Seemingly unscanned mail weirdness...

[Peter Bates]

Hello all (obviously not the birthday boy, of course :) ...)

Had a rash of spammy stuff today from 'x at tom.com', where
x is the usual sort of randomly generated stuff.
I've now resorted to address verification for this domain, but was
still intrigued by one email passed to me from a member of staff...

We're running MS 4.25, SA 2.61, with Postfix (2-something or other)...

According to our MUA (Novell GroupWise is where the mail eventually
ends up), the entire content of the message is:

Return-path: <crhfcdirahaei at tom.com>
Received: from postbox.lshtm.ac.uk
        (mailgw.lshtm.ac.uk [193.63.251.36])
        by s-nst5.lshtm.ac.uk; Fri, 16 Jan 2004 17:24:18 +0000
Received: from customer-148-233-202-142.uninet.net.mx
(customer-148-233-202-142.uninet.net.mx [148.233.202.142])
        by postbox.lshtm.ac.uk (Postfix) with SMTP id 2D901156066
        for <brian.furner at lshtm.ac.uk>; Fri, 16 Jan 2004 17:23:57 +0000
(GMT)
Received: from [148.233.202.142] by 3001hosting.comIP with HTTP;
        Fri, 16 Jan 2004 12:14:27 +0600
From: postmaster at lshtm.ac.uk
Message-Id: <20040116172357.2D901156066 at postbox.lshtm.ac.uk>
Date: Fri, 16 Jan 2004 17:23:57 +0000 (GMT)
To: undisclosed-recipients:;


crhfcdirahaei at tom.com


... what I'm curious about is the total lack of any MailScanner mention
here, and this should have definitely passed through (in fact, there
isn't really a mechanism whereby it doesn't pass through MS).

Is our MUA not reporting the entire content here, or is the 'To:
undisclosed-recipients:;' being used in a tricksy fashion?

...



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838