strange email from myself!

Gill Terry

unread,

Jul 13, 2002, 3:26:01 PM7/13/02

to

This evening I received an email, apparently from myself (gill@picture-
house.demon.co.uk) entitled "My pics".

There was no text, but just an attachment of 4k. I have pasted the
headers below. Please could somebody tell me if this is just a benign
piece of rubbish, or is there something to worry about? (Needless to
say, I didn't send it.)

Received: from pop3.demon.co.uk by picture-house.demon.co.uk with POP3
id <"picture-house.1026575440:10:10873:122".picture-
ho...@pop3.demon.co.uk>
for <pictur...@pop3.demon.co.uk> ; Sat, 13 Jul 2002 20:13:39 +0100
Return-Path: <gi...@picture-house.demon.co.uk>
Received: from punt-1.mail.demon.net by mailstore
for gi...@picture-house.demon.co.uk id 1026575440:10:10873:122;
Sat, 13 Jul 2002 15:50:40 GMT
Received: from [202.85.159.99] ([202.85.159.99]) by punt-
1.mail.demon.net
id aa1103837; 13 Jul 2002 15:50 GMT
Subject: RE: My pics
Received: from picture-house.demon.co.uk by 66CK1R706FYP.picture-
house.demon.co.uk with SMTP for gi...@picture-house.demon.co.uk; Sat, 13
Jul 2002 11:53:53 -0500
From: gi...@picture-house.demon.co.uk
MIME-Version: 1.0
Message-Id: <903X4OH50X8NY60U...@picture-house.demon.co.uk>
Reply-To: gi...@picture-house.demon.co.uk
Importance: Normal
X-Sender: gi...@picture-house.demon.co.uk
X-Encoding: MIME
Date: Sat, 13 Jul 2002 11:53:53 -0500
X-Priority: 3
To: gi...@picture-house.demon.co.uk
Content-Transfer-Encoding: Quoted-Printable
Content-Type: multipart/alternative; boundary="----
=_NextPart_73_41233644421"
--
Gill Terry
Use the Reply To: address.
Do not send anything to the From: address

Kevin Reilly

unread,

Jul 13, 2002, 5:03:20 PM7/13/02

to

On Sat, 13 Jul 2002 Gill Terry wrote:

>Received: from [202.85.159.99] ([202.85.159.99]) by punt-
>1.mail.demon.net
> id aa1103837; 13 Jul 2002 15:50 GMT

That's the key line (anything after Subject: being suspect). WHOIS details
for that IP reveal the following:

Search results for '202.85.159.99'
inetnum 202.85.159.98 - 202.85.159.99
netname GLOBALSPEEDNETWORKLIMITED-HK
descr GLOBAL SPEED NETWORK LIMITED
country HK
admin-c WK113-AP,
tech-c DI16-AP,
mnt-by MAINT-HK-IS,
changed hostm...@iadvantage.net.hk 20020514
source APNIC

person Woo Kai Hin Kelvin,
address RM 908A, 9/F,
address Kin Tak Fung, Ind. Bldg.
address 174 Wai Yip St.
address Kwun Tong, Kowloon
country HK
phone +852-81012528
fax-no +852-23941493
e-mail kel...@hkspeed.com,
nic-hdl WK113-AP,
mnt-by MAINT-HK-IS,
changed hostm...@iadvantage.net.hk 20020204
source APNIC

So the true source is a system, possibly running an open mail relay, in
Hong Kong. It's spam, and the chances of getting anything useful from an
abuse report are unfortunately minimal. If you want to follow it up I
guess kel...@hkspeed.com is the chap to start with.

(When I first did the look-up I mis-typed the first digit as 205 and got
the Department Of Defense's Space And Naval Weapons Research Division. Now
if you were being spammed by them that would be worth investigating!)

--
Kev
__________________________________________________________________________
"It was as if a small ten-megaton bomb had gone off."
Simon Bates

Ian Blakeley

unread,

Jul 13, 2002, 5:17:26 PM7/13/02

to

Gill Terry <sp...@picture-house.demon.co.uk> collected a few stray
electrons and created:

>
>
>This evening I received an email, apparently from myself (gill@picture-
>house.demon.co.uk) entitled "My pics".
>

Strange. I got one as well, albeit with slightly different headers.

>There was no text, but just an attachment of 4k. I have pasted the
>headers below. Please could somebody tell me if this is just a benign
>piece of rubbish, or is there something to worry about? (Needless to
>say, I didn't send it.)
>
>

[....]

Gill Terry

unread,

Jul 13, 2002, 5:23:21 PM7/13/02

to

In article <Z4Yh$qDYWJ...@denali.org.uk>, Kevin Reilly
<use...@denali.org.uk> writes

>
>So the true source is a system, possibly running an open mail relay, in
>Hong Kong. It's spam, and the chances of getting anything useful from an
>abuse report are unfortunately minimal. If you want to follow it up I
>guess kel...@hkspeed.com is the chap to start with.
>

Thanks for this, Kevin.
Just to double-check: there's no suggestion here that _my_ system is at
fault at all, is there? (Not running an open relay myself or anything?)

Cheers,

Gill

David Bolt

unread,

Jul 14, 2002, 1:32:52 AM7/14/02

to

On Sat, 13 Jul 2002, Kevin Reilly <use...@denali.org.uk> wrote:-

>On Sat, 13 Jul 2002 Gill Terry wrote:
>
>>Received: from [202.85.159.99] ([202.85.159.99]) by punt-
>>1.mail.demon.net
>> id aa1103837; 13 Jul 2002 15:50 GMT
>
>That's the key line (anything after Subject: being suspect). WHOIS details
>for that IP reveal the following:
>
> Search results for '202.85.159.99'
> inetnum 202.85.159.98 - 202.85.159.99

> changed hostm...@iadvantage.net.hk 20020514

> e-mail kel...@hkspeed.com,

>So the true source is a system, possibly running an open mail relay, in
>Hong Kong.

You're right about that being the true source, but it's an open proxy
rather than an open relay.

>It's spam, and the chances of getting anything useful from an
>abuse report are unfortunately minimal. If you want to follow it up I
>guess kel...@hkspeed.com is the chap to start with.

Personally, I'd skip them and go upstream to "ab...@iadvantage.net" and
"ab...@iadvantage.net.hk" letting them know that the system is an open
proxy, not that doing so would help.

Quite often it appears that abuse reports sent to most providers in that
region end up in the bit bucket, sometimes with auto-ignore bots mailing
out a typical boilerplate. However, some providers do take action, so it
may be an idea to send a complaint.

Regards,
David Bolt

--
A3010 4Mb, A4000 4Mb RiscOS 3.11 |Member of the RC5 Team Acorn
AMD Duron/900 512Mb WinXP |cracking keys at 14.8Mkeys/sec
AMD Duron/1100 32Mb SuSE 7.3 |
AMD Duron/950 64Mb SuSE 7.0 |http://www.distributed.net/
Intel Celeron/400 64Mb SuSE 7.3

David Bolt

unread,

Jul 14, 2002, 1:42:05 AM7/14/02

to

On Sat, 13 Jul 2002, Gill Terry <sp...@picture-house.demon.co.uk> wrote:-

<snip>

>Thanks for this, Kevin.
>Just to double-check: there's no suggestion here that _my_ system is at
>fault at all, is there?

No. If you'd sent the mail the received header would have looked
something like this:

Received: from picture-house.demon.co.uk (picture-house.demon.co.uk [158.152.4.215]) by punt-1.mail.demon.net

id aa1103837; 13 Jul 2002 15:50 GMT

>(Not running an open relay myself or anything?)

Turnpike doesn't relay so most unlikely. You can always do a test to
find out by using the relay tester at:

<URL:telnet://relay-test.mail-abuse.org/>

John Underwood

unread,

Jul 13, 2002, 7:12:43 PM7/13/02

to

On Sat, 13 Jul 2002 at 22:23:21, Gill Terry wrote in
demon.ip.support.turnpike
(Reference: <mtuk0QAJ...@picture-house.demon.co.uk>)

>Just to double-check: there's no suggestion here that _my_ system is at
>fault at all, is there? (Not running an open relay myself or anything?)

You use Turnpike and, if I remember from earlier correspondence, you use
it exclusively. If so you are not running an open relay.
--
John Underwood
The Reply-To: address will remain in use for at least 30 days, you may write to
me using jo...@theunderwoods.org.uk. NB this is a positive change. Mail to the
From: address may be rejected or a complaint raised about it as UCE/Spam.

Gordon Hodgson

unread,

Jul 14, 2002, 9:39:04 AM7/14/02

to

In message <+nGv0fAJ...@picture-house.demon.co.uk>, Gill Terry
<sp...@picture-house.demon.co.uk> writes

>
>
>This evening I received an email, apparently from myself (gill@picture-
>house.demon.co.uk) entitled "My pics".
>
>There was no text, but just an attachment of 4k. I have pasted the
>headers below. Please could somebody tell me if this is just a benign
>piece of rubbish, or is there something to worry about? (Needless to
>say, I didn't send it.)

What was the attachment? A lot of viruses have been doing address
spoofing.
--
Gordon Hodgson
thatboyneedstherapy

news(at)popculture(dot)demon(dot)co(uk)