From owner-freebsd-questions  Sun Apr 27 20:35:50 1997
Return-Path: <owner-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id UAA17519
          for questions-outgoing; Sun, 27 Apr 1997 20:35:50 -0700 (PDT)
Received: from revolution.3-cities.com (msmith@revolution.3-cities.com [204.203.224.155])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id UAA17514
          for <freebsd-questions@freebsd.org>; Sun, 27 Apr 1997 20:35:46 -0700 (PDT)
Received: (from msmith@localhost) by revolution.3-cities.com (8.7.4/8.7.3) id UAA18695 for freebsd-questions@freebsd.org; Sun, 27 Apr 1997 20:32:00 -0700 (PDT)
From: Mark D Smith <msmith@revolution.3-cities.com>
Message-Id: <199704280332.UAA18695@revolution.3-cities.com>
Subject: Re: COME SEE THE HOTTEST scam spam on the net!!!
To: freebsd-questions@freebsd.org
Date: Sun, 27 Apr 1997 20:32:00 -0700 (PDT)
In-Reply-To: <199704272003.NAA02441@tuna.ProGroup.COM> from "Craig W. Shaver" at Apr 27, 97 01:03:08 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

>  
> This is coming from cyberpromo, through agis.net.  I am sending their
> management hate mail, making phone calls, etc ....
> 
> When you get this kind of email expand the headers, most of the from
> and reply addresses are forged, but the received list should show
> a good ip address.  Do a traceroute to each of the addresses, and 
> send email to root, postmaster, and abuse at each of the addresses.
> Copy the headers and your traceroutes into your replies.

I've been doing this for some time, but as of the last 2 weeks, I've
been getting spam from IP adresses that nslookup denies exist.  Since
I'm getting my mail through an ISP, I can't change the mail rules at
all to check for a valid IP before accepting an SMTP connection.

Mark