Re: Persistant worm sender

Turan Fettahoglu <[email protected]> organized electrons in article
news:[email protected] that appeared as follows:
> I keep on receiving one or two worm e-mails like this. It comes from a
> Nigerian address and contains a Bagle worm.
>
> SpamCop says this address is listed.
>
> The complaint address seems to be the sender's address. What would be
> a reasonable address for a complaint - without exposing oneself to
> the sender? It seems to be the revenge of a Nigerian scam artist.
>
> Kind regards
> Turan Fettahoglu
>
> Return-Path: Nadine. [email protected]
> Received: from filter04.aul.t-online.de ([127.0.0.1]) by localhost
>  with smtp id 1ClJgH-0HeykS0; Mon, 3 Jan 2005 05:18:57 +0100
> Received: from mailin07.aul.t-online.de [172.18.16.135] by
> filter04.aul.t-online.de id EKDNPR61 outgoing id HTRUTAYU;
>    03 Jan 2005 05:18:57 +0100
> Received: from dorinet4.com ([213.181.81.242]) by
>  mailin07.sul.t-online.de with smtp id 1ClJfy-102jAG0; Mon, 3 Jan
> 2005 05:18:38 +0100
> Date: Mon, 03 Jan 2005 05:18:32 -0800
> To: "Turan.Fe" <[email protected]>
> From: "Nadine.Ruchti" <Nadine. Ruchti @ somewhere-in-switzerland.ch>
> Subject: **SPAM** **SPAM BLIST 213.181.81.242** *SPAM* Forum notify
> Message-ID: <[email protected]>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>         boundary="--------uloaytxhnfkqcwtblxqs"
> X-WW-Spam-Likelihood: profile=default;Bayesian=50, BodyRules=50,
> DBL=50, HeaderRules=99, Mailshell=94, total=100
> X-TOI-SPAM: y;1;2005-01-03T04:19:11Z
> X-TOI-MSGID: f48ad91d-79a2-4112-9b08-b4d5522eaf2c
> X-Seen: false
> X-Bayesian-Result: Spam (100)
> X-Bayesian-Words: ajilon 99 aktivitäten 99 angewendet 99 bedrohung 99
> dorinet4 99 erzeugt 99 gefunden 99 maßnahmen 99 mcafee 99 melden 99
> mögliche 99 nadine 99 ruchti 99 teile 99 verdächtigen 99
> X-HTMLM-Score: 0
> X-HTMLM-Attach: MD5=594B38EE3AB6AACBE9A7A25FA463B43C
> Name=McAfee_EmailScanReport.txt
> X-SpamPal: SPAM BLIST 213.181.81.242
> X-Blist-Pattern: 213.181.64.0 - 213.181.95.255

At present, reports for 213.181.81.242 would go to
[email protected].  Even spammers deserve to know that their
systems are infected, but you need not reveal your important secret
email addresses to them while reporting such infected systems.
spammotel.com and sneakemail.com can help you with this task, using the
Manual Report guidelines at
http://forum.spamcop.net/forums/index.php?showtopic=2530#entry19972 .

Please don't try to send reports to the Organizational Contact for
213.181.64.0 - 213.181.95.255 (CIDR 213.181.64.0/19), [email protected]
because micro.com.ng has no nameservice.

-- 
Thanks and Best Regards,  Jeff G.
I have been a SpamCop User/Member/Customer since 1999 and am a
Moderator of the new web-based forums (now the primary method for
getting help, http://forum.spamcop.net).  Please reply via Forum, Group,
or List only.