where'd this spam come from?

[zoobie]

I'm suddenly receiving spam to a non-profit site. Since I use the PHP mail() function and they can't see my addy, they must have sent me an email in which I replied thusly showing them my addy.

Once I started receiving these, I replied that this was a non-profit site but the email came back saying it was undeliverable with no such address.

Here's the headers...Is it coming from thebat.net?



Return-path: <2825consoon@zoomamap.com>
Envelope-to: admin@mysite.com
Delivery-date: Thu, 21 Sep 2006 07:05:08 -0400
Received: from zoob by rachel.c0d3w4lk3r.com with local-bsmtp (Exim 4.52)
id 1GQMMd-00073s-Bo
for admin@mysite.com; Thu, 21 Sep 2006 07:05:08 -0400
X-Spam-Checker-Version: SpamAssassin 3.1.5 (2006-08-29) on
server410.server-center.net
X-Spam-Level: ***
X-Spam-Status: No, score=3.3 required=5.0 tests=DATE_IN_FUTURE_03_06,
HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET autolearn=no version=3.1.5
Received: from [89.38.64.65] (helo=ovidiu-3n0i43y3)
by server410.server-center.net with esmtp (Exim 4.52)
id 1GQMMY-00072j-QR
for admin@mysite.com; Thu, 21 Sep 2006 07:05:07 -0400
Received: from 212.27.35.136 (HELO mrelay2.online.net)
by mysite.com with esmtp (TG4A2QLG C0DAY9)
id ZQ293I-9BB076-5V
for admin@mysite.com; Thu, 21 Sep 2006 21:04:29 +0480
Date: Thu, 21 Sep 2006 21:04:29 +0480
From: "Horacio Hairston" <2825consoon@zoomamap.com>
X-Mailer: The Bat! (v3.62.14) Educational
X-Priority: 3 (Normal)
Message-ID: <525725302.57166019133204@thebat.net>
To: admin@mysite.com
Subject: THURSDAY.while experiencing
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------29C386E0C3F05E0"
X-Spam: Not detected

------------29C386E0C3F05E0
Content-Type: multipart/alternative;
boundary="----------29CAB4F05E0C3F05"


------------29CAB4F05E0C3F05
Content-Type: text/plain; charset=Windows-1252
Content-Transfer-Encoding: quoted-printable


If I ever get my hands on this sorry sucker...

[liorean]

It can be from a mail addy collector that has installed itself on the computers of anybody whose mail you have answered to, also.

I'd suggest you to take a look at <uri:http://www.rahul.net/falk/index.html>

[zoobie]

Well, thebat.net seems to be an email service which may account for the spam always changing it's addy...probably thru a script.
I'll take a look at that page.
Thx