actually much of the SPAM is from the US, it is just re-routed through
a foreign ISP, to mask it's origin... the email below appears to be from
Korea -- ssymail.ssy.co.kr (ssymail.ssy.co.kr [203.244.4.3] -- but
is actually from the USA via att.net -- mis.prserv.net [12.64.61.135]
! The Hotmail email may also be forged, but if it is not Microsoft/Hotmail
is very good at removing offenders. In response to this SPAM I forwarded
this MEssage with full headers to: abuse@att.net and abuse@hotmail.com
look for the first "Received:" -- looking bottom up -- as a message
is re-routed a new "Received:" is added to the top of the heap.
below, the first[originating] IP address is 12.64.61.135.
HTH,
Valdis Krebs
http://www.orgnet.com
Return-Path:
Received:
from ssymail.ssy.co.kr (ssymail.ssy.co.kr [203.244.4.3]) by indefatigable.cnchost.com id
GAA12437; Sat, 5 Jan 2002 06:40:24 -0500 (EST) [ConcentricHost SMTP MX 1.27]
From:
etiuto73dxfu@hotmail.com
Received:
from 12.64.61.135 (slip-12-64-61-135.mis.prserv.net [12.64.61.135]) by ssymail.ssy.co.kr
(8.8.5/8.8.5) with SMTP id LAA14158; Sat, 5 Jan 2002 11:36:28 GMT
Message-ID:
<200201051136.LAA14158@ssymail.ssy.co.kr>
To:
Subject:
Do Something About Your Hair Loss Now! Receive $100 in Free..
Date:
Sat, 05 Jan 2002 19:36:12 -0500
MIME-Version:
1.0
Content-Type:
text/html; charset="iso-8859-1"
Content-Transfer-Encoding:
quoted-printable
X-Priority:
3
X-MSMail-Priority:
Normal
Errors-To:
amnfs43dygl@pobox.sk
X-Mailer:
Microsoft Outlook Express 5.50.4133.2400
X-Mozilla-Status:
9001
X-Mozilla-Status2:
00000000
X-UIDL:
17487
SPAM follows...
air-l-request@aoir.org wrote:
[snip]
I observe that much of this material seems to come via third-world
nations, especially Russia. This means that European privacy laws --
and North American laws, when they are created -- will not be of much
use in stopping the problem.
[snip]