[Mimedefang] Blacklist vs Access_db

[Stefano McGhee]

>Both the envelope sender and the From: header are easily faked, so they
>are more useful (IMO) for whitelisting than for blacklisting.  And if
>you are whitelisting someone, it's unlikely the From: header and envelope
>sender will be different (except for mailing lists.)

It's interesting that you say that.  I thought that the envelope header WAS
a cinch to fake, but the From:header was more difficult.  I can read a
header and see people claiming to be from hotmail, aol, or msn, but
actually sending through a server in East Nowhere.  But I'm still kinda'
fuzzy on the details of the From: header that the MTA uses.  Does anyone
have a link to a resource that could help me better understand how to
decipher some of these headers better?  I've attached a copy of the headers
of a most recent piece of spam reported to me by my users.  It was for,
well, male member enlargement, and got a SpamAssassin score of -68!
Crafty...

Stefano


Received: from galactica.arcweb.com ([63.111.209.16]) by apollo.arcweb.com
with Microsoft SMTPSVC(5.0.2195.5329);

         Tue, 10 Dec 2002 13:30:56 -0500

Received: from msn.com (80-24-53-118.uc.nombres.ttd.es [80.24.53.118])

        by galactica.arcweb.com (8.12.6/8.12.6) with SMTP id
gBAIXGh2001480;

        Tue, 10 Dec 2002 13:33:21 -0500

Received: from n9.groups.huyahoo.com ([137.249.136.93])

        by mta21.bigpong.com with SMTP; Tue, 10 Dec 2002 17:30:16 -0700

Received: from unknown (HELO n9.groups.huyahoo.com) (37.194.51.231)

        by asy100.as122.sol-superunderline.com with esmtp; 10 Dec 2002
10:30:07 -0700

Received: from [84.130.213.105] by smtp-server.tampabayr.com with asmtp; 10
Dec 2002 03:29:58 +1200

Received: from unknown (111.152.131.247)

        by hd.ressort.net with NNFMP; Tue, 10 Dec 2002 15:29:49 -0400

Received: from unknown (HELO n9.groups.huyahoo.com) (134.16.90.196)

        by pet.vosni.net with local; Tue, 10 Dec 2002 11:29:40 +0700

Reply-To: <esi69 at msn.com>

Message-ID: <002b41b64b5d$6758e3c0$1dc21ba2 at ubhmch>

From: <esi69 at msn.com>

To: X

Cc: X

Subject: Increase your penis 3 inches in 22 days

Date: Tue, 10 Dec 2002 16:20:24 +0200

MIME-Version: 1.0

Content-Type: text/html; charset="iso-8859-1"

X-Priority: 3 (Normal)

X-MSMail-Priority: Normal

X-Mailer: The Bat! (v1.52f) Business

Importance: Normal

X-Spam-Status: No, hits=-68.4 req=10

X-Scanned-By: MIMEDefang 2.25 (www . roaringpenguin . com / mimedefang)

Return-Path: esi69 at msn.com

X-OriginalArrivalTime: 10 Dec 2002 18:30:56.0622 (UTC)
FILETIME=[478618E0:01C2A07A]