Subject: Spam, spam, wonderful spam

From: Gaal Yahas <[email-masked]>
Date: Sun, 9 Jul 2000 11:07:14 +0300

Spammers are starting to work hard on obfuscating their traces. Look
what I got today: this *appears* not to have been relayed much; and
the embedded URLs in the message are "encoded" with JavaScript. Quite
amazing, really. (My POP3 box is on netvision and fortinbras is my
machine. forum2.org is where mail gets addressed to.)

Anyone feel like busting their show?

== spam letter (not attached to prevent some clients from showing html) ==

---

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 9 Jul 2000 13:48:11 +0300

On Sun, Jul 09, 2000, Gaal Yahas wrote about "[hackers-il] Spam, spam, wonderful spam":
>..

I just added 210.103.124.223 to orbs.org's list - it was an open relay
through which the spam was sent to you. If you use ORBS, you'll never
get a spam through this path again (though those idiots can probably find
other open relays to send spam from - but ORBS is quite up-to-date with
relay spammers usually).

and a warning - DO NOT FLAME ME about this message. I'm sick and tired of being
flamed in this mailing list, especially on the spam subject...

-- 
Nadav Har'El                        |        Sunday, Jul 9 2000, 6 Tammuz 5760
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Sign on a back of truck: "Overtakers
http://nadav.harel.org.il           |beware, or you might meet the Undertaker"

---

From: Adam Morrison <[email-masked]>
Date: Sun, 09 Jul 2000 14:02:21 +0300

> Anyone feel like busting their show?

		[...]

> Received: from idec2. ([210.103.124.223]) by forum2.org (8.8.5) id WAA27599 for <[email-masked]>; Sat, 8 Jul 2000 22:07:45 -0600 (MDT)
> X-Authentication-Warning: forum2.org: Host [210.103.124.223] claimed to be idec2.
> Received: from x198 by idec2. (SMI-8.6/SMI-SVR4)
>         id NAA09067; Sun, 9 Jul 2000 13:05:05 +0900

They raped an old, default SunOS 5 Sendmail, which does does not
record the client (except for the HELO).

Nothing new about this part.