George A. Theall on 6 Nov 2008 04:04:57 -0800

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] SPAM Question

On Wed, Nov 05, 2008 at 08:51:32PM -0500, Brian Vagnoni wrote:

> I found this in my inbox. I didn't send it, isn't my address or a domain I recognize. Any ideas? The body of the message was html and something about msn.

Your email address was probably used to send some spam.  It's hard to
know with certainty, though, since all you have is one message that
appears to be a bounce.  Anyway... 

> Hi. This is the qmail-send program at
> I'm afraid I wasn't able to deliver your message to the following addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
> <>: has two MX records, and the one with the higher priority is So this seems normal.

> failed after I sent the message.'s other MX record points to

> Remote host said: 550 5.7.1 Message content rejected, spam score is too high.
> --- Below this line is a copy of the message.
> Return-Path: <>

This generally comes from the envelope sender (ie, "MAIL FROM") and
explains why you got the bounce. 

> Received: (qmail 7194 invoked by uid 89); 4 Nov 2008 20:40:24 -0000
> Received: by simscan 1.3.1 ppid: 7191, pid: 7192, t: 0.4180s
>          scanners:none
> Received: from unknown (HELO casa-9plhr7737j) (
>   by 0 with SMTP; 4 Nov 2008 20:40:24 -0000

Assuming this is accurate, the IP belongs to Global Village Telecom,
which appears to be an ISP in Brazil. 

> Received-SPF: softfail (0: transitioning SPF record at does not designate as permitted sender)

If you run your own DNS, you may have a record of this transaction.

> X-Originating-IP: [826.4.779.37]

Really... 826.? Must be one of those new-fangled IPv5 addresses. :-)

Philadelphia Linux Users Group         --
Announcements -
General Discussion  --