Date: Tue, 13 Jan 2004 19:48:27 -0500
From: Ronald D. Edge 
Newsgroups: news.admin.net-abuse.email
Subject: [SPAM] Cyberdealsusa? Ecooloffers? Laurel Canyon CA? Topica on cogentco.com.

This is odd. At one of my ISP addresses that for the two years or so of its 
existence has been virtually spam-free, today I get two that appear to be from 
Topica in cogentco.com space, at least the rDNS claims it is under 
"Topica.demarc.cogentco.com."

I assume they are trying to be CAN SPAM compliant, since each includes the same 
street address with a claim you can remove yourself from future mailings.

Both are directly from:
  out013.picaper.com (out013.picaper.com [38.113.203.33]

Of course each also claims the exact same baldfaced lie, as follows:
"This is a commercial advertisement which you have received because you have
registered to receive special offers and promotions through one of our 
affiliate networks."

This posted to http://mainsleazespam.com as example of mainsleaze spam under 
pretending to be legal under the "You CAN SPAM Act" of 2003.

1. From: ChristiansDating 
   Subject: Singles & Romance Connecting

with this instruction:
  To be removed from future mailings please click on the unsubscribe
  link or send postal mail to the following corporate address:

  3940 Laurel Canyon Blvd., #667
  Studio City, CA 91604

This one only had a link to:
  a href="http://cyberdealsusa.com/maabPltaa3nlYad9uPbe/"> img
  src="http://freepromosdaily.com/realcafe/V3_@-the-cafe_A.jpg"
[In the original spam, the link was in inline link to a jpeg, so 
 the image appeared in your email if you were reading in HTML
 enabled email.]

and then:

2. From: "X10.com" 
   Subject: Protect Your Home - Easy & Affordable Home Solutions

with this instruction:
  To be removed from future mailings please click on the unsubscribe
  link or send postal mail to the following corporate address:

  3940 Laurel Canyon Blvd., #667

with a remove link:
href="http://cyberdealsusa.com/?aaacTR.ad9uPb.aabPlt.aaaaae.aaaaaa.xxxxxxxx@xxx
x.xx.us"  (my address munged)

cyberdealsusa.com traces to:
  Topica.demarc.cogentco.com [38.112.8.58]
and then:
  cu.picaper.com [38.113.203.208]

This one had links such as this:
  http://ads.x10.com/?bHNlZWRjb3JuZW1haWw3LmRhd=RND|xcam

with a final remove link:
http://ecooloffers.com/?aaacTR.ad9uPb.aabPN3.aaaaab.aaaaaa.xxxxxxxx@xxxx.xx.us
  (my address munged)

ecooloffers.com traces to:
 Topica.demarc.cogentco.com [38.112.8.58]
and then:
  cu.picaper.com [38.113.203.208]


Both have return addresses supposedly at esweetdeals.com.

So: spam from cogentco.com space. Not a shock. Spam from Topica? 
Not a shock. But I suspect a harbinger of things to come.

Headers below.

---
Ron.
http://edgeinfotech.com
http://mainsleazespam.com

===========================================
Return-Path: 
Received: from out013.picaper.com (out013.picaper.com [38.113.203.33])
        by kirkwood.hoosier.net (8.11.6/8.11.6) with SMTP id i0CMoRw04806
        for ; Mon, 12 Jan 2004 17:50:27 -0500
Mime-Version: 1.0
Content-Type: multipart/alternative;
    boundary="1070459706.1463792894.1073941203"
To: xxxxxxxx@xxxx.xx.us
From: ChristiansDating 
Subject: Singles & Romance Connecting
Date: Mon, 12 Jan 2004 13:10:15 -0800
Message-ID: <469837899-1463792638-1073941815@cyberdealsusa.com>
Errors-To: 
Reply-To: 
Parts/Attachments:
=============================================
Return-Path: 
Received: from out023.picaper.com (out023.picaper.com [38.113.203.43])
        by kirkwood.hoosier.net (8.11.6/8.11.6) with SMTP id i0D2C4w22548
        for ; Mon, 12 Jan 2004 21:12:04 -0500
Mime-Version: 1.0
Content-Type: text/plain
To: xxxxxxxx@xxxx.xx.us
From: "X10.com" 
Subject: Protect Your Home - Easy & Affordable Home Solutions
Date: Mon, 12 Jan 2004 13:05:02 -0800
Message-ID: <1884067889-1463747838-1073941502@ecooloffers.com>
Errors-To: 
Reply-To: 
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by kirkwood.hoosier.net
    id i0D2C4w22548
=============================================