Sour Grapes

Strange email From: header

Headers and message of a message I received today, as displayed by claws-mail, except that I changed the ":" to "<colon>" so no one would accidentally click on the URI:

X-Claws-Bogosity: Spam, spamicity=1
Return-Path: <MAILER-DAEMON>
Received: from X177.bbn2-082.lipetsk.ru (X177.bbn2-082.lipetsk.ru [95.179.82.177] (may be forged))
by sdf.lonestar.org (8.14.7/8.14.5) with SMTP id s0AAtmic017717
for <hugh@freeshell.org>; Fri, 10 Jan 2014 10:55:50 GMT
Date: xRunnersPerQueue=20
Message-Id: <201401101055.s0AAtmic017717@sdf.lonestar.org>
Received: from unknown (HELO localhost) (andrew.fishman@richland.k12.la.us@170.240.165.94)
by 95.179.82.177 with ESMTPA; Thu, 9 Jan 2014 14:48:20 +0300
From: andrew.fishman@richland.k12.la.us
To: hugh@freeshell.org
Subject: Become the girls' first-rate lover

Improve your acting in bed http<colon>//attractive.pbphgwbr.in/

Over the last six months, I've received 113 SPAM message—and no non-spam—with this content in the Date: header. As the Received: headers show, this one was probably mailed yesterday and I received it today. What surprises me is that when I search the Web for the term "XRunnersPerQueue" I find nothing. Nil. Zip. Nada. Nihil. Maybe if someone else getting such spam gets curious, they'll find this post. If so, and they have some idea where these messages come from, whence XRunnersPerQueue is derived, or what it means, I hope they'll let me know.

Original post by Namenlosen Trinker at 1/10/2014 03:29:00 PM Eastern time :: 2 comment(s) ::

2 comment(s):

I've had the same issue for quite some time with that kind of Spam. I cannot figure out how to configure a Spam filter to automatically delete it, either. It was really bad for awhile, but now I just get a few a week. Let me know if you figure out a Spam filter for it. I use Pine for my MUA.

Thanks,
Catherine

Comment posted by Anonymous at 21 December, 2014 20:20

I don't remember what email client I was using at the time of the original post, but today I use Claws Mail and catch these messages by searching for any header containing the string "xRunnersPerQueue=20". I couldn't specify the "Date:" header because then the filter process wanted a date to look for. Currently I mark them as spam, which causes them to be moved to a spam folder, from which I periodically report them to various spam collectors.

To be exact, the Claws filter I use specifies Condition as "headers_part match \"xRunnersPerQueue=20\"" and Action as "mark_as_spam stop". I don't know Pine well enough to make a specific suggestion, but maybe the Claws filter I use will be of some help.

Comment posted by Namenlosen Trinker at 21 December, 2014 23:06