[Coco] spoof e-mail "from coco3.com"

[Willard Goosey]

On Mon, Feb 22, 2010 at 05:44:44PM -0600, Roger Taylor wrote:
> I'm not sure if anybody else got one of these but someone used my 
> payment at coco3.com e-mail address and sent me the following message:
[...]
> Because of the poor spelling, I can assume it is HexStar or a Russian 
> bot again, but what do I know.

> Ok, has anybody else received an e-mail like the above?

Yes, I've gotten some of these recently.  Last one I looked at the
headers for started in .hu Except of course it was forged to look like
it was from my isp.

Try looking at the full headers for the complete path the message
followed.  It'll probably start at something like FOOBAR1234, then go
through some weird Warsaw Pact machines, then to you.

Most spam like this doesn't make it through my spam filter.  They are
getting smarter though.  People do occasionally email me legit zip
files, so I can't just automatically throw those out like I do any
sort of Windoze binaries and scripts.

Willard
-- 
Willard Goosey  goosey at sdc.org
Socorro, New Mexico, USA
I search my heart and find Cimmeria, land of Darkness and the Night.
  -- R.E. Howard