[SpamCop-List] Re: Tricking the sc date?

[Mike Easter]

Tim McGraw wrote:
> These two emails arrived in my inbox within the last hour as all but
> the initial header shows.
>
> Could it be a spammy trick?

I don't think it is a spammy trick.  I think the EL server that the
mindspring source IP used held the item for 5 days.  I haven't figured
out yet the oddball EL service - that isn't a normal EL pathway for the
'average' mindspringer to be sending it, ie that is an atypical EL smtp
service.

> BTW, I use mailhosts, if that makes a difference.

No, assuming that the 'expected' path is that host is for it to go aol
=> spamcop.

spamcop.net/sc?id=z701242402z62c3f5a690bf313709ba1fc67ca2b371z
spamcop.net/sc?id=z701242403z834f1d977008809f9ec3de2338d73419z

Both of those say:

  by mailgate.cesmail.net Fri
  by air-xb01.mail.aol.com Fri
  by rly-xb05.mx.aol.com Fri
  by corpgate0.mail.atl.earthlink.net Fri
  from user-38lcon0.dialup.mindspring.com ([209.86.98.224] helo=biz) by
emory.mail.atl.earthlink.net Sun

> Oddly, I did actually receive the same email from the same forged
> sender on Dec. 5.

The content of the spams is about an ebay seller's product and promotes
shopjimbos.homestead.com which is verio, but it also has a 'strange'

This is an advertisement from timetolaugh.info.
In order to opt-out from further e-mails from timetolaugh.info, please
reply to shopjimbos at hotmail.com with "REMOVE" in subject.

which can be seen in a current sightings, and in various 'iterations'
such as subdomains and alternate spellings.


-- 
Mike Easter
kibitzer, not SC admin