June 2002 - WLUG - wlug.mailman3.com

Re: [Wlug] spam with header

by Andy Stewart

On Sunday 30 June 2002 1:03 pm, Theo Van Dinter wrote: > On Sun, Jun 30, 2002 at 11:32:14AM -0400, Charles R. Anderson wrote: > > And now I just received this same spam... Indeed it did come through > > wlug. We could prevent this sort of thing by only allowing subscribers > > of the list to post to the list. How does everyone feel about that? I think it is perfectly reasonable to limit posting to the list to list members only. I would prefer not to have to do that, but I really don't want the spam. Hypothetically speaking, what stops folks like this from subscribing, posting their garbage, and then unsubscribing? Are the spam generating robots that smart? I knew this would happen eventually. Perhaps we should consider ourselves lucky that it hasn't been more prevalent. Hopefully, Chuck and others can track this down and get it stopped (at least at this one source). Thanks - your efforts are appreciated! Later, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

June 30, 2002

Re: [Wlug] spam with header

by Theo Van Dinter

On Sun, Jun 30, 2002 at 11:32:14AM -0400, Charles R. Anderson wrote: > And now I just received this same spam... Indeed it did come through > wlug. We could prevent this sort of thing by only allowing subscribers > of the list to post to the list. How does everyone feel about that? It's fine by me. Alternately, if we don't want to go that route, I've developed a small set of tools (procmail/some perl/spamassassin) to filter out spam from mailing lists. It was written for use with majordomo, but it's generic enough that it should work with most any mailing list software. One of these days I'll actually finish the article I was writing about it. :| It doesn't catch 100% of the spam, but it does catch the vast majority, including the one that got through. I'd be happy to share for the wlug list if interested. -- Randomly Generated Tagline: When will I learn? The answers to life's problems aren't at the bottom of a bottle. They're on TV! -- Homer Simpson There's No Disgrace Like Home

June 30, 2002

Re: [Wlug] spam with header

by avedis＠ma.ultranet.com

Thanks, Charles. If we don't normally get serious email from people off the list, then it seems reasonable for us to only allow list members to post. I assumed that's how it already was. Greg Charles R. Anderson wrote: > And now I just received this same spam... Indeed it did come through > wlug. We could prevent this sort of thing by only allowing subscribers > of the list to post to the list. How does everyone feel about that? > > I usually look up the IP address in the Received line of the most > trusted mail server (usually the one closest to the destination, in this > case smtp.wpi.edu) Don't rely on the hostname, always use the > bracketed IP address, and look it up in the ARIN whois database: > > Received: from chat.ru ([194.143.190.11]) > by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 > > >>whois 194.143.190.11(a)whois.arin.net > > > This reveals that the owner of that IP address isn't in the Americas > (ARIN), but in Europe (RIPE), so you have to look it up again. (For > Asian hosts look it up again in APNIC, whois.apnic.net) > > >>whois 194.143.190.11(a)whois.ripe.net > > > For RIPE hosts, I usually complain to the admin-c: and tech-c: e-mail: > addresses: > > jonr(a)hedgehognet.co.uk > noc(a)uk.xo.com > tc(a)uk.concentric.com > > In this case, the e-mail addresses don't look like generic abuse > contacts, so I tried abuse@ their domains first: > > abuse(a)hedgehognet.co.uk > abuse(a)uk.xo.com > abuse(a)uk.concentric.com > > (For virus e-mails I use security@domain.) > > If those bounce, then I'll try the real e-mail addresses. > > On Sun, Jun 30, 2002 at 10:44:04AM -0400, Gregory Avedissian wrote: > avedis> Return-Path: wlug-admin(a)mail.wlug.org > avedis> Received: from paramount.ind.wpi.edu (root(a)paramount.ind.WPI.EDU > avedis> [130.215.24.199]) by acestes-fe0.ultra.net (8.8.8/ult/n26500/mtc.v2) with > avedis> ESMTP id HAA01415; Sun, 30 Jun 2002 07:06:22 -0400 (EDT) > avedis> Received: from paramount.ind.WPI.EDU (IDENT:mailman@localhost [127.0.0.1]) > avedis> by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB1Tn02769; > avedis> Sun, 30 Jun 2002 07:01:29 -0400 > avedis> Received: from smtp.WPI.EDU (root(a)smtp.WPI.EDU [130.215.24.62]) > avedis> by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB0En02743 > avedis> for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:00:14 -0400 > avedis> Received: from chat.ru ([194.143.190.11]) > avedis> by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 > avedis> for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:04:07 -0400 (EDT) > avedis> Message-Id: <200206301104.g5UB46wx028128(a)smtp.WPI.EDU> > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

June 30, 2002

Re: [Wlug] spam with header

by Charles R. Anderson

And now I just received this same spam... Indeed it did come through wlug. We could prevent this sort of thing by only allowing subscribers of the list to post to the list. How does everyone feel about that? I usually look up the IP address in the Received line of the most trusted mail server (usually the one closest to the destination, in this case smtp.wpi.edu) Don't rely on the hostname, always use the bracketed IP address, and look it up in the ARIN whois database: Received: from chat.ru ([194.143.190.11]) by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 > whois 194.143.190.11(a)whois.arin.net This reveals that the owner of that IP address isn't in the Americas (ARIN), but in Europe (RIPE), so you have to look it up again. (For Asian hosts look it up again in APNIC, whois.apnic.net) > whois 194.143.190.11(a)whois.ripe.net For RIPE hosts, I usually complain to the admin-c: and tech-c: e-mail: addresses: jonr(a)hedgehognet.co.uk noc(a)uk.xo.com tc(a)uk.concentric.com In this case, the e-mail addresses don't look like generic abuse contacts, so I tried abuse@ their domains first: abuse(a)hedgehognet.co.uk abuse(a)uk.xo.com abuse(a)uk.concentric.com (For virus e-mails I use security@domain.) If those bounce, then I'll try the real e-mail addresses. On Sun, Jun 30, 2002 at 10:44:04AM -0400, Gregory Avedissian wrote: avedis> Return-Path: wlug-admin(a)mail.wlug.org avedis> Received: from paramount.ind.wpi.edu (root(a)paramount.ind.WPI.EDU avedis> [130.215.24.199]) by acestes-fe0.ultra.net (8.8.8/ult/n26500/mtc.v2) with avedis> ESMTP id HAA01415; Sun, 30 Jun 2002 07:06:22 -0400 (EDT) avedis> Received: from paramount.ind.WPI.EDU (IDENT:mailman@localhost [127.0.0.1]) avedis> by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB1Tn02769; avedis> Sun, 30 Jun 2002 07:01:29 -0400 avedis> Received: from smtp.WPI.EDU (root(a)smtp.WPI.EDU [130.215.24.62]) avedis> by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB0En02743 avedis> for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:00:14 -0400 avedis> Received: from chat.ru ([194.143.190.11]) avedis> by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 avedis> for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:04:07 -0400 (EDT) avedis> Message-Id: <200206301104.g5UB46wx028128(a)smtp.WPI.EDU>

June 30, 2002

Re: [Wlug] spam attack

by Michelle Vadeboncoeur

On Sun, 30 Jun 2002, Charles R. Anderson wrote: CRA> On Sun, Jun 30, 2002 at 08:44:53AM -0400, avedis(a)ma.ultranet.com wrote: CRA> avedis> I just received some porn spam that has wlug address as the return CRA> avedis> address. Should I just ignore and delete, forward to spamcop, or does CRA> avedis> someone here want to deal with the spammer personally? Looks like it CRA> avedis> came from 194.143.190.11. This shit should be illegal. CRA> CRA> Just because it has the wlug return address, doesn't mean it came through the CRA> wlug email list. Forward the full headers here so we can take a look at CRA> where is really came from. although you probably also got it by now, here's the message I got, since you asked: begin forwarded message -------- >From MAILER-DAEMON8898(a)chat.ru Sun Jun 30 10:48:14 2002 Return-Path: <wlug-admin(a)mail.wlug.org> Received: from paramount.ind.wpi.edu (paramount.ind.WPI.EDU [130.215.24.199]) by eclectic.kluge.net (8.11.6/8.11.6) with ESMTP id g5UB5fR06502; Sun, 30 Jun 2002 07:05:42 -0400 Received: from paramount.ind.WPI.EDU (IDENT:mailman@localhost [127.0.0.1]) by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB16n02757; Sun, 30 Jun 2002 07:01:06 -0400 Received: from smtp.WPI.EDU (root(a)smtp.WPI.EDU [130.215.24.62]) by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB0En02743 for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:00:14 -0400 Received: from chat.ru ([194.143.190.11]) by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:04:07 -0400 (EDT) Message-Id: <200206301104.g5UB46wx028128(a)smtp.WPI.EDU> From: "Arcady 28412" <MAILER-DAEMON8898(a)chat.ru> To: <wlug(a)mail.wlug.org> X-Priority: 3 X-Mailer: The Bat! (v1.54d) Date: Sun, 30 Jun 2002 15:06:57 +0400 Mime-Version: 1.0 Content-Type: text/html; charset="ISO-8859-2" X-Warning: zoxjCpdlo1zoxj1ruj@30577 Subject: [Wlug] Real ZOO web site, welcome! <zoxjCpdlo1zoxj1ruj> Sender: wlug-admin(a)mail.wlug.org Errors-To: wlug-admin(a)mail.wlug.org X-BeenThere: wlug(a)mail.wlug.org X-Mailman-Version: 2.0beta5 Precedence: bulk Reply-To: wlug(a)mail.wlug.org List-Id: Worcester Linux Users Group <wlug.mail.wlug.org> [ The following text is in the "ISO-8859-2" character set. ] [ Your display is set for the "ISO-8859-1" character set. ] [ Some characters may be displayed incorrectly. ] <html>  <body text="#000000" bgcolor="#FFFFFF"> I got your email from ICQ, may be it will be interested? The BEST zoo site on the @net!  Sex With Dogs Horse Blow Jobs.  Snake Fuck. <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">REAL ANIMAL FUCKING!</a> 100% HARDCORE!  <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">rol.rape-sexy.com</a> <hr> <a href="http://rol.rape-sexy.com/unsub.cgi?em=wlug@mail.wlug.org">unsub</a> Good luck.  </body></html> _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug -------- end forwarded message

June 30, 2002

spam with header

by Gregory Avedissian

---------- Forwarded Message ---------- Return-Path: wlug-admin(a)mail.wlug.org Received: from paramount.ind.wpi.edu (root(a)paramount.ind.WPI.EDU [130.215.24.199]) by acestes-fe0.ultra.net (8.8.8/ult/n26500/mtc.v2) with ESMTP id HAA01415; Sun, 30 Jun 2002 07:06:22 -0400 (EDT) Received: from paramount.ind.WPI.EDU (IDENT:mailman@localhost [127.0.0.1]) by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB1Tn02769; Sun, 30 Jun 2002 07:01:29 -0400 Received: from smtp.WPI.EDU (root(a)smtp.WPI.EDU [130.215.24.62]) by paramount.ind.wpi.edu (8.11.6/8.11.6) with ESMTP id g5UB0En02743 for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:00:14 -0400 Received: from chat.ru ([194.143.190.11]) by smtp.WPI.EDU (8.12.5/8.12.5) with SMTP id g5UB46wx028128 for <wlug(a)mail.wlug.org>; Sun, 30 Jun 2002 07:04:07 -0400 (EDT) Message-Id: <200206301104.g5UB46wx028128(a)smtp.WPI.EDU> From: "Arcady 28412" <MAILER-DAEMON8898(a)chat.ru> To: <wlug(a)mail.wlug.org> X-Priority: 3 X-Mailer: The Bat! (v1.54d) Date: Sun, 30 Jun 2002 15:06:57 +0400 Mime-Version: 1.0 Content-Type: text/html; charset="ISO-8859-2" X-UIDL: ae92ef1fea768b8ce77d61b44fbde8c9 Status: R X-Status: N X-Warning: zoxjCpdlo1zoxj1ruj@30577 Subject: [Wlug] Real ZOO web site, welcome! <zoxjCpdlo1zoxj1ruj> Sender: wlug-admin(a)mail.wlug.org Errors-To: wlug-admin(a)mail.wlug.org X-BeenThere: wlug(a)mail.wlug.org X-Mailman-Version: 2.0beta5 Precedence: bulk Reply-To: wlug(a)mail.wlug.org List-Id: Worcester Linux Users Group <wlug.mail.wlug.org> <html>  <body text="#000000" bgcolor="#FFFFFF"> I got your email from ICQ, may be it will be interested? The BEST zoo site on the @net!  Sex With Dogs Horse Blow Jobs.  Snake Fuck. <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">REAL ANIMAL FUCKING!</a> 100% HARDCORE!  <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">rol.rape-sexy.com</a> <hr> <a href="http://rol.rape-sexy.com/unsub.cgi?em=wlug@mail.wlug.org">unsub</a> Good luck.  </body></html> _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug <html>  <body text="#000000" bgcolor="#FFFFFF"> I got your email from ICQ, may be it will be interested? The BEST zoo site on the @net!  Sex With Dogs Horse Blow Jobs.  Snake Fuck. <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">REAL ANIMAL FUCKING!</a> 100% HARDCORE!  <a href="http://rol.rape-sexy.com/?refid=zoxjCpdlo1zoxj1ruj">rol.rape-sexy.com< /a> <hr> <a href="http://rol.rape-sexy.com/unsub.cgi?em=wlug@mail.wlug.org">unsub</a> Good luck.  </body></html> _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug -------------------------------------------------------

June 30, 2002

Re: [Wlug] spam attack

by Charles R. Anderson

On Sun, Jun 30, 2002 at 08:44:53AM -0400, avedis(a)ma.ultranet.com wrote: avedis> I just received some porn spam that has wlug address as the return avedis> address. Should I just ignore and delete, forward to spamcop, or does avedis> someone here want to deal with the spammer personally? Looks like it avedis> came from 194.143.190.11. This shit should be illegal. Just because it has the wlug return address, doesn't mean it came through the wlug email list. Forward the full headers here so we can take a look at where is really came from. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

June 30, 2002

Re: [Wlug] spam attack

by desdinova＠soupforare.net

On 30 Jun 2002 at 8:44, avedis(a)ma.ultranet.com wrote: > I just received some porn spam that has wlug address as the return > address. Should I just ignore and delete, forward to spamcop, or does > someone here want to deal with the spammer personally? Looks like it > came from 194.143.190.11. This shit should be illegal. [Bad joke] Well, it *is* but not in every state [/Bad joke] :P James > Awaiting further instructions... > > Greg > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

June 30, 2002

spam attack

by avedis＠ma.ultranet.com

I just received some porn spam that has wlug address as the return address. Should I just ignore and delete, forward to spamcop, or does someone here want to deal with the spammer personally? Looks like it came from 194.143.190.11. This shit should be illegal. Awaiting further instructions... Greg

June 30, 2002

Real ZOO web site, welcome! <zoxjCpdlo1zoxj1ruj>

by Arcady 28412

June 30, 2002