From: Dan Weston , Dec 13, 2003

Over the past month or so I have become aware that unsolicited mail is going out with forged return addresses which appear to come from the nerdworks.com domain.

This type of spam with forged return addresses is known as a "Joe-job".

The repeated e-mails you have received from "a.nesbittqt@nerdworks.com" (or any other *@nerdworks.com address) were not sent from anyone at Nerdworks. Check the routing on the email and you will see that it is not sent from Nerdworks. For example, look at the routing for one sample joe-job email to see that it originated in a Russian domain.

Received: from high.global-net.ru (213-148-25-18.global-net.ru [213.148.25.18]) by rly-xj03.mx.aol.com (v97.10) with ESMTP id MAILRELAYINXJ36-5103fd01e5b22c; Fri, 05 Dec 2003 00:57:48 -0500
Received: from capitolcredit.com (213-148-25-253.global-net.ru [213.148.25.253] (may be forged))
by high.global-net.ru (8.12.10/8.12.10) with SMTP id hB55vAIO091564;
Fri, 5 Dec 2003 08:57:49 +0300 (MSK)
Message-ID: <3ce501c3baf4$32ba1dc7$785a912b@rquuujd>
From: "Anastasie Nesbitt" <a.nesbittqt@nerdworks.com>

I hate spam as much as you do. I haven't found any way to stop the Joe-job. I can recommend POPFile as a great spam filter.