How OLD are the lists spammers use? The stock spam below was sent to
[EMAIL PROTECTED] cu20b was retired in 1987!
The lower Received header is faked. columbia.edu resolves to
external-smtp-multi-vif.cc.columbia.edu, but that's a virtual
interface, not a host. No Received would ever have "by external..."
in it. This is a variation on the recently described Received forgery.
We have been checking already for "by columbia.edu" in Received, and
I will add this variation today.
Joseph Brennan
Lead Email Systems Engineer
Columbia University Information Technology
------------ Forwarded Message ------------
. . .
Received: from ppp25-145.adsl.forthnet.gr
(ppp25-145.adsl.forthnet.gr [212.251.108.145])
by longan.cc.columbia.edu (8.13.7/8.13.6) with SMTP
id kAS8pfii018311 for <[EMAIL PROTECTED]>;
Tue, 28 Nov 2006 03:51:49 -0500 (EST)
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: from [212.251.108.145] (port=40748
helo=ppp25-145.adsl.forthnet.gr)
by external-smtp-multi-vif.cc.columbia.edu with esmtp
id 515070-515070-81 for [EMAIL PROTECTED];
Tue, 28 Nov 2006 10:51:44 +0200 (EET)
Message-ID: <[EMAIL PROTECTED]>
From: "Misty" <[EMAIL PROTECTED]>
To: "Amado" <[EMAIL PROTECTED]>
Subject: AggressiveInvestorsAlert
Date: Tue, 28 Nov 2006 10:51:44 +0200 (EET)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_24F6_01C712CA.6E04A380"
. . .
BLNM Price Climbs 92% and Volume is up 10,000% In Just Two Days Trading!
It's not to late to get in!
Company: Bralorne Mining Company
Symbol: BLNM.OB
Price: $0.31 (+92% in 2 days)
5 Day Target: $1.15
---------- End Forwarded Message ----------
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
