procmail
[Top] [All Lists]

Re: spam from murlin

1997-05-21 06:19:00
sarg(_at_)murlin(_dot_)com writes:
From procmail-request(_at_)Informatik(_dot_)RWTH-Aachen(_dot_)DE  Wed May 21 
12:41:52 1997
Received: by nmrc.ucc.ie (8.6.12/8.6.6) with ESMTP id MAA19891
        for <lhecking(_at_)nmrc(_dot_)ucc(_dot_)ie>; Wed, 21 May 1997 
12:42:23 +0100
Received: (from lists(_at_)localhost) by Campino.Informatik.RWTH-Aachen.DE 
(RBI-Z-5/8.6.12) id NAA27154 for lhecking(_at_)nmrc(_dot_)ucc(_dot_)ie; Wed, 
21 May 1997 13:43:05 +0200 (MET DST)
Resent-Date: Wed, 21 May 1997 13:43:05 +0200 (MET DST)
X-Authentication-Warning: campino.informatik.rwth-aachen.de: lists set sender 
to procmail-request(_at_)informatik(_dot_)rwth-aachen(_dot_)de using -f
From: sarg(_at_)murlin(_dot_)com
Message-Id: <199705211134(_dot_)GAA19500(_at_)murlin(_dot_)com>
To: sarg(_at_)murlin(_dot_)com
Date: Wed, 21 May 97 06:32:27 -0500
Subject: Limited Time Offer (Free Money Maki
X-Mailer: Extractor Pro v5.0
X-Sender: Extractor Pro v5.0
Resent-Message-ID: <"k_RH6C.A.clG.15tgz"@campino>
Resent-From: procmail(_at_)Informatik(_dot_)RWTH-Aachen(_dot_)DE
X-Mailing-List: <procmail(_at_)informatik(_dot_)rwth-aachen(_dot_)de> 
archive/latest/11186
X-Loop: procmail(_at_)informatik(_dot_)rwth-aachen(_dot_)de
Precedence: list
Resent-Sender: procmail-request(_at_)Informatik(_dot_)RWTH-Aachen(_dot_)DE

 Excellent demonstration material. Wasn't caught by my spam filters
 because it came from the list.

 Unless the Message-Id: is forged, this seems to come from murlin.com:

Murlin Computer, Inc. (MURLIN-DOM)
   1435A Thompson Blvd
   Sedalia, Mo 65301
   US

   Domain Name: MURLIN.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Schmitt, Rich  (RS1257)  sirsmoke(_at_)MURLIN(_dot_)COM
      816-827-6868
   Billing Contact:
      Schmitt, Rich  (RS1257)  sirsmoke(_at_)MURLIN(_dot_)COM
      816-827-6868

   Record last updated on 13-Feb-97.
   Record created on 08-Nov-95.
   Database last updated on 20-May-97 05:00:33 EDT.

   Domain servers in listed order:

   GUITAR.SOUND.NET             205.242.192.20
   ECHO.SOUND.NET               205.242.192.21


 The Web site mentioned (strutyourstuff) is apparently served by
 cyberpromo, what a surprise:

...
10  192.157.69.19 (192.157.69.19)  204 ms  194 ms  198 ms
11  a0.58.philadelphia1.agis.net (206.185.158.9)  186 ms  213 ms  199 ms
12  cyberpromo.philadelphia1.agis.net (206.185.158.2)  199 ms *  251 ms
13  205.199.2.49 (205.199.2.49)  214 ms  181 ms  200 ms




<Prev in Thread] Current Thread [Next in Thread>