I got a curious email that looks to be normal spoofing (email sent TO the same person in the FROM)
However, the header indicates it was whitelisted through Declude because it appears to be local mail and IP address of 0.0.0.0
Trying to figure out how an alias account can actually send email in the first place. Here is the header with names redacted:
Return-Path: <ALIAS@domain.org>
Received: from bl7-250-156.dsl.telepac.pt (bl7-250-156.dsl.telepac.pt) by mymailserver.com with SMTP;
Tue, 24 Mar 2015 05:58:23 -0400
From: < ALIAS@domain.org >
To: < ALIAS@domain.org >
Subject: SPAM-LOW: Hello
Date: 24 Mar 2015 08:32:46 -0100
Message-ID: <001901d06618$04e4cf10$197f90ac$@domain.org>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0016_01D06618.04E1D7AD"
X-Mailer: Microsoft Outlook 14.0
Thread-Index: Acu7jqh0v6g796q5u7jqh0v6g796q5==
Content-Language: en
X-MessageSniffer-Identifier: C:\SmarterMail\Spool\proc\work\38440822.eml
X-GBUdb-Analysis: Unknown
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-4487-c
X-Declude-Sender: ALIAS@domain.org [0.0.0.0]
X-Declude-Spoolname: 38440822.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.12.05 "http://www.declude.com/x-note.htm"
X-Declude-Scan: Incoming Score [0] at 05:58:28 on 24 Mar 2015
X-Declude-Tests: Whitelisted
X-Country-Chain:
X-Declude-Code: e
X-HELO: bl7-250-156.dsl.telepac.pt
X-Identity: 0.0.0.0 | (Private IP) | domain.org
X-SmarterMail-Spam: Reverse DNS Lookup, DK_None, Declude: 0
X-SmarterMail-TotalSpamWeight: 10
Any ideas on how this happens?
Thanks