Jump to content

Spam without sender or subject


Oriolus
 Share

Recommended Posts

Hi,

All of a sudden (am I to blame myself for this?) I get spams that display no sender in my inbox, nor a subject is displayed. If I open the header, I find there, for instance:

"ca watch instead of a real one?

The reason why replica watches are so popular is because=20

you can look classy and professional, yet not have to spend=20

tens of thousands of dollars doing it. These watches look identical=20

to the ones you will find at the jewellery store selling for prices=20

most people would not be able to afford. There is no reason=20

why these beautiful watches should only be limited to the rich,=20

but to everyone who wants to add a touch of class to their life style.

Buy or browse replica watches here

------=_NextPart_000_0004_01C885C2.07D55895

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable"

I configured my Outlook 2007 such that no mail body is displayed, nor can I see the first lines of the body of the mail, if these mails are recognised as spam residing in either my SPAMfighter folder or my Unwanted mail (junkmail) folder. But I wanted to report these spams, which is not possible since these spams were sent in this (or likewise) way.

If I start (pretend to) sending a reply (is this already a dangerous action?), I find for instance:

"Van:

Verzonden: Geen

Onderwerp:

Why would I want to buy a replica watch instead of a real one?

The reason why replica watches are so popular is because

you can look classy and professional, yet not have to spend

tens of thousands of dollars doing it. These watches look identical

to the ones you will find at the jReturn-Path: Received: from mwinf6004.orange.nl (mwinf6004.orange.nl) by mwinb6006 (SMTP Server) with LMTP; Fri, 14 Mar 2008 12:02:09 +0100 X-Sieve: Server Sieve 2.2 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6004.orange.nl (SMTP Server) with ESMTP id 5FC5B240008A for ; Fri, 14 Mar 2008 12:02:09 +0100 (CET) Received: from 85.132.42.84 (unknown [85.132.42.84]) by mwinf6004.orange.nl (SMTP Server) with ESMTP id 5198F2400088 for ; Fri, 14 Mar 2008 12:02:03 +0100 (CET) X-ME-UUID: 20080314110203334.5198F2400088[at]mwinf6004.orange.nl Message-ID: From: "Quality Products" To: "Purses" Subject: Handbags Date: Fri, 14 Mar 2008 09:14:45 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=---=extPart_000_0004_01C885C2.07D55895" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=extPart_000_0004_01C885C2.07D55895 Content-Type: text/plain; charset=so-8859-1" Content-Transfer-Encoding: quoted-printable Why would I want to buy a replica watch instead of a real one? The reason why replica watches are so popular is because you can look classy and professional, yet not have to spend tens of thousands of dollars doing it. These watches look identical to the ones you will find at the jewellery store selling for prices most people would not be able to afford. There is no reason why these beautiful watches should only be limited to the rich, but to everyone who wants to add a touch of class to their life style. Buy or browse replica watches here __________ NOD32 2945 (20080313) Informatie __________ Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem. http://www.nod32.nl ------=extPart_000_0004_01C885C2.07D55895 Content-Type: text/html; charset=so-8859-1" Content-Transfer-Encoding: quoted-printable

Why would I want to buy a replica watch instead of a real one?

The reason why replica watches are so popular is because

you can look classy and professional, yet not have to spend

tens of thousands of dollars doing it. These watches look identical

to the ones you will find at the jewellery store selling for prices

most people would not be able to afford. There is no reason

why these beautiful watches should only be limited to the rich,

but to everyone who wants to add a touch of class to their life style.

Buy or browse replica watches here

__________ NOD32 2945 (20080313) Informatie __________

Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.

http://www.nod32.nl

------=extPart_000_0004_01C885C2.07D55895--

"

Under the sentence "Buy or browse replica watches here" one can fing the URL:

http://mewlegos.com/, which I found to be malicious at McAfee's SiteAdvisor.

Apparently this spam is sent by a Dutch spammer, reading the NOD32-trayler.

My general question is:

How can I ever send in this spam to SpamCop. I use the free reporting option.

My earlier stated questions above are summarized here:

1. Do I get spams described in this mail, because I did something (what) that I shouldn't have done?

Also to fight spammers I report unsafe URLs at: http://www.siteadvisor.com/, but therefor I should somehow get to figure out what addresses are mentioned (advertised) within the spammer's mail-body.

(As a matter of fact, just now I get an email without sender nor subject, seemingly originating from TechWorld, but apart from the normal links to articles by TechWorld, the far most largest part contains links like: http://www=2Ew3=2Eorg/1999/xhtml embedded in a huge HTML source part that is pasted under the seemingly legitimate content that might be sent to the spammer from TechWorld.)

2. Can I do myself any harm by only opening (or as I described, starting to forward) mails that have no visible sender?

I'm aware of the extensiveness of this post I'm sending now, but I thought: being vague about things is no good start to get help!

Thank you in advance,

Oriolus

OS: Windows Vista Home Premium

Link to comment
Share on other sites

Aaagh what a mess. Somewhere, somehow you need to be seeing the headers like in this reconstruction:

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz

That is not showing the HTML source, nor of course the spamvertized URL buried in that source. I think you have some configuration/option issues (but obscure, to me).

Does Outlook still allow you to right-click (the unopened mail) and select "Options" to show the headers? That's a start. Opening spam - and "pretend" replying - is not generally recommended. Nor is having a preview pane open. But if your security settings are locked down that is one way to view the HTML source - if html is present, right-clicking in the preview pane should provide an option of "View Source" (then right-click, "Select All" and "Copy" for pasting into the webform submission box). You are evidently seeing the HTML somehow already - how is not clear to me (or is it just the URL in the "tell-tale" window at the bottom of the screen?).

Anyway, with the headers and the source (or plain text from preview if no HTML) it is possible to copy and paste into the "Outlook and Eudora Workaround" 2-part form on the members' web page. The parser should pick up any URLs in the HTML (or plain text) body.

Many assumptions in the above, chiefly that the functions in Outlook 2003 with XP are something like what is available to you with your later application and operating system.

Link to comment
Share on other sites

Aaagh what a mess. Somewhere, somehow you need to be seeing the headers like in this reconstruction:

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz

That is not showing the HTML source, nor of course the spamvertized URL buried in that source. I think you have some configuration/option issues (but obscure, to me).

A mess indeed, but what I see when I open the URL you suggest to study on, merely shows the standard 2-part reporting page with the same URL as TRACKING URL. This is what I got:

"SpamCop v 647 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved.

Here is your TRACKING URL - it may be saved for future reference:

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz

Reports regarding this spam have already been sent:

Reportid: 2928512450 To: cancelled[at]devnull.spamcop.net

If reported today, reports would be sent to:

Re: 85.132.42.84 (Administrator of network where email originates)

farhad.i[at]caspel.com

_______________________ (I inserted this line in order to make it more like I see it)

Report another spam?

Welcome, Oriolus.

Your average reporting time is: 4 hours; Great!"

I don't understand what you are trying to explain to me, giving me the URL

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz, I'm sorry. If I guess: you think that I should get this answer from the reporting system after reporting; but the problem is that I cannot report! Please, read on:

Does Outlook still allow you to right-click (the unopened mail) and select "Options" to show the headers? That's a start.
Yes, it allows me to do that, but the result is what I showed. Here is another one:

"mal

X-Mailer: Microsoft Outlook Express 6.00.2900.3028

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028"

So, what I get, no headers, whereas this does happen if I choose a spam mail that indeed has a sender and a subject line.

Opening spam - and "pretend" replying - is not generally recommended. Nor is having a preview pane open. But if your security settings are locked down that is one way to view the HTML source - if html is present, right-clicking in the preview pane should provide an option of "View Source" (then right-click, "Select All" and "Copy" for pasting into the webform submission box).
[bTW: As a matter of fact, I pretended to forward (I misinformed you), but I think this makes in effect no difference.]

Yes, that is the normal way of handling spams, but I boarded up the folders in which I expect spam will arrive, if recognized, either by Outlook itself, or by SPAMfighter. Though I didn't open the spam mail, I directly commanded to pretend a forward, by which request the mail becomes visible, like I showed in the second cut of my first post. I expected this pretending to forward to be less dangerous than opening the mail, but never mind, I was looking for an opportunity to being able to copy the contents of the body, like I do again now with the spam who's "headers" I showed earlier in this post:

(BTW: Van means From, Verzonden means Sent, Geen means None and Onderwerp means Subject)

"

-----Oorspronkelijk bericht-----

Van:

Verzonden: Geen

Onderwerp:

------=_NextPart_001_9C05_01C885E8.94997150

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

I've played on and off with pumps, weights, and exercises for the last few years and have never gained one centimeter.

I recently began VPXL and was pleasantly surprised to see that this product actually works.

I have been on the product 2 months now and I have already gained 1 inch.

http://www.seuirigsta.com

Its fantastic! My new girlfriend is really impressed with my size and stamina.

------=_NextPart_001_9C05_01C885E8.94997150

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML><HEAD>

<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">

<META content=3D"MSHTML 6.00.2900.3028" name=3DGENERATOR>

<STYLE></STYLE>

</HEAD>

<BODY bgColor=3D#f3f3f3>

<DIV><FONT face=3DArial size=3D2>I've played on and off with pumps, weights, and exercises for the last few years and have never gained one centimeter.<BR></FONT></DIV>

<DIV><FONT face=3DArial size=3D2>I recently began VPXL and was pleasantly surprised to see that this product actually works.<BR></FONT><Return-Path: <op[at]wanadoo.nl>

Received: from mwinf6002.orange.nl (mwinf6002.orange.nl)

by mwinb6006 (SMTP Server) with LMTP; Fri, 14 Mar 2008 16:32:13 +0100

X-Sieve: Server Sieve 2.2

Received: from me-wanadoo.net (localhost [127.0.0.1])

by mwinf6002.orange.nl (SMTP Server) with ESMTP id D1629240008B

for <wnl000000000000000647537424[at]back60-mail02-03.me-wanadoo.net>; Fri, 14 Mar 2008 16:32:13 +0100 (CET)

Received: from 89-180-202-155.net.novis.pt (89-180-202-155.net.novis.pt [89.180.202.155])

by mwinf6002.orange.nl (SMTP Server) with SMTP id 092FF2400081

for <jre.lieftinck[at]wanadoo.nl>; Fri, 14 Mar 2008 16:32:12 +0100 (CET)

X-ME-UUID: 20080314153213377.092FF2400081[at]mwinf6002.orange.nl

X-Original-To: jre.lieftinck[at]wanadoo.nl

Delivered-To: jre.lieftinck[at]wanadoo.nl

Received: from [89.180.202.155] (port=37943 helo=89-180-202-155.net.novis.pt)

by smtp-in.wanadoo.nl with esmtp

id becb6b-4b873d-18

for jre.lieftinck[at]wanadoo.nl; Fri, 14 Mar 2008 15:32:15 -0000

Message-ID: <9c0501c885e8$947c7370$9bcab459[at]wanadoo.nl>

From: "Rebecca" <op[at]wanadoo.nl>

To: "Ina" <jre.lieftinck[at]wanadoo.nl>

Subject: make your friend bigger

Date: Fri, 14 Mar 2008 15:32:15 -0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_001_9C05_01C885E8.94997150"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.3028

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

------=_NextPart_001_9C05_01C885E8.94997150

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

I've played on and off with pumps, weights, and exercises for the last few years and have never gained one centimeter.

I recently began VPXL and was pleasantly surprised to see that this product actually works.

I have been on the product 2 months now and I have already gained 1 inch.

http://www.seuirigsta.com

Its fantastic! My new girlfriend is really impressed with my size and stamina.

__________ NOD32 2945 (20080313) Informatie __________

Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.

http://www.nod32.nl

------=_NextPart_001_9C05_01C885E8.94997150

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML><HEAD>

<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">

<META content=3D"MSHTML 6.00.2900.3028" name=3DGENERATOR>

<STYLE></STYLE>

</HEAD>

<BODY bgColor=3D#f3f3f3>

<DIV><FONT face=3DArial size=3D2>I've played on and off with pumps, weights, and exercises for the last few years and have never gained one centimeter.<BR></FONT></DIV>

<DIV><FONT face=3DArial size=3D2>I recently began VPXL and was pleasantly surprised to see that this product actually works.<BR></FONT></DIV>

<DIV><FONT face=3DArial size=3D2>I have been on the product 2 months now and I have already gained 1 inch.<BR></FONT></DIV>

<DIV><FONT face=3DArial size=3D2><a href=3D"http://www.seuirigsta.com">http://www.seuirigsta.com</a><BR></FONT></DIV>

<DIV><FONT face=3DArial size=3D2>Its fantastic! My new girlfriend is really impressed with my size and stamina.<BR></FONT></DIV>

<BR>

<BR>

__________ NOD32 2945 (20080313) Informatie __________<BR>

<BR>

Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.<BR>

<A HREF=3D"http://www.nod32.nl">http://www.nod32.nl</A><BR>

</BODY></HTML>

------=_NextPart_001_9C05_01C885E8.94997150--"

You are evidently seeing the HTML somehow already - how is not clear to me (or is it just the URL in the "tell-tale" window at the bottom of the screen?).

I don't exactly understand what you mean by this question, but what I showed in my first post and what I just quoted in red in this post, was exactly what I found in the forwarding mail I pretended to send.

Anyway, with the headers and the source (or plain text from preview if no HTML) it is possible to copy and paste into the "Outlook and Eudora Workaround" 2-part form on the members' web page. The parser should pick up any URLs in the HTML (or plain text) body.

Again, indeed this is the normal way to report when one uses Outlook, but my examples are different: I cannot report these spams, because the headers are no headers (or at least incomplete). This fact I put down to (impute to) the fact that these kind of spams appear to have no sender, or Outlook cannot find them: I don't see them in the list of mails and if I order Outlook to reveal the headers, then there appears to be rubbish whereas one should find proper headers.

Many assumptions in the above, chiefly that the functions in Outlook 2003 with XP are something like what is available to you with your later application and operating system.

This also is true: that is the right assumption, but in these cases where there is no sender and no subject, either these spams are composed in a shrewd way, or Outlook cannot handle a specific nature of these spams, so that the described rubbish is the result.

I hope, I explained things in another way, so that things are clearer!

I have to tell more about this bizarre behavior, but I'll come with it later: lack of character left :( .

Thanks, Oriolus

Link to comment
Share on other sites

The worst thing is that I get a non-spam mail in my inbox with the "non-header":

"--------------------------------------------------------------------

Aaagh what a mess. Somewhere, somehow you need to be seeing the headers like in this reconstruction:

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz

That is not showing the HTML source, nor of course the spamvertized URL buried in that source. I think you have some configuration/option issues (but obscure, to me).

"

and the body:

"

-----Oorspronkelijk bericht-----

Van:

Verzonden: Geen

Onderwerp:

Does Outlook still allow you to right-click (the unopened mail) and select "Options" to show the headers? That's a start. Opening spam - and "pretend" replying - is not generally recommended. Nor is having a preview pane open. But if your security settings are locked down that is one way to view the HTML source - if html is present, right-clicking in the preview pane should provide an option of "View Source" (then right-click, "Select All" and "Copy" for pasting into the webform submission box). You are evidently seeing the HTML somehow already - how is not clear to me.

Anyway, with the headers and the source (or plain text from preview if no HTML) it is possible to copy and paste into the "Outlook and Eudora Workaround" 2-part form on the members' web page. The parser should pick up any URLs in the HTML (or plain text) body.

Many assumptions in the above, chiefly that the functions in Outlook 2003 with XP are something like what is aReturn-Path: <news[at]news.spamcop.net>

Received: from mwinf6302.orange.nl (mwinf6302.orange.nl)

by mwinb6006 (SMTP Server) with LMTP; Fri, 14 Mar 2008 18:58:17 +0100

X-Sieve: Server Sieve 2.2

Received: from me-wanadoo.net (localhost [127.0.0.1])

by mwinf6302.orange.nl (SMTP Server) with ESMTP id 2CEA15C00086

for <wnl000000000000000647537424[at]back60-mail02-03.me-wanadoo.net>; Fri, 14 Mar 2008 18:58:17 +0100 (CET)

Received: from zeta.cesmail.net (zeta.cesmail.net [64.88.168.67])

by mwinf6302.orange.nl (SMTP Server) with ESMTP id D7B1E5C00085

for <jre.lieftinck[at]wanadoo.nl>; Fri, 14 Mar 2008 18:58:16 +0100 (CET)

X-ME-UUID: 20080314175816883.D7B1E5C00085[at]mwinf6302.orange.nl

Received: from localhost (localhost [127.0.0.1])

by zeta.cesmail.net (Postfix) with SMTP id B84C3DC8057

for <jre.lieftinck[at]wanadoo.nl>; Fri, 14 Mar 2008 13:58:14 -0400 (EDT)

MIME-Version: 1.0

Content-type: text/plain; charset="iso-8859-1"

From: "SpamCop Discussion" <news[at]news.spamcop.net>

Date: Fri, 14 Mar 2008 13:58:14 -0400

To: jre.lieftinck[at]wanadoo.nl

Subject: Topic Subscription Reply Notification ( SpamCop Discussion )

X-Priority: 3

X-Mailer: IPB PHP Mailer

Message-Id: <20080314175814.B84C3DC8057[at]zeta.cesmail.net>

Oriolus,

Farelf has just posted a reply to a topic that you have subscribed to titled "spam without sender or subject".

----------------------------------------------------------------------

Aaagh what a mess. Somewhere, somehow you need to be seeing the headers like in this reconstruction:

http://www.spamcop.net/sc?id=z1718771253z8...ee859681dfd70dz

That is not showing the HTML source, nor of course the spamvertized URL buried in that source. I think you have some configuration/option issues (but obscure, to me).

Does Outlook still allow you to right-click (the unopened mail) and select "Options" to show the headers? That's a start. Opening spam - and "pretend" replying - is not generally recommended. Nor is having a preview pane open. But if your security settings are locked down that is one way to view the HTML source - if html is present, right-clicking in the preview pane should provide an option of "View Source" (then right-click, "Select All" and "Copy" for pasting into the webform submission box). You are evidently seeing the HTML somehow already - how is not clear to me.

Anyway, with the headers and the source (or plain text from preview if no HTML) it is possible to copy and paste into the "Outlook and Eudora Workaround" 2-part form on the members' web page. The parser should pick up any URLs in the HTML (or plain text) body.

Many assumptions in the above, chiefly that the functions in Outlook 2003 with XP are something like what is available to you with your later application and operating system.

----------------------------------------------------------------------

The topic can be found here:

http://forum.spamcop.net/forums/index.php?...view=getnewpost

If you have configured in your control panel to recieve immediate topic reply notifications, you may receive an

email for each reply made to this topic. Otherwise, only 1 email is sent per board visit for each subscribed topic.

This is to limit the amount of mail that is sent to your inbox.

Unsubscribing:

--------------

You can unsubscribe at any time by logging into your control panel and clicking on the "View Subscriptions" link.

Regards,

The SpamCop Discussion team.

http://forum.spamcop.net/forums/index.php

__________ NOD32 2948 (20080314) Informatie __________

Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.

http://www.nod32.nl

"

I suspect to have some serious malware! I have to look after that first! :wub:

Oriolus

Edited by Oriolus
Link to comment
Share on other sites

At the top of this (and basically every page here) .... insert this string as shown --> "outlook 2007" <-- into the white box to the right of the / search for --> / box. This does Google search for the phrase between the quotes within this Forum. Problems with Outlook 2007 and SpamCop.net Reporting have come up numerous times. At this moment, I can't actually recall if someone has actually found "the" solution yet .. but also noting that there is also the possible issue seen in previous versions of Outlook, that of being just how it was installed, used, and what it connects to .... specifically, the 'Internet Mode' as compared to the 'Corporate Mode' .... in reality, this boils down to whether Outlook connects to an 'Exchange Server' or not. If it does, the Outlook user is also impacted by just how the 'Exchange Server' is configured.

The problem you are attempting to describe (no Subject:, From:, etc. lines) isn't seen as actually valid. Your samples do include the (full?) headers with these specific lines showing, but .... that header-data block is embedded within a bunch of 'extra' notes, HTML garbage from the body, on and on.

I have no idea what "SPAMfighter" does, nor if it may be part of the issue. Several of the other Outlook 2007 Topics include references to other thrid-party software tools that have not been uopdated to work with Outlook 2007.

Link to comment
Share on other sites

Hi Wazoo,

I have no idea what "SPAMfighter" does, nor if it may be part of the issue. Several of the other Outlook 2007 Topics include references to other thrid-party software tools that have not been uopdated to work with Outlook 2007.

I shall remove SPAMfighter from my machine and see what's happening in the coming hours.

Also, I'll look in the Outlook 2007 corner as you suggest.

Thaks so far,

Oriolus

Link to comment
Share on other sites

I shall remove SPAMfighter from my machine and see what's happening in the coming hours.

Also, I'll look in the Outlook 2007 corner as you suggest.

After removing SPAMfighter I tried to reboot, but my my 'real' C:=Vista- and D:Data-disks were gone. Only a third, old Win98-disk (not bootable any more) with 3 partitions appeared after booting in DOS-mode showing C:, D: and E:...

Now I am afraid my motherboard has crashed. Possibly those crasy mails were a foresaying of the coming crash?! I'll have the technician. at the shop where I bought my pc, look after the problem. If that is solved, I'll tell whether I still get senderless and subjectless garbage mails or not. Thanks so far, now sitting behind my good old Mac :)

Oriolus

Edited by Oriolus
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...