Subject: RE: [Asrg] Scrambled headers?

From: "Sauer, Damon" <[email-masked]>
Date: Fri, 21 Mar 2003 12:58:00 -0600

Junk added in by the spammer to thwart scripts that look at "Received: from"
and filter based on that.

Damon

-----Original Message-----
From: Rob [mailto:[email-masked]]
Sent: Friday, March 21, 2003 12:20 PM
To: [email-masked]
Subject: [Asrg] Scrambled headers?

First time I saw this - what does anyone make of it?

X-From_: [email-masked]  Fri Mar 21 02:04:29 2003
Return-Path: <[email-masked]>
Received: from hudson.redwire.net (064-186-240-103.prvnet.redwired.net 
[64.186.240.103])
	by lily.redwire.net (8.12.5/8.12.5) with ESMTP id h2LA4Qts011823
	for <[email-masked]>; Fri, 21 Mar 2003 02:04:26 -0800
Date: Fri, 21 Mar 2003 02:57:59 -0700 (MST)
Comments: Received: from Pb:;692?o4962A7C:D366D]4@>|:>=F4<J49F4<Jo2@=]4@>Nz
B
           Received: from 
Jx:?7@oH2D966ED]4@>|:?7@oHHH\\3>8>FD:4D6CG:46]4@>|:?7@o36C8\D2442?:]4@>|:>3:
8>2?;o2@=]4@>|:644:oAC@\FD2]4@>|9@FC=23o6C@=D]4@>Tx 
M
           Received: from 
Ma:>2E6<4@>o2@=]4@>|:==FD:@?o4J36CC62=:EJ]?6E|:?7@o2C>@C42D6]4@>|:?7@oDF3D62
=6G6=]4@>|:?7@oA6C\G2D4\DFC8]4@>|:46>2?d`eo9@E>2:=]4@>Tv 
T
           Received: from 
Tu:??@G2E:G6o2C8@9@FDE@?]4@>|9J3@FoFD2]?6E|:?>JH@C=5gbo2@=]4@>|:?DFC6o:?7:]?
6E|:?7@DG4DoA6?6=]4@>|:?7@o;@9??J3C@?4@]4@>Tq 
R
           Received: from 
Ac:?7@o3:==9@==:?8]4@>|:?7@o>2:?6=24C@DD6]4@>|9@DE>2DE6CoG@=@?6E]4@>|:?7@o3C
25JA=4]4@]F<|:==FDA=FDo>:?5DAC:?8]4@>|:>>:Io9@E>2:=]4@>Tz 
G
           Received: from 
Rm9@DE>2DE6CoHAC6DD]4@>|:?7@oH84E]4@>|9F>2?0=628F6a__`F<oJ29@@]4@>|:?7@o7C@>
A2C25:D6]4@>|9C@25DAF3277oH@C=5?6E]2EE]?6E|9F?E6C]D4o>:?5DAC:?8]4@>Mr 
Z
           Received: from 
Nr:;F:46o255C]4@>|9F>AEJ56G2o2@=]4@>|:592J?6Do>@F?6E]4@>|:4:>=@o9@>6]42|:0>:
DD0J@F0H6DoJ29@@]4@>|:2CE@>o2@=]4@>TT 
T
           Received: from 
Nz:37:G6o2@=]4@>|:>2C=J>2Co9@>6]4@>|9F89aaego2@=]4@>|9A]<2H2?o<2H2?]56|:5?E9
D@o4D]4@>|:?7@o52E2DFAA@CE:?4]4@>Rb 
Y
           Received: from 
PQ9@J@?8oD<J7246]4@>|9D5>2C49o2@=]4@>|:=2>@E96oH@C=5?6E]2EE]?6E|:<5EE>oJ29@@
]4@]F<|:<52G:Do9@E>2:=]4@>|:?7@oE96C>2=6?8:?DE]4@>Rz 
M
Errors: [email-masked]
From: OTC-Stocks <[email-masked]>
To: ZzNjiADf <[email-masked]>

-----------------------------------------------------------
Rob Ayer   -    Network Operations
-----------------------------------------------------------
Office		858-244-9040 x205
Fax		858-244-9043
Mobile		858-518-4894
Tollfree	866-4REDWIRE
Pager		[email-masked]

RedWire Broadband
5771 Copley Drive Suite 100
San Diego, Ca 92111
http://www.redwire.net
-----------------------------------------------------------

I'm a SpamCon Foundation Member, #638
Verify it at http://www.spamcon.org/search/member-search.shtml
Why aren't you?

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

*****
"The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential, proprietary, and/or
privileged material.  Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.  If you received
this in error, please contact the sender and delete the material from all
computers."
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Sauer, Damon" <[email-masked]>
Date: Fri, 21 Mar 2003 13:03:16 -0600

Nahh... Those headers are after the message ID. Just spam "value add".

Damon

-----Original Message-----
From: Chuq Von Rospach [mailto:[email-masked]]
Sent: Friday, March 21, 2003 1:19 PM
To: Rob
Cc: [email-masked]
Subject: Re: [Asrg] Scrambled headers?

someone's trying that new sendmail exploit.

On Friday, March 21, 2003, at 09:19  AM, Rob wrote:

> Message-Id: <[email-masked]>
> Comments: Received: from 
> Pb:;692?o4962A7C:D366D]4@>|:>=F4<J49F4<Jo2@=]4@>Nz B
>           Received: from --
Chuq Von Rospach, Architech
[email-masked] -- http://www.plaidworks.com/chuqui/blog/

-- 
Chuq Von Rospach, Architech
[email-masked] -- http://www.plaidworks.com/chuqui/blog/

*****