Over the past few days, I’ve been getting a lot of this type of spam (read: spam where the subject of the message is the same as the first name of the sender). Just for grins I pulled apart the headers. My notes are in bold:
From – Wed Nov 15 17:58:49 2006
Pretty standard Mozilla Thunderbird inbound message headers
These spammers are faking the return-path…
Delivery-date: Wed, 15 Nov 2006 17:47:36 +0000
Received: from philpem.me.uk [18.104.22.168]
by localhost with POP3 (fetchmail-6.2.5)
for *******@localhost (single-drop); Wed, 15 Nov 2006 17:50:09 +0000 (GMT)
That’s the server handling my mail – executor.castlecore.com.
Received: from [22.214.171.124] (helo=dslb-082-083-236-169.pools.arcor-ip.net)
by executor.castlecore.com with esmtp (Exim 4.52)
for *******@philpem.me.uk; Wed, 15 Nov 2006 17:47:36 +0000
This suggests that the mail was sent through a spam zombie or open relay. My money’s on the former.
Received: from 126.96.36.199 (HELO gra2.brt.ebrd.com)
by philpem.me.uk with esmtp (;O>’.00>7’15 AQY0N)
for *******@philpem.me.uk; Wed, 15 Nov 2006 17:47:46 -0540
This is faked. It seems the spam mailer is doing a DNS lookup to find out what server MXes for ebrd.com. That just happens to be gra2.brt.ebrd.com. So the mailer/virus/RAT adds on this header to make it look like the zombie is relaying from a valid MX.
From: “Newton Abbott”
To: < *******@philpem.me.uk>
Like I said. Subject == FirstName. A few regexps and some extensions to HAMSTER should block this rubbish quite nicely.
Date: Wed, 15 Nov 2006 17:47:46 -0540
What the hell? Five hours and 40 minutes behind GMT?! I thought the International Time Zones worked in 30-minute increments…
1252 is Central Europe.
X-Priority: 3 (Normal)
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Faking M$ Outlook Express. Cute.
X-HAMSTER-Info: HAMster 0.0.1-beta1 (Atlanta) ($Rev$)
X-HAMSTER-Info: by Phil Pemberton
HAMSTER is my spam filter. HAMSTER is an acronym for ‘Highly Adaptable Mail Scanner for Tracking and Eliminating Rubbish’. It’s written in C using the PCRE libraries, and is blazingly fast on my Linksys NSLU2. I really do need to add support for MIME splitting and decoding though, then maybe some method of identifying and eliminating image spam…
So as you can see, there are at least two filters I’ll be adding to HAMSTER – the ‘weird time zone’ filter, and one to detect the ‘subject == firstname’ case. Hopefully that should improve the SNR of my email inbox a little…