<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
actually much of the SPAM is from the US, it is just re-routed through
a foreign ISP, to mask it's origin... the email below appears to be from
Korea --  ssymail.ssy.co.kr (ssymail.ssy.co.kr [203.244.4.3] -- but
is actually from the USA via att.net --  mis.prserv.net [12.64.61.135]
!  The Hotmail email may also be forged, but if it is not Microsoft/Hotmail
is very good at removing offenders.  In response to this SPAM I forwarded
this MEssage with full headers to:  abuse@att.net and abuse@hotmail.com
<p>look for the first "Received:" -- looking bottom up -- as a message
is re-routed a new "Received:" is added to the top of the heap.
<p>below, the first[originating] IP address is 12.64.61.135.
<p>HTH,
<p>Valdis Krebs
<br><A HREF="http://www.orgnet.com">http://www.orgnet.com</A>
<br> 
<br> 
<blockquote TYPE=CITE>
<pre>Return-Path: 
                           <etiuto73dxfu@hotmail.com>
                  Received: 
                           from ssymail.ssy.co.kr (ssymail.ssy.co.kr [203.244.4.3]) by indefatigable.cnchost.com id
                           GAA12437; Sat, 5 Jan 2002 06:40:24 -0500 (EST) [ConcentricHost SMTP MX 1.27]
                     From: 
                           etiuto73dxfu@hotmail.com
                  Received: 
                           from 12.64.61.135 (slip-12-64-61-135.mis.prserv.net [12.64.61.135]) by ssymail.ssy.co.kr
                           (8.8.5/8.8.5) with SMTP id LAA14158; Sat, 5 Jan 2002 11:36:28 GMT
               Message-ID: 
                           <200201051136.LAA14158@ssymail.ssy.co.kr>
                       To: 
                           <oys9b7qrp@hotmail.com>
                   Subject: 
                           Do Something About Your Hair Loss Now! Receive $100 in Free..
                     Date: 
                           Sat, 05 Jan 2002 19:36:12 -0500
            MIME-Version: 
                           1.0
             Content-Type: 
                           text/html; charset="iso-8859-1"
 Content-Transfer-Encoding: 
                           quoted-printable
                X-Priority: 
                           3
         X-MSMail-Priority: 
                           Normal
                 Errors-To: 
                           amnfs43dygl@pobox.sk
                 X-Mailer: 
                           Microsoft Outlook Express 5.50.4133.2400
          X-Mozilla-Status: 
                           9001
         X-Mozilla-Status2: 
                           00000000
                  X-UIDL: 
                           17487




 SPAM follows...</pre>
</blockquote>

<p>air-l-request@aoir.org wrote:
<p>[snip]
<blockquote TYPE=CITE> 
<br>I observe that much of this material seems to come via third-world
<br>nations, especially Russia. This means that European privacy laws --
<br>and North American laws, when they are created -- will not be of much
<br>use in stopping the problem.</blockquote>
[snip]</html>