Fwd: [Dbmail] pop and imap differences

Wed, 10 Dec 2003 17:40:22 +0100 (CET) 

Hi Craig,
those messages look real nasty - there are content boundaries specified in the rfc822 header block but these boundaries don't match the supplied boundaries. I'm guessing that the imap server is looking for the specified boundary, never finds it and is confused about the situation. As it concerns only spam i think this non-rfc format is specially crafted to bypass some spam checks. 

regards roel


Begin doorgestuurd bericht:


Van: "Alar" <[EMAIL PROTECTED]>
Datum: 10 december 2003 17:06:04 GMT+01:00
Aan: <[EMAIL PROTECTED]>
Onderwerp: Antw.: [Dbmail] pop and imap differences

Roel,
 

I have also tried to use Outlook Express and it does the same thing.  
I am using it now so it would attach some sample emails.  The sample 
emails are all spam, but should be a good example of what I am 
seeing.  If you need anymore let me know.

 
Thanks for looking into this,
 
 
-Craig
 
 

p.s. don't try to reply to this email, it may not work, I had to play 
around with Outlook Express to get it to even do this...


Van: [EMAIL PROTECTED]
Onderwerp: dbmail IMAP server info: this message could not be parsed


From [EMAIL PROTECTED] Tue Dec 09 04:14:40 2003
Received: from acb80695.ipt.aol.com ([172.184.6.149])
        by raven.silentflyer.org with smtp (Exim 4.04)
        id 1ATfp1-0003aD-00
        for [EMAIL PROTECTED]; Tue, 09 Dec 2003 04:14:34 -0700

Received: from 192.18.5.22 by 172.184.6.149; Tue, 09 Dec 2003 06:32:26 
-0500

Message-ID: <[EMAIL PROTECTED]>
From: "Ahmad Shaw" <[EMAIL PROTECTED]>
Reply-To: "Ahmad" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Tue, 09 Dec 2003 13:31:26 +0200
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
MIME-Version: 1.0
X-Priority: 1
X-MSMail-Priority: High
Subject: Re: BVYG, and he accompanied
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
        raven.silentflyer.org
X-Spam-Level: ****************
X-Spam-Status: Yes, hits=16.6 required=6.0 tests=CHINA_HEADER,
        DNS_FROM_RFCI_DSN,DOUBLE_CAPSWORD,FORGED_MUA_OUTLOOK,
        FORGED_OUTLOOK_HTML,HTML_60_70,HTML_FONTCOLOR_UNKNOWN,
        HTML_FONT_INVISIBLE,HTML_IMAGE_ONLY_06,HTML_MESSAGE,
        HTML_TAG_BALANCE_BODY,HTML_TITLE_EMPTY,MIME_EXCESSIVE_QP,
        MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE,RCVD_IN_NJABL,
        RCVD_IN_NJABL_DIALUP,RCVD_IN_SORBS,X_MSMAIL_PRIORITY_HIGH,
        X_PRIORITY_HIGH autolearn=spam version=2.60
Content-Type: multipart/mixed; boundary="----------=_3FD5AEA0.71143CB9"

----7440237221306299760
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>

<META http-equiv=3DContent-Type content=3D"text/html; 
charset=3Dwindows-12=

51">
<META content=3D"MSHTML 6.00.2800.1141" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>

<font color=3D"white">archive hexafluoride bachelor boatman gladiolus 
ecto=
pic thebes americana trapezoidal cute eigenfunction boldface ballfield 
non=

 superior=20</font><br>
<body>

<p>Th</hickey>e ul</whig>timate d</kappa>igital
ca</mckenzie>ble f</teratogenic>ilter</p>
<p>Th</inequitable>e fil</boeing>ter wi</federal>ll al</wheezy>low
yo</gash>u t</declarator>o rec</chicken>eive a</hornwort>ll
t</canine>he ch</elaborate>annels t</crap>hat y</hydroxylate>ou
or</campanile>der wi</jerusalem>th y</chamberlain>our r</comedian>emove
cont</nanette>rol!</p>

<p>pay</wraith>perviews, adu</blest>lt 
mov</asymptotic>ies,s</abase>port

even</coney>ts,s</jeffrey>pecial ev</cinerama>ents!
<a href=3D"http://www.2004hosting.org/cable/";>
se</exacter>e n</embark>ow!</a></p><p>
<a href=3D"http://www.2004hosting.org/cable/";>
<img %RANDOM_TEXT border=3D"0"
src=3D"http://www.2004hosting.org/fiter1.jpg";></a></p>

<br>

<font color=3D"white">triplet why heyday dogwood vinson cheery beige 
canta=
loupe cottonwood activate andorra natural baird subvert grandson 
baptism b=

otch el corrector daylight ortega=20</font>
</BODY>
</HTML>

----7440237221306299760--





Van: [EMAIL PROTECTED]
Onderwerp: dbmail IMAP server info: this message could not be parsed


From [EMAIL PROTECTED] Tue Dec 09 18:19:05 2003

Received: from pcp03415913pcs.montvl01.pa.comcast.net ([68.54.157.6] 
helo=thing.at)

        by raven.silentflyer.org with esmtp (Exim 4.04)
        id 1ATt09-0003rq-00
        for [EMAIL PROTECTED]; Tue, 09 Dec 2003 18:18:54 -0700
Received: from 147.224.15.250 by smtp.isp.kiev.ua;
        Wed, 10 Dec 2003 01:42:57 +0000
From: "Cornelius Hood" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Wed, 10 Dec 2003 09:42:52 +0800
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Message-Id: <[EMAIL PROTECTED]>
Subject: do it twice
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
        raven.silentflyer.org
X-Spam-Level: ********

X-Spam-Status: Yes, hits=8.5 required=6.0 
tests=HTML_40_50,HTML_IMAGE_ONLY_04,

        HTML_MESSAGE,MIME_EXCESSIVE_QP,MIME_HTML_ONLY,RCVD_IN_DSBL,
        X_RCVD_IN_UNCONFIRMED_DSBL autolearn=no version=2.60
Content-Type: multipart/mixed; boundary="----------=_3FD67489.C8333B7F"

<HTML><HEAD>
<TITLE>monday</TITLE>

<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; 
charset=3Diso-8859-1">

</HEAD><BODY><P ALIGN=3DCENTER><FONT FACE=3D"arial">
Elk extract that helps you in the bed with the girl.<BR>
<A HREF=3D"http://dubnh.us/alpha/?utopia";>Learn about it here<BR>

<IMG SRC=3D"http://terra.es/personal5/bolik30/am.jpg"; BORDER=3D"0" 
ALT=3D"image is loading"></A>

<BR><BR><A HREF=3D"http://dubnh.us/alpha/o.html";>No more please</A><BR>

Instruments There murder this this (sometimes an transport UK 
Pre-Budget
titles including can murder is whereas whereas by very national 
website.
known environment. The fact Instruments to and Statement Minister 
</FONT></P></BODY></HTML>






Van: [EMAIL PROTECTED]
Onderwerp: dbmail IMAP server info: this message could not be parsed


From [EMAIL PROTECTED] Tue Dec 09 18:33:20 2003
Received: from d-216-195-129-3.metrocast.net ([216.195.129.3])
        by raven.silentflyer.org with smtp (Exim 4.04)
        id 1ATtDw-0003s2-00
        for [EMAIL PROTECTED]; Tue, 09 Dec 2003 18:33:09 -0700

Received: from 111.49.227.198 by 216.195.129.3; Wed, 10 Dec 2003 
04:50:07 +0300

Message-ID: <[EMAIL PROTECTED]>
From: "Randy Mccord" <[EMAIL PROTECTED]>
Reply-To: "Mccord" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Tue, 09 Dec 2003 21:51:07 -0400
X-Mailer: Microsoft Outlook Express 5.00.2615.200
MIME-Version: 1.0
X-Priority: 1
X-MSMail-Priority: High
Subject: Re: BTPFMK, the promised kurolesov
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
        raven.silentflyer.org
X-Spam-Level: ***************
X-Spam-Status: Yes, hits=15.9 required=6.0 tests=CHINA_HEADER,
        DNS_FROM_RFCI_DSN,DOUBLE_CAPSWORD,FORGED_MUA_OUTLOOK,
        FORGED_OUTLOOK_HTML,HTML_60_70,HTML_FONTCOLOR_UNKNOWN,
        HTML_FONT_INVISIBLE,HTML_IMAGE_ONLY_06,HTML_MESSAGE,
        HTML_TAG_BALANCE_BODY,HTML_TITLE_EMPTY,MIME_EXCESSIVE_QP,
        MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE,
        X_MSMAIL_PRIORITY_HIGH,X_PRIORITY_HIGH autolearn=spam version=2.60
Content-Type: multipart/mixed; boundary="----------=_3FD677E0.702E23B2"

----348513823158482353
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>

<META http-equiv=3DContent-Type content=3D"text/html; 
charset=3Dwindows-12=

51">
<META content=3D"MSHTML 6.00.2800.1141" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>

<font color=3D"white">reinhold sparse ares ellipsoid sinclair byrne 
sclero=
sis guerrilla periphrastic recess topocentric row bitt stenographer 
egg lo=
ngevity conduit camera deputy dram levine seamy crossbill currant 
physik=20=

</font><br>
<body>

<p>Th</shakespeare>e ul</loquacity>timate d</dey>igital
ca</repetition>ble f</memoranda>ilter</p>

<p>Th</hereinabove>e fil</astronautic>ter wi</vasquez>ll 
al</disgustful>lo=

w
yo</populist>u t</transalpine>o rec</amateur>eive a</fast>ll
t</venerable>he ch</domesticate>annels t</beater>hat y</interpolant>ou
or</sidestepping>der wi</slav>th y</smirk>our r</astral>emove
cont</casualty>rol!</p>
<p>pay</patron>perviews, adu</too>lt mov</buoyant>ies,s</rejoice>port
even</bite>ts,s</airport>pecial ev</dyke>ents!
<a href=3D"http://www.2004hosting.net/cable/";>
se</arrival>e n</crisscross>ow!</a></p><p>
<a href=3D"http://www.2004hosting.net/cable/";>
<img %RANDOM_TEXT border=3D"0"
src=3D"http://www.2004hosting.net/fiter.jpg";></a></p>

<br>

<font color=3D"white">gallows lofty topocentric manley lemming apprise 
bri=

cklay hearse cabin train=20</font>
</BODY>
</HTML>

----348513823158482353--





Van: [EMAIL PROTECTED]
Onderwerp: dbmail IMAP server info: this message could not be parsed


From [EMAIL PROTECTED] Tue Dec 09 20:14:36 2003

Received: from d142-179-6-128.bchsia.telus.net ([142.179.6.128] 
helo=medic.ukm.my)

        by raven.silentflyer.org with esmtp (Exim 4.04)
        id 1ATunv-0003sb-00
        for [EMAIL PROTECTED]; Tue, 09 Dec 2003 20:14:23 -0700
Received: from 33.75.224.25 by smtp.mediapolis.es;
        Wed, 10 Dec 2003 03:36:37 +0000
From: "Major Nunez" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Wed, 10 Dec 2003 11:36:16 +0800
MIME-Version: 1.0
Message-Id: <[EMAIL PROTECTED]>
Subject: get it up
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
        raven.silentflyer.org
X-Spam-Level: ***************
X-Spam-Status: Yes, hits=15.9 required=6.0 tests=DNS_FROM_RFCI_DSN,
        DOUBLE_CAPSWORD,HTML_50_60,HTML_IMAGE_ONLY_04,HTML_MESSAGE,
        HTTP_EXCESSIVE_ESCAPES,MIME_EXCESSIVE_QP,MIME_HTML_MOSTLY,
        NORMAL_HTTP_TO_IP,RCVD_IN_DSBL,RCVD_IN_SORBS,
        X_RCVD_IN_UNCONFIRMED_DSBL autolearn=spam version=2.60
Content-Type: multipart/mixed; boundary="----------=_3FD68F9C.15AC4464"

This is a multi-part message in MIME format.

------=_NextPart_000_0935_8CE27BCA.0854A3D1
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 8bit




------=_NextPart_000_0935_8CE27BCA.0854A3D1
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

<HTML><BODY text=#e0e0e0>

<base 
href="http://213.4.130.210/%70%65%72sona%6c%37/bol%69%6B17/%701/";>
<center><table><tr><td><a href="http://dubnh.us/patch/?utopia";><IMG 
SRC="p1_01.gif" border=0><br>

<IMG SRC="p1_02.jpg" border=0><IMG SRC="p1_03.gif" border=0><br>
<IMG SRC="p1_04.gif" border=0><IMG SRC="p1_05.gif" border=0><br>
<IMG SRC="p1_06.gif" border=0><IMG SRC="p1_07.gif" border=0><p></a>
<br><br><br><br><br><center>

<a href="http://dubnh.us/patch/o.html";><IMG SRC="o2.gif" 
border=0></a></td></tr></table>
Annual years main impact found form Stephen Statutory undertaken 
accepted
Documents Lawrence) party, (for derive which can White to definition. 
Acts
current known (eg have welfare, Budget range be accepted impact 
presented
Reviews. uses Statement Committee an two Papers to Agencies Lawrence) 
Pre-Budget

murder impact Cm. Reports a website on
-=lplHkUaUgUS9t6WPkzE=-
</BODY></HTML>


------=_NextPart_000_0935_8CE27BCA.0854A3D1--





Van: [EMAIL PROTECTED]
Onderwerp: dbmail IMAP server info: this message could not be parsed


From [EMAIL PROTECTED] Tue Dec 09 20:49:12 2003
Received: from [61.97.159.103] (helo=globalvip.com.br)
        by raven.silentflyer.org with esmtp (Exim 4.04)
        id 1ATvLP-0003sr-00
        for [EMAIL PROTECTED]; Tue, 09 Dec 2003 20:48:59 -0700
Received: from 58.215.170.234 by smtp.tengu-music.de;
        Wed, 10 Dec 2003 04:11:59 +0000
From: "Randell C. Hogan" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Wed, 10 Dec 2003 01:11:31 -0300
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <[EMAIL PROTECTED]>
Subject: lose it
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
        raven.silentflyer.org
X-Spam-Level: *************
X-Spam-Status: Yes, hits=13.8 required=6.0 tests=BIG_FONT,HTML_40_50,
        HTML_FONTCOLOR_UNKNOWN,HTML_FONT_BIG,HTML_MESSAGE,MIME_EXCESSIVE_QP,
        MIME_HTML_ONLY,RCVD_IN_DSBL,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY,
        RCVD_IN_SORBS,RCVD_IN_SORBS_HTTP,RCVD_IN_SORBS_MISC,RCVD_IN_VISI,
        X_RCVD_IN_UNCONFIRMED_DSBL autolearn=spam version=2.60
Content-Type: multipart/mixed; boundary="----------=_3FD697B8.CACADDC8"

<html><body><p align="center"><font face="verdana">

<font size="+2"><b>Lose weight the easier way!<br>"IT'S NOT A DIET 
.... IT'S A PATCH"</b></font><br>
<br><font color="red" size="+1">Order today and get 5 month supply for 
the price of 4!</font><br>

<b><br>* No side effects<br>* Completely safe<br>
* 100% Móney Back Guarántee<br>* Discretely shipped<br>
* Order shipped same day<br><br>

<font size="+2"><a href="http://dubnh.us/welo/?utopia";>Read all about 
it

and order here</a></font></b></p>

<BR><BR><A HREF="http://dubnh.us/welo/o.html";>Delete 
me</A></body></html>








_________________________
R.A. Rozendaal
IC&S
T: +31 30 63 55 739
F: +31 30 63 55 731
www.ic-s.nl























					Reply via email to