Subject:     Re: FW: Email 57 Million People for $99
Date:        7/5/98 17:38
To:          Scott Huffman, scooty2@webkorner.com

On 7/5/98 16:26, Scott Huffman sent the following ASCII stream:

>Hi ya Chris,
>
>How's your Sunday going so far?  Well this is the 3rd e-mail that I've 
>received.  Your probably right that the spammers are jumping around the 
>net for mail servers.  I tried tracing this one down, but couldn't come up 
>with anything.  I was able to log in their mail server and send me an 
>e-mail, but couldn't do any better.
>
>Have you received this one?
>

Yes and no. I've gotten 5 to date, all available at:
http://www.studio42.com/kill-the-spam/1998/reports/firepower.html

Oh, I also tried doing a relay from ONE of their attacks, but have yet to see the test hit 
my mail server. I'm assuming it is bogged down relaying this idiot's spam.

I haven't yet received a spam relayed via the network you have received one from. Key word: 
yet.


Oh: thank you for sending the entire spam with complete headers. I'm more interested in 
the headers, but feel free to continue to do as you have been.

Note: I'm working on the assistance sections, finally.

>Scott Huffman
>
>
>>From cibu46@prodigy.com Sun Jul 05 20:09:56 1998
>Received: by mail.webkorner.com from localhost
>    (router,SLMail V3.0); Sun, 05 Jul 1998 20:09:56 -0400
>Received: by mail.webkorner.com from eti-nt.etec.uni-karlsruhe.de 
>[129.13.117.158]
>    (SLmail 3.0.2421 ()); Sun, 05 Jul 1998 20:09:55 -0400
>Received: from eti.etec.uni-karlsruhe.de (unverified [129.13.117.159]) by 
>eti-nt.etec.uni-karlsruhe.de
> (EMWAC SMTPRS 0.83) with SMTP id <B0000179245@eti-nt.etec.uni-karlsruhe.de>;
> Mon, 06 Jul 1998 02:09:17 +0200
>Received: from ETI1/SpoolDir by eti.etec.uni-karlsruhe.de (Mercury 1.32);
>    6 Jul 98 02:09:19 +100
>Received: from SpoolDir by ETI1 (Mercury 1.32); 6 Jul 98 02:08:54 +100
>Received: from Default (206.175.226.27) by eti.etec.uni-karlsruhe.de 
>(Mercury 1.32);
>    6 Jul 98 02:08:51 +100

Only header line worth anything:

>nslookup 206.175.226.27
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    sf-dnpqf-027.compuserve.net
Address:  206.175.226.27

Bad news. CompuServe. CompuServe hasn't grasped the concept of the internet running outside 
their operating hours, proving CompuServe has no valid place on the internet.

>To: cibu46@prodigy.com
>From: cibu46@prodigy.com
>Comments: Authenticated sender is <cibu46@prodigy.com>
>Subject: Email 57 Million People for $99
>Message-Id: <199807054276ZAA9088@pimaia4y.etec.uni-karlsruhe.de>
>Date: Sun, 05 Jul 1998 20:09:56 -0400

Unfortunately, most admins take the weekends off, even overseas. I wouldn't hold my breath 
until Monday. Wait, it's already Monday over there in Germany(don't ask why I know this). 
You should see something tomorrow morning if they are responsive.

UPDATE:
When searching through recently received spams, namely ones from Fire power, they have also 
hijacked Canadian and "il" domains. Not sure what IL is at the moment, not real concerned 
either, but I'm sure I'll be forced to learn it eventually.