On Fri, Apr 30, 2004 at 06:49:59AM -0500,
Paul Russell ([log in to unmask]) said:
> Lately, I've started seeing spamming alerts for messages generated
> by a spamware program that apparently has an uninitialized value for
> the username portion of the sender address. Apparently, both the
> spammer and the spamware author have Clue Quotients with negative
> values.
>
>> A   network   wide   spamming   alert    has   just   been   received   from
>> [log in to unmask]       concerning       messages       posted       by
>> [log in to unmask] to multiple LISTSERV lists.

It gets better.  I just got one direct.  You also have, in the headers:

  Received: from %RECEIVED.cs.com (%RECEIVED.cs.com [138.128.99.64]) by
    61.18.185.210 %REC_WITH;
  Message-ID: <[log in to unmask]>
  Content-Type: text/plain; charset=%CHARSET

And, in the text/plain portion of the body (my favorite):

  %MAKE_TXT[3-6]

and nothing else.  The text/html part seems to be normal spam
(although it also has the variable charset).



--
Jim Toth
[log in to unmask]
(804) 827-1227
IT Analyst/Academic Technology