Better to forward such as these to [log in to unmask] I sent yours on.
Frankly, as you know, true spoofing is pretty hard to block.
On 9/17/11 6:54 PM, Richard Wiggins wrote:
> Over the last few days I've gotten a lot of spam spoofing my address
> of [log in to unmask] as both sender and receiver. When I wrote
> [log in to unmask] they advised me to block the sender. While I could do
> that, for the naive eye, the sender is a faux me, and for the more
> sophisticated eye, the sender varies.
>
> Here is the latest spam mail, including headers, showing that various
> @msu.edu mailboxes are targets. Maybe ATS could investigate and block
> this.
>
> /rich
>
>
> Delivered-To: [log in to unmask]
> Received: by 10.220.150.66 with SMTP id x2cs100855vcv;
> Sat, 17 Sep 2011 02:54:07 -0700 (PDT)
> Received: by 10.101.199.1 with SMTP id b1mr322199anq.113.1316253246653;
> Sat, 17 Sep 2011 02:54:06 -0700 (PDT)
> Return-Path:<[log in to unmask]>
> Received: from mx50.mail.msu.edu (mx50.mail.msu.edu [35.9.75.200])
> by mx.google.com with ESMTPS id q20si7319259ann.202.2011.09.17.02.54.05
> (version=TLSv1/SSLv3 cipher=OTHER);
> Sat, 17 Sep 2011 02:54:05 -0700 (PDT)
> Received-SPF: neutral (google.com: 35.9.75.200 is neither permitted
> nor denied by best guess record for domain of [log in to unmask])
> client-ip=35.9.75.200;
> Authentication-Results: mx.google.com; spf=neutral (google.com:
> 35.9.75.200 is neither permitted nor denied by best guess record for
> domain of [log in to unmask]) [log in to unmask]; dkim=pass
> [log in to unmask]
> DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
> d=msu.edu; s=mail;
> h=Subject:Content-Transfer-Encoding:Message-ID:Content-Type:MIME-Version:Date:Subject:To:From;
> bh=PPHK/Wp7KaXpYd/lArfkx4/wCaK+c9q7uYlkDGfsAls=;
> b=PyByD4v7moLaK3up8gthlqFqDTy/KILfGbhldZR7oNVTRkpL6yR0L3O0MfUYDo8eqVBdehOIqhzSjbFYDpasXiikp9jzHmEbYCFOEQUFXrGWbE4AyOtqxxKyfKUql1C6RRYXr4bGG8JaODfrGYvmYTTDkQZGtH55DJMu7mZ+QdA=;
> Received: from [31.162.119.179]
> by mx50.mail.msu.edu with esmtp (Exim 4.75 #3)
> id 1R4rb1-0003Ql-J8; Sat, 17 Sep 2011 05:54:04 -0400
> Received: from 31.162.119.179(helo=fkdafof.affywvodwzspl.su)
> by with esmtpa (Exim 4.69)
> (envelope-from )
> id 1MMYGQ-2440yd-8T
> for [log in to unmask]; Sat, 17 Sep 2011 14:54:02 +0500
> From:<[log in to unmask]>,
> <[log in to unmask]>,
> <[log in to unmask]>
> To:<[log in to unmask]>,
> <[log in to unmask]>,
> <[log in to unmask]>
> Subject: FW: Update your PC
> Date: Sat, 17 Sep 2011 14:54:02 +0500
> MIME-Version: 1.0
> Content-Type: text/html
> charset="iso-8859-1"
> X-Priority: 3
> X-Mailer: dztg-77
> Message-ID:<[log in to unmask]>
> Content-Transfer-Encoding: quoted-printable
> X-Virus: None found by Clam AV
> X-Spam-Level: ******
> X-Spam-Report: All incoming messages to mail.msu.edu are analyzed for
> typical spam
> characteristics. See http://techbase.msu.edu/article.asp?id=11475 for
> additional report information.
>
> Content preview: Best online (pirated) software: 92.63.81.93,Good Luck [...]
>
>
> Content analysis details: (6.3 points, 5.0 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> 3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
> [31.162.119.179 listed in zen.spamhaus.org]
> 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
> [31.162.119.179 listed in bb.barracudacentral.org]
> 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
> X-Spam-Score: 6.3
> Subject: *****SPAM***** FW: Update your PC
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> <HTML><HEAD>
>
|