lecardinal.de

I realized that a lot of Spammails use a faked sender in the form john.doe@lecardinal.de. I promise these Mail was not sent from this domain. You can simply proof where the Mail came from. Just watch into the header of the email. In most emailclients you have to adjust the view of the mail then you will see a header like this:

Received: from xxx.xxx.xxxxx.xxx ([xx.xx.x.xx]) by SERV_OWA_SMTP.MJS.local
     with Microsoft SMTPSVC(6.0.3790.1830);
     Thu, 19 Jul 2007 15:27:13 +0200
Received: from xxxxxxx.xxxxxxxx-xxxxxx.xxxx.xx (localhost [xxx.x.x.x])
     by xxx.xxx.xxxxxx.xxx (SMTP Server) with ESMTP id D77FD18458
     for <xxxxx.xxxxxxx@xxxxxxxx-xxxxxx.xxxx.xx>; Thu, 19 Jul 2007
     15:27:13 +0200 (CEST)
Received: from BANCO1 ([130.147.154.152]:24139 "EHLO BANCO1"
     smtp-auth: <none> TLS-CIPHER: <none> TLS-PEER-CN1: <none>)
     by host76-71-static.24-87-b.business.telecomitalia.it with ESMTP id
     S22VTVVSGSWNEQVE (ORCPT
     <rfc822;xxxxx.xxxxxxx@xxxxxxxx-xxxxxx.xxxx.xx@xxxx.xxx.xxxxx.xxx>);
Thu, 19 Jul 2007 15:27:50 +0200
Message-ID: <000c01c7ca08$85a6f8d0$4c471857@BANCO1>
From: "Arianne Nyakacska" <Nyakacskamsrxs@lecardinal.de>
To: xxxxx.xxxxxxx@xxxxxxxx-xxxxxx.xxxx.xx
Subject: Emailing: Rechenschaft.pdf
Date: Thu, 19 Jul 2007 15:27:15 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0008_01C7CA19.492FC8D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
X-mjsva-spamrating: 1.700000
X-mjsva-spam: not-spam
Return-Path: nyakacskamsrxs@lecardinal.de
X-OriginalArrivalTime: 19 Jul 2007 13:27:13.0856 (UTC)
FILETIME=[84B82C00:01C7CA08]

The example above is a Spammail. You can see several sections beginning with "Received: from ...". I have placed some Xs to anonymize the original reciepient.

So, how can you recognize if it is Spam or not? It's easy: All messages sent from domain lecardinal.de have one "Received:"-section containing the following string:

You can see the IP 64.33.63.70 which belongs to shadow.prohost.de and you can proof this on http://ip-lookup.net/.

All mails from the domain lecardinal.de are routed over shadow.prohost.de

So, if you see an IP like the one in the first example (130.147.154.152) check it with http://ip-lookup.net/ and you'll see where it came from. In the above case you'll find that the IP belongs to phillips.com and it's clear that Phillips® wont send Spammails but the Spammer could have used a compromised computer in the IP-Range of Phillips®. Sorry, Phillips, for this example.

Regards

LeCardinal