[Wylug-help] Help needed with trying to identify spammer

Tue Nov 8 19:22:52 UTC 2011

I can't believe how slow you guys are.
1st reply after 9 minutes, 2nd reply after 11 minutes.
Many THANKS...

Here is the email that the complaing is about:

Details of the reported abuse:
===========================
Return-Path: <root at blackvelvet.gvl99.co.uk>
Received: from mtain-db01.r1000.mx.aol.com (mtain-db01.r1000.mx.aol.com
[172.29.64.85])
by imd-mb06.r1000.mx.aol.com (Inbound Mail Deferral) with ESMTP id
3AB2370345765
for <redacted at aim.com>; Mon, 7 Nov 2011 23:07:00 -0500 (EST)
Received: from blackvelvet.gvl99.co.uk (mail.gvl99.co.uk [88.97.199.145])
by mtain-db01.r1000.mx.aol.com (Internet Inbound) with ESMTP id
2941D38000086
for <redacted at netscape.net>; Mon, 7 Nov 2011 23:06:59 -0500 (EST)
Received: from blackvelvet.gvl99.co.uk (redvelvet.gvl99.co.uk [127.0.0.1])
by blackvelvet.gvl99.co.uk (8.13.8/8.13.8) with ESMTP id pA846u08016305
for <redacted at netscape.net>; Tue, 8 Nov 2011 04:06:56 GMT
Received: (from root at localhost)
by blackvelvet.gvl99.co.uk (8.13.8/8.13.8/Submit) id pA846tJw016304;
Tue, 8 Nov 2011 04:06:55 GMT
Date: Tue, 8 Nov 2011 04:06:55 GMT
Message-Id: <201111080406.pA846tJw016304 at blackvelvet.gvl99.co.uk>
From: =?utf-8?Q?=E2=98=85?= Julie Loblick =?utf-8?Q?=E2=98=85?=
<julie_loblick at julie-loblick.info>
To: redacted at netscape.net
Subject: This is Julie. I'm back in town. SHALL WE MEET?
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_0c448a95e82cdc96df49e11bacc9743a"
x-aol-global-disposition: G
X-AOL-SCOLL-SCORE: 1:2:101240896:93952408
X-AOL-SCOLL-URL_COUNT: 2
x-aol-sid: 3039ac1d40554eb8aae32b98
X-AOL-IP: 88.97.199.145
X-AOL-SPF: domain : blackvelvet.gvl99.co.uk SPF : none
I am back in town. Remember me? http://www.julie-loblick.info/

--------------------------------------------------------------------
Visit http://www.julie-loblick.info/createprofile.html to create your 
online profile hosted by us.
Visit ht<html><head></head><body>
<DIV style=3D"FONT-FAMILY: 'Tahoma'; color:#000000; FONT-SIZE: 13pt">
I am back in town. Remember me?<br>
<a href=3D"http://www.julie-loblick.info/">http://www.julie-loblick.info/</=
a>
<br><br><br><br><DIV style=3D"FON

Hope somebody can make sense of this.
I must admit. I'm struggling.

John C

At 19:03 08/11/2011 +0000, you wrote:
>Hi Guys...
>
>I have been notified that a spammer is sending mail through my server.
>I need help in finding out how this is happening.
>
>John C
>
>
>=================================================
>
>   Check out our British Country Music Web Sites
>
>         http://www.countrymusic.org.uk
>         http://www.bcmi-radio.co.uk
>
>   Over 300,000 visitors a week
>
>=================================================
>
>
>_______________________________________________
>Wylug-help mailing list
>Wylug-help at wylug.org.uk
>https://mailman.lug.org.uk/mailman/listinfo/wylug-help

=================================================

   Check out our British Country Music Web Sites

         http://www.countrymusic.org.uk
         http://www.bcmi-radio.co.uk

   Over 300,000 visitors a week

=================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.lug.org.uk/pipermail/wylug-help/attachments/20111108/d33f6038/attachment.htm>