Oddly enough, this spam seems to have been forwarded by a 3rd party
claiming to be spamcop.net rather than by the original spammer. Are
they testing the nettest page? Are they trying to get the original
spammer in trouble? Or are they simply clueless? Why did they send
four of them? We just don't know. The address it was submitted from,
66.81.145.51, seems to have no relation to either spamcop.net or
djenis.info.

ffhaneea04b08s05 decodes to:
66.81.145.51 2004-02-08 19:05

host-66-81-145-51.rev.o1.com

Feb  8 23:38:02 www sendmail[2010]: i194bqf02010: from=<cowtown@spamcop.net>, size=3937, class=0, nrcpts=1, msgid=<20040208161600.whz2lmoksw4s4s4c@webmail.spamcop.net>, proto=ESMTP, daemon=MTA, relay=c60.cesmail.net [216.154.195.49]
Feb  8 23:38:12 www sendmail[2013]: i194bqf02010: ctladdr=<nts-ffhaneea04b08s05@munged.ext> (8/0), delay=00:00:10, xdelay=00:00:10, mailer=prog, pri=33187, dsn=2.0.0, stat=Sent

[08/Feb/2004:19:05:44 -0500] ts host-66-81-145-51.rev.o1.com "GET /nettest/ HTTP/1.1" 200 7648 http://www.munged.ext/

  Search results for: ! NET-66-81-112-0-1

OrgName:    O1 Dialup Services
OrgID:      ODS-16
Address:    1515 K Street
Address:    Suite 100
City:       Sacramento
StateProv:  CA
PostalCode: 95814
Country:    US

NetRange:   66.81.112.0 - 66.81.223.255
CIDR:       66.81.112.0/20, 66.81.128.0/18, 66.81.192.0/19
NetName:    NETBLK-66-81-112-223
NetHandle:  NET-66-81-112-0-1
Parent:     NET-66-81-0-0-1
NetType:    Reassigned
Comment:
RegDate:    2003-01-28
Updated:    2003-01-28

AbuseHandle: OAB-ARIN
AbuseName:   Abuse, Option One
AbusePhone:  +1-916-554-2121
AbuseEmail:  abuse@o1.com

OrgTechHandle: ONE-ARIN
OrgTechName:   NetEng, Option One
OrgTechPhone:  +1-916-554-2121
OrgTechEmail:  neteng@o1.com

# ARIN WHOIS database, last updated 2004-02-08 19:15

  Search results for: ! NET-66-81-0-0-1

OrgName:    01.com
OrgID:      01CO
Address:    770 L Street
Address:    Suite 960
City:       Sacramento
StateProv:  CA
PostalCode: 95814
Country:    US

NetRange:   66.81.0.0 - 66.81.255.255
CIDR:       66.81.0.0/16
NetName:    NETBLK-O1-BLK1
NetHandle:  NET-66-81-0-0-1
Parent:     NET-66-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.O1.COM
NameServer: NS2.O1.COM
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    2001-02-28
Updated:    2003-01-30

TechHandle: ONE-ARIN
TechName:   NetEng, Option One
TechPhone:  +1-916-554-2121
TechEmail:  neteng@o1.com

OrgAbuseHandle: OAB-ARIN
OrgAbuseName:   Abuse, Option One
OrgAbusePhone:  +1-916-554-2121
OrgAbuseEmail:  abuse@o1.com

OrgTechHandle: ONE-ARIN
OrgTechName:   NetEng, Option One
OrgTechPhone:  +1-916-554-2121
OrgTechEmail:  neteng@o1.com

# ARIN WHOIS database, last updated 2004-02-08 19:15

------------------------------------------------------------

Return-path: cowtown@spamcop.net Sun Feb 8 23:38:02 2004 [2004-02-08 23:38:03 59253]
Received: from c60.cesmail.net (c60.cesmail.net [216.154.195.49])
   by www.munged.ext (8.11.6/8.11.6) with ESMTP id i194bqf02010
   for <nts-ffhaneea04b08s05@munged.ext>; Sun, 8 Feb 2004 23:38:02 -0500
Received: from unknown (HELO gamma.cesmail.net) (192.168.1.20)
   by c60.cesmail.net with SMTP; 08 Feb 2004 19:15:59 -0500
Received: (qmail 14205 invoked by uid 99); 9 Feb 2004 00:16:00 -0000
Received: from host-66-81-145-51.rev.o1.com (host-66-81-145-51.rev.o1.com
[66.81.145.51]) by webmail.spamcop.net (Horde) with HTTP for
<cowtown@spamcop.net@cesmail.net>; Sun, 8 Feb 2004 16:16:00 -0800
Message-ID: <20040208161600.whz2lmoksw4s4s4c@webmail.spamcop.net>
Date: Sun, 8 Feb 2004 16:16:00 -0800
From: cowtown@spamcop.net
To: "munged.ext" <nts-ffhaneea04b08s05@munged.ext>
User-Agent: Internet Messaging Program (IMP) 4.0-cvs
X-spamfilt: Chienworks* SpamFilt - 2004-02-08 23:38:03 - [59253]
X-spamfilt: IP addresses: 1
X-spamfilt: Large words found: 5
X-spamfilt: No subject
X-spamfilt: Excessive use of quoted-printable: 24.05
X-spamfilt: b-/b - 1 - click here if you
X-spamfilt: b-/b - 1 - internet mail service
X-spamfilt: b-/b - 1 - make money at home
X-spamfilt: bay hits: +0 -11
X-spamfilt: bay head: +5 -8.2
X-spamfilt: bay body: +98.2 -710.4
X-spamfilt: bay html: + -713.5
X-spamfilt: bay index: 0.933254436339179
X-spamfilt: #0 +0 -11 =0

Return-Path: <bruce.westbrook@chron.com>
Delivered-To: spamcop-net-cowtown@spamcop.net
Received: (qmail 5921 invoked from network); 8 Feb 2004 08:29:07 -0000
Received: from unknown (HELO blade3.cesmail.net) (192.168.1.213)
by blade6.cesmail.net with SMTP; 8 Feb 2004 08:29:07 -0000
Received: (qmail 2496 invoked from network); 8 Feb 2004 08:29:06 -0000
Received: from c-24-2-145-242.client.comcast.net (24.2.145.242)
by blade3.cesmail.net with SMTP; 8 Feb 2004 08:29:05 -0000
Received: from [52.156.205.168] by c-24-2-145-242.client.comcast.net with ESMTP
id 94799280; Sat, 07 Feb 2004 21:19:35 -0100
Message-ID: <q8$047$3-7i2i8n39$-qp5@o0o60jazum4b>
From: "" <bruce.westbrook@chron.com>
Reply-To: "" <bruce.westbrook@chron.com>
To: cowtown@spamcop.net
Subject: Make money at home with eBay! cnuyjvsx u oyfxdun w
Date: Sat, 07 Feb 04 21:19:35 GMT
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_DDEF.CC5600D3B34_"
X-Priority: 3
X-MSMail-Priority: Normal
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on blade6
X-Spam-Level: *******************************
X-Spam-Status: hits=31.8 tests=BANG_GUARANTEE,CLICK_BELOW,DATE_SPAMWARE_Y2K,
FORGED_IMS_HTML,FORGED_IMS_TAGS,FORGED_MUA_IMS,HTML_50_60,
HTML_FONTCOLOR_RED,HTML_FONT_INVISIBLE,HTML_IMAGE_ONLY_06,
HTML_MESSAGE,HTML_TITLE_EMPTY,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,
MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE,MISSING_OUTLOOK_NAME,MONEY_BACK,
NO_REAL_NAME,OBFUSCATING_COMMENT,ORDER_NOW,WORK_AT_HOME version=2.60
X-SpamCop-Checked: 192.168.1.213 24.2.145.242
X-SpamCop-Disposition: Blocked bl.spamcop.net


--_DDEF.CC5600D3B34_
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<html><head><title></title>
</head>
<body background=3D"http://qpksd.info/ads2/whtbg.gif">

<font color=3D#ffffff size=3D1>order confirmation. your order should be s=
hipped by January, via fedex.
your federal express tracking number is charm.</font><font size=3D=
"1"><BR>
<font color=3D#ffffff> thank you for registering. your userid is:
autumn</font></font><br>

<center>
<a href=3D"http://trenchermen.qpksd.info/index.php?id=3D173&affid=3D4924=
"><img src=3D"http://qpksd.info/ads2/myab_plane1.jpg" border=3D"0">
</a>

<p><strong><font color=3D"#FF0000">Learn to Make A Fortune With Ebay!</f=
ont><br>
<font color=3D"#9933CC">Complete Turnkey System, If forever reason you c=
an't make atleast $500 in your 1st month we will give you your money back =
guaranteed!</font><br><font color=3D"#FF00FF"></font><strong><font
color=3D=
"#000000"> Software - Videos - Turorials</font><br><font color=3D"#FF0000"=
>Get 2 F*R*E*E Airline Tickets If You Order NOW!</font><br>
<a href=3D"http://www.qpksd.info/index.php?id=3D173&affid=3D4924">
Cl<!--aural-->ick Here For Information</a></strong><br></p>



</font> <br><br><br>
<p></p></p>
<p><font color=3D"#000000" size=3D"2" face=3D"arial, helvetica, sans-seri=
f">cli<!--scour-->ck
<a href=3D"http://qpksd.info/gone.php">here</a> if you would not like to =
receive future mai<!--inspect-->lings.</font></p>
</center>


</body>
</html>