Re: Earthlink emails

Tue, 26 Sep 2006 20:18:11 -0700

> Received: from SHERI-PTIN5DJM8 (cpe-74-71-30-143.twcny.res.rr.com [74.71.30.143])
 
That mail came from a RoadRunner zombie account in Minnesota, has nothing to do with Earthlink other than the forged headers.
 
If that is the entire message, and there isn't an image attached, they might be a bit hard to detect and stop.
 
I'd check if maybe they are all coming from the same broken zombie system, and if so, block it specifically.
 
Of course, if you had net tests running you would at least get a DUL hit on this, and possibly some others.
 
        Loren
----- Original Message -----
Sent: Tuesday, September 26, 2006 9:24 AM
Subject: Earthlink emails

I am getting a lot of earthlink.net emails with 4-5 random words in the body. I am at a lost how to prevent these. Any suggestions??
 
Thanks
Bryan
 
Subject:
axiom closure advocacy
From:
Blair <[EMAIL PROTECTED]>
Date:
Mon, 25 Sep 2006 22:17:02 -0500
To:
"[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
Return-Path:
<[EMAIL PROTECTED]>
Received:
from jonas.corp.good-sam.com by oraclemail.corp.good-sam.com with ESMTP id 78034461159241089; Mon, 25 Sep 2006 22:24:49 -0500
Received:
from relay2.corp.good-sam.com ([127.0.0.1]) by jonas.corp.good-sam.com (Netscape Messaging Server 4.15) with ESMTP id J66K5D00.QEM; Mon, 25 Sep 2006 22:24:49 -0500
Received:
from localhost (unknown [127.0.0.1]) by relay2.corp.good-sam.com (Postfix) with ESMTP id ED14919734E; Mon, 25 Sep 2006 22:19:52 -0500 (CDT)
Received:
from relay2.corp.good-sam.com (localhost.localdomain [127.0.0.1]) by localhost.good-sam.com (Postfix) with ESMTP id AF23B197561; Mon, 25 Sep 2006 22:15:30 -0500 (CDT)
Received:
from SHERI-PTIN5DJM8 (cpe-74-71-30-143.twcny.res.rr.com [74.71.30.143]) by relay2.corp.good-sam.com (Postfix) with SMTP id 36BF4197613; Mon, 25 Sep 2006 22:15:30 -0500 (CDT)
Message-ID:
<[EMAIL PROTECTED]>
MIME-Version:
1.0
X-Mailer:
Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE:
Produced By Microsoft MimeOLE V6.00.2800.1106
Thread-Index:
cjP2e3ogNnRAWCd1RrPAz5dlnZTe3DJGeSOW
X-Spam-Checker-Version:
SpamAssassin 3.0.1 (2004-10-22) on relay2.corp.good-sam.com
X-Spam-Status: 
No, score=0.0 required=6.0 tests=none autolearn=disabled version=3.0.1
Content-Type:
text/plain; charset=Windows-1252
Content-Transfer-Encoding:
base64

attenuatebackwood altitude airline cheeky chinesedanube

-------------------------------------------------

This email transmission and any documents, files or previous

email messages attached to it may contain information that is

confidential or legally privileged. If you are not the intended

recipient, you are hereby notified that any disclosure, copying,

printing, distributing or use of this transmission is strictly

prohibited. If you have received this transmission in error,

please immediately notify the sender by telephone or return

email and delete the original transmission and its attachments

without reading or saving in any manner.



The Evangelical Lutheran Good Samaritan Society.

---------------------------------------------------------

Reply via email to