Return-Path: Received: from imap.bigfoot.com (imap.bigfoot.com [208.134.165.9]) by island.ethz.ch (8.10.1/8.10.1) with ESMTP id eB526251215688 for ; Tue, 5 Dec 2000 03:06:03 +0100 (MET) Received: from maverick ([192.168.1.230]) by imap.bigfoot.com (8.9.3/8.9.3) with SMTP id VAA25694 for ; Mon, 4 Dec 2000 21:06:06 -0500 (EST) Message-ID: <200012050206.VAA25694@imap.bigfoot.com> X-Sender: williamgull@imap.bigfoot.com (Unverified) X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0 Date: Mon, 04 Dec 2000 20:44:03 -0500 To: Neil Franklin From: William Gull Subject: Not a Bigfoot address (was Re: Spam,was Hi There!) In-Reply-To: <200011221837.TAA00621@chonsp.franklin.ch> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Status: RO X-Status: X-Keywords: X-Mozilla-Status: 8001 X-Mozilla-Status2: 00000000 At 07:37 PM 11/22/00 +0100, you wrote: >One of your users is spamming > >Shut down their mail box > >----- forwarded spam >Mail-from: From markzmizz@bigfoot.com Wed Nov 22 19:11:14 2000 >Return-Path: >Received: from localhost (localhost [127.0.0.1]) > by chonsp.franklin.ch (8.9.3/19991231-neil@franklin.ch) with ESMTP id TAA00513 > for ; Wed, 22 Nov 2000 19:11:13 +0100 >From: markzmizz@bigfoot.com >Received: from localhost > by localhost with POP3 (fetchmail-5.1.2) > for neil@localhost (single-drop); Wed, 22 Nov 2000 19:11:14 +0100 (MET) >Received: from nice.ethz.ch (root@nice.ethz.ch [129.132.134.85]) > by island.ethz.ch (8.10.1/8.10.1) with ESMTP id eAMFEDW876791 > for ; Wed, 22 Nov 2000 16:14:13 +0100 (MET) >Received: from ns.realhost.co.kr (root@[210.109.204.230]) > by nice.ethz.ch (8.8.7/8.8.7) with ESMTP id QAA12342 > for ; Wed, 22 Nov 2000 16:14:02 +0100 (MET) >Received: from 210.109.204.230 (adsl-63-193-188-8.dsl.bkfd14.pacbell.net [63.193.188.8]) > by ns.realhost.co.kr (8.9.3/8.8.7) with SMTP id AAA26305 > for ; Thu, 23 Nov 2000 00:14:13 +0900 >Message-Id: <200011221514.AAA26305@ns.realhost.co.kr> >To: neil.franklin@Nice.CH >Date: Tue, 21 Nov 00 22:35:03 EST >Subject: Hi There! > >Hi There! > >I thought I would drop you a quick note and let you know that >there is an exciting and very profitable SELF-RUN online >business which is exploding in 2000. > >This is the EASIEST and the HOTTEST online business today! >Voted as #1 online business in a major business magazine! >Company of the month twice in another major publication! > >Please check out my website below for more details: > >http://205.134.171.164/members/inetx/ > >It takes only 30 seconds to find out. You will be glad that you did! > >Thank you and have a nice day!......Brian >----- > >-- >Neil Franklin, neil@franklin.ch.remove http://neil.franklin.ch/ >Nerd, Geek, Hacker, Unix Guru, Sysadmin, Roleplayer, LARPer, Mystic > Thank you for bringing this unfortunate circumstance to our attention. We have investigated your complaint, and have concluded that, despite the fact that a Bigfoot address was specified as the "From" or "Reply-To" address of this message, the message was not sent from our Bigfoot mail server. You can verify this by looking at the headers of the original message -- the domain from which many of the messages were actually sent appears there. We have absolutely no record of the Bigfoot address that they are using, and we are going on the assumption that the headers were forged. Unfortunately, apart from contacting the ISPs involved, there is not much more we can do. If you would like to pursue this matter further (which we encourage you to do), the best approach may be to send a copy of the original message to the postmaster of the domain from which it originated (and you may already have done so). If the problem persists, please let us know so that we can look into further actions we might take. Once again, thanks for contacting us. ###### Return-Path: Received: from tkecmailc02.one.microsoft.com ([207.46.230.20]) by island.ethz.ch (8.10.1/8.10.1) with ESMTP id eB5FqcI1224906 for ; Tue, 5 Dec 2000 16:52:39 +0100 (MET) Received: from mail pickup service by tkecmailc02.one.microsoft.com with Microsoft SMTPSVC; Tue, 5 Dec 2000 07:52:32 -0800 From: Date: Tue, 5 Dec 2000 07:52:31 -0800 To: Subject: RE: CST20002509ID - Spam, was [Fwd: This is your Future, Seize the MIME-Version: 1.0 Message-ID: <017701c05ed3$60b37d20$3972389d@one.microsoft.com> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft CDO for Windows 2000 Content-Class: urn:content-classes:message X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-OriginalArrivalTime: 05 Dec 2000 15:52:32.0190 (UTC) FILETIME=[60D29DE0:01C05ED3] Status: RO X-Status: X-Keywords: X-Mozilla-Status: 8011 X-Mozilla-Status2: 00000000 Hello neil, Thank you for writing to MSN Hotmail. The account that you reported is not a valid Hotmail account. The individual is forging message headers, suggesting that the message originated with Hotmail. All message headers from the Hotmail system include a line that reads [X-originating-IP] to ensure that the message is an authentic message from our system. Example: Tue 02 July 1997 13:47:27 PST X-Originating-IP: [123.4.567.89] From: "Scarlett O'Hara" scarlett0gwtw@hotmail.com We have actively pursued legal action against many individuals who forge addresses from the Hotmail domain. Please help us by forwarding all unsolicited e-mail with the Hotmail domain name in the headers or bodies to: abuse@hotmail.com I encourage you to go to the following links to learn more about spam, forged message headers, and how to complain about e-mail abuse: The Anti-Spam HOWTO: http://www.cauce.org/ Spam FAQ: http://www.bluemarble.net/~scotty/forgery.html Hotmail has comprehensive online help available to you. For more information on Hotmail features, functions, and issues, click the "Help" button on the horizontal navigation bar. Sincerely, Alvin F. MSN Hotmail Customer Support Your satisfaction with my Customer Service is very important to me. If you consider your issue resolved, please click on the link below to let me know how I am doing. With your comments, please include my name and ticket number (found in this mail's subject line) to help me keep track of my performance. Customer Service Survey: http://msn.surveyhost.com/hotmail/ --- Original Message --- From: neil@arch.ethz.ch To: abuse@hotmail.com Sent: Tue Dec 5 02:15:10 PST 2000 Subject: Spam, was [Fwd: This is your Future, Seize the One of your mail boxes is being used for spamming) Shtu down the box, if it exists -------- Original Message -------- Return-Path: Received: from nice.ethz.ch (root@nice.ethz.ch [129.132.134.85])by island.ethz.ch (8.10.1/8.10.1) with ESMTP id eB52pGU1208291for ; Tue, 5 Dec 2000 03:51:16 +0100 (MET) Received: from relay1.nce.smtp.psi.net (relay1.nce.smtp.psi.net [38.9.152.2])by nice.ethz.ch (8.8.7/8.8.7) with ESMTP id DAA02406;Tue, 5 Dec 2000 03:51:14 +0100 (MET) From: xfkgt@hotmail.com Received: from mail.dfrv.com ([38.177.103.2] helo=EXCHANGE.dfrv.com)by relay1.nce.smtp.psi.net with esmtp (Exim 3.13 #3)id 14384L-0000XO-00; Mon, 04 Dec 2000 21:43:02 -0500 Received: from ndose.hotmail.com (10.0.0.1 [10.0.0.1]) by EXCHANGE.dfrv.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2448.0)id XKW6GXCQ; Mon, 4 Dec 2000 21:41:56 -0500 To: hnhzg@Onlinemarts Reply-To: sam11me2@n2mail.com Subject: This is your Future, Seize the Opportunity! [zaeka] Message-Id: Date: Mon, 04 Dec 2000 21:43:02 -0500 Hi, Creating an Offshore Presence to minimize taxes, enhance your privacy and protect your assets. For information mailto:sam11me@n2mail.com?subject=OFFSHORE_TOOLS |||||||||||||||||||||||||||||||||||||||||||||||||||| YOUR OFFSHORE NUMBERED BANK ACCOUNT... NO SETUP FEE. Confidentiality, Security, Efficiency and Low Costs Assured. mailto:sam11me@n2mail.com?subject=Offshore_Numbered_Account ++++++++++++++++++++++++++++++++++++++++++++++++++ Did you know? Over 60% of Hedge Funds Out Perform S&P 500 Could you live with 103%, 95%, 91%, 82%, 77%, 71%, 68% Return on your money in Hedge Funds? Let us tell you how it is possible. mailto:sam11me@n2mail.com?subject=HEDGE_FUND_INVESTMENTS ===================================================== WE WILL LOAN YOU UP TO $2,000 NO INTEREST TO INITIATE YOUR OFFSHORE FOREX TRADING ACCOUNT. You do NOT have to pay it back if you cannot pay for the loan out of earnings! mailto:sam11me@n2mail.com?subject=FOREX_LOAN_DETAILS_PLEASE ###################################################### TRY YOUR HAND FREE. Bet on stocks. Bet on Currency FOREX or Bet which way the market is going... up or down. Double or triple your money over night. It is better than poker, more interesting than card games and educational while you do it. Try our FREE trade period to get your experience or your feet wet as they say. mailto:sam11me@n2mail.com?subject=BET_ON_THE_MARKET ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ REFERRAL PROGRAM THAT PAYS $50, $500, $750 PLUS MORE. Not Multi Level. You send us the client. We do all the rest. We credit FEES to your FREE OFFSHORE WORLDWIDE DEBIT CARD. mailto:sam11me@n2mail.com?subject=REFERAL_FEES '''''''''''''''''''''''''''''''''''''''''''''''''' FOR DETAILS ABOUT ANY OF THESE ITEMS, CALL US TOLL FREE at 1 800 938 7707. Just ask for "ALL DETAILS, PLEASE." Have A Great Day! ###### Return-Path: Received: from mail.ciso.com (ciso.com [64.30.219.34]) by island.ethz.ch (8.10.1/8.10.1) with ESMTP id eBEL2Mu1566683 for ; Thu, 14 Dec 2000 22:02:23 +0100 (MET) Received: from STATION01 [64.30.219.40] by mail.ciso.com (SMTPD32-6.05) id A74C178E026C; Thu, 14 Dec 2000 13:10:36 -0800 From: "Eric Swanson \(CISO.COM\)" To: Subject: RE: Spam, was [Fwd: Increase Your Sex Drive ! 1431] Date: Thu, 14 Dec 2000 13:02:08 -0800 Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_003C_01C065CE.109D8180" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal In-Reply-To: <3A389660.2B65749A@franklin.ch> Status: RO X-Status: X-Keywords: X-Mozilla-Status: 8011 X-Mozilla-Status2: 00000000 I am guessing that you are sending us this email thinking that it was coming from us. The address of nashville-dialupxxx.ppp09.ciso.com is not us or is even valid. >From what we can tell is the spammer is coming from somewhere Asia. This guy has been driving us nuts. We have also consulted with Ipswich (the email server manufacture) and they believe that the same is true. It looks like someone is using nashville-dialupxxx.ppp09.ciso.com to make it look like it is us. The spam is not going through our server, our email server is on 64.30.219.34. If we can be of any further help or if you any other information to help get this guy stopped, please let me know. Eric Swanson CISO 800-968-2432 -----Original Message----- From: neil@arch.ethz.ch [mailto:neil@arch.ethz.ch] Sent: Thursday, December 14, 2000 1:44 AM To: abuse@ciso.com; postmaster@ciso.com Subject: Spam, was [Fwd: Increase Your Sex Drive ! 1431] One of your users (nashville-dialup308.ppp09.ciso.com) is spamming Shut down hi snet access -------- Original Message -------- Return-Path: Received: from UMQ4. (www2.okayama-moc.go.jp [210.152.198.19])by island.ethz.ch (8.10.1/8.10.1) with SMTP id eBE7WNM1549047;Thu, 14 Dec 2000 08:32:23 +0100 (MET) Received: from nashville-dialup308.ppp09.ciso.com by UMQ4. (SMI-8.6/SMI-SVR4)id QAA19567; Thu, 14 Dec 2000 16:33:11 +0900 From: ric11181@aol.com Message-ID: <000064716b06$00001784$0000286f@nashville-dialup308.ppp09.ciso.com> To: Subject: Increase Your Sex Drive ! 1431 Date: Wed, 13 Dec 2000 23:12:17 -0800 MIME-Version: 1.0 Content-Type: text/html;charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal