Who Are The Good Guys?

Thu May 15 00:58:37 UTC 1997

On Tue, 13 May 1997, David Stoddard wrote:

> 	of our engineers called them this afternoon, they said they were
> 	innocent because someone was using them as a relay -- nice try, but
> 	if they were a relay, we should not have seen any messages other
> 	than those destined for addresses on our network.  Instead, we got
> 	the entire spam feed.  They even went so far as to insert forged
> 	Received headers into the messages to try and throw us off.

Maybe in this case you were being sharked, but before we got everything
clamped down on our servers we saw a number of spammers who were
'multi-hopping' their UCE and including faking headers and sending false
HELO data.

The excerpt below from my archives shows them bouncing mail off our
server, to iea.com, and then to AOL.  The real originator was at rmii.com,
but they attempted to put in some semi-fake headers before that. 

I guess the moral of the story is "trust no one, and filter, filter,
filter..."  Sad, but true.

Ed
--------
Ed Landa
ComStar Communications Corp.
770-333-8779

----------------------- Headers --------------------------------
>From secretshopping at infinite.com  Thu Apr 17 05:22:57 1997
Return-Path: <secretshopping at infinite.com>
Received: from comtch.iea.com (comtch.iea.com [198.17.249.2])
	  by emin41.mail.aol.com (8.8.5/8.8.5/AOL-2.0.0)
	  with ESMTP id FAA02072;
	  Thu, 17 Apr 1997 05:22:55 -0400 (EDT)
From: secretshopping at infinite.com
Received: from matlock.comstar.net (matlock.comstar.net [207.15.208.2])
	by comtch.iea.com (8.8.5/8.8.5) with ESMTP id JAA19149;
	Thu, 17 Apr 1997 09:22:49 GMT
Received: from comstar.net (slip156.rmii.com [166.93.1.56]) by
matlock.comstar.net (8.8.5/8.7.1) with SMTP id FAA01899; Thu, 17 Apr 1997
05:22:46 -0400
Received: from You&I at infinite.com by infinite.com (8.8.5/8.6.5) with SMTP id
GAA08242 for <You&I at infinite.com>; Thu, 17 Apr 1997 01:22:10 -0600 (EST)
To: You&I at infinite.com
Message-ID: <1992077.777 at infinite.com>
Date: Thu, 17 Apr 97 01:22:10 EST
Subject: Why not make money shopping. . . instead of spending money!
X-PMFLAGS: 128 0
X-UIDL: 1234567891011121314151617181920mabcdefghijk
Comments: Authenticated sender is <powerinfo at infinite.com>