Christopher Clements <bcnjr5@gmail.com> writes: > On Sun, Mar 05, 2017 at 12:42:50PM +1100, Ben Finney wrote: >>Christopher Clements <bcnjr5@gmail.com> writes: >> >>> On Sat, Mar 04, 2017 at 03:36:58PM +1100, Ben Finney wrote: >>> >I think the best explanation is that the entire message ??? complaint and >>> >quoted part ??? were composed and sent by the spammer themselves. >>> >>> Oh, the "original" message is seperate, I just replied to a reply. >> >>That doesn't contradict my explanation; I think both messages are >>composed by the spammer. > > Sorry about that, I misread you and thought that you thought that there > was only one message. > > On closer examination, I think you are correct in saying that the > replies are written by the spammer as well. On closer examination of what? The headers of the mail you're apparently complaining about look pretty genuinely like the mail really did come from gmail, so are you suggesting that 'The Illuminati <trainjohnson87@gmail.com>' is the spammer? That looks like a genuine person -- I cannot imagine a spammer creating supporting evidence for a spamming account. e.g.: https://twitter.com/trainjohnson87 Note that that twitter account appears to belong to someone called Anthony, which matches the salutation in the Spam that he then replied to. The level of maturity shown in his reply appears to be in line with someone that is obsessed with minecraft. > Perhaps they simply want to waste space in archives? > Not much of a motive/goal, but I get the feeling that the perpetrator > doesn't have much of a life to start with. It seems very plain to me that the spammers are recycling headers from our list mail on the basis that gmail's anti-spam will have learned that as HAM, and are so are more likely to let that pass through. That then provokes a small fraction of the victims to shout at us, because they don't know ho to read headers. That is what you are seeing. If anyone knows people that fight spam at gmail, I suppose that they might want to treat listmail that comes from an unusual IP address with great suspicion, but I don't think this is in any way limited to gmail. I guess we could help the mail servers of the recipients of the initial messages make that decision if we did SPF for debian.org, but I guess that the lack of SPF probably indicates that this is very hard to do with our distributed setup. Cheers, Phil. -- |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd. |-| http://www.hands.com/ http://ftp.uk.debian.org/ |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY
Attachment:
signature.asc
Description: PGP signature