Tech: Email Question

03 May 02 - 08:55 PM (#704010)
Subject: Email Question
From: Jon Freeman

I've been playing around with a few email programs in Kixnux latelt, sending myself test messages, etc. so it's a little difficult for me to remember what I have done and to make matters worse, I've deleted many items in sent items folders...

This morning I recieved a message which I have no recollection of sending and can't find anything in the sent items folders (but see above)... I checked the headers which are:

Return-path: <[e-mail]>
Delivery-date: Fri, 03 May 2002 06:54:31 +0100
Received: from morpheus.uk.clara.net ([195.8.69.214])
by buckaroo.freeuk.net with esmtp (Exim 3.33 #3)
id 173W1X-0008C9-00
for [e-mail]; Fri, 03 May 2002 06:54:31 +0100
Received: from amavis by morpheus.uk.clara.net with scanned-ok (Exim 3.35 #1)
id 173W1X-000IMK-00
for [e-mail]; Fri, 03 May 2002 06:54:31 +0100
Received: from buckaroo.freeuk.net ([212.126.144.5])
by morpheus.uk.clara.net with esmtp (Exim 3.35 #1)
id 173W1X-000IMB-00
for [e-mail]; Fri, 03 May 2002 06:54:31 +0100
Received: from hypnos.uk.clara.net ([213.253.16.103])
by buckaroo.freeuk.net with esmtp (Exim 3.33 #3)
id 173W1X-0008C6-00
for [e-mail]; Fri, 03 May 2002 06:54:31 +0100
Received: from [24.98.172.83] (helo=webmaster)
by hypnos.uk.clara.net with smtp (Exim 3.33 #1)
id 173W1W-000PVB-00
for [e-mail]; Fri, 03 May 2002 06:54:31 +0100
X-RBL-Warning: (bl.spamcop.net) Blocked - see http://spamcop.net/bl.shtml?24.98.172.83
Message-Id:
From: [e-mail]
Bcc:
Date: Fri, 03 May 2002 06:54:31 +0100
X-Virus-Scanned: by Claranet Antivirus Service
X-Envelope-To: [e-mail]
X-claradeliver-Version: 4.14.8
X-UIDL: 1020405271.31509.buckaroo.freeuk.net
X-RCPT: jonbanjo
Status: R
X-Status: N

The line that really gets me is the one that starts "X-RBL-Warning". Can someone please explain what happened here and why the spam block on 24.98.172.83 crops up?

Jon

---

03 May 02 - 09:02 PM (#704016)
Subject: RE: BS: Email Question
From: Amos

You can probably get this question answered at SpamCop, which is providing the service; it may be that your self-sent loop had garbage in the Subject line, which sometimes is used by spammers to deceive certain filters, eh? It looks to me like your ISP is using a SpamCop service, and they're usually very good (or were back when I used them) -- but any filter can make an error.

AA

---

03 May 02 - 09:28 PM (#704029)
Subject: RE: BS: Email Question
From: Jon Freeman

Thanks Amos, I will try to follow that up. I had visited the site earlier today and checked on 24.98.172.83 and followed up on ARIN where I found it was a US ISP that none of my self tests should touch (I think).

My fear was that someone has tried to use my email address and tried relaying via 24.98.172.83 (a game I have never played) but given my own memory failures as to what test messages I sent when and my trying of a few email programs, your type of explaination seems far more likely than anyone trying to impersonate me and that somehow the message got back to me when blocked by the spam filter

Jon

---

04 May 02 - 07:31 PM (#704470)
Subject: RE: BS: Email Question
From: mack/misophist

Take a look at the spamcop address shown in the header. They were protecting you from that address, which generates spam.

---

05 May 02 - 01:03 AM (#704577)
Subject: RE: BS: Email Question
From: Amos

The SpamCop is an antispam service, not a spam-generating one -- they keep databases of known IPs who originate or relay spam and keep the sys admins of those sites advised of offenses.

A

---