|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Who Are The Good Guys?
On Tue, 13 May 1997, David Stoddard wrote: > of our engineers called them this afternoon, they said they were > innocent because someone was using them as a relay -- nice try, but > if they were a relay, we should not have seen any messages other > than those destined for addresses on our network. Instead, we got > the entire spam feed. They even went so far as to insert forged > Received headers into the messages to try and throw us off. Maybe in this case you were being sharked, but before we got everything clamped down on our servers we saw a number of spammers who were 'multi-hopping' their UCE and including faking headers and sending false HELO data. The excerpt below from my archives shows them bouncing mail off our server, to iea.com, and then to AOL. The real originator was at rmii.com, but they attempted to put in some semi-fake headers before that. I guess the moral of the story is "trust no one, and filter, filter, filter..." Sad, but true. Ed -------- Ed Landa ComStar Communications Corp. 770-333-8779 ----------------------- Headers -------------------------------- >From [email protected] Thu Apr 17 05:22:57 1997 Return-Path: <[email protected]> Received: from comtch.iea.com (comtch.iea.com [198.17.249.2]) by emin41.mail.aol.com (8.8.5/8.8.5/AOL-2.0.0) with ESMTP id FAA02072; Thu, 17 Apr 1997 05:22:55 -0400 (EDT) From: [email protected] Received: from matlock.comstar.net (matlock.comstar.net [207.15.208.2]) by comtch.iea.com (8.8.5/8.8.5) with ESMTP id JAA19149; Thu, 17 Apr 1997 09:22:49 GMT Received: from comstar.net (slip156.rmii.com [166.93.1.56]) by matlock.comstar.net (8.8.5/8.7.1) with SMTP id FAA01899; Thu, 17 Apr 1997 05:22:46 -0400 Received: from You&[email protected] by infinite.com (8.8.5/8.6.5) with SMTP id GAA08242 for <You&[email protected]>; Thu, 17 Apr 1997 01:22:10 -0600 (EST) To: You&[email protected] Message-ID: <[email protected]> Date: Thu, 17 Apr 97 01:22:10 EST Subject: Why not make money shopping. . . instead of spending money! X-PMFLAGS: 128 0 X-UIDL: 1234567891011121314151617181920mabcdefghijk Comments: Authenticated sender is <[email protected]> - - - - - - - - - - - - - - - - -
|