Re: Spam .. Find the sender !

[Blake Willis <blakew () cais net>]

Jan,

        Looks like a UUnet dialup user to me.  I'd say call UUnet's NOC,
find out to whom this dialup was resold (e.g. Mindspring, Earthlink,
etc...) and give them a call.  Good luck.

        Blake Willis
        CAIS Engineering

---------------------------------------------------------------------------
Blake Willis                                            703-448-4470x483
Network Engineer, New Customers                         blakew () cais net
CAIS Internet, a CGX Communications Company
---------------------------------------------------------------------------

On Sun, 10 May 1998, Jan Czmok wrote:

> Hi!
>
> We got some spam mail from
> > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
> (153.37.184.151)
> >   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
>
> and i cannot query the database (arin , ripe or radb) for the owner of
> this network.
> Any hints ?
>
> If we can find the sender, then we go for a hunt against this spammers.
>
> So far...
>
> Greetings
>
>
> Jan Czmok
> IPF.NET NOC
>
> more headers :
>
>  Return-Path: hioqibua38 () msn com
> > Delivery-Date: Sun May 10 04:48:03 1998
> > Received: (qmail 26693 invoked from network); 10 May 1998 04:48:03
> -0000
> > Received: from claven.cse.psu.edu (HELO cse.psu.edu) (130.203.3.50)
> >   by finch.cse.psu.edu with SMTP; 10 May 1998 04:48:03 -0000
> > Received: from relay.ipf.net (relay.ipf.net [195.88.0.13]) by
> cse.psu.edu (8.8.8/8.7.3) with SMTP id AAA21505 for
> <0000 () 0000 cs psu edu>; Sun, 10 May 1998 00:48:02 -0400 (EDT)
> > Date: Sun, 10 May 1998 00:48:02 -0400 (EDT)
> > From: hioqibua38 () msn com
> > Received: (qmail 13706 invoked from network); 10 May 1998 04:47:58
> -0000
> > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
> (153.37.184.151)
> >   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
> > To: hioqibua38 () msn com
> > Comments: Authenticated sender is <hioqibua38 () msn com>
> > Errors-To: shadow007 () hotmail com
> > Subject: DO YOU KNOW HIS OR HER BACKGROUND???
> > Message-Id: <199805103688SAA3125 () post ipf net>