Re: Spam .. Find the sender !

["Jay Stewart" <cosmo () olywa net>]

Jan,

153.35.0.0/16, 153.36.0.0/16, 153.37.0.0/16 *all* belong to UU.NET and are
used for multiple nationwide ISP dialups.  Send mail to abuse () uu net, and
consider blocking these prefixes from connecting to your SMTP servers.

Jay Stewart
Vice President
Olympia Networking Services - "Olympia's Premier ISP"
Phone (360) 753.3636  Fax (360) 357.6160  http://www.olywa.net

---------------------
C:\>whois -h whois.arin.net 153.37.0.0

UUNET Technologies, Inc. (NET-UUNETCUSTB37)
   3060 Williams Drive
   Fairfax, VA 22031

   Netname: UUNETCUSTB37
   Netnumber: 153.37.0.0

   Coordinator:
      Uunet, AlterNet - Technical Support  (OA12-ARIN)  help () UUNET UU NET
      +1 (800) 900-0241
   Alternate Contact:
      UUNET Postmaster  (UUPM-ARIN)  postmaster () uunet uu net
      703-206-5440


   Domain System inverse mapping provided by:

   HUGIN.UU.NET                 153.39.242.112
   MUNIN.UU.NET                 153.39.242.113
   AUTH60.NS.UU.NET             198.6.2.181

   Record last updated on 21-May-97.
   Database last updated on 8-May-98 16:08:58 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and nic.ddn.mil for MILNET Information.


-----Original Message-----
From: Jan Czmok <czmok () ipf de>
To: nanog () merit edu <nanog () merit edu>
Date: Monday, May 11, 1998 9:19 AM
Subject: Spam .. Find the sender !


> Hi!
>
> We got some spam mail from
> > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
> (153.37.184.151)
> >   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
>
> and i cannot query the database (arin , ripe or radb) for the owner of
> this network.
> Any hints ?
>
> If we can find the sender, then we go for a hunt against this spammers.
>
> So far...
>
> Greetings
>
>
> Jan Czmok
> IPF.NET NOC
>
> more headers :
>
> Return-Path: hioqibua38 () msn com
> > Delivery-Date: Sun May 10 04:48:03 1998
> > Received: (qmail 26693 invoked from network); 10 May 1998 04:48:03
> -0000
> > Received: from claven.cse.psu.edu (HELO cse.psu.edu) (130.203.3.50)
> >   by finch.cse.psu.edu with SMTP; 10 May 1998 04:48:03 -0000
> > Received: from relay.ipf.net (relay.ipf.net [195.88.0.13]) by
> cse.psu.edu (8.8.8/8.7.3) with SMTP id AAA21505 for
> <0000 () 0000 cs psu edu>; Sun, 10 May 1998 00:48:02 -0400 (EDT)
> > Date: Sun, 10 May 1998 00:48:02 -0400 (EDT)
> > From: hioqibua38 () msn com
> > Received: (qmail 13706 invoked from network); 10 May 1998 04:47:58
> -0000
> > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
> (153.37.184.151)
> >   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
> > To: hioqibua38 () msn com
> > Comments: Authenticated sender is <hioqibua38 () msn com>
> > Errors-To: shadow007 () hotmail com
> > Subject: DO YOU KNOW HIS OR HER BACKGROUND???
> > Message-Id: <199805103688SAA3125 () post ipf net>