B
blob
Guest
Ich erhalte ab und zu mails unter meiner mailbox copaya.yi.org , die angeblich von meinem eigenen Rechner , zweiter Name monkey.is-a-geek.net , versendet wurden, wo aber nur der header gefälscht wurde und sie in Wirklichkeit hauptsächlich von rdslink.ro kommen. Sie werden von mir auch als spam klassifiziert, incl. via rbl , pbl. Trotzdem will ich diesen Mißbrauch meines Server-Namens unterbinden. Wo kann ich das melden, so daß mails von rdslink.ro möglichst überhaupt nicht mehr weitergeleitet werden ?
Code:
From macon691@rdslink.ro Tue Oct 16 13:31:55 2007
Received: from localhost by werner
with SpamAssassin (version 3.2.3);
Tue, 16 Oct 2007 13:32:05 -0300
From: Instant.Booster@monkey.is-a-geek.net
To: werner@copaya.yi.org
Subject: Can you afford to lose 300,000 potential customers per year ?
Date: 16 Oct 2007 23:51:39 -0700
Message-Id: <20071016235137.5D839219FA44EB49@from.header.has.no.domain>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on werner
X-Spam-Level: ******************
X-Spam-Status: Yes, score=18.8 required=5.0 tests=BAYES_99,
DATE_IN_FUTURE_12_24,HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_PBL,RDNS_NONE,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,
URIBL_OB_SURBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=spam version=3.2.3
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4714E785.439C7093"
This is a multi-part message in MIME format.
------------=_4714E785.439C7093
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "werner", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: This brand new advertising tool has never been used Can you
afford to lose 300,000 potential customers per year ? How would You like
to divert 1000s of fresh, new visitors daily to Your web site or affiliate
web site from Google, Yahoo, MSN and others At $0 cost to you...? [...]
Content analysis details: (18.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: promote-biz.net]
1.9 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: promote-biz.net]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: promote-biz.net]
1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: promote-biz.net]
1.5 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: promote-biz.net]
0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: promote-biz.net]
0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[222.162.139.95 listed in zen.spamhaus.org]
2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?222.162.139.95>]
Vom Server monkey.is-a-geek.net/copaya.yi.org als SPAM klassifiziert
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4714E785.439C7093
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path: <macon691@rdslink.ro>
Received: from rdslink.ro ([222.162.139.95])
by monkey.is-a-geek.net (8.14.1/8.14.1) with ESMTP id l9GGVm2q012300
for <werner@copaya.yi.org>; Tue, 16 Oct 2007 13:31:52 -0300
Reply-To: macon691@rdslink.ro
From: Instant.Booster@monkey.is-a-geek.net
To: werner@copaya.yi.org
Subject: Can you afford to lose 300,000 potential customers per year ?
Date: 16 Oct 2007 23:51:39 -0700
Message-ID: <20071016235137.5D839219FA44EB49@from.header.has.no.domain>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_47F9EECC.51D39F2C"
This is a multi-part message in MIME format.
------=_NextPart_000_0012_47F9EECC.51D39F2C
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD><TITLE>This brand new advertising tool has never been used</TITL=
E>
<META content=3D"text/html; charset=3Dwindows-1252" http-equiv=3DContent-Typ=
e>
<META content=3D"MSHTML 6.00.2800.1595" name=3DGENERATOR>
<META content=3DFrontPage.Editor.Document name=3DProgId>
<META content=3D"Microsoft FrontPage 4.0" name=3DGENERATOR>
<META content=3DFrontPage.Editor.Document name=3DProgId></HEAD>
<BODY>
<P align=3Dleft><FONT face=3D"Arial, Helvetica, sans-serif" size=3D2>Can you=
afford to lose 300,000 potential customers per year ?</FONT></P>
<P align=3Dleft><FONT face=3D"Arial, Helvetica, sans-serif" size=3D2>How wou=
ld You like to divert 1000s of fresh,<BR>new visitors daily to Your web site=
or affiliate web site from<BR>Google, Yahoo, MSN and others At $0 cost to y=
ou...?</FONT></P>
<P align=3Dleft><FONT face=3D"Arial, Helvetica, sans-serif" size=3D2>...iNST=
ANT BOOSTER diverts 1000s of fresh,<BR>new visitors daily to Your web site o=
r affiliate<BR>web site from Google, Yahoo, MSN and others<BR>at $0 cost to =
you!</FONT></P>
<P align=3Dleft><FONT face=3D"Arial, Helvetica, sans-serif" size=3D2>...No m=
atter what you are selling or offering -<BR>INTSANT BOOSTER will pull in hor=
des of potential customers to your website - instantly!</FONT></P>
<P align=3Dleft><FONT face=3DArial size=3D2><STRONG>For Full details please =
read the attached .html file</STRONG></FONT></P>
<P align=3Dleft> </P><FONT size=3D3><B>
<P align=3Dleft> </P>
<P align=3Dleft> </P>
<P align=3Dleft> </P>
<P align=3Dleft> </P>
<P align=3Dleft> </P>
<P align=3Dleft><FONT face=3DArial size=3D2>Unsubscribe</FONT></P>
<P align=3Dleft><FONT face=3DArial size=3D2>Please read the attached .txt fi=
le</FONT></P></B></FONT></BODY></HTML>
------=_NextPart_000_0012_47F9EECC.51D39F2C
Content-Type: text/html; name="instantbooster.htm"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="instantbooster.htm"
PGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5Mb2FkaW5nIHBhZ2UuLi48L3RpdGxlPg0KPG1ldGEg
aHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMjtVUkw9aHR0cDovL3d3dy5wcm9tb3Rl
LWJpei5uZXQvbWcvaW5zdGFudGJvb3N0ZXIvaW5kZXguaHRtIj4NCjxzY3JpcHQ+DQp1cmw9
J2h0dHA6Ly93d3cucHJvbW90ZS1iaXoubmV0L21nL2luc3RhbnRib29zdGVyL2luZGV4Lmh0
bSc7DQppZihkb2N1bWVudC5pbWFnZXMpIHsgdG9wLmxvY2F0aW9uLnJlcGxhY2UodXJsKTsg
fQ0KZWxzZSB7IHRvcC5sb2NhdGlvbi5ocmVmPWh0dHA6Ly93d3cucHJvbW90ZS1iaXoubmV0
L21nL2luc3RhbnRib29zdGVyL2luZGV4Lmh0bTsgfQ0KPC9zY3JpcHQ+DQo8L2hlYWQ+DQo8
Ym9keT5Mb2FkaW5nDQo8YSBocmVmPWh0dHA6Ly93d3cucHJvbW90ZS1iaXoubmV0L21nL2lu
c3RhbnRib29zdGVyL2luZGV4Lmh0bT5wYWdlPC9hPi4uLg0KPC9ib2R5Pg0KPC9odG1sPg0K
------=_NextPart_000_0012_47F9EECC.51D39F2C
Content-Type: text/plain; name="Unsubscribe email.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Unsubscribe email.txt"
d2VibWFzdGVyQHByb21vdGUtYml6Lm5ldA==
------=_NextPart_000_0012_47F9EECC.51D39F2C--
------------=_4714E785.439C7093--
Und, blacklist status: clear, obwohl mein spam-Filter diese IP als bekannten Spammer angibt
