Note the items highlighted in red. Having both the subject and To fields UTF-8 encoded is weird and unnecessary and popular spammers behavior. Also having the return-path and the From from different domains does it. Fails SPF which makes it look like it's a fake email address.Return-Path: <nobody@sun.imwebd.com>
Received: from sun.imwebd.com (thinkpads.com [67.214.227.38]) by <blahblahblah> with SMTP;
Wed, 27 Mar 2013 13:26:24 -0700
Received: from nobody by sun.imwebd.com with local (Exim 4.80)
(envelope-from <nobody@sun.imwebd.com>)
id 1UKwvE-0002Nx-QD
for <blahblahblah>; Wed, 27 Mar 2013 14:26:12 -0600
To: "=?UTF-8?B?QmlsbEc=?=" <blahblahblah>
Subject: =?UTF-8?B?TmV3IHByaXZhdGUgbWVzc2FnZSBoYXMgYXJyaXZlZA==?=
From: <bill@thinkpads.com>
Reply-To: <bill@thinkpads.com>
MIME-Version: 1.0
Message-ID: <c3ae45522022e219ba0f1bd86962c8ed@www.thinkpads.com>
Date: Wed, 27 Mar 2013 14:26:11 -0600
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PhpBB3
X-MimeOLE: phpBB3
X-phpBB-Origin: phpbb://forum.thinkpads.com
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sun.imwebd.com
X-AntiAbuse: Original Domain - <blahblahblah>
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - sun.imwebd.com
X-Get-Message-Sender-Via: sun.imwebd.com: uid via acl_c_vhost_owner from authenticated_id: nobody from /only user confirmed/virtual account not confirmed
X-SmarterMail-Spam: Commtouch 30 [value: Bulk], SPF_None, DK_None, DKIM_None
X-CTCH-RefId: str=0001.0A010206.51535612.0041,ss=3,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
X-SmarterMail-TotalSpamWeight: 30
All that adds up to a Commtouch spam score of 30 (15 is borderline). 30 is out of this world.



