Strange spam-type emails.

[Matilda]

I've been getting a lot of emails – between six and eight yesterday and today - that have no subject matter, no sender's address, and no recipient listed. I can recognise them instantly, because they just have "1KB" in the size column, and nothing else at all. There was nothing written there when I opened one to check what it might be.

I've tried to send them to the spam folder, but the next time one comes in, it stays in the Inbox, so they're not really spam. I've tried using the blocking device in the Message icon in Outlook Express, but that won't work either, I imagine because the sender's address is hidden.

Has anyone ever seen anything like this, and do you know what to do about it? It's really stupid and annoying, because I have to take the time to delete them from what is a business email address. Any advice on how to deal with them would be appreciated.

[ChromeFoundry]

1. If you want to block them...

a lot will depend on your email provider's available options (hotmail, gmail, etc)

You should be able to get a lot more information about the sender by looking at the SMTP header.. Outlook like to hide that from you.

For blocking at the client... It depends on the version of Outlook, you should be able to select the message in the Inbox, then press Alt+Enter to bring up the message properties. You'll find a section that displays the raw Header information. You should be able to find enough information about the messages (IP Address, sender Address, etc) to add a rule to block the messages for further infiltrating your inbox.

[Matilda]

2. I confess I'm technologically illiterate,

and most of what I've learned about operating a computer has been through trial and error.

The messages are marked Sender: Unspecified; Recipient: None; Subject: nothing.

Somebody is doing this deliberately and it's frustrating not to be able to block them. I'll try what you said, but I did try going to the "Message" option at the top of my email, and clicking on "Block Sender", but it couldn't read anything. Neither does my Cloudmark spam filter block it. I have Outlook Express, and I'm on Windows XP 2003, and Internet Explorer 7. I have a separate Gmail account which has nothing to do with work, and it isn't affected.

Will your suggestion work with this version of Outlook Express?

[Matilda]

3. Okay, I was able to open the message and find the source

(which is a lot of gobbledegook to me), but there isn't any way I can block it, because the toolbar at the top of
the page is hidden while the message is open.

How should I proceed once I've sourced it? I saved it in my Inbox instead of deleting it.

[ChromeFoundry]

4. Look at the header fields...

find the first line beginning with "From:"...

Check if the line contains any form of email address.

If no email address, you will probably want to create a Filter Rule to send all messages that do not have an "@" character in the "From:" field to the "Trash" folder.

If it does contain an email address, block the sender, or the entire domain message originated from.

[Matilda]

5. Thank you so much for your patience with me!

I'm so clueless about things like this.

What I've done is copy everything that appeared in Properties, and perhaps it may make sense to you. I'm completely
unable to block it through Outlook Express or Cloudmark, and I'm not sure how to create a filter. Could you look
at it and tell me if there's anything I can do, because I'm still getting multiple emails through every day.

Received: (qmail 32285 invoked from network); 6 Jul 2011 17:41:16 +1000
Received: from ipmail04.adl6.internode.on.net (150.101.137.141)
by mail001.web24.net.au with SMTP; 6 Jul 2011 17:41:16 +1000
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhgCAKE7EU47p+89/2dsb2JhbAAMRoJRnRWHKa50ni6GNgSifg
Received: from ppp239-61.static.internode.on.net (HELO <192.168.1.3>) (<59.167.239.61>)
by ipmail04.adl6.internode.on.net with ESMTP; 04 Jul 2011 13:45:22 +0930
User-Agent: Microsoft-Entourage/12.30.0.110427
Date: Mon, 04 Jul 2011 14:15:20 +1000

[ChromeFoundry]

6. According to this header

I do not see how this could even be delivered to your email account. There is no To: field to route the message.

The 59.167.239.61 address is owned by an Australian ISP.
the 150.101.137.141 address is owned by the same company: Internode - internode.com.au

I would check your filter rules to see if you can add a filter to send any message that does not contain an '@' character in the From: address, to the Trash folder. Since this message has no From: field, the rule should send it to Trash.

[Matilda]

7. It's certainly the weirdest thing I've ever seen.

The lack of a "from" field is what's been preventing me from blocking it either through my spam filter or via the
email toolbar.

Where do I find out about the filter rules?

[Matilda]

8. I found what to do to set up a filter.

This person is very cunning, because it's easier if there is a subject listed, but it also allows for certain words
being used, so I copied in the first line of the info that's available, and ordered the filter to delete it.

I can only wait and see whether any more of these arrive.

Thanks for the help; I'll let you know if this works.

[ManiacJoe]

9. Not sure if what you did is going to work.

Can you be a lot more verbose about what you put into the filter text?

[Matilda]

10. You're right; it didn't work.

I just copied the first line of the email as it appears above, because I thought that probably contained the only clue about where it came from, but clearly it wasn't enough, because this morning I got six more just like it, that came in over the weekend.

Should I try copying the whole message into the filter? Or is there something else I can do?

[ManiacJoe]

11. Unfortunately, Outlook Express has limited filtering abilities.

Outlook is not much better.

Based on the header you included way up, you could try putting "Received: from ipmail04.adl6.internode.on.net" in the filter. This assumes that "web24" is your mail provider and that they have no relationship with "internode". This filter would have the effect of acting on all email (good and bad) coming from that one email server.

If you want to do some really good filtering, I recommend Mailwasher Pro:
http://www.firetrust.com/en/products/mailwasher-pro