Re: spamvertizing on Level3
- Date: Tue, 26 Mar 2002 11:18:11 +0100 (MET)
An extract of my previous mail is included at the end of this. Before
that, however, a piece of spam that arrived fairly close in time. Now,
despite my address seems to be on most spam CDs I have never received
spam from that source before.
Hm.
o Pure coincidence.
o Spammers have joined anti-spam@localhost.
o Spammers trawl anti-spam@localhost archives.
o paul@localhost forwarded my address to them.
o <caroline.skene@localhost forwarded my address to them.
Hm, hm, hm.
Dear Level3, please see to that my mail address is removed from what-
ever address catalogues you or your customers keep. The spam was un-
wanted and I do NOT want to receive more of that kind. Thank you.
Gunnar Lindberg
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>From newsletter@localhost Fri Mar 22 12:12:55 2002
>Return-Path: newsletter@localhost
>Received: from mailer1.goodcleanporn.com (mailer1.goodcleanporn.com [209.245.127.11])
> by wentzl.cdg.chalmers.se (8.8.8/8.8.8) with SMTP id MAA26215
> for lindberg@localhost; Fri, 22 Mar 2002 12:12:52 +0100 (MET)
>From: "Missing You" newsletter@localhost
>To: lindberg@localhost
>Date: Fri, 22 Mar 2002 03:04:38 -0800
>Message-Id: <6pa30e11c3ee7.6aqteq86s71at6up1x@localhost
>Received: from mailer1.goodcleanporn.com [209.245.127.11] by 7n35u.mailer1.goodcleanporn.com with SMTP; Fri, 22 Mar 2002 03:04:38 -0800
>Subject: 4 Secret Sex Sites -- Just Released (ADV:ADLT)
>Content-Type: text/html;
> charset=us-ascii
>Content-Transfer-Encoding: 7BIT
>X-Mailer: cdg.chalmers.se!lindberg#tntc14bGCPO03212002*
>Reply-To: remove@localhost
><HTML>
><HEAD>
><TITLE>THE NETS TOP CARTOON SITES!</TITLE>
><META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
><META content="MSHTML 5.50.4613.1700" name=GENERATOR>
></HEAD>
><BODY BGCOLOR=BLACK TEXT=WHITE ALINK=RED VLINK=GOLD LINK=GOLD>
><img src="http://www.goodcleanporn.com/sites/tntc14b/tntc14bGCPO03212002.gif?M=tntc14bGCPO03212002&ID=lindberg@localhost; width="1" height="1">
> ...
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>From owner-anti-spam-wg@localhost Thu Mar 21 14:46:58 2002
>Delivered-To: lists-anti-spam-wg-out@localhost
>From: Gunnar Lindberg lindberg@localhost
>Date: Thu, 21 Mar 2002 14:46:38 +0100 (MET)
>Message-Id: <200203211346.OAA14518@localhost>
>To: anti-spam@localhost, paul@localhost
>Subject: Re: spamvertizing on Level3
>Cc: caroline.skene@localhost
>In-Reply-To: <005801c1d0da$ca5b6600$0400a8c0@localhost>
>Hm, interesting idea popped up... Let's "grep | sort -u" in syslog...
>Now, of course hostnames don't say much, do they :-)? Or do they?
>NB, it's the authentic .in-addr.arpa (PTR) names, it's n o t "HELO".
>Numbers in () are the actual # of calls those hosts made that day.
>Single day syslog.
> Gunnar Lindberg
>whois -h whois.arin.net
>Level 3 Communications, Inc. (NETBLK-LEVEL3-CIDR)
> Netblock: 209.244.0.0 - 209.247.255.255
>/var/log/syslog (70)
>relay=mailer1.goodcleanporn.com [209.245.127.11]
>relay=mailer4.goodcleanporn.com [209.245.127.14]
>relay=mailer5.goodcleanporn.com [209.245.127.15]
>relay=mailer6.cuttingedgeoffers.com [209.245.127.66]
>relay=mailer7.cuttingedgeoffers.com [209.245.127.67]
> ...
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++