cancel
Showing results for 
Search instead for 
Did you mean: 

Spam

ChrisL
Grafter
Posts: 734
Thanks: 4
Registered: 13-12-2007

Spam

I don't get spammed on this address, so I'm mighty upset to have received one (headers below). This looks like obvious spam, but it got through the Cloudmarks. There doesn't seem to be any way to report mistakes once they are removed from the server by POP3, so I wondered if these headers could be passed on to someone who could do some good with them? Does anybody think I should be reporting it to Yahoo Groups, which is almost certainly where the spammer got my address?
Best wishes
Chris
Quote
Return-path: <boothpaul@yahoo.co.uk>
Envelope-to: sue@username.plus.com
Delivery-date: Tue, 20 Nov 2012 03:49:54 +0000
Received: from [212.159.8.109] (helo=avasin03.plus.net)
  by inmx13.plus.net with esmtp (PlusNet MXCore v2.00) id 1TaeqQ-0008AO-IF
  for sue@username.plus.com; Tue, 20 Nov 2012 03:49:54 +0000
Received: from nm24-vm0.bullet.mail.ird.yahoo.com ([212.82.109.239])
by avasin03.plus.net with Plusnet Cloudmark Gateway
id Rfps1k00E59wquC01fpukG; Tue, 20 Nov 2012 03:49:54 +0000
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.0 cv=baXpoZzB c=1 sm=1 a=LgDWJv78OYkwNmwnUdLTzA==:17
a=PLmm6w-6prgA:10 a=2qy6Z3e1nRMA:10 a=zzxzp6Hi2ogA:10 a=he5gM0cRyqEA:10
a=BrDiTsk0AAAA:8 a=CjxXgO3LAAAA:8 a=zFUb7-TSb0clQQ3CnecA:9 a=wPNLvfGTeEIA:10
a=RN2LHwatl3TC6NiGuisA:9 a=7K-VQTdBO6zplVCh:21 a=crv564e//AH1OIdV2hJviQ==:117
Received: from [77.238.189.50] by nm24.bullet.mail.ird.yahoo.com with NNFMP; 20 Nov 2012 03:49:52 -0000
Received: from [212.82.108.245] by tm3.bullet.mail.ird.yahoo.com with NNFMP; 20 Nov 2012 03:49:52 -0000
Received: from [127.0.0.1] by omp1010.mail.ird.yahoo.com with NNFMP; 20 Nov 2012 03:49:52 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 263908.41099.bm@omp1010.mail.ird.yahoo.com
Received: (qmail 38678 invoked by uid 60001); 20 Nov 2012 03:49:52 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s1024; t=1353383392; bh=nZjoEywsVw55IopHMrwTlDNB0v5Z9Fbnbz2VyYgoTUM=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-IDCheesyate:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Ew8vaDwoDi4zJfGDqGEBH2g/5dSDX+74awSuVYmADCn75jrDbq8T5caqZmIhXtNis8ieV0TulTwjcsLJ3Zyq8z/uO033KieL78s7mQ5OrHZJmxn5iTDSaovT9CsVgYnUZcVxJNnq9u+viJHmNZ1Wm0Ey6xCfl4BNHfSYmM5ZC/E=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.co.uk;
  h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-IDCheesyate:From:Reply-To:Subject:To:MIME-Version:Content-Type;
  b=11PCBvTOIEqlB3GS9nY6YwU4vcwFWg47c696+VXP/BICXK7D4zkIROCX6zb1ro23piVF9ikWD1O2jq21ryznClSVZ0BSdlA/OUWDi3ruowcxzNj7U6S1/SmNXOQCtv0/8fcMo0cPc/A4Png8X9ZwNVaNz/0INsBVgEU3+eSMg1w=;
X-YMail-OSG: c6allOUVM1mzK8FreAFwf8eOyIMVf.8qdr40Ce.BDuvq8W7
WHAQBpqqCsSlaY329aYCEwyt5mOX5qFXLNcldwumh25Zfwesg6AajeU6bJhz
Y_g2lFJF6RmPkgwk6ZEn25unWsIjU3aBUKLZlCYFJbBPiZOonqUJ8Ihcz4Yj
e.xGZUyDDQ7Y1euw24nBPm_JYRkLRWGayM.Er_NiDgSTKuk1ibSHBr1gT7Ky
0TmFeylTUBd7RSe6AsOzlpAMY3EHiohHfLTQODt21R1tu1zsZncKTvMAnoTz
D_FfySfnZqpxy_rr9vV.PF3XLSQT1FEQuzyQvsG2QEwPKieeiWh5gc0P6vxN
nTpLahIay_G0M3FfuwLi57tyNNiPk._WSFf83ad_lUv59GMi2gnB_SjvshTq
wfKd2W4xoXFOC1kik83DvlEKpSH.s.AHZYdiTTjQn.r96WrsdpwqxeYm9lBg
-
Received: from [91.228.3.138] by web171301.mail.ir2.yahoo.com via HTTP; Tue, 20 Nov 2012 03:49:52 GMT
X-Rocket-MIMEInfo: 001.001,DQoNCsKgwqAgSSBhbSBpbiBMaW1hc3NvbCwgQ3lydXMgYXQgdGhlIG1vbWVudC4gSSBhbSBoZXJlIGZvciBhIFZvbHVudGFyeSBUcmFpbmluZyBQcm9ncmFtIChWVFApLCBhbmQgdW5mb3J0dW5hdGVseSBJIGp1c3QgaGFkIG15IGJhZyBzdG9sZW4gZnJvbSBtZSB3aXRoIG15IHBhc3Nwb3J0IGFuZCBwZXJzb25hbCBlZmZlY3RzLiBJIMKgaGF2ZSBiZWVuIHRyeWluZyB0byBzb3J0IHRoaW5ncyBvdXQgd2l0aCB0aGUgbmVjZXNzYXJ5IGF1dGhvcml0aWVzLCBJIG5lZWQgc29tZSBhc3Npc3RhbmNlIGZyb20gwqABMAEBAQE-
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.126.470
Message-ID: <1353383392.33984.YahooMailClassic@web171301.mail.ir2.yahoo.com>
Date: Tue, 20 Nov 2012 03:49:52 +0000 (GMT)
From: Paul Booth <boothpaul@yahoo.co.uk>
Reply-To: boothpaul1@yahoo.co.uk
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="862858767-804529790-1353383392=:33984"
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Hi
--862858767-804529790-1353383392=:33984
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

=A0=A0 I am in Limassol, Cyrus at the moment. I am here for a Voluntary Tra=
ining Program (VTP), and unfortunately I just had my bag stolen from me wit=
h my passport and personal effects. I =A0have been trying to sort things ou=
t with the necessary authorities, I need some assistance from =A0you.=A0=A0=
Let me know if you can be of any help.
=A0Thanks
=A0Paul.
-- snip --
4 REPLIES
Community Veteran
Posts: 1,375
Thanks: 33
Registered: 07-03-2008

Re: Spam

The text looks suspiciously like a well known attempt to get money up-front from those who would like to sponge on you. Had this a while back by some one who has come across my email address which may not have been edited out by a Fwder, along with others known to me.
Roll eyes
ChrisL
Grafter
Posts: 734
Thanks: 4
Registered: 13-12-2007

Re: Spam

Yeah, I'm amazed anyone thinks they can still get away with that one. But I suppose they go in cycles: some neophyte will get one of his spams and show fatal curiosity. The content may be unoriginal, but the spammer seems to have done something clever to avoid being laughed off the court by our gatekeepers....
Chris
Infinity
Seasoned Pro
Posts: 6,128
Thanks: 264
Fixes: 3
Registered: 19-06-2011

Re: Spam

I keep emails on original server (non Plusnet) when accessed via POP3, auto deleted after one week.
Just in case there is a POP3 problem, and I need to access original emails.
I also auto forward all emails to another server, same reason.
Also, allows me to mark as SPAM any that get through the original server spam trap, for them to be actioned.
They actively deal with messages marked as spam.

I also do an active messages delete every so often on the original server.
ChrisL
Grafter
Posts: 734
Thanks: 4
Registered: 13-12-2007

Re: Spam

Good idea!  I'll look into this now. Thanks PlusComUK.
Chris