Subject:     Re: FW: WORRIED ABOUT HIS OR HER BACKGROUND??
Date:        7/8/98 20:12
To:          Scott Huffman, scooty2@webkorner.com

On 7/8/98 15:23, Scott Huffman sent the following ASCII stream:

>Chris,
>
>Here's one I'm working on.  I traced the route back to compustupid.com as 
>origination of the e-mail and networldtron.net as the relaying 
>mail-server.  Am I on track?  However, I'm unable to log into the 
>mailserver via telnet.  Any suggestions?
>

Let me check into that. I got one of these too. Are you attempting to hit the mail server 
via port 25, or using port 23?(normal). Also, which server?

>How are things?  Do you still have too much time on your hands like me? :)

I haven't had much spare time in months. I get to work a full 10 hours a day, and in between 
fight spam and do other web sites. Average of a 20 hour day.

>
>Scott
>

>>From kida75@msn.com Wed Jul 08 18:29:13 1998
>Received: by mail.webkorner.com from localhost
>    (router,SLMail V3.0); Wed, 08 Jul 1998 18:29:13 -0400
>Received: by mail.webkorner.com from www.networldtron.net [207.243.145.1]
>    (SLmail 3.0.2421 ()); Wed, 08 Jul 1998 18:29:13 -0400

Is this the server you're attemptng to get into?

>nslookup 207.243.145.1
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    nwtdns1.networldtron.net
Address:  207.243.145.1

>telnet 207.243.145.1 25
Trying 207.243.145.1...
Connected to nwtdns1.networldtron.net.
Escape character is '^]'.
220 www.networldtron.net ESMTP Sendmail 8.8.8/8.8.8; Wed, 8 Jul 1998 23:00:26 -0
400 (EDT)
HELO satan.org
250 www.networldtron.net Hello home001.mediacity.com [205.216.172.6], pleased to
 meet you
quit
221 www.networldtron.net closing connection
Connection closed by foreign host.

Telnet wasn't much of a problem. Let's try the other one.

>Received: from flacare (hd72-033.hil.compuserve.com [199.174.252.33])
>	by www.networldtron.net (8.8.8/8.8.8) with SMTP id SAA20272;

A spamware operator?

>telnet 199.174.252.33 25
Trying 199.174.252.33...
telnet: Unable to connect to remote host: No route to host

Spammer currently gone. Most spamware will not accept incoming SMTP connections anyways.


>	Wed, 8 Jul 1998 18:18:49 -0400 (EDT)
>Date: Wed, 8 Jul 1998 18:18:49 -0400 (EDT)
>From: kida75@msn.com
>To: kida75@msn.com
>Comments: Authenticated sender is <kida75@msn.com>
>Errors-To: BUCMICHAEL@hotmail.com
>Subject: WORRIED ABOUT HIS OR HER BACKGROUND??
>Message-Id: 
><199807083331SAA45520@19980613143246296.aaa401@sql1.networldtron.net>

You definately got this one nailed right on the head. Worldtron use for relaying with a 
CompuServe spammer. LART away, hopefully networldtron.net will do something about this!