[SpamCop-List] Re: announcement for our members

[Bill Beyer]

"Mike Easter" <MikeE at ster.invalid> wrote in message
news:dlgeif$1vg$1 at news.spamcop.net...
> Bill Beyer wrote:
> www.spamcop.net/sc?id=z827743513zf980d5e844735a686bb7f72c0d0dcaebz
>
> Before we even read the body content of a spam, we look at its headers
> which show a no rDNS .eg source under Nile Online which is SCbl/ed for
> reports and spamtraps but not currently listed as an abused
> proxy/trojan.  Additionally there is a bogus helo and a bogus Received
> line -- but since those 'bogosities' aren't misleading, they could be
> simply due to a misconfigured server.  In any case, only the source is
> SCbl/ed
>
> That is an item alleging to be about child pr0n, which almost always
> makes me think about a joejob.  It doesn't provide a website, but
> instead has a yahoo from and an rcn 'payload' contact email address.
>
> > Looks like some folks pissed off spammy.
>
> Which folks?  Similar items to that appear in sightings, but I find no
> online persona history for either of the addresses blckjak101 at yahoo.com
> or jkeon at rcn.com which would be what is being jobbed or the real payload
> if it isn't bogus.
>
> -- 
> Mike Easter
> kibitzer, not SC admin


I received 4 of these messages on 2 different email accounts with 3
different email addresses in the body of the spam. Googling the email
addresses revealed very little about them other than the fact that 1 of them
was a valid address used as a replyto in a craigslist ad. My assumption is
that the names being used in the spew are the ones being joe jobbed
therefore the ones who pissed off spammy. Here are the trackers for the
other 3 if you care to look at them.

http://www.spamcop.net/sc?id=z827822307z552d7bc3ed8f99dc1541d5209de5260dz
http://www.spamcop.net/sc?id=z827743516z3d4e540a28f9b17b0786bce3a53f839fz
http://www.spamcop.net/sc?id=z827743515z266100717d26c32492e615252072bebfz