SPAM emails - Questions / discussion

[AZhitman]

Read this FIRST: spam-emails-please-read-this-first-t507918.html

I'll leave this thread open for people to post up the email header, or ask questions.

I think I covered the topic pretty well, though... I hope.

[ffrpwner]

haha i was wondering wat was going on....heres the email i got.

HELLO (forums.nicoclub.com) from stella dunn

Hi dear,
My name is stella.i saw email today at (forums.nicoclub.com) i like to correspond with you in love friendship, and i will also like to know you bette,i think this is the better way to start a very good relationship from my own perspective,i hope to reply with my photos .
thanks
from
stella

[frapjap]

I got the same email as above.
Topic Header on both reads:

"HELLO (forums.nicoclub.com)"


Maybe we should all spam this cockfag right back with an inbox full of Longcat attachments!

[Dittoz7]

Does that mean she won't reply with pictures?
Ooooh! world why must you be so cruel....
:'(

[danshaz82]

I got the same email as above.
Topic Header on both reads:

"HELLO (forums.nicoclub.com)"


Maybe we should all spam this cockfag right back with an inbox full of Longcat attachments!

good ol' fashioned Learned'd raid?

[AZhitman]

Guys, I love y'all, but those aren't email headers. We've all seen the content of the email, it's irrelevant.

[Dittoz7]

To bad most email have a size limit. If not i will send him the universe gif lol. 30kx60k

[frapjap]

What the heck is an email header? I was thinking subject header, my mistake.

[Q451990]

Header information from my spam from "stella"

Return-Path: <[email protected]>
Received: from mtain-dc07.r1000.mx.aol.com (mtain-dc07.r1000.mx.aol.com [172.29.64.135]) by air-md06.mail.aol.com (v129.4) with ESMTP id MAILINMD063-8b8a4c88878a3b8; Thu, 09 Sep 2010 03:06:50 -0400
Received: from n1-vm1.bullet.mail.gq1.yahoo.com (n1-vm1.bullet.mail.gq1.yahoo.com [67.195.23.153])
by mtain-dc07.r1000.mx.aol.com (Internet Inbound) with SMTP id EF2DE38000092
for <hidden email address>; Thu, 9 Sep 2010 03:06:49 -0400 (EDT)
Received: from [67.195.9.83] by n1.bullet.mail.gq1.yahoo.com with NNFMP; 09 Sep 2010 07:06:48 -0000
Received: from [98.137.27.130] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 09 Sep 2010 07:06:48 -0000
Received: from [127.0.0.1] by omp204.mail.gq1.yahoo.com with NNFMP; 09 Sep 2010 07:06:48 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 25296 invoked by uid 60001); 9 Sep 2010 07:06:48 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1284016008; bh=rlKCxJOCe+l7+iAi/lTyJRKhXqSjAq9TKg5CRRSrtwY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=PH8aYCRw9zmJrgxVxqxMHXIq6e/AQKbF8yaU5MH3TIGIkFCvkp00QyyXBLaqqo3hxxF5NhEutT4fQcfRuKSVtJVCtMbgqAmVI90p8fBno/fpBwCtbxchbEc/9uRcHR/8FKJhQc4F0iMFh1F+2BQ3JpYdNWrgO8/0xXt91YsS5UY=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=RvX6Cj8HHAsNJEbTKaoDc0OL2CqLOFYn0zcmVLfIY6qtk3LMoPA9e/ck6S7sb2OhiYArG+yoAl5GAHiEsdiufmQpzkMdqj3Tdu+rXdEl4cErSDSFK5CNJUoQjmXz7aovMsf1veUeHXRkHwKI04oT0c8EJCeoNYzTn91wncuRwr8=;
Message-ID: <[email protected]>
X-YMail-OSG: w36dgBAVM1kPa1yfrXzwXa.12zBykZW6_VJVheOjj2d84TE
NyCMSZCvCFhpFOyWMIwBRQ4IhCVbF8aSGr1YLcgfOibng9NbF5.9yRn4k1Mw
tZRCcx3N8T_qNi_IZxu9lhVgA.gfj.KfIkl9f_x3WIlopqWL603X7gVRHCT9
Lb4jNi37JDF7TL5AyVNwKbd.o2UJU1k7UF00MhusNkjzxTJLrQvZLPK_aIQl
BWldvcHhjVYur177Y4zzm2pLayUbbBIX23JbHNfXMM91MWeTpOS3C_LDYJih
MJjxyrHfdKQqKJL3H9u_aztqfAi.oVvBdeSJMMAXHqEPu7TOLDYMTJLMItYb
p.ejeCgx.ISSrX1JFESwQmgNbxkmGVRFljpO_NSiau6W22012mTGo.gBUTi6
ZzBq1YNnb7TjKUftcuO2aFsMKbVimyd.gLAHMS.PGPcX9eclooCZ7qbZY8n9
UU76VneVF08_vmQVOL0ogUgbbx0QPLvRsaJwPunbSppFU66TSdwRuXgLvccR
iNKrmHbYHUXaxFyCbyLyQbE59QeQzdFPvK3LQoc.R7Vp._kX05Gdy2vaydVk
c5gUpBqHOWd7e3m6c54zaV.BEntksJD51dS7jEXkl7lVVnLNS1rsEUpcrnUE
6ZEqGiOGqyBd8aKw4yucP0W6X0dgYLOkJYAlSIbBVDfhWWT0NfO9llqKElod
77DrKkxWhMSScC7DYB8RidXp_MvvmhIP4.a9riWQYmZUJMV72gV3CNGfSXnZ
ehZ4Pjcox_KSBIt0dj7NJez3_xIX7d2m_w.eu2GCEhX4NWTghYckj40sr0ah
vf821ou35w0MM9nrsqLd01cUa6idrtPpV_SEso6nAMgBy8w--
Received: from [41.208.140.135] by web180208.mail.gq1.yahoo.com via HTTP; Thu, 09 Sep 2010 00:06:48 PDT
X-Mailer: YahooMailClassic/11.4.7 YahooMailWebService/0.8.105.279950
Date: Thu, 9 Sep 2010 00:06:48 -0700 (PDT)
From: stella dun <[email protected]>
Reply-To: [email protected]
Subject: HELLO [forums.nicoclub.com]
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-607402540-1284016008=:10575"
x-aol-global-disposition: G
x-aol-sid: 3039ac1d40874c8887897368
X-AOL-IP: 67.195.23.153
X-AOL-SPF: domain : att.net SPF : none

[AZhitman]

THERE ya go.

Now, you report the spam to the user's ISP, which in this case, is hotmail and att.net.

[Frank E Bones]

This is what I have,

Return-Path: <[email protected]>
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.91])
by cdptpa-imta04.mail.rr.com with ESMTP
id <[email protected]>
for <email address removed>; Mon, 6 Sep 2010 23:11:03 +0000
Return-Path: <[email protected]>
X-Cloudmark-Score: 0
X-RR-Connecting-IP: 77.238.189.155
X-Authority-Analysis: v=1.1 cv=RRy6qDb426VPIs1zNJNIYhNyqLkClo/PwNjQMJDNOdE= c=1 sm=0 a=tUZ1sZWNdkgA:10 a=FCiRqLcxSTsdhjhRf4YV9g==:17 a=6epKX5HEAAAA:8 a=3L8wzjj8CWQ99TsaG9UA:9 a=M5P-epv8QVPY-50JhcIzIXh4WZYA:4 a=QEXdDO2ut3YA:10 a=HX_mayst_VMcxpKi0fQA:9 a=celqJFZ15r9gaRKX-wMA:7 a=h6FzSkXTrFsQi0LFQzWoUSFpRkkA:4 a=FCiRqLcxSTsdhjhRf4YV9g==:117
Received: from [77.238.189.155] ([77.238.189.155:42490] helo=web29510.mail.ird.yahoo.com)
by cdptpa-iedge10.mail.rr.com (envelope-from <[email protected]>)
(ecelerity 2.2.2.39 r()) with ESMTP
id B7/51-05714-605758C4; Mon, 06 Sep 2010 23:11:03 +0000
Received: (qmail 62149 invoked by uid 60001); 6 Sep 2010 23:10:59 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.dk; s=s1024; t=1283814659; bh=/5rWbHTxP5EjFPrjfXwHJqqXWXDZxbn4adcYqfN9ycY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=vDi5OL8pZQFPxzcGhYjRiR8vTIjnpdfiEDCw1ZnvGmAuG0o/dNCzoVQRDuAe7CRMJ7nfWPZiRYwLG8zb0MpO3VmErbunmgYfHptP7SxrIpRqZ9Ke3ZKq9tTCeIR3cHOymaamUK1hxxnfXfjZ6LgzABowT3paWKiCjcbrHNAhdDw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.dk;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=vbpWz7yIhFyNw30yqnYW18sn0Rby1dfqSm38gn8hQxqigL5doYOwzwdPzEfAUTKe14iN43QBE09zgZY0z0bhe+N8uuf7C5Dx+2OEzYCPhRG6SuOxg20xl0GvODhgs1hxlfEpQpqtFQVqlUZiN/dIevMtqdlEnYC2M5WWpzGCiWs=;
Message-ID: <[email protected]>
X-YMail-OSG: Uz1Omi0VM1lXy_GUQeBhKlwXORZoQWirM3Ar4oWb0jQs.Zq
vKpHtVwgkg9iE0c7C_gU3snnnu2SLIKl0WUmE.oA_4b.ZTBQ3KUOw3GGu9m_
56rt9u2fJu9iM4c0GN.sEMXC9U0Ptf00.N2LRBGNiBky88937tdk57_Rkibt
d49adyvEx9tdyGpL3A7L4m0ozU.xLtZdqWDfKFaVLWTjjGOnj6sGX2yYDd1i
hT6fzKMjwlvbUit8XEUew6xp6LTGnDr2fmhoRckRIgpbCCKmHirPyge9P9Zu
YLgAJKnOOhE0BmhkTS5Y1WmQ0SxMAsnnLUDXSZFDZ1Fy4aRkvgpjIFJMs1lM
nNmsO_ZolznxvmEWOCy2kdrNnCXYVNnRoeSztwDUvqOH32_sSMNPUWwH6ZKY
PoZ98xoejyngW3Jl_icClhtNa2D4Dqk6ZqIV8acOekUOjODeiLPN_1JO5Nt8
Sh1fDVTyQvMa2Mb66xwslffvhB6f8zAULvjHyq4uyaj29Szjk5ExMA7BDum.
2eqUjIaHZXKEhraQ6L906SsllNsZhFFalpTL2ns890TF.ONPfFU53nNUWKaB
kix32LwyZ9SQfyZTuNffyjxqrb1O36U0BjLgrIq1mmtEdwN9viRKRCu3YuQc
u48CO3y7Ecs.Wtlly_BR7_g3SdVTUhA6mEYk5NyMLU6uNTWE8G9Ai473SBac
9JXrfj2odqdUEJhqqCF7NmnksPvCifHL5ic2bLAs-
Received: from [196.207.193.37] by web29510.mail.ird.yahoo.com via HTTP; Mon, 06 Sep 2010 23:10:59 GMT
X-Mailer: YahooMailClassic/11.3.2 YahooMailWebService/0.8.105.279950
Date: Mon, 6 Sep 2010 23:10:59 +0000 (GMT)
From: karenkaren <[email protected]>
Reply-To: [email protected]
Subject: Hello
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-557437904-1283814659=:60976"

--0-557437904-1283814659=:60976
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


Hello Dear
My name is Ms Karen i saw your profile today

at(http://www.nicoclub.com)and became interested in

you, write me back on([email protected])i

have alot to discuss with you
Thanks=0A=0A
--0-557437904-1283814659=:60976
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<table cellspacing=3D"0" cellpadding=3D"0" border=3D"0" ><tr><td valign=3D"=
top" style=3D"font: inherit;"><br>Hello Dear<br>My name is Ms Karen i saw y=
our profile today<br><br>at(http://www.nicoclub.com)and became interested in<br><b=
r>you, write me back on([email protected])i<br><br>have alot to discuss =
with you<br>Thanks</td></tr></table><br>
--0-557437904-1283814659=:60976--

[Chaotic_Warlord]

I was going to forward it to you Greg, but since you already know about it I'll just delete it.

[The00Dustin]

<snip>
Received: from n1-vm1.bullet.mail.gq1.yahoo.com (n1-vm1.bullet.mail.gq1.yahoo.com [67.195.23.153])
by mtain-dc07.r1000.mx.aol.com (Internet Inbound) with SMTP id EF2DE38000092
for <Q451990's e-mail address for the spambots>; Thu, 9 Sep 2010 03:06:49 -0400 (EDT)
<snip>

<snip>
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.91])
by cdptpa-imta04.mail.rr.com with ESMTP
id <[email protected]>
for <Frank E Bones' e-mail address for the spambots>; Mon, 6 Sep 2010 23:11:03 +0000
<snip>

Much like the post explaining the spam suggests not sharing your e-mail address in your profile (and to an even greater degree since posts might be visible without an account), you shouldn't post your address in the open if you don't want spam, which I am assuming is the case since you are providing your headers here. You guys may want to edit your posts to hide that (need to leave it when submitting it to any ISP/authority, but not for open forum examples), and future posters may want to do the same.

[Q451990]

Much like the post explaining the spam suggests not sharing your e-mail address in your profile (and to an even greater degree since posts might be visible without an account), you shouldn't post your address in the open if you don't want spam, which I am assuming is the case since you are providing your headers here. You guys may want to edit your posts to hide that (need to leave it when submitting it to any ISP/authority, but not for open forum examples), and future posters may want to do the same.

Good point! I just removed email addresses from both posts.

Heath