Spyware Warrior

wyrmrider

"Best anti-spyware program"

Return-Path: <3NKBYX@mminternet.com>
Received: from N711P013.adsl.highway.telekom.at ([62.47.32.205])
by mx-a065a23.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1d6TAb1Jf3NZFpE0
Thu, 3 Mar 2005 08:53:18 -0800 (PST)
Received: from ourselves (155.56.106.223)
by p63.adele.aeronautic.apologetic.globalnet.co.uk
(InterMail vR.8.01.86.76 286-8513-929-10314-12-072010998) with ESMTP
id <305677.TEZ7619.m752-mail.bose.crotchety.net.cable.rogers.com@embryonic>
for <mdfmuse@earthlink.net>; Thu, 03 Mar 2005 11:47:43 -0500
Message-ID: <34510zv019whe$31avj2$43a288j6@excursion>
Reply-To: "spyware shield" <3NKBYX@mminternet.com>
From: "spyware shield" <3NKBYX@mminternet.com>
To: <mdfmuse@earthlink.net>
Subject: Best Anti-Spyware Program
Date: Thu, 03 Mar 2005 22:52:43 +0600
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="%OLATTACH1"
X-ELNK-AV: 0

message text below-wyrmrider

message source

Status: U
Return-Path: <3NKBYX@mminternet.com>
Received: from N711P013.adsl.highway.telekom.at ([62.47.32.205])
by mx-a065a23.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1d6TAb1Jf3NZFpE0
Thu, 3 Mar 2005 08:53:18 -0800 (PST)
Received: from ourselves (155.56.106.223)
by p63.adele.aeronautic.apologetic.globalnet.co.uk
(InterMail vR.8.01.86.76 286-8513-929-10314-12-072010998) with ESMTP
id <305677.TEZ7619.m752-mail.bose.crotchety.net.cable.rogers.com@embryonic>
for <mdfmuse@earthlink.net>; Thu, 03 Mar 2005 11:47:43 -0500
Message-ID: <34510zv019whe$31avj2$43a288j6@excursion>
Reply-To: "spyware shield" <3NKBYX@mminternet.com>
From: "spyware shield" <3NKBYX@mminternet.com>
To: <mdfmuse@earthlink.net>
Subject: Best Anti-Spyware Program
Date: Thu, 03 Mar 2005 22:52:43 +0600
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="%OLATTACH1"
X-ELNK-AV: 0

This is a multi-part message in MIME format.

--%OLATTACH1
Content-Type: multipart/alternative;
boundary="%OLATTACH2"

--%OLATTACH2
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Get a capable html e-mailer

--%OLATTACH2
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"multipart/alternative; charset=3D=
us-ascii">
<META content=3D3D"MSHTML 6.00.2900.2604" name=3D3DGENERATOR>
<STYLE></STYLE>
</HEAD>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span style=3D'font-size:=
10.0pt;
font-family:Arial'><a href=3D"http://www.morpheus-spyware.info?aid=3D624">=
<font
color=3Dblack><span style=3D'color:windowtext;text-decoration:none'><img b=
order=3D0
id=3D"_x0000_i1027" src=3D"cid:image001.gif@01C49EB0.FFD29500"></span></fo=
nt></a><o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span style=3D'font-size:=
10.0pt;
font-family:Arial'><a href=3D"http://www.spyware-finder.info/discon">Off
this camp-aign</a><o:p></o:p></span></font></p>

</div>

</body>

</html>

Over 90% of internet connected pc’s are contaminated

Spyware could be monitoring your every click, and that information could be used to harm you!

Protect your privacy, act now!

You’re entitled to a free scan

--%OLATTACH2--

--%OLATTACH1
Content-Type: image/gif;
name="image001.gif"
Content-Transfer-Encoding: base64
Content-ID: <image001.gif@01C49EB0.FFD29500

ld · Posted: Thu Mar 03, 2005 5:00 pm Post subject:

That definately looks like spam and does not appear to be from mminternet.com. It doesn't look like earthlinks mailservers are SPF aware. mminternet.com has SPF records and if I am reading them right then the only valid email server is what is in their MX records. Here are the MX records for mminternet.com:
mail-1.mminternet.com internet address = 216.86.207.16
mail-2.mminternet.com internet address = 216.86.207.17
mail-3.mminternet.com internet address = 216.86.207.18

It appears the email came from N711P013.adsl.highway.telekom.at ([62.47.32.205]) which looks like a DSL user in Austria.

This appears to be a fake header:
Received: from ourselves (155.56.106.223)
by p63.adele.aeronautic.apologetic.globalnet.co.uk