From owner-freebsd-questions  Sun Apr 27 13:03:04 1997
Return-Path: <owner-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id NAA26254
          for questions-outgoing; Sun, 27 Apr 1997 13:03:04 -0700 (PDT)
Received: from seabass.progroup.com (catfish.progroup.com [206.24.122.2])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA26249
          for <questions@freebsd.org>; Sun, 27 Apr 1997 13:03:00 -0700 (PDT)
Received: from tuna.ProGroup.COM (tuna.progroup.com [206.24.122.5]) by seabass.progroup.com (8.7.5/8.7.3) with SMTP id NAA25931; Sun, 27 Apr 1997 13:01:19 -0700 (PDT)
Received: by tuna.ProGroup.COM (SMI-8.6/SMI-SVR4)
	id NAA02441; Sun, 27 Apr 1997 13:03:08 -0700
From: craig@tuna.progroup.com (Craig W. Shaver)
Message-Id: <199704272003.NAA02441@tuna.ProGroup.COM>
Subject: Re: COME SEE THE HOTTEST scam spam on the net!!!
To: tomdean@ix.netcom.com
Date: Sun, 27 Apr 1997 13:03:08 -0700 (PDT)
Cc: questions@freebsd.org
In-Reply-To: <3363715E.156@ix.netcom.com> from "Thomas D. Dean" at Apr 27, 97 08:31:42 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> 
> This is somewhat off the subject, but, is impacting us.
> 
> I see an increase of postings of "sex-vertisements" and other
> advertisements from various sources.  The above "sex-vertisement"
> appeared on comp.unix.bsd.freebsd.announce.  I seem to be
> receiving an increasing amount of advertisement e-mail addressed to
> me.  Sometimes, I receive 10 copies of the same message, daily.
> Most of these seem to come from <someone>@savetrees.com.
> 
> Most of these mail messages originators seem to be able to hide their
> ID well enough that I cannot send a reply.
> 
> I have tried replying to "webmaster@<whatever>" and "root@<whatever"
> in an attempt to get someone to stop this, but, many times,
> that mail is returned as undeliverable.
> 
> Looking at the source of mail thru savetrees.com, there is a
> reply address, abuse@savetrees.com.  I get an automated response from
> there.  But, it may do some good to ping them?
> 
> Is there any way to determine a proper address to reply to these
> unsolicited and sometimes offensive messages?
> 
 
This is coming from cyberpromo, through agis.net.  I am sending their
management hate mail, making phone calls, etc ....

When you get this kind of email expand the headers, most of the from
and reply addresses are forged, but the received list should show
a good ip address.  Do a traceroute to each of the addresses, and 
send email to root, postmaster, and abuse at each of the addresses.
Copy the headers and your traceroutes into your replies.
 



-- 
Craig Shaver  (craig@progroup.com) (415)390-0654 
Productivity Group POB 60458 Sunnyvale, CA  94088