abuse però quando gli faccio analizzare queste email mi sbaglia sempre (crede che la fonte dello spam sia l'ultimo rimbalzo e si ferma)
ecco un esempio di header (questa email tra l'altro non era spam ma virus che leggendolo è molto preoccupante ^^)
la mail in questio ha fatto questo giro:
ricevuta sull'indirizzo a cui ha inviato lo spammer (mioindirizzo@evcz.tk) e poi reindirizzata verso la mia email di "deposito" (miaCasellaDeposito@serenacom.net)
- Codice: Seleziona tutto
Return-Path: <sales@supereva.it>
Delivered-To: miaCasellaDeposito@6
Received: (qmail 28240 invoked from network); 23 Dec 2003 14:49:29 -0000
Received: from unknown (HELO www.dot.tk) (195.20.32.92)
by 212.34.224.147 with SMTP; 23 Dec 2003 14:49:29 -0000
Received: from nukumatau (localhost [127.0.0.1])
by www.dot.tk (Postfix) with SMTP id 7C1E8380006
for <miaCasellaDeposito@SERENACOM.NET>; Tue, 23 Dec 2003 14:54:58 +0000 (UTC)
Received: from 62.94.131.8:1470 by nukumatau (PowerMail) with id <1072191298:162752:nukumatau.3005632>; Tue, 23 Dec 2003 14:54:58 +0000 (UTC)
From: sales@supereva.it
To: mioIndirizzo@evcz.tk
Subject: Your IP was logged
Importance: Normal
X-Mailer: X-SMTP V6.63
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="OEMCOMPUTER4043f671e9a962"
Message-Id: <20031223145458.7C1E8380006@www.dot.tk>
Date: Tue, 23 Dec 2003 14:54:58 +0000 (UTC)
This is a multi-part message in MIME format.
--
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
____________________________________________
Did you know that you could
earn money with Dot TK? It's
simple. Become an affiliate
today and promote Dot TK on
your website!
http://www.dot.tk/vc00804.html
____________________________________________
--OEMCOMPUTER4043f671e9a962
Ladies and Gentlemen,
Downloading of Movies, MP3s and Software is illegal and punishable by law.
We hereby inform you that your computer was scanned under the IP 61.235.88.43 . The
contents of your computer were confiscated as an evidence, and you will be indicated.
You get the charge in writing, in the next days.
In the Reference code: #55541, are all files, that we found on your computer.
The sender address of this mail was masked, to protect us against mail bombs.
- You get more detailed information by the Federal Bureau of Investigation -FBI-
- Department for "Illegal Internet Downloads", Room 7350
- 935 Pennsylvania Avenue
- Washington, DC 20535, USA
- (202) 324-3000
--OEMCOMPUTER4043f671e9a962
Content-Type: plain/text;
name="Norton AntiVirus eliminato1.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Norton AntiVirus eliminato1.txt"
Tm9ydG9uIEFudGlWaXJ1cyBoYSByaW1vc3NvIGwnYWxsZWdhdG86IHJlZmNvZGU1NTU0MS56
bG8uDQogVzMyLlNvYmVyLkNAbW0g6CBzdGF0byByaWxldmF0byBjb21lIG1pbmFjY2lhIG5l
bGwnYWxsZWdhdG8u
--OEMCOMPUTER4043f671e9a962--
