On 21/10/05, Erik Moeller erik_moeller@gmx.de wrote:
Rowan Collins:
On 21/10/05, erik_moeller@gmx.de erik_moeller@gmx.de wrote:
This message was not sent by me, but by host213-186.pool8173.interbusiness.it, as the headers show. It uses a forged From: line. It is, in fact, the W32/Netsky.AN worm or a variation thereof, which uses subject lines like "Re: hi" and body text like "why should I?".
D'oh! Should have thought of that. Damn spoofable protocols. And damn non-human e-mails. And, obviously, damn worms [and their writers].
Out of interest, I thought there was an SPF filter running on the mailing list server; the only "Received-SPF" header I can see seems to be comparing against the line "Sender:wikitech-l-bounces@..." and succeeding. Is it just obscuring the previous one?
Anyway, sorry.
-- Rowan Collins BSc [IMSoP]