spam not sent to my address still comes to me

[drjamie03]

I apologize if the subject line isn't very informative...I'm not sure how to describe what is happening. I keep getting spam that isn't addressed to me...when I look at the headers, they consistently look something like this (and as far as I can tell, there isn't a BCC list of addresses or other mass list of email addresses)
From <> Sat, 08 Jul 2006 13:04:09 -0800
From: ManuelGlass <>
To: Dentguy <>

Why are these messages coming to me?

(just in case it matters, here is the entire header of one of the spam messages):

Code: Select all

From <> Sat, 08 Jul 2006 13:04:09 -0800
From: ManuelGlass <>
To: Dentguy <>
Return-Path: <>
Received: from 209.86.93.226 ([222.120.39.170])
by mx-clapper.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1fZj25KD3Nl34b0; Sat, 8 Jul 2006 16:04:05 -0400 (EDT)
Received: from 37OB67J (aho.ctitech.com [222.120.39.170])
by 80V0IZ.ctitech.com with SMTP id MONLAT
for <>; Sat, 08 Jul 2006 13:04:09 -0800
Message-ID: <>
Date: Sat, 08 Jul 2006 13:04:09 -0800
X-ELNK-Info: spv=0;
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=000;
X-Antivirus: avast! (VPS 0627-3, 07/07/2006), Inbound message
X-Antivirus-Status: Clean
Delivery-Date: Sat, 8 Jul 2006 13:07:05
Status: U
X-Poco-Score-Detail: +7 [X-POCO-SCORE=+]AND[TO=%EMAIL%]AND[TO=%REPLYTO%]AND[CC=%EMAIL%]AND[CC=%REPLYTO%] (X-Poco-Score +, and To %email%, and To %replyto%, and Cc %email%, and Cc %replyto%)
X-Poco-Score-Detail: +3 [X-MAILER=] (X-Mailer )
X-Poco-Score: +12
X-Poco-Score-Detail: +2 [FROM=%ADDRESSBOOKS%] (From %addressbooks%)
X-Poco-Scored: +12
X-Poco-Score-Exceeds: 10
Subject: masochist but each Marion Joyner
Mime-Version: 1.0
Content-Type: multipart/related; boundary="66836016-POCO-88425077"
X-Poco-UID: 60448652
X-Poco-Status: U
X-Account: drjamie03

~ Removed email addresses to prevent harvesting + added Code tags ... Eric ~

[robin]

Hi Jamie - the reason that you are getting mail that is apparently not addressed to you is that the sender is using the facility that provides the BCC feature.

Firstly, you won't see a "BCC" list in the mail headers because is it just that - blind.

Secondly, the information in the headers is not the information that is used to route the message to you. When the mail server sends the message it uses a completely different set of instructions (look up the spec for SMTP protocol) that don't necessarily bear any relation to the information in the header.

It's a bit like your postman bringing a letter up to you and saying "this is for you" even though your name / address is not on the letter.

Unfortunately because of the presence of the BCC facility, all mail servers will accept messages if the instructions are "here is a message for ..." even if they are not in the header. *

* this is not strictly true depending on the way that the mail server is set up, but it is part of the delivery mechanism specification.

[rolo]

I've been trying to figure out how to write a script or filter that looks for "http://" in the message body and if if the message has "http://" in it and it isn't from someone in the address book or to someone in the addressbook then stop processing and delete it from server.

Any ideas on how it would work?

Thx,

[Michael]

You might not be able to delete it from the server, Poco only checks limited information in the message body in the pre-download filters. In general though you would want to create a filter in the "Pre-download" group. Within this filter you want to check for:

• "From" "Known Senders" "Match only if not found.
• "Message body" "http://"

. You would then set the action to "Delete this message".