Spam Sender
c marx jr
abuse department?
Return-Path: <redancq3f...@netw.de>
Received: from h4.mail.home.com ([24.0.0.57]) by mail.rdc2.pa.home.com
(InterMail vM.4.01.02.17 201-229-119) with ESMTP
id
<20000430112259.MOSZ509...@h4.mail.home.com>
for <****.****.****.nj.home.com>;
Sun, 30 Apr 2000 04:22:59 -0700
Received: from mx4-w.mail.home.com (mx4-w.mail.home.com [24.0.0.54])
by h4.mail.home.com (8.9.3/8.9.0) with ESMTP id EAA09793;
Sun, 30 Apr 2000 04:22:54 -0700 (PDT)
From: redancq3f...@netw.de
Received: from fishtank.keyin.com ([198.165.237.2])
by mx4-w.mail.home.com (8.9.1/8.9.1) with SMTP id EAA03565;
Sun, 30 Apr 2000 04:22:51 -0700 (PDT)
Received: from digitex.net (unverified [63.249.254.12]) by
fishtank.keyin.com
(EMWAC SMTPRS 0.83) with SMTP id <B0001...@fishtank.keyin.com>;
Sun, 30 Apr 2000 08:50:27 -0230
Date: Sun, 30 Apr 2000 06:37:45
Subject: Special Report: Reach Thousands of Prospects Monthly
Message-ID: <jl0xuwe1u1cjsg...@digitex.net>
Content-Type: text/plain
_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/
* * M A K I N G M O N E Y * *
How To Reach Thousands Of Prospects Every Month And Make The
Difference Between Success & Failure In Your Online Business
O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order
is received before 2pm Pacific. 24hour fax service, just fax
to: 1-435-806-3011
To order, via credit card simply cut/paste and print out the
EZ ORDER FORM below and fax to our office today.
***** MILLIONS CD - Volume 10 *****
**** NOW ONLY $247! ****
This "Special Price" is in effect for the next 72 hours,
after that we go back to our regular price of $299.00 ...
Don't delay... you can be in business tomorrow!
We accept Visa, Mastercard, Amex and Checks by Fax.
Fax your order to: 1-435-806-3011
----------------------Cut & Paste----------------------
---------------------EZ Order Form---------------------
_____Yes! I want everything! I am ordering within 72 hours.
Include my FREE "Business On A CD" bonus along with your 10
Million Vol. 10 E-Mail address CD (plus 1,154,089 bonus addresses)
for the special price of only $247.00 + shipping as indicated
below.
_____Oop's I missed the 72 hour "special". I am ordering Vol. 10
at the regular price of $299.00 + shipping.
your check below and
fax it to our office along with the EZ Order Form to:
1-435-806-3011
**24 HOUR FAX SERVICES** PLEASE PASTE YOUR
CHECK HERE AND FAX IT TO US AT 1-435-806-3011
*****************************************************
If You fax a check, there is no need for you to mail the
original. We will prepare a one-time draft, with the exact
information on your original check. All checks will be
held for bank clearance. (7-10 days) Make payable to:
"JC-Marketing"
********************************************************
Do not reply to this message -
********************************************************
To register your e-mail address for removal from unsolicited
mailings, visit: http://www.OptList.com
*****************************
A!
>How do I find out where this spam below came from so I can complain to their
>abuse department?
Good, thorough primer at http://www.stopspam.org/email/headers/headers.html.
Follow the Received handoff chain downwards (back in time); other headers are
trivially forged:
>Received: from h4.mail.home.com ([24.0.0.57]) by mail.rdc2.pa.home.com
> (InterMail vM.4.01.02.17 201-229-119) with ESMTP
> id
><20000430112259.MOSZ509...@h4.mail.home.com>
> for <****.****.****.nj.home.com>;
> Sun, 30 Apr 2000 04:22:59 -0700
mail.rdc2.pa.home.com gets it from ([24.0.0.57]), which calls itself
h4.mail.home.com
>Received: from mx4-w.mail.home.com (mx4-w.mail.home.com [24.0.0.54])
> by h4.mail.home.com (8.9.3/8.9.0) with ESMTP id EAA09793;
> Sun, 30 Apr 2000 04:22:54 -0700 (PDT)
h4.mail.home.com gets it from (mx4-w.mail.home.com [24.0.0.54])
>Received: from fishtank.keyin.com ([198.165.237.2])
> by mx4-w.mail.home.com (8.9.1/8.9.1) with SMTP id EAA03565;
> Sun, 30 Apr 2000 04:22:51 -0700 (PDT)
mx4-w.mail.home.com gets it from ([198.165.237.2]), doesn't record rDNS,
records HELO as fishtank.keyin.com. Fishtank is probably an open relay; send
the postmaster at keyin.com a pointer to http://mail-abuse.org/tsi/.
>Received: from digitex.net (unverified [63.249.254.12]) by
>fishtank.keyin.com
> (EMWAC SMTPRS 0.83) with SMTP id <B0001...@fishtank.keyin.com>;
> Sun, 30 Apr 2000 08:50:27 -0230
fishtank.keyin.com gets it from 63.249.254.12, rDNS unverified, HELO
'digitex.net.' The spammer lied in the HELO.
$ whois -h whois.arin.net =63.249.254.12
C I Host (NETBLK-CIHOST2)
...
NS.CIHOST.COM 216.221.162.81
NS2.CIHOST.COM 216.221.162.111
$ whois -h whois.abuse.net cihost.com
ab...@cihost.com
.
>O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order
>is received before 2pm Pacific. 24hour fax service, just fax
>to: 1-435-806-3011
>
>To order, via credit card simply cut/paste and print out the
>EZ ORDER FORM below and fax to our office today.
>
>***** MILLIONS CD - Volume 10 *****
>
>**** NOW ONLY $247! ****
>
...
>Do not reply to this message -
Always good advice! Never reply to spammer's "remove" lists.
>To register your e-mail address for removal from unsolicited
>mailings, visit: http://www.OptList.com
$ traceroute www.OptList.com
traceroute: unknown host www.OptList.com
Optlist.com appears dead. Yeah!
A!