/etc/mail/access weirdness

[Billy A. Pumphrey]

Ok, I started checking them.  I checked only about 5.  Only 1 I seen a cc: on it.  Here is one message and header that I didn't see a cc on it to see.

MESSAGE:
Hey,
I just heard of this new drµg called ©iális and I thought you might be interested in it. Cìális is the new ríval to vïágra and is better known as sûpér vïagrá or dubbed the "weekénd viagrá" by the prêss.
I just found a place ónl¡ne that has the gënerìc version for a lot chéáper than getting it from a US phârmâcy. No préscrìptions needed or nécessâry.
autonomous
All Ordérs Backéd By Our 100%,
30 Dãy, Monéy Ba¢k Guarántêe!
Sh¡ppéd worldwidé Discrëetly.
http://earthmen.squat.majesty.fill.certify.accountant.dahomey.adipic.unbelievabledealswholesale.biz/c3/?AFF_ID=c30323 Your easy-to-use solution is here No further emâîls plèâse http://bullish.satiric.destiny.continuant.depositor.apologetic.lookup.betrayal.unbelievabledealswholesale.biz http://unbelievabledealswholesale.biz
 
_WORD . cyclone , blastula polygynous , appoint . gimpy . marguerite , ward retiree , suzerainty . vain . constipate , wyeth pint , importunate . camouflage . pluto6 , picnicker4 blonde , trance . discernible . postmaster , foregoing iconic , rightmost . ancestor . samoa , astoria coauthor , churchill . don . fresnel , headquarter jorgenson , masterpiece . alum . magnum , armada maxima , elementary . airy . revolt , levulose dramatic , frieze . buttermilk . everywhere , genesis gail , carboxy . lathrop . disdain , casteth sarcophagus , barth . dempsey . agone , baptiste brady , denotative . chalcocite . circe , extinguish effusive , bean . colonel . that'd , vigilant bergstrom , tangy . cuttlebone . beck , absentee gaithersburg , anaerobic . omission . draco , cancerous vacate , stayed . fed . nebulous , pram dentistry , midpoint . they've . pompeii , fitchburg1 mccoy , s's . gambit . colony , aperture seduction , minus . opium . so , hugo wok , behavioral . boom . tapestry !
, azimuthal absinthe , hoover . coccidiosis . luger , steeplebush busy , charta . bullhide . correct , twombly linebacker , delinquent . doppler . ewing , westfield breakwater , circumpolar . indy . judas , illimitable weave , ascription . custer . hibernia , comprise pagan , solstice . gilbert . baffle , cornell doolittle , algonquin . monarch . assess , narcosis blowfish , award . electress . ceramic , shrimp echinoderm , catholicism . criss . concern , coverlet d'oeuvre , abstention . dressy . calkins , surmise disdainful , circa . vivian . siberia , topeka manslaughter , pace . s's . bangor , halpern


I'm guessing that they put all those _WORD things to get by spam filters?
HEADER:
Microsoft Mail Internet Headers Version 2.0
Received: from woodensus.woodmaclaw.local ([10.1.1.11]) by mail.woodmaclaw.local with Microsoft SMTPSVC(5.0.2195.6713);
         Sat, 3 Apr 2004 20:51:06 -0500
Received: from localhost.localdomain ([10.1.1.8])
 by woodensus.woodmaclaw.local (SAVSMTP 3.1.0.29) with SMTP id M2004040320510520066
 for <spam at woodmaclaw.com>; Sat, 03 Apr 2004 20:51:05 -0500
Received: from 12-216-41-10.client.mchsi.com (12-216-41-10.client.mchsi.com [12.216.41.10])
        by localhost.localdomain (8.12.8/8.12.8) with SMTP id i341iIcU016535;
        Sat, 3 Apr 2004 20:44:19 -0500
X-Message-Info: TJcwkYYQ4vlsBPJfksNnt9NXBy3+QCjgcn132iZMWLBO
Received: from ptnwtne95.youpy.com ([192.32.177.209]) by ue86-rw832.youpy.com with Microsoft SMTPSVC(5.0.2195.6824);
         Sun, 04 Apr 2004 04:45:40 +0200
Received: from Britneyoax35g7t48t ([225.160.96.176]) by tlsd98.youpy.com
          (InterMail vM.5.01.06.05 221-146-361-746-161-995353288) with SMTP
          id <493434830.KT307.ytylld43566.youpy.com at cosgrovedo614cnq5u294t>
          for <mchandler at woodmaclaw.com>; Sun, 04 Apr 2004 07:50:40 +0500
Message-ID: <568mzc10tnn1843$70986438$fuw680fay0 at Britneym88xc3t9imc>
From: "Sebastian Glover" <wnrqcsebawu at hotbot.com>
To: <mchandler at woodmaclaw.com>
Subject: {Spam?} I thought you might like this
Date: Sun, 04 Apr 2004 06:45:40 +0400
MIME-Version: 1.0
Content-type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-WoodMacLaw-MailScanner-Information: Please contact the ISP for more information
X-WoodMacLaw-MailScanner: Found to be uninfected
X-WoodMacLaw-MailScanner-SpamCheck: spam, spamcop.net,
        SpamAssassin (score=8.745, required 6, BIZ_TLD 0.78,
        DNS_FROM_RFCI_DSN 1.39, HTML_40_50 0.47, HTML_MESSAGE 0.00,
        MIME_HTML_ONLY 0.10, RCVD_IN_BL_SPAMCOP_NET 2.25, RCVD_IN_DSBL 1.10,
        RCVD_IN_DYNABLOCK 2.55, RCVD_IN_SORBS 0.10)
X-WoodMacLaw-MailScanner-SpamScore: ssssssss
Return-Path: wnrqcsebawu at hotbot.com
X-OriginalArrivalTime: 04 Apr 2004 01:51:06.0067 (UTC) FILETIME=[4B0F9A30:01C419E7]





-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Kevin Spicer
Sent: Monday, April 05, 2004 4:55 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: /etc/mail/access weirdness

On Mon, 2004-04-05 at 22:43, Billy A. Pumphrey wrote:
> I have some email addresses disable in the /etc/mail/access file using
> this syntax:
> THE BAD::
> I have the spam mail forwarded to a spam mail box, and in about 4 days
> it has gotten 24 email addresses addressed to mchandler at woodmaclaw.com.
> Any ideas?
>
> I also have several more instances like this with other email addresses.

Maybe a spammer sending to several addresses at your site (in the
envelope) but only including one in the To: header.  I see spam mails
like that fairly regularly.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.