Re: Who Are The Good Guys?

[Ed Landa <elanda () comstar net>]

On Tue, 13 May 1997, David Stoddard wrote:

>       of our engineers called them this afternoon, they said they were
>       innocent because someone was using them as a relay -- nice try, but
>       if they were a relay, we should not have seen any messages other
>       than those destined for addresses on our network.  Instead, we got
>       the entire spam feed.  They even went so far as to insert forged
>       Received headers into the messages to try and throw us off.

Maybe in this case you were being sharked, but before we got everything
clamped down on our servers we saw a number of spammers who were
'multi-hopping' their UCE and including faking headers and sending false
HELO data.

The excerpt below from my archives shows them bouncing mail off our
server, to iea.com, and then to AOL.  The real originator was at rmii.com,
but they attempted to put in some semi-fake headers before that. 

I guess the moral of the story is "trust no one, and filter, filter,
filter..."  Sad, but true.

Ed
--------
Ed Landa
ComStar Communications Corp.
770-333-8779

----------------------- Headers --------------------------------
> From secretshopping () infinite com  Thu Apr 17 05:22:57 1997
Return-Path: <secretshopping () infinite com>
Received: from comtch.iea.com (comtch.iea.com [198.17.249.2])
          by emin41.mail.aol.com (8.8.5/8.8.5/AOL-2.0.0)
          with ESMTP id FAA02072;
          Thu, 17 Apr 1997 05:22:55 -0400 (EDT)
From: secretshopping () infinite com
Received: from matlock.comstar.net (matlock.comstar.net [207.15.208.2])
        by comtch.iea.com (8.8.5/8.8.5) with ESMTP id JAA19149;
        Thu, 17 Apr 1997 09:22:49 GMT
Received: from comstar.net (slip156.rmii.com [166.93.1.56]) by
matlock.comstar.net (8.8.5/8.7.1) with SMTP id FAA01899; Thu, 17 Apr 1997
05:22:46 -0400
Received: from You&I () infinite com by infinite.com (8.8.5/8.6.5) with SMTP id
GAA08242 for <You&I () infinite com>; Thu, 17 Apr 1997 01:22:10 -0600 (EST)
To: You&I () infinite com
Message-ID: <1992077.777 () infinite com>
Date: Thu, 17 Apr 97 01:22:10 EST
Subject: Why not make money shopping. . . instead of spending money!
X-PMFLAGS: 128 0
X-UIDL: 1234567891011121314151617181920mabcdefghijk
Comments: Authenticated sender is <powerinfo () infinite com>

- - - - - - - - - - - - - - - - -