[SURBL-Discuss] Joe Wein has a new friend?

Joe Wein joewein at pobox.com
Mon Jul 25 09:18:38 CEST 2005



> FWIW Joe's getting jobbed:

Hi Jeff,

I had three joe jobs against me between December 2003 and February 2004.
Since then it had been quiet, but I must say I wasn't entirely surprized
that it continued, especially after a PayPal joe job less than two months
ago.

> Return-Path: <bouteille at kinki-kids.com>
> Received: from dbzmail.com ([61.85.57.209])
>         by smtp1.supranet.net (8.12.10/8.12.10) with SMTP id
j6P3ZTlx009677
>         for <x>; Sun, 24 Jul 2005 22:35:30 -0500 (CDT)
> Received: from kinki-kids.com (kinki-kids-com-bk.mr.outblaze.com
[64.62.181.92])
>         by dbzmail.com (Postfix) with ESMTP id E5A841602F
>         for <x>; Sun, 24 Jul 2005 00:39:14 -0500
> From: "Ambulance U. Descant" <bouteille at kinki-kids.com>

This seems to be a bulkmailer that inserts fake Outblaze references into the
headers to obscure the broadband hosts that are the real sources (or
proxies). I've seen other examples with other bogus Outblaze maildomains for
the fake sender. According to one admin who monitored the Joe job sources
from their site the hosts are running something called "DMS Revolution proxy
spam engine".

Joe

> To: Info <x>
> Subject: Hi dear
> Date: Sun, 24 Jul 2005 00:39:14 -0500
> Message-ID: <100101c59012$879febec$06412c2e at kinki-kids.com>
> MIME-Version: 1.0
> Content-Type: text/plain
> Content-Transfer-Encoding: 7bit
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook, Build 10.0.2605
> Importance: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123
> X-GMX-Antivirus: 0 (no virus found)
> X-UIDL: K,H!!c%?"!Fde!!XT9"!
>
> Hi
> Try jwSpamSpy, our spam filter for POP3 mailboxes.
> We use it to track spammers and scammers.
> Free full featured 30 day evaluation version available!
>
> http://www.joewein.de/
>
>
> --
> Don't harm innocent bystanders.
>
> _______________________________________________
> Discuss mailing list
> Discuss at lists.surbl.org
> http://lists.surbl.org/mailman/listinfo/discuss
>
>



More information about the Discuss mailing list