I'm not sure this will help or not. Anyway, here is the header I get
from that annoying message. Certain server names/e-mail addresses have
been changed. The stuff at the bottom 'SPAM: ....' is just our anti-spam
program assigning scores to what it finds. The mail server in our case
is Novell Groupwise.
Maybe this will help someone ... Mike
Received: from <our mail server>
by <our mail server>; Thu, 07 Aug 2003 09:00:37 -0600
Received: from guinness.omniscient.com (guinness.omniscient.com
[64.134.101.78])
by <our mail server> (8.9.1-p2/8.9.0.Beta5) with ESMTP id
JAA24028
for <me AT someplace DOT com>; Thu, 7 Aug 2003 09:00:35 -0600
Received: from guinness.omniscient.com (localhost [127.0.0.1])
by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id
h77F0ZMt023392
(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168
verify=NO);
Thu, 7 Aug 2003 11:00:35 -0400 (EDT)
Received: from localhost (daemon@localhost)
by guinness.omniscient.com (8.12.9/8.12.9/Submit) with SMTP id
h77F0XVA023391;
Thu, 7 Aug 2003 11:00:33 -0400 (EDT)
Received: by guinness.omniscient.com (bulk_mailer v1.13); Thu, 7 Aug
2003 11:00:33 -0400
Received: from guinness.omniscient.com (localhost [127.0.0.1])
by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id
h77F0WMt023386
(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168
verify=NO)
for <amanda.org.amanda-users-list AT guinness.omniscient DOT com>; Thu,
7 Aug 2003 11:00:32 -0400 (EDT)
Received: (from majordom@localhost)
by guinness.omniscient.com (8.12.9/8.12.9/Submit) id
h77F0WIh023385
for amanda.org.amanda-users-list; Thu, 7 Aug 2003 11:00:32 -0400
(EDT)
X-Authentication-Warning: guinness.omniscient.com: majordom set sender
to owner-amanda-users AT amanda DOT org using -f
Received: from sapphire.omniscient.com (sapphire.omniscient.com
[64.134.101.71])
by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id
h77F0TMt023381
(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168
verify=NO)
for <amanda-users AT amanda DOT org>; Thu, 7 Aug 2003 11:00:30 -0400
(EDT)
Received: from localhost (pool-138-89-183-57.mad.east.verizon.net
[138.89.183.57])
by sapphire.omniscient.com (8.12.9/8.12.9) with SMTP id
h77Exwem003144
for <amanda-users AT amanda DOT org>; Thu, 7 Aug 2003 11:00:11 -0400
(EDT)
Date: Thu, 7 Aug 2003 10:59:58 -0400 (EDT)
Message-Id: <200308071500.h77Exwem003144 AT sapphire.omniscient DOT com>
From: admin AT amanda DOT org
To: Amanda-users <amanda-users AT amanda DOT org>
Reply-To: admin AT amanda DOT org
X-Mailer: The Bat! (v1.61)
X-Priority: 2 (High)
Subject:S-P-A-M 8.1/5.0 your account roowuomj
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------E4D3400C0061DF1"
Sender: owner-amanda-users AT amanda DOT org
X-Spam-Flag: YES
X-Spam-Status: Yes, hits=8.1 required=5.0
tests=SUBJ_HAS_UNIQ_ID,FORGED_MUA_THEBAT,NO_REAL_NAME,
SUBJ_HAS_SPACES,X_AUTH_WARNING
X-Spam-Checker-Version:GEE Whiz GAS (Gee Anti Spam) v1.3.1
X-Spam-Level: *********
------------E4D3400C0061DF1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hello there,
I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.
---
Best regards, Administrator
rooruomu
------------E4D3400C0061DF1
Content-Type: application/x-zip-compressed; name="message.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="message.zip"
Click to view Base64 Encoded File message.zip
Content-Type: text/plain; name="gas-results.txt"
Content-Transfer-Encoding: attachment; filename="gas-results.txt"
Content-Disposition: 7bit
SPAM: SUBJ_HAS_UNIQ_ID (1.5 points) Subject contains a unique ID
SPAM: FORGED_MUA_THEBAT (4.3 points) Forged mail pretending to be
from The Bat!
SPAM: NO_REAL_NAME (0.9 points) From: does not include a real
name
SPAM: SUBJ_HAS_SPACES (2.4 points) Subject contains lots of white
space
SPAM: X_AUTH_WARNING (-1.0 points) Has a
X-Authentication-Warning header
Score Total: 8.1
|
