New subject: Spam via Wikimedia lists (Fwd: is it you? cortney here)

16 Mar 2008

I just received the email below as spam via
wikimania-l(a)lists.wikimedia.org. However the email is clearly not sent
via the mailing list as it is lacking the footer and subject and also
am I not subscribed to that lists. It does however appear to be sent
via the Wikimedia mail servers:

Received-SPF: pass (google.com: best guess record for domain of
mailman-bounces(a)lists.wikimedia.org designates 91.198.174.5 as
permitted sender) client-ip=91.198.174.5;
Authentication-Results: mx.google.com; spf=pass (google.com: best
guess record for domain of mailman-bounces(a)lists.wikimedia.org
designates 91.198.174.5 as permitted sender)
smtp.mail=mailman-bounces(a)lists.wikimedia.org
Received: from localhost ([127.0.0.1]:60535 helo=lily.knams.wikimedia.org)
	by lily.knams.wikimedia.org with esmtp (Exim 4.63)
	(envelope-from &lt;mailman-bounces(a)lists.wikimedia.org&gt;)
	id 1JaubS-00049V-RN; Sun, 16 Mar 2008 15:16:52 +0000
Received: from [88.228.143.104] (port=1611 helo=localhost)
	by lily.knams.wikimedia.org with smtp (Exim 4.63)
	(envelope-from &lt;kvbzdlz(a)rentalsite.net&gt;)
	id 1JaubB-0003xM-JV; Sun, 16 Mar 2008 15:16:47 +0000
Message-Id: <3199094_@TLZ8679880_@TLZ>
Date: Sun, 16 Mar 2008 08:15:53 -0800
X-Mailer: Talisma Mail Version 5.0
X-Mobile: Nokia 3D
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: wikimania-l(a)lists.wikimedia.org
From: "cortney" &lt;kvbzdlz(a)rentalsite.net&gt;
Original-recipient: rfc822;wikimania-l(a)lists.wikimedia.org
Subject: is it you? cortney here
X-Antivirus: avast! (VPS 080313-0, 13.03.2008), Outbound message
X-Antivirus-Status: Clean
Sender: mailman-bounces(a)lists.wikimedia.org
Errors-To: mailman-bounces(a)lists.wikimedia.org
X-Spam-Score: 9.0 (+++++++++)
X-Spam-Report: Spam detection software, running on the system
"lily.knams.wikimedia.org", has
	identified this incoming email as possible spam. If you have any
	questions, see the administrator of that system for details.
	Content analysis details:   (9.0 points, 5.0 required)
	pts rule name              description
	---- ---------------------- --------------------------------------------------
	2.9 FROM_LOCAL_NOVOWEL     From: localpart has series of non-vowel letters
	1.9 MSGID_MULTIPLE_AT      Message-ID contains multiple '@' characters
	-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
	-0.0 SPF_PASS               SPF: sender matches SPF record
	3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
	[score: 1.0000]
	1.4 DNS_FROM_RFC_WHOIS     RBL: Envelope sender in whois.rfc-ignorant.org
	-0.7 AWL                    AWL: From: address is in the auto white-list

Are the Wikimedia mail servers being used as open relay, or am I
missing something in the headers?

Bryan

---------- Forwarded message ----------
From: cortney &lt;kvbzdlz(a)rentalsite.net&gt;
Date: Sun, Mar 16, 2008 at 5:15 PM
Subject: is it you? cortney here
To: wikimania-l(a)lists.wikimedia.org

 Hi

 My name is cortney. I found your email on that dating site.
 I also love sex on the side. I have a loving partner but he is
working 16 hours a day and we have sex only once a week :(
 If you are interested and wanna see my pictures just email me at
ccortney268(a)golovable.com
 Don`t reply, use the email above (my boyfriend doesn`t know about that email!)