[mdlug] Question on Spam

[Aaron Kulkis]

Carl T. Miller wrote:
> A. Kalten wrote:
>> Quite frequently I receive spam that seems to originate from
>> bona fide IP addresses that would not likely be in the spamming
>> business.  For example, just today I noticed a spam message with
>> both the "From:" and "Reply-to:" fields containing abacus21.com,
>> which is a legitimate business located in Buffalo, NY, serving the
>> hospitality industry.  Of course, these fields can be spoofed, but
>> the complete header does show the message as originating at
>> abacus21.com:
> 
> Not really.  The only header that you can believe is the
> first Received header.  If it says it came from a server
> you can trust, you can then believe the next Received
> header.  Keep doing this until you come to the first
> server you don't know or trust.  Notice that means you
> can't trust that the Return-Path, To, From or Reply-To
> headers, unless you trust every Received header.
> 
>> Return-Path: <a-8 at abacus21.com>
>> Received: from barium.ypsi.provide.net (root at localhost)
>> 	by xxxxxxxxxxx.xxx (8.12.11/8.12.11) with ESMTP id l678eaDn013984
>> 	for <info at xxxxxxxxxxx.xxx>; Sat, 7 Jul 2007 04:40:36 -0400
>> X-ClientAddr: 221.133.163.182
>> Received: from [221.133.163.182] ([221.133.163.182])
>> 	by barium.ypsi.provide.net (8.12.11.20060308/8.12.11) with ESMTP id
>> l678eWWn013906
>> 	for <info at xxxxxxxxxxxx.xxx>; Sat, 7 Jul 2007 04:40:33 -0400
>> Received: from [221.133.163.182] by abacus21.com.inbound20.mxlogic.net;
>> Sat, 7 Jul 2007 08:40:35 -0900
> 
> Let's look at your headers.  The first Received shows
> that xxxxxxxxxxxx.xxx (this must be your mail server)
> received it from barium.ypsi.provide.net.  We can likely
> trust them, since they are likely your ISP.  The second
> header says it came from 221.133.163.182.  Since we don't
> know who that is and they don't have a hostname associated
> with that address, we can't trust anything else in this
> message to be accurate.  Thus we don't know whether or
> not it did come from abacus21.com.
> 
>> The host command indicates that the originating address is definitely
>> abacus21.com:
>>
>> [/]# host abacus21.com
>> abacus21.com mail is handled by 20 abacus21.com.inbound20.mxlogic.net.
>> abacus21.com mail is handled by 20 abacus21.com.inbound20.mxlogicmx.net.
>> abacus21.com mail is handled by 30 abacus21.com.inbound30.mxlogic.net.
>> abacus21.com mail is handled by 30 abacus21.com.inbound30.mxlogicmx.net.
>> abacus21.com mail is handled by 10 abacus21.com.inbound10.mxlogic.net.
>> abacus21.com mail is handled by 10 abacus21.com.inbound10.mxlogicmx.net.
> 
> All the host command shows is what IP addresses abacus21.com
> uses to accept email.  It doesn't tell us a thing about the
> message you received.
> 
>> Whenever I take the time to check, I can find many other examples
>> of this.  Just last week, I spotted joespools.com, a swimming pool
>> installer from Georgia, as another source of spam.  There have been
>> countless other cases.
>>
>> Is this an example of the fabled Botnet or Zombie operation?  That is,
>> could abacus21.com have been hijacked for the purpose of sending spam?
>> Or is the explanation just a simple matter of abacus21.com being
>> a relay?
> 
> It's most likely from a botnet or zombie.  There's big money
> out there for people who can automate the delivery of spam
> while hiding their identities.

Until they get whacked or arrested.