How are spam e-mails filtered ?
- by kevindqc
Hello.
I'm just wondering how some e-mails get past the spam filter, and some don't? Everyday I get World of Warcraft phishing emails that get past the filter...
For example, here's a phishing email (just the header) I got in my inbox, and not in my junk mail:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: n:0
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-Message-Info: M98loaK0Lo27IVRxloyPIZmAwUHKn18nx0o/idLdvGYjK48i19NuvFOnRFYGWE+HdIrNJpi1XaYx0gaAV13cgRnkWSzgHKG1
Received: from blizzard.com ([204.45.59.37]) by SNT0-MC3-F21.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 10 Apr 2010 06:38:24 -0700
Received: from hxeabjlh ([192.168.1.165])
(envelope-sender <[email protected]>)
by 192.168.1.111 with ESMTP
for <[email protected]>; Sat, 10 Apr 2010 08:43:24 -0500
Reply-To: <[email protected]>
Sender: [email protected]
Message-ID: <DE567AFB9E2F3DD985A2D9A8D12D2917@hxeabjlh>
From: "[email protected]" <[email protected]>
To: <[email protected]>
Subject: World of Warcraft Account Password verification
Date: Sat, 10 Apr 2010 21:38:10 +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_04EE_0137659E.1AA23350"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Return-Path: [email protected]
X-OriginalArrivalTime: 10 Apr 2010 13:38:24.0607 (UTC) FILETIME=[17F3A6F0:01CAD8B3]
From what I understand, when you send an email with SMTP, you can specify any hostname in the "HELO" command. Here, the spammer specified "blizzard.com". And he sent his email through Hotmail using Outlook Express.
I just don't understand how this gets past the spam filter?
There's this SPF thing that seems to exist... but it doesn't seem to be used by blizzard?
I'm on Windows, and if I use nslookup to look for the TXT records of blizzard.com and worldofwarcraft.com, I don't see a thing.... so blizzard is not using SPF? Why would that be?
