 Delivered-To: x Received: (qmail 1578 invoked by uid 32008); 21 Feb 2004 23:36:48 -0000 Received: from unknown (HELO pcp04439157pcs.verona01.nj.comcast.net) (68.39.130.118) by c.mx.broadviewnet.net with SMTP; 21 Feb 2004 23:36:48 -0000 Received: from [224.120.110.180] by 68.39.130.118 with with DES-CBC3-SHA encrypted SMTP; Sat, 21 Feb 2004 18:37:37 -0500X-Authentication-Warning: hotelman interregnum priest Date: Sat, 21 Feb 2004 18:37:37 -0500From: "Nathaniel Warren" <ifdclzezodh[at]atlaswebmail.com>Reply-To: "Nathaniel Warren" <ifdclzezodh[at]atlaswebmail.com>Message-ID: <23459091870243.97998980930718667276[at]exuberant>To: Katelyn <jolin[at]broadviewnet.net>Subject: brandy electra lawrenceReferences: <020214732595803929562700[at]corrupt>In-Reply-To: <020214732595803929562700[at]corrupt>X-Mailer: fifo afar Mime-Version: 1.0Content-Type: text/html; charset=us-asciiContent-Transfer-Encoding: 7bit X-Mail-Format-Warning: Bad RFC2822 header formatting in <html> X-Mail-Format-Warning: Bad RFC2822 header formatting in <body> X-Mail-Format-Warning: Bad RFC2822 header formatting in Tir<sauce>ed of sear</semiramis>ching for the best possible fina<glucose>ncial solu</kingbird>tion.<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in Only APP<confect>LY ONCE and let the fina</eyewitness>ncial consu<downslope>ltants come to you.<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in No more endless sear</compressive>ching. Have up to 4 qual<refractometer>ified<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in profe</gavel>ssional consul<adjudge>tants come to you. Pro</incredulity>grams in all<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in state for all of your fina<seriatim>ncial pro</breadfruit>blems.<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in Ho<holster>me Allow</contextual>ances<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in Fina<farmland>ncial Restr</deity>ucture<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in and more... <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <a ref="http://www.jewelry.com/" href="http: //www.supriseyourmate.biz/ml/"><b> X-Mail-Format-Warning: Bad RFC2822 header formatting in GE<font style="font-size: 1;">c</font>T MO<four>RE INF</isotopic>ORMATION</a> X-Mail-Format-Warning: Bad RFC2822 header formatting in <br><br><br><br><br><br><br> X-Mail-Format-Warning: Bad RFC2822 header formatting in rem at www.supriseyourmate.biz<br> X-Mail-Format-Warning: Bad RFC2822 header formatting in <snippage> X-Mail-Format-Warning: Bad RFC2822 header formatting in </body> X-Mail-Format-Warning: Bad RFC2822 header formatting in </html> X-Bogosity: No, tests=bogofilter, spamicity=0.500000, version=0.11.1.3 X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4 X-spam-Level: ** X-spam-Status: hits=2.9 tests=DATE_MISSING,FROM_NO_LOWER version=2.63 X-SpamCop-Checked: 192.168.1.101 64.115.0.113 64.115.0.61 68.39.130.118 X-SpamCop-Disposition: Blocked bl.spamcop.net Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.