Click here for Uncommented version
| What I send is in Bold Red font. What the mail server sends back is in normal font. | Comments are in Green Italics |
| telnet mail.hypertouch.com 25 | Here I "call" the mail server computer (mail.hypertouch.com) from my machine on port 25. Port 25 is the "channel" used to move email on the Internet (E.g. Web pages are sent on port 80). The program I am using to make the connection is called "telnet" while the spammer likely used "Desk Top Server 98" a commercial program designed specifically to send bulk email. |
| Trying 209.31.44.214... Connected to mail.hypertouch.com. Escape character is '^]'. | "telnet" making the call to mail.hypertouch.com (which has the IP address of 209.31.44.214) |
| 220-Stalker Internet Mail Server V.1.8b3 is ready. 220 (1)ESMTP is spoken here. (2)You are welcome (3)No unsolicited email ads or violating Calf Bus Sect 17538 |
mail.hypertouch.com answers, telling what mail program is being used The mail server then says three things to me:
|
| HELO Made-Up-Name-desk98 250 209.31.44.214 cannot verify Made-Up-Name-desk98 |
I should tell the mail server
the name of the machine that is calling it. Instead I say my
name is "Made-Up-Name-desk98" (the spammer just said "desk98"). The mail server (209.31.44.214) tried to lookup my name and match it to my IP address. When of course they do not match up, it says 'You lied'--though with more diplomatic words... |
| MAIL FROM:<Made-Up-Name-emailplus@321media.com> 250 <Made-Up-Name-emailplus@321media.com> sender accepted |
This email message is from: Made-Up-Name-emailplus@321media.com |
| RCPT TO: <recipes@hypertouch.com> 250 <recipes@hypertouch.com> recipient accepted |
This email message should be sent to: recipes@hypertouch.com |
| DATA 354 Enter mail, end with "." on a line by itself |
I'm ready to send the body of the email message. The mail server says 'tell me the message, and when you are done, end with a "."' |
| From: Email Marketing <emailplus@321media.com> To: <recipes@hypertouch.com> Message-Id: <419.436278.39703056-Made-Up-Number-emailplus@321media.com> Subject: MAKE BIG $$$$$$ WITH YOUR RECIPES Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Date: Wed, 28 Apr 1999 21:29:48 -0700 Could you use more money? How's $44,440 sound? How's over a $1,000,000 sound? Our computer,money tree does all the work for you!!! You must be listed in the computer to collect all your checks. There is no way anyone can cheat as in other clubs with no control center. You get every dollar comong to you. So go for a sure thing. To get signed up right away rush $20 to CED RECIPES POB 1481.STOCKTON ,CA 95201 PLEASE INCLUDE ONE RECIEPE AND 4SASE. THIS IS ONE OF THE BEST PROGRAMS AROUND. GOOD LUCK. TO BE REMOVED FROM LIST WRITE REMOVE IN SUBJECT BOX. FOR MORE INFO RUSH SASE CED POBOX 1481,STOCKTON,CA 95201 |
I send the body of the message. Note, I can put whatever I want here, including whatever "Date:" or "From:" fields I wish. And yes,the spammer did send the messages with ugly, broken line formatting. |
| . 250 S.0000014938 message accepted for delivery |
I'm done with my spam so I send a "."
The mail server says it accepts the email |
| quit 221 209.31.44.214 closing connection |
I say "quit" The mail server says it's closing the connection |
| Connection closed by foreign host. | The "telnet" program says the connection was closed by the mail server |