[Gllug] What's the point of content-less Spam?

[Chris Bell]

On Wed 28 Apr, Mamading Ceesay wrote:
> 

> 
> Hmm, I think I might start doing this as well.
> 

   The junk mail has not entirely stopped.

   I only rely on the data authenticated by Demon. A typical header might
include

> 
> Received: from [218.12.34.234] (helo=194.217.242.254)
>       by punt-3.mail.demon.net with smtp id 1AfSKl-0000rR-8Z
>       for chrisbell at overview.demon.co.uk; Sat, 10 Jan 2004 23:16:00 +0000
> Received: from [186.202.235.115] by 194.217.242.254 SMTP id i7ofP7yhlj9rav; Sun, 11 Jan 2004 00:10:33 +0100
> Message-ID: <9g3$-4o1k$aha4q2n08 at l9h.kzp.o6>
> From: "Maryanne Mcconnell" <djquldnj at yahoo.de>
> Reply-To: "Maryanne Mcconnell" <djquldnj at yahoo.de>
> To: chrisbell at overview.demon.co.uk
> Subject: Re: my new car for next rally eh  rvwb 
> Date: Sun, 11 Jan 04 00:10:33 GMT
> X-Mailer: Microsoft Outlook, Build 10.0.2616
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>       boundary="_DB66CAE_F77E"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-UIDL: ddG"!+X&!!4n1!!/#`"!
> Status: O  
> X-IS-UID: 1073770552
> 

or


> Received: from [64.179.76.31] (helo=host-64-179-76-31.buf.choiceone.net)
>       by punt-3.mail.demon.net with smtp id 1AfSCK-0007JI-Jt
>       for chrisbell at overview.demon.co.uk; Sat, 10 Jan 2004 23:07:16 +0000
> Received: from (HELO urce) [242.113.156.196] by host-64-179-76-31.buf.choiceone.net with SMTP; Sun, 11 Jan 2004 00:06:37 +0100
> Message-ID: <k452-n47j940297w$06$t4i at r7zzwes>
> From: "Adele Moon" <u468hppcxd at aol.com>
> Reply-To: "Adele Moon" <u468hppcxd at aol.com>
> To: chrisbell at overview.demon.co.uk
> Subject: If you cannot connect to my chat, try on ICQ  pwtenexsw tqhsdbghi
> Date: Sun, 11 Jan 04 00:06:37 GMT
> X-Mailer: QUALCOMM Windows Eudora Version 5.1
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>       boundary="..B3F5CA.1BEF"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-UIDL: *_M!!W-N"!CU\"!'(\!!
> Status: O  
> X-IS-UID: 1073770551 

where only the IP address enclosed in square brackets that has been
authenticated as it is received by Demon can be taken as genuine, so the
whois look-ups are done on  

[218.12.34.234]

and 


[64.179.76.31]
 
 
--  
Chris Bell 

-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug