Subject:     Re: Fresh Spam...don't you just love the smell
Date:        7/8/98 21:54
To:          Scott Huffman, scooty2@webkorner.com

On 7/8/98 20:41, Scott Huffman sent the following ASCII stream:

>
>Chris,
>
>This one just came in.  I tried to login to their mail server, but it told 
>me they don't relay.  Bullshit.
>
>Scott

What I would do is relay a spam, then forward it back to them, along with a copy of their 
statement "we don't relay"

Let me see for myself:
>From used1@usedcomputer.cc Thu Jul 09 00:39:24 1998
Received: by mail.webkorner.com from localhost
    (router,SLMail V3.0); Thu, 09 Jul 1998 00:39:24 -0400
Received: by mail.webkorner.com from ramone.wwonline.com [209.82.60.3]
    (SLmail 3.0.2421 ()); Thu, 09 Jul 1998 00:39:24 -0400

>nslookup 209.82.60.3
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    ramone.wwonline.com
Address:  209.82.60.3
Relaying server tagged.

Received: from sat1 (slappy11.wwonline.com [209.82.60.156]) by ramone.wwonline.com (8.8.5/8.7.2) 
with SMTP id AAA27056; Thu, 9 Jul 1998 00:38:12 -0400 (EDT)
Date: Thu, 9 Jul 1998 00:38:12 -0400 (EDT)

>nslookup 209.82.60.156
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    slappy11.wwonline.com
Address:  209.82.60.156
Well, hot damn. They are right, they don't relay. Why? Inside attack. Spammer is on their 
network, using the LOCAL server for spamming.

From: used1@usedcomputer.cc

The following lines are CRAP injected by the spamware.

Received: from login_0246.whynot.net (mx.whynot.net[206.212.231.88]) by whynot.net (8.8.5/8.7.3) 
with SMTP id XAA06276 for sender422@whynot.net;  Wed, 8 July 1998 20:41:12 -0700 (EDT)
To: used1@usedcomputer.cc

End of crap. Well, sort of.

Subject: FREE CATALOG!
Reply-To: sample@whynot.net
X-PMFLAGS: 10322341.10
X-UIDL: 10293287_192832.222
Comments: Authenticated Sender is <user122@whynot.net>
Message-Id: <66336639_83717959>

There's your answer for that. Should we beleive the "no relaying" rule? Well:

>telnet 209.82.60.3 25
Trying 209.82.60.3...
Connected to ramone.wwonline.com.
Escape character is '^]'.
220 ramone.wwonline.com ESMTP Sendmail 8.8.5/8.7.2; Thu, 9 Jul 1998 01:00:06 -04
00 (EDT)
helo slappy11.wwonline.com
250 ramone.wwonline.com Hello home001.mediacity.com [205.216.172.6], pleased to
meet you
mail from:satan@hell.org
250 satan@hell.org... Sender ok
rcpt to:abuse@studio42.com
551 abuse@studio42.com... we do not relay
rcpt to:abuse@studio42.com@wwonline.com
551 abuse@studio42.com@wwonline.com... we do not relay
quit
221 ramone.wwonline.com closing connection
Connection closed by foreign host.

I'm satisfied they don't relay.

I have to limit our communications. Please email me when you need help only. I'm getting 
swamped. I had 4 spams so far today, and I feel like I'm LARTing more than I should. I'm 
also working on another web site right now and this is cuttiing into that. I don't mind 
corresponding with you, and in fact you're marked as one my my priority folks. We just 
need to limit this to stuff where you're getting stumped. You seem to have taken quickly 
to this stuff, which is great. If you wish, please visit the anti-spam web board, as that 
is a perfect place for this stuff:

http://www.studio42.com/kill-the-spam/
That's the home of my anti-spam site. I'd prefer you start there. Get interactive and enjoy 
the web board. I've also installed traceroute, whois and nslookup CGI's for the benefit of 
all. You'll get more help than you can handle, plus my regulars will quickly welcome you into 
our little board with open arms.