systemnotes org Location: System Notes / notes / security / Live Spam example

Help for Aspiring Sysadmins

Linux / Open Source / Howto / Tips & Tricks

Language: en
 






Latest News

2009.07.29
RHCE Flash Cards Released

2008.01.11
Website Design Updated. This is a work in progress...

2008.01.11
RHCE Study Guide Removed due to a potential copyright issue

2007.12.03
RHCE Study Guide Released

 

Links:


Do you find this site useful?

donate








Spread Firefox Affiliate Button

Documents


Real Spam with full headers

If someone wants to take the time to trace spammers, here is some mail to go through. Actual “to” address has been changed to me@mydomain.com. Everything else is live data.

April 2003


X-Apparently-To: me@mydomain.com via 66.218.79.82; 16 Apr 2003 17:53:27 -0700 (PDT) 
X-YahooFilteredBulk: 200.13.207.55 
Return-Path: <ursula26nsp@gte.net> 
Received: from 200.13.207.55 (EHLO sanfrancisco.celam.org) (200.13.207.55) by mta149.mail.scd.
yahoo.com with SMTP; 16 Apr 2003 17:53:24 -0700 (PDT) 
Received: from smtp0361.mail.yahoo.com ([195.146.212.215]) by sanfrancisco.celam.org with Microsoft 
SMTPSVC(5.0.2195.2966); Wed, 16 Apr 2003 16:28:17 -0500 
Date: Wed, 16 Apr 2003 21:36:16 GMT 
From: "chuck" <ursula26nsp@gte.net> | This is not spam | Add to Address Book 
X-Priority: 3 
To: me@mydomain.com 
Subject: systemnotes, Receive $2,000 daily returning phone calls. 
Mime-Version: 1.0 
Content-Type: text/plain; charset=us-ascii 
Content-Transfer-Encoding: 7bit 
Return-Path: ursula26nsp@gte.net 
Message-ID: <SANFRANCISCOIBWEayK00019693@sanfrancisco.celam.org> 
X-OriginalArrivalTime: 16 Apr 2003 21:28:25.0306 (UTC) FILETIME=[1D1893A0:01C3045F] 
Content-Length: 483 

Your email: me@mydomain.com

How would you like to receive $5,000 to $10,000 
cash every week starting immediately?

All you have to do is return calls from home -
to people who have asked to be called -no selling.

Please call 618-355-1776

I will personally call you back, and take no more than
Two minutes of your time.

To be removed from future mailings, send to 32pat32@excite.com and you 
will be removed. Do not use the toll free number, or you will not be 
removed

Analysis

This one appears to have sent from a company in Bogota, Colombia 
WHOIS Search Results

  WHOIS Record for  

celam.org Back-order this name   

Registrant:
Colomsat S.A. (CELAM-DOM)
   Calle 80 No 9 - 66
   Bogota
   cu,123
   co

   Domain Name: CELAM.ORG

   Administrative Contact, Technical Contact:
      Aparicio, Jason  (JA1060)        japarici@COLOMSAT.NET.CO
      Colomsat S.A.
      Calle 80 No 9 - 66
      BOGOTA
      CO
      (571) 312 7288

   Record expires on 20-May-2003.
   Record created on 19-May-1997.
   Database last updated on 17-Apr-2003 16:50:46 EDT.

   Domain servers in listed order:

   TRAUCO.COLOMSAT.NET.CO       200.13.195.2
   OLAFO.COLOMSAT.NET.CO        200.13.197.2