[CLUE-Talk] 9 News Spam ...

[Steve Fry]

Kirk Rafferty wrote:
> Looks like it's a hoax.  You didn't include the envelope headers of the
> email (crucial in tracking spam), but look at the domain it's from:
> ronindev.com.  

Yes - in the headers it also shows that it came from ronindev.com.

> That's a domain registered to somebody in AR.  9News' domain
> is KUSA.com.  While it's possible that, if 9News *were* spamming, they
> might want to use a different domain, it's pretty suspicious all the same.

> Also, notice the link:
> http://www.ronindev.com/kusa/etm.dll/04252002-C?09NEWSSPAMSUCKS
 
> I doubt 9News, even if they were spamming, would have a link ending in
> "9NEWSSPAMSUCKS".

Regarding that link, in my original post, I stated that "I played with
the variable a little - but it should still work for you." - I'm the one
that came up with that.  I didn't want to be sending out a link with
some sort of encrypted ID related to me to this (and other) list(s). 
Therefore, I discovered that if I played with the variable value, I
could still let everyone get to that page - and maybe have a little fun
with their logs at the same time!

Steve

-----------------------------------------------
              IR3W Web Services
   Steve Fry - steve at ir3w.com - 720-233-3WWW
    Web Site Design, Development, and More!
             http://www.ir3w.com
-----------------------------------------------