Hello,

I have received email from spammer pretending to come from Red Hat. I include
the message source so someone can check the origin. It would be nice if there
is a mail that address spam and phising issue.

--
Luya Tshimbalanga
Fedora Project contributor

----------


Return-Path: <seosecrets2@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on ns2.i-mecca.net
X-Spam-Level: **
X-Spam-Status: No, score=2.3 required=3.0 tests=HTML_MESSAGE,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DNSWL_MED,URIBL_BLA CK,URIBL_OB_SURBL
autolearn=no version=3.2.3
X-Original-To: luya_tfz@ns2.i-mecca.net
Delivered-To: luya_tfz@ns2.i-mecca.net
Received: from localhost (ns2 [127.0.0.1])
by ns2.i-mecca.net (Postfix) with ESMTP id 7D77B720C7E
for <luya_tfz@ns2.i-mecca.net>; Thu, 8 May 2008 12:46:53 -0400 (EDT)
Received: from ns2.i-mecca.net ([127.0.0.1])
by localhost (ns2.i-mecca.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id nvLDUlIHjI9R for <luya_tfz@ns2.i-mecca.net>;
Thu, 8 May 2008 12:46:53 -0400 (EDT)
Received: from mx1.util.phx.redhat.com (mx1-phx.redhat.com [209.132.177.92])
by ns2.i-mecca.net (Postfix) with ESMTP id C2538720C04
for <luya_tfz@thefinalzone.net>; Thu, 8 May 2008 12:46:52 -0400 (EDT)
Received: from bastion.fedora.phx.redhat.com (bastion.fedora.phx.redhat.com
[10.8.34.50])
by mx1.util.phx.redhat.com (8.13.1/8.13.1) with ESMTP id m48GkrTj020023
for <luya_tfz@thefinalzone.net>; Thu, 8 May 2008 12:46:53 -0400
Received: from mx1.util.phx.redhat.com (mx1.util.phx.redhat.com [10.8.4.92])
by bastion.fedora.phx.redhat.com (8.13.8/8.13.8) with ESMTP id m48H4GqE001544
for <luya@fedoraproject.org>; Thu, 8 May 2008 17:04:16 GMT
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254])
by mx1.util.phx.redhat.com (8.13.1/8.13.1) with ESMTP id m48Gkj28020013
for <luya@fedoraproject.org>; Thu, 8 May 2008 12:46:47 -0400
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m48Gkj9w032463
for <luya@fedoraproject.org>; Thu, 8 May 2008 12:46:45 -0400
Received: from gmail.com ([125.211.197.209])
by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id m48GkUGU007885
for <luya@fedoraproject.org>; Thu, 8 May 2008 12:46:32 -0400
Reply-To: seosecrets2@gmail.com
From: Top.SEO.Secrets@redhat.com
To: luya@fedoraproject.org
Subject: 1000s Of Hits From Google, Yahoo, MSN And Others At $0 Cost To You !
Date: 09 May 2008 00:46:29 +0800
Message-ID: <20080509004629.357205F0CAF66DB5@from.header.has.n o.domain>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_0127425C.17C52513"
X-RedHat-NoPTR: 125.211.197.209 has sent a message and has no valid PTR record
X-RedHat-Spam-Warning: 6.763 (******)
AWL,FH_FROMEML_NOTLD,HTML_MESSAGE,RCVD_IN_BL_SPAMC OP_NET,RDNS_NONE,URIBL_BLACK,URIBL_OB_SURBL
X-RedHat-Spam-Score: 6.763 ******
X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254
X-Scanned-By: MIMEDefang 2.63 on 172.16.48.31


This is a multi-part message in MIME format.

------=_NextPart_000_0012_0127425C.17C52513
Content-Type: text/plain
Content-Transfer-Encoding: 8bit


As incredible as it may sound you're about to discover a system how you

can drive 1000s of potential customers to any website or affiliate website
at $0 cost to you!What if I told you that I'm making thousands of dollars
each week and I'm not paying a
dime for advertising ?

Google, Yahoo, MSN and others are sending me hundreds of new customers
every week
- at $0 cost! Make Money On Auto-Pilot While You're Sleeping Or Even On
Vacation?
STOP Everything You Are Doing and Read This Now!

This works for any product, website or affiliate website!

FOR FULL DETAILS PLEASE READ THE ATTACHED .HTML FILE











To Unsubscribe
Please read the attached .txt file
------=_NextPart_000_0012_0127425C.17C52513
Content-Type: text/html; name="full_details.htm"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="full_details.htm"

PGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5Mb2FkaW5nIHBhZ2UuLi 48L3RpdGxlPg0KPG1ldGEg
aHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMjtVUkw9aH R0cDovL2FkdmVydGlzZWJ6
LmNvbSI+DQo8c2NyaXB0Pg0KdXJsPSdodHRwOi8vYWR2ZXJ0aX NlYnouY29tJzsNCmlmKGRv
Y3VtZW50LmltYWdlcykgeyB0b3AubG9jYXRpb24ucmVwbGFjZS h1cmwpOyB9DQplbHNlIHsg
dG9wLmxvY2F0aW9uLmhyZWY9aHR0cDovL2FkdmVydGlzZWJ6Lm NvbTsgfQ0KPC9zY3JpcHQ+
DQo8L2hlYWQ+DQo8Ym9keT5Mb2FkaW5nDQo8YSBocmVmPWh0dH A6Ly9hZHZlcnRpc2Viei5j
b20+cGFnZTwvYT4uLi4NCjwvYm9keT4NCjwvaHRtbD4NCg==

------=_NextPart_000_0012_0127425C.17C52513
Content-Type: text/plain; name="Unsubscribe email.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Unsubscribe email.txt"

aHR0cDovL3d3dy5yZW1vdmVtYXN0ZXIuY29t

------=_NextPart_000_0012_0127425C.17C52513--

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Thu, May 8, 2008 at 5:59 PM, Luya Tshimbalanga
<luya@fedoraproject.org> wrote:
> Hello,
>
> I have received email from spammer pretending to come from Red Hat. I include
> the message source so someone can check the origin. It would be nice if there
> is a mail that address spam and phising issue.

This came to your fedoraproject.org address, and was thus handled by
Red Hat. No news here, move on . You can use abuse@ pretty much
any domain and it should reach a person.

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Quoting Jon Stanley <jonstanley@gmail.com>:

> This came to your fedoraproject.org address, and was thus handled by
> Red Hat. No news here, move on . You can use abuse@ pretty much
> any domain and it should reach a person.

Good to know. Thanks

--
Luya Tshimbalanga
Fedora Project contributor
http://www.fedoraproject.org/wiki/LuyaTshimbalanga

Written from XO laptop

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Thu, 2008-05-08 at 18:07 -0400, Jon Stanley wrote:
> On Thu, May 8, 2008 at 5:59 PM, Luya Tshimbalanga
> <luya@fedoraproject.org> wrote:
> > Hello,
> >
> > I have received email from spammer pretending to come from Red Hat. I include
> > the message source so someone can check the origin. It would be nice if there
> > is a mail that address spam and phising issue.
>
> This came to your fedoraproject.org address, and was thus handled by
> Red Hat. No news here, move on . You can use abuse@ pretty much
> any domain and it should reach a person.

I don't think the spammer was pretending to come from Red Hat. I'm
fairly sure that '@redhat.com' you see in the From: address was added by
Red Hat's machines -- the original just said 'From: Top.SEO.Secrets'.

The Red Hat machines probably should have rejected the RFC2822-invalid
mail, but instead they accepted it and even qualified the address
'Top.SEO.Secrets', rewriting it to appear 'Top.SEO.Secrets@redhat.com'.
And then sent it on to you, since it was sent to your @fedoraproject.org
address.

--
dwmw2

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Thu, 2008-05-08 at 17:59 -0400, Luya Tshimbalanga wrote:
> Hello,
>
> I have received email from spammer pretending to come from Red Hat. I include
> the message source so someone can check the origin. It would be nice if there
> is a mail that address spam and phising issue.
>
> --
> Luya Tshimbalanga
> Fedora Project contributor
>

BTW. I've got this mail too and evolution shows only Top SEO Secrets in
the Form field. I think it's because it didn't come through redhat,
because I received it on my gmail account (and into the Spam folder).
The message header is totally crap, I wonder how came that redhat
mailers resend it to you...

Martin


Message header:

Delivered-To: martin.sourada@gmail.com
Received: by 10.141.146.9 with SMTP id y9cs30569rvn; Thu, 8 May 2008
12:15:40 -0700 (PDT)
Received: by 10.114.103.1 with SMTP id a1mr3424005wac.190.1210274140503;
Thu, 08 May 2008 12:15:40 -0700 (PDT)
Return-Path: <seosecrets2@gmail.com>
Received: from gmail.com ([125.211.197.209]) by mx.google.com with ESMTP
id
j21si8034447wah.6.2008.05.08.12.15.36; Thu, 08 May 2008 12:15:40
-0700 (PDT)
Received-SPF: neutral (google.com: 125.211.197.209 is neither permitted
nor
denied by domain of seosecrets2@gmail.com)
client-ip=125.211.197.209;
Authentication-Results: mx.google.com; spf=neutral (google.com:
125.211.197.209 is neither permitted nor denied by domain of
seosecrets2@gmail.com) smtp.mail=seosecrets2@gmail.com
Reply-To: seosecrets2@gmail.com
To: martin.sourada@gmail.com
Subject: 1000s Of Hits From Google, Yahoo, MSN And Others At $0 Cost To
You
!
Date: 09 May 2008 03:15:35 +0800
Message-ID: <20080509031535.EBACFD50FABCF620@from.header.has.n o.domain>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_B37D026D.8238B6D5"
X-Evolution-Source: imap://martin.sourada%
40gmail.com@imap.gmail.com:993/
From:

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list