Hi.

I got two pornographic-sounding spams today, one apparently from
Werner, the other apparently from Ted Harding.  Rather than wait to
see if these are isolated incidents, I'm cut 'n' pasting both
emails with full headers into this post.

I'm not an expert in mail header forensics, but someone else may
spot something useful.  I'm operating on the "an ounce of
prevention is worth a pound of cure" theory here.  I can deal with
spams like these easily myself, provided they remain sporadic.  But
in the event they become systematic and affect other list members,
these two messages may prove useful in isolating the source of the
problem.

==================Begin bogus email from [EMAIL PROTECTED]

>From [EMAIL PROTECTED]  Thu Mar 31 11:48:45 2005
Return-path: [EMAIL PROTECTED]
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Thu, 31 Mar 2005 11:46:49 -0500
Received: from pop.golden.net [199.166.210.104]
        by localhost with POP3 (fetchmail-5.9.11)
        for [EMAIL PROTECTED] (single-drop); Thu, 31 Mar 2005
11:48:45 -0500 (EST)
Received: from exprod6mx30.postini.com ([64.18.1.170] helo=psmtp.com)
        by mail4.int.golden.net with smtp (Exim 4.12)
        id 1DH2oi-000Njt-00
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 11:46:48
-0500
Received: from source ([199.166.210.22]) (using TLSv1) by 
exprod6mx30.postini.com
+([64.18.5.10]) with SMTP;
        Thu, 31 Mar 2005 11:46:46 EST
Received: from lists.gnu.org ([199.232.76.165])
        by mail3.int.golden.net with esmtp (Exim 4.12)
        id 1DH2of-0004Pm-00
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 11:46:46 -0500
Received: from localhost ([127.0.0.1] helo=lists.gnu.org)
        by lists.gnu.org with esmtp (Exim 4.43)
        id 1DH34E-0003zD-Cn
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 12:02:50 -0500
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
        id 1DH30h-0001PN-62
        for groff@gnu.org; Thu, 31 Mar 2005 11:59:11 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
        id 1DH30S-0001Hl-Vf
        for groff@gnu.org; Thu, 31 Mar 2005 11:59:08 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
        by lists.gnu.org with esmtp (Exim 4.43) id 1DH30S-0001E5-Bf
        for groff@gnu.org; Thu, 31 Mar 2005 11:58:56 -0500
Received: from [194.2.232.250] (helo=199.232.76.166)
        by monty-python.gnu.org with smtp (Exim 4.34) id 1DH2ik-0007k9-Uq
        for groff@gnu.org; Thu, 31 Mar 2005 11:40:39 -0500
From: wl <[EMAIL PROTECTED]>
To: groff@gnu.org
Date: 31 Mar 2005 18:40:37 +0100
MIME-Version: 1.0
X-Mailer: OstroSoft SMTP Component (5.1.1)
Content-Type: multipart/mixed; boundary="--NextMimePart"
Message-Id: <[EMAIL PROTECTED]>
X-Content-Filtered-By: Mailman/MimeDel 2.1.5
Subject: [Groff] File - movie SuCkingPuSSy.mpeg
X-BeenThere: groff@gnu.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: groff.gnu.org
List-Unsubscribe: <http://lists.gnu.org/mailman/listinfo/groff>,
        <mailto:[EMAIL PROTECTED]>
List-Archive: <http://lists.gnu.org/pipermail/groff>
List-Post: <mailto:groff@gnu.org>
List-Help: <mailto:[EMAIL PROTECTED]>
List-Subscribe: <http://lists.gnu.org/mailman/listinfo/groff>,
        <mailto:[EMAIL PROTECTED]>
Sender: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
X-original-rcpt: [EMAIL PROTECTED]

[-- Attachment #1 --]
[-- Type: text/plain, Encoding: 7bit, Size: 0K --]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit


[-- Attachment #2 --]
[-- Type: text/plain, Encoding: 7bit, Size: 0.1K --]
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Groff mailing list
Groff@gnu.org
http://lists.gnu.org/mailman/listinfo/groff

===================End bogus email from [EMAIL PROTECTED]

=========Begin bogus email from [EMAIL PROTECTED]

>From [EMAIL PROTECTED]  Thu Mar 31 12:08:58 2005
Return-path: [EMAIL PROTECTED]
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Thu, 31 Mar 2005 12:08:35 -0500
Received: from pop.golden.net [199.166.210.104]
        by localhost with POP3 (fetchmail-5.9.11)
        for [EMAIL PROTECTED] (single-drop); Thu, 31 Mar 2005 12:08:58 -0500 
(EST)
Received: from exprod6mx89.postini.com ([64.18.1.73] helo=psmtp.com)
        by mail1.int.golden.net with smtp (Exim 4.12)
        id 1DH39n-000ATb-00
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 12:08:35 -0500
Received: from source ([199.166.210.22]) (using TLSv1) by 
exprod6mx89.postini.com
+([64.18.5.10]) with SMTP;
        Thu, 31 Mar 2005 09:08:33 PST
Received: from lists.gnu.org ([199.232.76.165])
        by mail5.int.golden.net with esmtp (Exim 4.12)
        id 1DH39l-000JRo-00
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 12:08:33 -0500
Received: from localhost ([127.0.0.1] helo=lists.gnu.org)
        by lists.gnu.org with esmtp (Exim 4.43)
        id 1DH3PJ-0007Ci-U6
        for [EMAIL PROTECTED]; Thu, 31 Mar 2005 12:24:37 -0500
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
        id 1DH3Oq-0007AR-18
        for groff@gnu.org; Thu, 31 Mar 2005 12:24:08 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
        id 1DH3Oh-00075C-Fx
        for groff@gnu.org; Thu, 31 Mar 2005 12:24:00 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
        by lists.gnu.org with esmtp (Exim 4.43) id 1DH3Oh-000752-9Z
        for groff@gnu.org; Thu, 31 Mar 2005 12:23:59 -0500
Received: from [194.2.232.250] (helo=199.232.76.166)
        by monty-python.gnu.org with smtp (Exim 4.34) id
1DH38K-0001xV-QP
        for groff@gnu.org; Thu, 31 Mar 2005 12:07:06 -0500
From: "Ted.Harding" <[EMAIL PROTECTED]>
To: groff@gnu.org
Date: 31 Mar 2005 19:07:03 +0100
MIME-Version: 1.0
X-Mailer: OstroSoft SMTP Component (5.1.1)
Content-Type: multipart/mixed; boundary="--NextMimePart"
Message-Id: <[EMAIL PROTECTED]>
X-Content-Filtered-By: Mailman/MimeDel 2.1.5
Subject: [Groff] Asses Mpeg's
X-BeenThere: groff@gnu.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: groff.gnu.org
List-Unsubscribe: <http://lists.gnu.org/mailman/listinfo/groff>,
        <mailto:[EMAIL PROTECTED]>
List-Archive: <http://lists.gnu.org/pipermail/groff>
List-Post: <mailto:groff@gnu.org>
List-Help: <mailto:[EMAIL PROTECTED]>
List-Subscribe: <http://lists.gnu.org/mailman/listinfo/groff>,
        <mailto:[EMAIL PROTECTED]>
Sender: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
X-original-rcpt: [EMAIL PROTECTED]

[-- Attachment #1 --]
[-- Type: text/plain, Encoding: 7bit, Size: 0K --]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit


[-- Attachment #2 --]
[-- Type: text/plain, Encoding: 7bit, Size: 0.1K --]
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Groff mailing list
Groff@gnu.org
http://lists.gnu.org/mailman/listinfo/groff

==========End bogus email from [EMAIL PROTECTED]

-- 
Peter Schaffter
  Author of _The Schumann Proof_ (RendezVous Press, Canada)
  http://www.golden.net/~ptpi/theschumannproof.html


_______________________________________________
Groff mailing list
Groff@gnu.org
http://lists.gnu.org/mailman/listinfo/groff

Reply via email to