FWIW Joe's getting jobbed:
Hi Jeff,
I had three joe jobs against me between December 2003 and February 2004. Since then it had been quiet, but I must say I wasn't entirely surprized that it continued, especially after a PayPal joe job less than two months ago.
Return-Path: bouteille@kinki-kids.com Received: from dbzmail.com ([61.85.57.209]) by smtp1.supranet.net (8.12.10/8.12.10) with SMTP id
j6P3ZTlx009677
for <x>; Sun, 24 Jul 2005 22:35:30 -0500 (CDT)Received: from kinki-kids.com (kinki-kids-com-bk.mr.outblaze.com
[64.62.181.92])
by dbzmail.com (Postfix) with ESMTP id E5A841602F for <x>; Sun, 24 Jul 2005 00:39:14 -0500From: "Ambulance U. Descant" bouteille@kinki-kids.com
This seems to be a bulkmailer that inserts fake Outblaze references into the headers to obscure the broadband hosts that are the real sources (or proxies). I've seen other examples with other bogus Outblaze maildomains for the fake sender. According to one admin who monitored the Joe job sources from their site the hosts are running something called "DMS Revolution proxy spam engine".
Joe
To: Info <x> Subject: Hi dear Date: Sun, 24 Jul 2005 00:39:14 -0500 Message-ID: 100101c59012$879febec$06412c2e@kinki-kids.com MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2605 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123 X-GMX-Antivirus: 0 (no virus found) X-UIDL: K,H!!c%?"!Fde!!XT9"!
Hi Try jwSpamSpy, our spam filter for POP3 mailboxes. We use it to track spammers and scammers. Free full featured 30 day evaluation version available!
-- Don't harm innocent bystanders.
Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss