Re: chain letter

Tue, 17 Mar 1998 10:49:48 -0500

Inge wrote:
> I have got something that looks lika a chain letter 3 times
> today.

I also received three copies through the ASA list. These chain
letters are illegal in the United States. I have already printed
out a copy (with the scam participants' addresses highlighted)
and sent it to the U.S. Postal Inspector's office.

> It is sent from, and it seems that
> it reaches me via this ASA listserver.

"" is a forgery. The "from" address of E-mail is
trivially forged and cannot be trusted in general. To track these
mails you must configure your mailer to show the "Received:" lines
in the header. As they appeared here, the "Received:" lines
contained (roughly) the following information:

] Received: from [] by []
] Received: from ([]) []
] Received: from [] by
] Received: from by [..]

These are read from top to bottom. My machine says it received the
E-mail from, which we can trust, says that
it received the mail from, which may
or may not be trustworthy, says that it received the mail from which turns out to be ""
The fourth one is a forgery, because (1) the fourth line's destination
should match the third line's origin (i.e., it should be a received
line for and it isn't), and (2) the numbers 293 and 458
in the IP address are out of the legal range (0 through 255).

The junk mail probably originated at and was sent by
hijacking's mail server. It also could have originated
at, if both of the bottom "Received:" lines are forgeries.
(But junk mailers rarely forge "Received:" lines that match up, so
it's much more likely that is involved.)

> Anyone who knows how to stop this ?

I've already sent E-mail notices to (that their
SMTP server is not secure and has been abused), and
(that they are probably harboring a junk E-mailer and should pull
his/her account).

Once "" is on junk mailers' lists, a steady flow of
this trash will be sent to that address -- no matter how many
individual "junk E-mailers" get disconnected. On other mailing
lists, "junk E-mail" is kept from getting to the receipients by
delaying list submissions from non-members. (They are not sent
to the list until the list administrator checks them out, and the
list admin can throw away junk E-mail.) I don't know if that is a
practical solution for this list or not.

-- Chris (