At 20:22 -0700 3/8/03, Vernon Schryver wrote:
Consider the common claims about spammers forging headers. When was
the last time you saw spam supposedly from CERT? Don't you think that
if spammers were willing to forge headers to get around simple
whitelists, at least some would use that envelope or header From value?
You mean like this? I have tonnes of these...
From i2secc0i(_at_)hotmail(_dot_)com Wed Mar 5 14:06:40 2003
Received: from 200.203.76.54 ([200.203.76.54])
by aleve.media.mit.edu (8.9.3/8.9.3/+ALEVE) with SMTP id OAA18641
for (...); Wed, 5 Mar 2003 14:05:44 -0500 (EST)
Date: Wed, 5 Mar 2003 14:05:44 -0500 (EST)
From: "Efrain Franckowiak" <i2secc0i(_at_)hotmail(_dot_)com>
To: "Contact List"
<(_dot_)(_dot_)(_dot_)(_at_)media-lab(_dot_)media(_dot_)mit(_dot_)edu>
Subject: Men, you have science in your corner
I see many forged headers. The biggest difference between "now" and
the state of
things, oh, five years ago, is that the MTAs do their own corrections to the
headers within [ ] so we can see where things actually came from. The above
didn't attempt to lie, but I've got plenty that do.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg