[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4688: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4690: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4691: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4692: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
Poco Forums • View topic - spam not sent to my address still comes to me

spam not sent to my address still comes to me

Discussion on Bayesian and standard junk mail filters

Moderators: Eric, Tomas, robin, Michael

spam not sent to my address still comes to me

Postby drjamie03 » Sat Jul 08, 2006 8:16 am

I apologize if the subject line isn't very informative...I'm not sure how to describe what is happening. I keep getting spam that isn't addressed to me...when I look at the headers, they consistently look something like this (and as far as I can tell, there isn't a BCC list of addresses or other mass list of email addresses)
From <> Sat, 08 Jul 2006 13:04:09 -0800
From: ManuelGlass <>
To: Dentguy <>

Why are these messages coming to me?

(just in case it matters, here is the entire header of one of the spam messages):

Code: Select all
From <> Sat, 08 Jul 2006 13:04:09 -0800
From: ManuelGlass <>
To: Dentguy <>
Return-Path: <>
Received: from 209.86.93.226 ([222.120.39.170])
by mx-clapper.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1fZj25KD3Nl34b0; Sat, 8 Jul 2006 16:04:05 -0400 (EDT)
Received: from 37OB67J (aho.ctitech.com [222.120.39.170])
by 80V0IZ.ctitech.com with SMTP id MONLAT
for <>; Sat, 08 Jul 2006 13:04:09 -0800
Message-ID: <>
Date: Sat, 08 Jul 2006 13:04:09 -0800
X-ELNK-Info: spv=0;
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=000;
X-Antivirus: avast! (VPS 0627-3, 07/07/2006), Inbound message
X-Antivirus-Status: Clean
Delivery-Date: Sat, 8 Jul 2006 13:07:05
Status: U
X-Poco-Score-Detail: +7 [X-POCO-SCORE=+]AND[TO=%EMAIL%]AND[TO=%REPLYTO%]AND[CC=%EMAIL%]AND[CC=%REPLYTO%] (X-Poco-Score +, and To %email%, and To %replyto%, and Cc %email%, and Cc %replyto%)
X-Poco-Score-Detail: +3 [X-MAILER=] (X-Mailer )
X-Poco-Score: +12
X-Poco-Score-Detail: +2 [FROM=%ADDRESSBOOKS%] (From %addressbooks%)
X-Poco-Scored: +12
X-Poco-Score-Exceeds: 10
Subject: masochist but each Marion Joyner
Mime-Version: 1.0
Content-Type: multipart/related; boundary="66836016-POCO-88425077"
X-Poco-UID: 60448652
X-Poco-Status: U
X-Account: drjamie03


~ Removed email addresses to prevent harvesting + added Code tags ... Eric ~
Jamie P
drjamie03
Poco Enthusiast
 
Posts: 254
Joined: Fri Aug 06, 2004 7:48 am
Location: Portland, OR

Postby robin » Sat Jul 08, 2006 8:01 pm

Hi Jamie - the reason that you are getting mail that is apparently not addressed to you is that the sender is using the facility that provides the BCC feature.

Firstly, you won't see a "BCC" list in the mail headers because is it just that - blind.

Secondly, the information in the headers is not the information that is used to route the message to you. When the mail server sends the message it uses a completely different set of instructions (look up the spec for SMTP protocol) that don't necessarily bear any relation to the information in the header.

It's a bit like your postman bringing a letter up to you and saying "this is for you" even though your name / address is not on the letter.

Unfortunately because of the presence of the BCC facility, all mail servers will accept messages if the instructions are "here is a message for ..." even if they are not in the header. *

* this is not strictly true depending on the way that the mail server is set up, but it is part of the delivery mechanism specification.
robin
 

Same problem

Postby rolo » Mon Sep 25, 2006 3:50 pm

I've been trying to figure out how to write a script or filter that looks for "http://" in the message body and if if the message has "http://" in it and it isn't from someone in the address book or to someone in the addressbook then stop processing and delete it from server.

Any ideas on how it would work?

Thx,
rolo
Drop-in Visitor
 
Posts: 6
Joined: Mon Sep 25, 2006 3:47 pm

Postby Michael » Tue Sep 26, 2006 2:50 am

You might not be able to delete it from the server, Poco only checks limited information in the message body in the pre-download filters. In general though you would want to create a filter in the "Pre-download" group. Within this filter you want to check for:
  • "From" "Known Senders" "Match only if not found.
  • "Message body" "http://"
. You would then set the action to "Delete this message".
Michael
Moderator
 
Posts: 866
Joined: Mon Jul 26, 2004 12:14 pm
Location: Victoria BC, Canada


Return to Junk Mail Filtering Help and How-To

Who is online

Users browsing this forum: No registered users and 3 guests

cron