OT Blank Emails (OE) Question

I've gotten a few of those. I've been using K9 to filter out spam, after a
bit of training it does an excellent job. It puts spam into a separate
folder where you can quickly scan the headers to see if there is anything
good that got misclassified. That happens very rarely and I only continue
to do it because I occasionally get mail generated from my website that it
might mistake as spam. It's much quicker to scan it all in a separate
folder than to pick out the bad among the good. Free at www.keir.net

In news:[email hidden],
Carmen <[email hidden]> stated
| Hi,
| With a fair sprinkling of computer geeks in here I figure it's worth a
| shot. :-)
| Since January I've gotten 36 emails that have no
| "Subject", no "To" or "From" information and no message body either.
| In Properties--->Details I see something like this:
| ******************************************
| Return-Path: <[email hidden]>
| Received: from [205.152.59.32] ([218.190.131.147])
| by imf04aec.mail.bellsouth.net
| (InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with
| SMTP
| id
|
|
| <20040905165123.XLYJ1764.imf04aec.mail.bellsouth.net@[205.152.59.32]>;
| Sun, 5 Sep 2004 12:51:23 -0400
| X-Message-Info: V
| Message-Id:
| <20040905165123.XLYJ1764.imf04aec.mail.bellsouth.net@[205.152.59.32]>
| Date: Sun, 5 Sep 2004 12:51:24 -0400
| *******************************************
| They don't all originate from the above IP address. These are some of
| the others:
| 218.190.131.147
| 218.59.224.157
| 64.217.149.166
| 218.191.130.213
| 80.37.96.76
| 24.85.79.207
| 221.124.232.134
| 210.222.197.23
| 211.201.125.108
| 211.113.213.86
| 220.190.87.7
| 218.80.138.220
|
| Lots of the Return-Path emails are Yahoo, but there are also some
| Starmate, Flashmail, Awemail, FS1860.net, Sonnet and other ISPs
| represented. They aren't "traceable". I suspect they're some sort of
| spam that didn't quite turn out right but if someone could direct me
| towards a way to stop them using OE's Message Rules or by some sort of
| add-on software I'd be grateful.
|
| Thanks and take care,
| Carmen

Carmen,
I don't know how you are tracing those emails, but I've been using
senderbase.com to track my website traffic. I plugged in some of the IP's you
listed, and this is what I got, and lots more:

80.37.96.76
TELEFONICA DE ESPANA
person: Antonio Fuentes
address: TELEFONICA DE ESPANA
address: Emilio Vargas, 4
address: 28043-MADRID
address: SPAIN
phone: +34 91 5194446
fax-no: +34 91 5846936

24.85.79.207
OrgName: Shaw Communications Inc.
OrgID: SHAWC
Address: Suite 800
Address: 630 - 3rd Ave. SW
City: Calgary
StateProv: AB
PostalCode: T2P-4L4
Country: CA

221.124.232.134
Hutchison Global Communications
country: HK
person: ITMM HGC
nic-hdl: IH17-AP
e-mail: [email hidden]
remarks: ---------------------
remarks: for spamming/hacking complaints
remarks: send reports to
remarks: [email hidden]

Maybe that will be useful for you.

I'm sorry, it is www.senderbase.org

You seem to be getting a lot of international email:

220.190.87.7
CHINANET-ZJ Wenzhou node network

218.80.138.220
CHINANET Shanghai province network

211.113.213.86
ONSE Telecom KR (Korea?)

218.59.224.157 CNCGROUP Shandong province network China

Use something like spamsubtract to block such stuff on the server so it
never gets to your PC. Nothing like this ever even gets downloaded because
if I don't recognize the sender or if the subject line makes no sense to me,
I nuke it. My virus software does a lot less work, too.

www.spamsubtract.com

Carmen wrote:
|| Lots of the Return-Path emails are Yahoo, but there are also some
|| Starmate, Flashmail, Awemail, FS1860.net, Sonnet and other ISPs
|| represented. They aren't "traceable". I suspect they're some sort
|| of
|| spam that didn't quite turn out right but if someone could direct me
|| towards a way to stop them using OE's Message Rules or by some sort
|| of add-on software I'd be grateful.
||
|| Thanks and take care,
|| Carmen

Carmen said:

Lots of the Return-Path emails are Yahoo, but there are also some
Starmate, Flashmail, Awemail, FS1860.net, Sonnet and other ISPs
represented. They aren't "traceable". I suspect they're some sort of
spam that didn't quite turn out right but if someone could direct me
towards a way to stop them using OE's Message Rules or by some sort of
add-on software I'd be grateful.

I believe they're noob-spammers, mistyping an extra return or
particular characters at the beginning of a line in the header of their
spamware, so the server sees it as the end of the message. The header
gets parsed alone, and the headless bodies are dropped by the server.

I don't know offhand how you could filter with OE, as I don't use OE.
Being a linux geek, I do it with procmail. There are probably
third party antispamware apps for Win that could handle filtering
on other headers, and compound rules like blank to and from.
I use a lot of filtering on Received headers, to block Asian spam.

If I didn't know how to write filtering rules with procmail, my
Newsguy email account has very advanced spamfiltering configuration
via a web interface, and they allow you the option of adding your ISP
email accounts to their spamfilter. You can optionally have it put
filtered messages in a holding queue for 4 days to examine, instead
of deleting, in case you didn't write your filter rule quite right,
and then change it to delete when you're sure the rule is correct.

--
jamie ([email hidden])

"There's a seeker born every minute."

Hello again,
<Snip of Blank Email problem details>
Okay, I dug around a bit, looked at some of your suggestions and found
a potential solution in Google:

http://tinyurl.com/5dbat
I wasn't aware that one could get the option to change filter terms to
a "not" later in the process. This gentleman's solution may do the
trick. It was easy enough to set up, so now I guess I just wait. It
leaves me wondering why OE was given to brain-damaged squirrels to
develop though.

Thank you guys. :-) <I'm saving all the suggestions in case it
doesn't work.>

Take care,
Carmen

Hi,

FOB said:

I've gotten a few of those. I've been using K9 to filter out spam,
after a
bit of training it does an excellent job. It puts spam into a
separate
folder where you can quickly scan the headers to see if there is
anything
good that got misclassified. That happens very rarely and I only
continue
to do it because I occasionally get mail generated from my website
that it
might mistake as spam. It's much quicker to scan it all in a
separate
folder than to pick out the bad among the good. Free at
www.keir.net

Thank you. I've put this away in case the solution I found doesn't
stop the blank emails. (Crossing fingers)

Take care,
Carmen

Hi,

(Xray586) said:

Carmen,
I don't know how you are tracing those emails, but I've been using
senderbase.com to track my website traffic. I plugged in some of
the IP's you listed, and this is what I got, and lots more:

I appreciate all your effort. I can do the IP address to useful info
conversion
alright, but in these cases reporting them as "abuse" isn't really
accurate.
They could just be some oddball glitch, so the best thing to do is
stop them from hitting my in-box.
Hopefully that will happen with the Message Rule I found in Google.

Thank you,
Carmen

Hi,

(Xray586) said:

Carmen,
I don't know how you are tracing those emails, but I've been using
senderbase.com to track my website traffic. I plugged in some of
the IP's you listed, and this is what I got, and lots more:

I appreciate all your effort. I can do the IP address to useful info
conversion
alright, but in these cases reporting them as "abuse" isn't really
accurate.
They could just be some oddball glitch, so the best thing to do is
stop them from hitting my in-box.
Hopefully that will happen with the Message Rule I found in Google.

Thank you,
Carmen

Hi,

Roger Zoul said:

Use something like spamsubtract to block such stuff on the server so
it
never gets to your PC. Nothing like this ever even gets downloaded
because
if I don't recognize the sender or if the subject line makes no
sense to me,
I nuke it. My virus software does a lot less work, too.

www.spamsubtract.com

Thank you for the steer. If the Message Rule doesn't do the trick
I'll try some of the other suggestions I got. I'm not sure that Spam
Subtract would work for me. Subject lines that don't make sense? You
don't know my friends. <G>

Take care,
Carmen

Hi,

Roger Zoul said:

Use something like spamsubtract to block such stuff on the server so
it
never gets to your PC. Nothing like this ever even gets downloaded
because
if I don't recognize the sender or if the subject line makes no
sense to me,
I nuke it. My virus software does a lot less work, too.

www.spamsubtract.com

Thank you for the steer. If the Message Rule doesn't do the trick
I'll try some of the other suggestions I got. I'm not sure that Spam
Subtract would work for me. Subject lines that don't make sense? You
don't know my friends. <G>

Take care,
Carmen

Carmen wrote:
|| Hi,
|| On 5-Sep-2004, "Roger Zoul" <[email hidden]> wrote:
||
||| Use something like spamsubtract to block such stuff on the server so
||| it
||| never gets to your PC. Nothing like this ever even gets downloaded
||| because
||| if I don't recognize the sender or if the subject line makes no
||| sense to me,
||| I nuke it. My virus software does a lot less work, too.
|||
||| www.spamsubtract.com
||
|| Thank you for the steer. If the Message Rule doesn't do the trick
|| I'll try some of the other suggestions I got. I'm not sure that Spam
|| Subtract would work for me. Subject lines that don't make sense?
|| You don't know my friends. <G>

🙂 Well, you see the return address and it will scan your address book and
let you approve those as people whose mail can come right through. Also, if
someone not currently in your address send you a mail, you can put them in
your "friends" group and their e-mails drop through. After some training ,
all the junk gets stopped at the door.

Carmen wrote:
|| Hi,
|| On 5-Sep-2004, "Roger Zoul" <[email hidden]> wrote:
||
||| Use something like spamsubtract to block such stuff on the server so
||| it
||| never gets to your PC. Nothing like this ever even gets downloaded
||| because
||| if I don't recognize the sender or if the subject line makes no
||| sense to me,
||| I nuke it. My virus software does a lot less work, too.
|||
||| www.spamsubtract.com
||
|| Thank you for the steer. If the Message Rule doesn't do the trick
|| I'll try some of the other suggestions I got. I'm not sure that Spam
|| Subtract would work for me. Subject lines that don't make sense?
|| You don't know my friends. <G>

🙂 Well, you see the return address and it will scan your address book and
let you approve those as people whose mail can come right through. Also, if
someone not currently in your address send you a mail, you can put them in
your "friends" group and their e-mails drop through. After some training ,
all the junk gets stopped at the door.

Hi,

(jamie) said:

I believe they're noob-spammers, mistyping an extra return or
particular characters at the beginning of a line in the header of
their
spamware, so the server sees it as the end of the message. The
header
gets parsed alone, and the headless bodies are dropped by the
server.

I'll take your word on it. A lot of the "hows" of computers are a
mystery to me. :-)
Thanks for trying to clear it up for me.

Take care,
Carmen

I use an earlier version of 'Mailwasher'. It allows you to preview any
email received and gives you the option to bounce, blacklist, and delete the
email before receiving. Unlike versions currently available, it is free.
It is fairly easy to set up and use, and is about 1.3 MB in size. If you
would like it, I will send it to you.