anonymous@mail1.hsphere.cc

[Funnyhat]

I keep getting blank emails from anonymous@mail1.hsphere.cc about 5 in the last week... It says recipient list not shown but that is it...

Submit a ticket with full email and headers.

[Funnyhat]

I know this is going to sound dumb but how do I view the header in Outlook?

[DigitalSkyline]

Same thing happened to me, after i removed the catch all from my account it stopped.

[jmbeach]

Originally Posted by Funnyhat

I know this is going to sound dumb but how do I view the header in Outlook?

File > Properties > Details tab

I think its just something spammer's are doing. From addresses are typical random characters @yahoo.com . Not much you can do for it.

[sobocinski]

Originally Posted by Bladesnitz

I think its just something spammer's are doing. From addresses are typical random characters @yahoo.com . Not much you can do for it.

I just got one too. Here are the headers:

Return-Path: <petieeyyli@hotmail.com>
Delivered-To: sobo@beaconts.com
Received: (qmail 80708 invoked by uid 399); 23 Feb 2004 18:33:21 -0000
From: anonymous@mail.hsphere.cc
Cc: recipient list not shown: ;
Delivered-To: changeme@beaconts.com
Received: (qmail 80703 invoked by uid 399); 23 Feb 2004 18:33:21 -0000
Received: from unknown (HELO sccrmxc12.comcast.net) (204.127.202.60)
by mail.hsphere.cc with SMTP; 23 Feb 2004 18:33:21 -0000
Date: Mon, 23 Feb 2004 18:33:21 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium
Received: from chello062178173073.14.14.vie.surfer.at ([62.178.173.73])
by sccrmxc12.comcast.net (sccrmxc12) with SMTP
id <20040223183237s120093fmue>; Mon, 23 Feb 2004 18:33:21 +0000
X-Originating-IP: [62.178.173.73]
Received: from 51.108.30.187 by 62.178.173.73; Mon, 23 Feb 2004 11:32:41 -0700
Message-ID: <F[20
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
mail.hsphere.cc
X-Spam-Status: No, hits=1.5 required=3.8 tests=INVALID_MSGID,NO_REAL_NAME
autolearn=no version=2.61

Yep...
The reason anonymous@mail#.hsphere.cc is in there is because the original message does not contain a FROM header, so vdelivermail tacks one in there when it sends it to your mailbox, to ensure the message is RFC compliant.

[sobocinski]

Originally Posted by Bladesnitz

Yep...
The reason anonymous@mail#.hsphere.cc is in there is because the original message does not contain a FROM header, so vdelivermail tacks one in there when it sends it to your mailbox, to ensure the message is RFC compliant.

I'm guessing then that Return-Path: <petieeyyli@hotmail.com> is just a patsy--not the real sender.

Rich

[CelticRaven]

What is the recommended solution to stopping these?

[mresell]

You can't other than filter and turn off catch all mail. They aren't coming from here...just more spammer stuff.

[Brangwyn]

You can of course always try tracking back the original IP (which may be spoofed) and flick an email off to the abuse@ address for that ISP, no guarantees anything will happen, but might make you feel better for at least trying to have done something about it, I've found a lot of ISP's do actually take it pretty seriously and generaly have investigated things when I've sent them a complaint.

[mresell]

Originally Posted by Brangwyn

You can of course always try tracking back the original IP (which may be spoofed) and flick an email off to the abuse@ address for that ISP, no guarantees anything will happen, but might make you feel better for at least trying to have done something about it, I've found a lot of ISP's do actually take it pretty seriously and generaly have investigated things when I've sent them a complaint.

Of course, I actually do this, but only for an isp I am familiar with, otherwise you could be sending email to who knows, possibly someone working w/ the spammer. Some of these spammers go to great lengths I have found.

[cambodia]

i got that problem too

[admin]

Has any one tried putting anonymous@mail#.hsphere.cc in SA to see if it will block it? That might work.. We may even be able to do that system wide, maybe matt can shed some light if that will work or not.