RE: [IMail Forum] Slightly OT: need help stopping "German-ish" emails

[Paul Paquette]

Title: Slightly OT: need help stopping "German-ish" emails

From what I see the Domain "Received: from iittyk.com" isn't a real domain

The IP e-mail was received from belongs to the following. Are you verifying

the Domain Name and address with RDNS?

 

 

06/18/04 10:22:56 whois [EMAIL PROTECTED]

 

whois -h whois.geektools.com 24.107.202.33 ...
GeekTools Whois Proxy v5.0.3 Ready.

 

Checking access for 66.211.129.162... ok.

 

Final results obtained from whois.arin.net.

 

Results:
Charter Communications CHARTERSTL-BLK-4 (NET-24-107-0-0-1)
                                  24.107.0.0 - 24.107.255.255
Charter Communications FLRSNT-MO-24-107-192 (NET-24-107-192-0-1)
                                  24.107.192.0 - 24.107.207.255

 

# ARIN WHOIS database, last updated 2004-06-17 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

 

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.

 

 

 

Thank You,
Paul E. Paquette


Quote - We live in a society exquisitely dependent on science and technology, in which hardly anyone knows anything about science and technology.

Carl Sagan

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Troy D. Hilton
Sent: Friday, June 18, 2004 10:05 AM
To: [EMAIL PROTECTED]
Subject: [IMail Forum] Slightly OT: need help stopping "German-ish" emails

Hello All,

I've got a couple client's that recently have been flooded with this German-looking spam. Here's some of the header info:

Received: from SMTP32-FWD by registermeonline.net
  (SMTP32) id A00000F9C; Thu, 17 Jun 2004 15:30:18 -0400
Received: from SMTP32-FWD by asert-llc.com
  (SMTP32) id A00000EB8; Thu, 17 Jun 2004 15:30:17 -0400
Received: from iittyk.com [24.107.202.33] by twinstar.com
  (SMTPD32-7.15) id A13FA840340; Thu, 17 Jun 2004 15:30:07 -0400
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Date: Thu, 17 Jun 2004 18:38:27 GMT
MIME-Version: 1.0
Subject: Geschrieben von Margrit am 07. April 2004 :Id:4138:
Importance: Normal
X-Priority: 3 (Normal)
Message-ID: <[EMAIL PROTECTED]>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-RBL-Warning: HELOBOGUS: Domain iittyk.com has no MX or A records [0301]. [2-8-4000]
X-Declude-Sender: [EMAIL PROTECTED] [24.107.202.33]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-Spam-Tests-Failed: HELOBOGUS
Status: U
X-UIDL: 383254604

Now, the email this was sent to, "JANETGREEN5005" is bogus but asert-llc.com is legit. Has anyone else seen this? Any suggestions on blocking this? My thinking is that some's system is infected somewhere and his name is on their mailing list, but I have no proof.

Troy D. Hilton
SofWerks LLC.
[EMAIL PROTECTED]
302-529-1961