Proxy-hopping WAS: RE: [Assp-user] Greylisting

[<dk...@pw...>]

John,

> were these all to the same recipient, 

yup.

> and did you check the spam collection
> (based on time) to see if they were identical emails? 

The emails themselves were base64 encoded so it was hard to tell at first.
So I stripped out all headers and blank likes them md5sum'd them to get
"259f5bc3b5bc53c7bf2039125e9fb8eb" on all 7 of them.

For posterity I attached them to a private message to you. They're in a
time-stamp "preserved" tar.gz archive.

> It's interesting behavior. I think I've seen it too... It's like, "it
didn't 
> work from this ip, let's try another -- maybe they'll like it then" seems 
> foolish... but then so does a lot of spam practices. Note that it's 
> interesting software that is able to proxy-hop like that. 

I've noted a few of them that follow the multi-proxy pattern, but this was
the first to repeat an IP. Then again I haven't really been using any apps
to track it, just eyeing it from time to time.

> Good software... dumb users.

Man.. Isn't that the case a lot?
:)

-- 
Dave