|
|
| ||||||||||||||||||
|
|
eMail Broadcast freeware for home office personal PC | Bounce email
manager
freeware for returned emails |
STOP SPAM |
|
|
|
| ||||||||||||||||||
|
This line purports to show where bullets.cybercon.com actually got the mail from that it relayed to me. Please note that " 199.217.156.7 " does not belong to hd70-155.hil.compuserve.com How do we know this? Simple, we use a tool called
nslookup (available for many platforms). Here is what we see: What does this all mean? It means that the first part of the line is bogus, but the second part is correct. We know that because most mail server software will report accurate information about where it got the mail from in most cases (it has to be misconfigured or older brain-dead software to be completely silent about where it got the mail from). It has been my observation that you can trust the IP address found within the square brackets, i.e. [199.217.156.7] So, we have a reasonable expectation that the spammer used a dialup account on Compuserve to send this spam. We still do not know if the ISP it was sent through is innocent or guilty, though. We will complain to Compuserve at abuse@compuserve.com, for starters.
>Received: from usr15-dialup53.mx1.Willowsprings.mci.net [166.55.38.181] Thus, the very top message was from my mailer, receiving the mail. The one right under that was from the ISP's mailer, sending it to me and reporting where it got it from. The rest is junk, designed to confuse us. Don't be fooled by "Authenticated sender" messages. They are easily faked, and mean nothing. They don't "authenticate" anything.
|
|
|
| ><HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> >Everybody loves Mr. Chicken! Ah, here's where it gets amusing! Now, if we follow Rush Limbaugh's advice and "follow the money," it would appear that the perpetrator of this spam has a mailbox at answerme.com and his handle is MrChicken What do we know about answerme.com ? Well, it happens that Cyberpromo is the owner of this particular domain. That kind of ends that trail for us, because Cyberpromo is a spamhaus, and their upstream provider, AGIS, is well aware of it and supports it. AGIS is a "backbone" on the Internet, so there is no one above them to complain to. Still, since Cyberpromo CLAIMS to be against illegal relaying, we can send a copy of the complaint to relayabuse@cyberpromo.com and also to abuse@agis.net This won't do anything, but what the heck.
So, that ends the spam. Now, what about the original ISP who sent the spam to me? Innocent party or spamhaus? Well, let's take a look at their web page: http://www.cybercon.com/aup.html Now, it would appear from looking at their homepage (http://www.cybercon.com/) and also by "reading between the lines" of their AUP, that Cybercon is a spamhaus, however thinly disguised. That does not mean that they authorized this spam, or that they were not hijacked. But the suspicion is definitely there. In any case, they get a copy of the complaint as well. If they were hijacked, they may wish to investigate further and perhaps initiate legal action. If they were not, they may remain silent on the matter. In any case, they also have an upstream provider, which can be determined by doing a traceroute So, we know they get their service from mci.net
|
|
|
|
| What else do we know about the elusive Cybercon? Let's check their IP range, to see who might own it. We can use whois  whois 199.217.156.0 [rs.internic.net] STARNET, L.L.C. (NETBLK-STARNET-CBLK) P.O. Box 6286 St. Louis, MO 63006-6286 Netname: STARNET-CBLK Netblock: 199.217.128.0 - 199.217.255.0 Maintainer: STLL Coordinator: Myers, Chris B. [President] (CBM10) chris@STARNET.NET (314) 227-3136 (FAX) (314) 716-6163 Domain System inverse mapping provided by: ADMIN.STARNET.NET 199.217.253.10 NEWS.STARNET.NET 199.217.253.11 NS1.DRA.NET 192.65.218.14 Record last updated on 30-Aug-96. So, it appears that Starnet owns their Class "C" license. Now, let's jump into
see 102--DejaNews (the land of "all my sins remembered") and see what we can find out: Upon reading the messages in question, it appears that they once complained that they had been mischaracterized as "cybercoM.com" [nothing of consequence found]
|
|
|
|
| So, it appears that MrChicken has posted an identical message a few days ago in UseNet. Just one, so not spam, although since it just happened, the others may not have been picked up by dejanews yet. www.dejanews.com Still, we see that sprynet.net was used, not cybercon.com . It begins to look as though cybercon.com is not guilty, but either was hijacked or has a bad actor on their hands. So, we still complain to Cybercon, but scratch abuse@mci.net (their upstream provider) from the list. From: bmattocks@comp-sol.com >Received: from bullets.cybercon.com (bullets.cybercon.com [199.217.156.7])
OK, folks, that's it for tonight.
Notes:
|
|
|
Home | Contact Us | Privacy Policy | Guest Book | Useful Sites Support | Purchase | Product Info | Download Bounce
eMail Manager Freeware |
|
Any
feed-back or suggestions? Please
