[SURBL-Discuss] Job Recruiter SPAMmers

Kevin A. McGrail kmcgrail at pccc.com
Wed May 25 13:05:55 CEST 2005


> So do they use zombies or fixed IPs to send from?

Without researching, I would guess that they are legitimate business using
their own resources or salespeople and do unethical solicitations.

What would you say from headers like this?

Received: from twm2005-dev.thoughtworthy.com ([10.10.10.31]) by
dev.thoughtworthy.com over TLS secured channel with Microsoft
SMTPSVC(6.0.3790.1830);
  Tue, 24 May 2005 17:21:13 -0400
Received: from sales (sales.anthemtechnologies.com [65.213.110.30])
 by twm2005-dev.thoughtworthy.com (8.13.4/8.13.4) with SMTP id
j4OLKKfc024063
 for <jobs at thoughtworthy.com>; Tue, 24 May 2005 17:20:26 -0400
x-esmtp: 0 0 1
Message-ID: <1956350-220055224202319526 at sales>
Errors-to: errors at anthemtechnologies.com
Reply-To: "Shailaja" <shailaja at anthemtechnologies.com>
From: "Shailaja" <staffingservices at anthemtechnologies.com>
To: jobs at thoughtworthy.com
Subject: Excellent Sr. Java certified with WSAD and .Net with BizTalk
consultants available for your consulting projects
Date: Tue, 24 May 2005 13:23:19 -0700
MIME-Version: 1.0
Content-Type: multipart/related;
 boundary="----=_NextPart_1956311245812426938202319526"
X-Spam-Status: No, hits=2.0 required=6.5
 tests=AWL,BAYES_00,EXCUSE_3,FB_REM_CAPS,HTML_MESSAGE,
       J_CHICKENPOX_31,J_CHICKENPOX_33,J_CHICKENPOX_36,
       J_CHICKENPOX_37,J_CHICKENPOX_43,J_CHICKENPOX_48,
       J_CHICKENPOX_73,MAILTO_SUBJ_REMOVE,MAILTO_TO_REMOVE,
       MIME_BOUND_NEXTPART,MIME_QP_LONG_LINE,OACYS_SINGLE,
       RM_rb_ANCHOR,RM_rb_BODY,RM_rb_BREAK,RM_rb_FONT,RM_rb_HTML,
       RM_rb_TITLE,RM_sl_LeadChar
 version=3.0.2
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 3.000002 (2004-11-16)
X-Scanned-By: MIMEDefang 2.51 on 10.10.10.31
Return-Path: staffingservices at anthemtechnologies.com
X-OriginalArrivalTime: 24 May 2005 21:21:13.0623 (UTC)
FILETIME=[8374BA70:01C560A6]


Regards,
KAM



More information about the Discuss mailing list