Oddly enough, this spam seems to have been forwarded by a 3rd party
claiming to be spamcop.net rather than by the original spammer. Are
they testing the nettest page? Are they trying to get the original
spammer in trouble? Or are they simply clueless? Why did they send
four of them? We just don't know. The address it was submitted from,
66.81.145.51, seems to have no relation to either spamcop.net or
djenis.info.
ffhaneea04b08s05 decodes to:
66.81.145.51 2004-02-08 19:05
Return-path: cowtown@spamcop.net Sun Feb 8 23:38:08 2004 [2004-02-08 23:38:09 59256]
Received: from c60.cesmail.net (c60.cesmail.net [216.154.195.49])
by www.munged.ext (8.11.6/8.11.6) with ESMTP id i194c2f02015
for <nts-ffhaneea04b08s05@munged.ext>; Sun, 8 Feb 2004 23:38:08 -0500
Received: from unknown (HELO delta.cesmail.net) (192.168.1.30)
by c60.cesmail.net with SMTP; 08 Feb 2004 19:22:46 -0500
Received: (qmail 5664 invoked by uid 99); 9 Feb 2004 00:22:47 -0000
Received: from host-66-81-157-62.rev.o1.com (host-66-81-157-62.rev.o1.com
[66.81.157.62]) by webmail.spamcop.net (Horde) with HTTP for
<cowtown@spamcop.net@cesmail.net>; Sun, 8 Feb 2004 16:22:47 -0800
Message-ID: <20040208162247.ul7tfy8goco8o8so@webmail.spamcop.net>
Date: Sun, 8 Feb 2004 16:22:47 -0800
From: cowtown@spamcop.net
To: "munged.ext" <nts-ffhaneea04b08s05@munged.ext>
User-Agent: Internet Messaging Program (IMP) 4.0-cvs
X-spamfilt: Chienworks* SpamFilt - 2004-02-08 23:38:09 - [59256]
X-spamfilt: IP addresses: 2
X-spamfilt: Large words found: 6
X-spamfilt: No subject
X-spamfilt: Excessive use of quoted-printable: 23.05
X-spamfilt: b-/b - 1 - click here if you
X-spamfilt: bay hits: +0 -11
X-spamfilt: bay head: +5 -8.2
X-spamfilt: bay body: +82.3 -576.9
X-spamfilt: bay html: + -580
X-spamfilt: bay index: 0.930893922844343
X-spamfilt: #0 +0 -11 =0
Return-Path: <kdimpel@cetlink.net>
Delivered-To: spamcop-net-cowtown@spamcop.net
Received: (qmail 8783 invoked from network); 7 Feb 2004 18:21:48 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by blade6.cesmail.net with SMTP; 7 Feb 2004 18:21:48 -0000
Received: (qmail 5848 invoked from network); 7 Feb 2004 18:21:48 -0000
Received: from me-kennebunk3c-23.knbnme.adelphia.net (68.71.174.23)
by mailgate.cesmail.net with SMTP; 7 Feb 2004 18:21:48 -0000
Received: from 40.40.196.130 by 68.71.174.23; Sun, 08 Feb 2004 21:24:00 +0300
Message-ID: <VWBOLWAAGDRPCXHPFIHN@msn.com>
From: "Bryce Case" <kdimpel@cetlink.net>
Reply-To: "Bryce Case" <kdimpel@cetlink.net>
To: cowtown@spamcop.net
Subject: ebay earns you fortunes
Date: Sun, 08 Feb 2004 12:20:00 -0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--195561567380590085"
X-IP: 240.146.62.184
X-Priority: 3
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on blade6
X-Spam-Level: **********
X-Spam-Status: hits.1 tests=CLICK_BELOW,HTML_50_60,HTML_FONTCOLOR_RED,
HTML_FONT_INVISIBLE,HTML_IMAGE_ONLY_04,HTML_MESSAGE,HTML_TITLE_EMPTY,
MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
OBFUSCATING_COMMENT,ORDER_NOW,PRIORITY_NO_NAME version=2.60
X-SpamCop-Checked: 192.168.1.101 68.71.174.23
X-SpamCop-Disposition: Blocked bl.spamcop.net
<font color=#ffffff size=1>order confirmation. your order should be shipped by January, via fedex.
your federal express tracking number is %RANDOM_WORD.</font><font size="1">
<font color=#ffffff> thank you for registering. your userid is:
%RANDOM_WORD</font></font>
<p><strong><font color="#FF0000">Learn to Make A Fortune With Ebay!</font>
<font color="#9933CC">Complete Turnkey System</font> <font color="#FF00FF"></font><strong><font color="#000000"> Software - Videos - Turorials</font> <font color="#FF0000">Get 2 F*R*E*E Airline Tickets If You Order NOW!</font>
<a href="http://www.woiejf.info/index.php?id=173&affid=864">
Cl<!--%RANDOM_WORD-->ick Here For Information</a></strong> </p>
</font>
<p></p></p>
<p><font color="#000000" size="2" face="arial, helvetica, sans-serif">cli<!--%RANDOM_WORD-->ck
<a href="http://woiejf.info/gone.php">here</a> if you would not like toreceive future mai<!--%RANDOM_WORD-->lings.</font></p>
</center>
</body>
</html> TOASTEDspam.com toasted spam dot com
