Spam from nobody@localhost.localdomain

[Wassercrats]

I thought it would be easier to find information about spam that comes from "nobody@localhost" but I just found one article yesterday. It sounded like the spam I received came from an exploit on FutureQuest and I need to contact FutureQuest, but I'm not sure. I've been reporting these to Ebay, and they respond with a form letter confirming it's a spoof email. Is that all I should be doing?Return-Path: <nobody@localhost.localdomain>
Delivered-To: barry --a-t-- polisource.com
Received: (fqmail 20558 invoked from network); 02 Oct 2005 23:13:11 -0000
Received: from mx07.futurequest.net (mx07.futurequest.net [69.5.6.178])
by pt01.futurequest.net ([69.5.6.170])
with FQDP via TCP; 02 Oct 2005 23:13:11 -0000
Received: (qmail 17104 invoked from network); 2 Oct 2005 23:13:11 -0000
Received: from localhost.localdomain ([61.100.108.205])
by mx07.futurequest.net ([69.5.6.178])
with ESMTP via TCP; 02 Oct 2005 23:13:10 -0000
Received: from localhost.localdomain (websmw [127.0.0.1])
by localhost.localdomain (8.13.1/8.13.1) with ESMTP id j938GF0F024948
for <barry --a-t-- polisource.com>; Mon, 3 Oct 2005 17:16:15 +0900
Received: (from nobody@localhost)
by localhost.localdomain (8.13.1/8.13.1/Submit) id j938GE7Z024946;
Mon, 3 Oct 2005 17:16:14 +0900
Date: Mon, 3 Oct 2005 17:16:14 +0900
Message-Id: <200510030816.j938GE7Z024946@localhost.localdomain>
To: barry --a-t-- polisource.com
Subject: Message from eBay Member Regarding Item #6434823351
From: customer@eBay.com
Reply-to: customer@eBay.com
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-Priority: 1
X-Spam-Checker-Version: SpamAssassin 3.0.4-gr0 (2005-06-05) by QuestScan
on Sun, 02 Oct 2005 19:13:15 -0400
X-Spam-Level: *****
X-Spam-Status: No, score=5.1 required=5.5 tests=FORGED_MUA_OUTLOOK,
FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_FONT_BIG,HTML_MESSAG E,
HTML_MIME_NO_HTML_TAG,HTML_TAG_EXIST_TBODY,MIME_HTML_ONLY,
NO_REAL_NAME,X_PRIORITY_HIGH autolearn=disabled version=3.0.4-gr0
X-Antivirus: AVG for E-mail 7.0.344 [267.11.6]
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=======AVGMAIL-4342FDB91189======="

[Arthur]

When reading and interpreting email headers, you should always start at the top (those are the headers you know you can trust) and work your way down.
The first 5 lines are normal and were generated by FutureQuest's servers. Then you come to this line;
Received: from localhost.localdomain ([61.100.108.205]) by mx07.futurequest.net ([69.5.6.178])

That is where it entered FutureQuest's network. The bit between the brackets, [61.100.108.205], was generated by MX07 based on the IP address of the incoming connection, the localhost.localdomain bit was how the remote computer actually identified itself (using HELO or EHLO).

The rest of the headers were generated by a server/servers outside our network and can't be trusted.

So, in short, the spam originated from 61.100.108.205, which is an IP address from Korea.

-Arthur

[Wassercrats]

Ok, so there's nothing local about the localhost part. I'll just keep reporting them to ebay. Thanks.