get-even

January 5, 2005

I have been seeing a lot of spam where the site is (mis)using DNS wildcards. This allows the

hostname to change for every recipient (and possibly track the recipient from web logs or reports).

In particular, it leads the SpamCop parser to state that there have been no recent reports, when I

know that I have reported the same site in just the last few days.

Two examples from this morning (same spammer - note identical DNS servers) are as follows

(using "dig" to demonstrate the wildcarding):

% dig '*.lijniahk.info' any [at]first.bubbalog.biz.

; <<>> DiG 9.3.0 <<>> *.lijniahk.info any [at]first.bubbalog.biz.

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64849

;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:

;*.lijniahk.info. IN ANY

;; ANSWER SECTION:

*.lijniahk.info. 1200 IN A 65.203.151.193

*.lijniahk.info. 1200 IN A 211.144.164.201

*.lijniahk.info. 1200 IN A 200.157.21.204

;; AUTHORITY SECTION:

lijniahk.info. 1200 IN NS FIRST.bubbalog.biz.

lijniahk.info. 1200 IN NS SECOND.bubbalog.biz.

lijniahk.info. 1200 IN NS THIRD.bubbalog.biz.

;; ADDITIONAL SECTION:

FIRST.bubbalog.biz. 1200 IN A 65.203.151.192

SECOND.bubbalog.biz. 1200 IN A 222.223.134.42

THIRD.bubbalog.biz. 1200 IN A 211.144.164.201

;; Query time: 193 msec

;; SERVER: 65.203.151.192#53(first.bubbalog.biz.)

;; WHEN: Wed Jan 5 09:09:32 2005

;; MSG SIZE rcvd: 202

--- AND

dig '*.inflfffc.info' any [at]first.bubbalog.biz.

; <<>> DiG 9.3.0 <<>> *.inflfffc.info any [at]first.bubbalog.biz.

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63501

;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:

;*.inflfffc.info. IN ANY

;; ANSWER SECTION:

*.inflfffc.info. 1200 IN A 65.203.151.193

*.inflfffc.info. 1200 IN A 211.144.164.201

*.inflfffc.info. 1200 IN A 200.157.21.204

;; AUTHORITY SECTION:

inflfffc.info. 1200 IN NS FIRST.bubbalog.biz.

inflfffc.info. 1200 IN NS SECOND.bubbalog.biz.

inflfffc.info. 1200 IN NS THIRD.bubbalog.biz.

;; ADDITIONAL SECTION:

FIRST.bubbalog.biz. 1200 IN A 65.203.151.192

SECOND.bubbalog.biz. 1200 IN A 222.223.134.42

THIRD.bubbalog.biz. 1200 IN A 211.144.164.201

;; Query time: 89 msec

;; SERVER: 65.203.151.192#53(first.bubbalog.biz.)

;; WHEN: Wed Jan 5 09:10:35 2005

;; MSG SIZE rcvd: 202

Thus each recipiant gets a unique hostname reported for the site, and the parser doesn't seem

able to recognize them as the same!

This *really* needs to be addressed quickly.

P.S. only "FIRST.bubbalog.biz" current functions, neither "SECOND.bubbalog.biz." or

"THIRD.bubbalog.biz." are `up' at this moment.

January 5, 2005

Hi,
...

So, my question is two-fold:

(1) Specifically, is above.net a lost cause? Is there something I should know about them? Should I give up allowing them un-munged reports?

-and-

(2) In general, are there legitimate reasons for ISP's to refuse munged reports? Perhaps a legitimate reason why they should demand to see the e-mail address of their accuser (me)? Or would I be better off returning to my policy of never checking the box next to munged-report-refusers on my reports?

All advice appreciated,

Dan

22376[/snapback]

Above.net is/was Paul Vixie and certainly *IS* reputable. As one of the largest bandwidth providers

in the world they have had (and do currently have) many unresolved spam issues. Just remember, these

are/were the same people who operate (or at least founded) MAPS. IMNSHO, they can be trusted.

January 3, 2005

This is what SpamCop is supposed to be doing when it can resolve the links, but I don't see much evidence that these sites go down. Manually resolving the ISP's and domain registrars is more than I'm willing to routinely put into it and I'm not sure I can be more "accurate."

22301[/snapback]

It seems that you are `mostly' correct when the sites are in Asia or eastern Europe, but this

particular fellow (the watch seller) seems to be in the British Isles - I'd expect the upstream

provider to *eventually* pull the plug. The "manual" resolution usually takes about 5 seconds

because I assume the name server is at the IP 202.102.230.36 - If that fails I try one or two

other "known" DNS servers; After that, if I don't have an answer, it probably takes 1-2 minutes

to run whois and test the listed name servers in parallel (but, I'm on a *nix box, so all this is pretty

trivial - usually I can just "!ns:0-1" and two cut-and-pastes from an already open window; two

seconds of work, two seconds of waiting and one second to cut-and-paste the result into the

report). Admittedly, if either you run a MS based box (all the tools are there, but it is a *pain*)

or are not an experienced "network nerd", it could certainly seem like too much effort. For example,

my wife uses Linux about 8 hours a day at work - even still, it would take a half hour to explain, and

until she understood the process well enough to account for the differences between her Linux at

work and the mostly `BSD boxes at home, it would probably take several minutes each of the first

couple of dozen times she would try (and I'm sure she isn't bothered enough to try - we get about

10 attempts a week to send spam to her accounts, and about 8,000 to mine, though only about

150-200 make it past the first llevel of filters, which gets them reported to SpamCop - last week

two got all the way into my mail boxes (but the SpamCop blocklist was responsible for preventing

about 350 at the first line of defense -- It is quites a ways down from the first filter I apply).

January 3, 2005

Report to who? They are constantly floating the domains. You seem the same sites ad infinitum, even when they are "resolved" and reported.

22296[/snapback]

Report them to the ISP who will pull the site, forcing them to move to a new ISP driving up costs. Also, report them to the registrar who will in many cases pull the domain (takes longer) - then "that" site is gone for good (until the next domain, again driving up costs and causing "down" time).

January 3, 2005

I agree, but in the end, to what purpose? As far as I know, the SCBL deals only with spam source, not spamvertized links. Sending spam reports to these spammer controlled sites is pointless. Reporting to 3rd parties involved with anti-spam prosecution might be of some value.

22292[/snapback]

One of the very few "good" points of CAN-spam, is that it presumes that the site is itself the spammer (as the old rule goes "follow the money"). Most ISPs *will* shut down the spamvertized site if you report it.

January 3, 2005

I purposely add an account at my domain for archiving all reports I make. Is it possible to

default such a "third party" check box to be already checked (saving a few seconds for the

majority of cases where I don't have to examine the full message, just the Subject header

or recognize the URLs (about 1/2 to 2/3 or the time)?

January 3, 2005

nice to see this explained. Been getting tons of Rolex spam pointing to vanai.com, and always unresolvable. Would be nice if SC could defeat this trick.

22289[/snapback]

Just over the Christmas holidays, he seems to have switched from mainly using

202.102.230.36 to mostly using 202.102.230.37. (DNS still mostly at 202.102.230.36

- when up -, but using domains/sites at 202.102.230.37).

December 28, 2004

In the part few days, several spam messages have contained web sites with multiple 'A' records in

their DNS. The SpamCop parser seem to only report/track the first one found, This reduces the

number of reports for a address by the number of distict 'A' records.

Example:

% nslookup -type=any www.substations.nbikgebj.info first.nokkauma.biz.

Server: first.nokkauma.biz.

Address: 65.203.151.193#53

Name: www.substations.nbikgebj.info

Address: 222.223.134.42

Name: www.substations.nbikgebj.info

Address: 202.102.230.37

Name: www.substations.nbikgebj.info

Address: 65.203.151.192

and for tracking purposes, in the part few minutes:

http://www.spamcop.net/sc?id=z707174640z33...0889565379a063z

http://www.spamcop.net/sc?id=z707174792z84...04c9c45a8da10cz

http://www.spamcop.net/sc?id=z707174870zc0...cecc1ac3f8033bz

Note some others have had as many as 6 'A' records (they are distict servers, but seem to contain

the same "pages" - also, not always are all of the 'A' valid or "up")

December 27, 2004

Comparison: from here www.spamcop.net -> a369.g.akamai.net [64.86.101.39]
StevenUnderwood .... www.spamcop.net = a369.g.akamai.net [199.232.159.244]

get-even ................... www.spamcop.net = a369.g.akamai.net [209.247.88.168]

The top two appear to be working just fine.

21799[/snapback]

Recurring Problem. (it started working again after about 5 minutes).

% telnet www.spamcop.net 80

Trying 166.90.133.200...

Connected to a369.g.akamai.net.

Escape character is '^]'.

HTTP/1.0 408 Request Time-out

Server: AkamaiGHost

Mime-Version: 1.0

Date: Mon, 27 Dec 2004 12:40:38 GMT

Content-Type: text/html

Content-Length: 163

Expires: Mon, 27 Dec 2004 12:40:38 GMT

<TITLE>Request Timeout</TITLE>

</HEAD><BODY>

<H1>Request Timeout</H1>

The server timed out while waiting for the browser's request.

</BODY></HTML>

Connection closed by foreign host.

Fatal error in process.

December 26, 2004

Working agin (though *very* slow).

December 26, 2004

This morning, while the forums work just fine, www.spamcop.net is *almost* unreachable. It pings,

and once (of a dozen attempts) I got a partial page, but all other attempts to confim spam result in

the errors "Gateway Timeout The proxy server did not receive a timely response from the upstream server."

and a direct telnet gives (after about two minutes, the "connect" is immediate):

% telnet www.spamcop.net 80

Trying 209.247.88.168...

Connected to a369.g.akamai.net.

Escape character is '^]'.

HTTP/1.0 408 Request Time-out

Server: AkamaiGHost

Mime-Version: 1.0

Date: Sun, 26 Dec 2004 13:39:08 GMT

Content-Type: text/html

Content-Length: 163

Expires: Sun, 26 Dec 2004 13:39:08 GMT

<TITLE>Request Timeout</TITLE>

</HEAD><BODY>

<H1>Request Timeout</H1>

The server timed out while waiting for the browser's request.

</BODY></HTML>

Connection closed by foreign host.

December 25, 2004

Thanks for that explanation. I'm also frustrated by having the parser fail to resolve perfectly valid links in much of the spam I report. For example, for the past week I've seen the parser output text like this:
Cannot resolve http://glee4me.com/soft/

Tracking link: http://glee4me.com/rr.php

No recent reports, no history available

...and the spammer site works perfectly well. I occasionally figure out the proper abuse address myself, with tools such as dig and geektools whois, but that sorta defeats the purpose of why I pay for and use this spamcop account; i.e. to identify these things more efficiently.

-Alex

21779[/snapback]

Like most of the similar spam in the last few weeks, this refers to a site at IP 202.102.230.36.

% nslookup -type=any glee4me.com 202.102.230.36

Server: 202.102.230.36

Address: 202.102.230.36#53

glee4me.com

origin = ns1.hckdnc.com

mail addr = hostmaster

serial = 2004084285

refresh = 3600

retry = 3600

expire = 3600

minimum = 3600

glee4me.com nameserver = ns1.hckdnc.com.

glee4me.com nameserver = ns2.hckdnc.com.

glee4me.com nameserver = ns3.hckdnc.com.

glee4me.com mail exchanger = 0 127.0.0.1.

Name: glee4me.com

Address: 202.102.230.36

There are "at least" 632 domains hosted at this site, all of which appear to send "bulk" email,

though a few (about one or two dozen) *might* be legitimate. Also, *at least* 300+ of them

(probably all, I haven't check them all *yet*) have either bogus MX records (point at 127.0.0.1

or invalid 'whois' data or both.

I've been able to catch and filter most by adding some new "uridnsbl", "uridnsblsub" and

"uridnsblsub" rules to my local Spamassassin. I don't know of any other method since all of

this spammer's emails (i.e. the set of domains at 202.102.230.36) seem to send all his UCE

through open relays or proxies (and he's quite good at finding new ones). Checking the URIs

against bogusmx.rfc-ignorant.org seems to catch most of them for me.

Notice also, this domain is only two days old. And it is probably some other spammer's joke, but

the domain contact's email is " ralsky[at]BonBon.net" (it probably isn't Alan Ralsky, I doubt even he

has that much audacity).

December 23, 2004

I think I overloaded the Yahoo mail server (it started sending '450' mailbox full try again messages back,
but they were all eventually originally dekvered or resent and delivered).

Anyway, for hotmail.com - 489 accounts, 1637 domains. No list as this board doesn't seem to take

messages that large (BTW. Hotmail's "abuse[at]" account seem to be working again -- another story, but

I've been talking to long time - both [at] Microsoft and knowing me - contacts at MS about clearing up

the rfc-ignorant.org issues for hotmail and msn -- Notice: they keep microsoft.com *perfectly* clean).

21728[/snapback]

Three different types of responses from MS. Examples of all three below (Note all messages were

iidentical: except for the account and domain name(s) -- How MS decides to bounce, assign to

abuse[at]hotmail.com or to abuse[at]css.one.microsoft.com is entirely beyond me; I'll call some MS

people and ask them to check. Still looks like "no response" expected.

NOTE: The third message state *NOT* to mail to "abuse[at]css.one.microsoft.com" - I used the address

\""MSN Hotmail Technical Support <abuse[at]hotmail.com>\" for everything.

---------------------------------------------- Type 1 -------------------------------------------------------------

From abuse[at]hotmail.com Wed Dec 22 23:10:29 2004

Date: Wed, 22 Dec 2004 23:10:14 -0500 (EST)

To: ??????????[at]?????????????

From: MSN Hotmail <abuse[at]hotmail.com>

Subject: Commercial Use of [a_mistercamiling[at]hotmail.com]

MIME-Version: 1.0

X-Originating-IP: [65.54.241.181]

Content-Type: TEXT/PLAIN; charset=iso-8859-1

Content-transfer-encoding: 8bit

This is an auto-generated response designed to let you know that our system received your support inquiry and a Support Representative will review your question and respond to you soon. Please note that you will not receive a reply if you respond directly to this message.

Thank you for contacting MSN Hotmail Support.

Remember that MSN Hotmail also has comprehensive online help available--just click "Help" in the upper right corner.

---------------------------------------------- Type 2 -------------------------------------------------------------

From daemon Wed Dec 22 23:11:37 2004

Date: Wed, 22 Dec 2004 23:11:37 -0500 (EST)

From: Mail Delivery Subsystem <MAILER-DAEMON>

To: ??????????

MIME-Version: 1.0

Content-Type: multipart/report; report-type=delivery-status;

boundary="iBN7BbgX015290.1103785897/?????????????"

Subject: Returned mail: see transcript for details

Auto-Submitted: auto-generated (failure)

This is a MIME-encapsulated message

--iBN7BbgX015290.1103785897/?????????????

The original message was received at Wed, 22 Dec 2004 23:11:34 -0800 (PST)

from ??????????[at]localhost

----- The following addresses had permanent fatal errors -----

MSN Hotmail Technical Support <abuse[at]hotmail.com>

(reason: 550 5.7.1 Unable to relay for abuse[at]hotmail.com)

----- Transcript of session follows -----

... while talking to mx2.hotmail.com.:

>>> DATA

<<< 550 5.7.1 Unable to relay for abuse[at]hotmail.com

550 5.1.1 MSN Hotmail Technical Support <abuse[at]hotmail.com>... User unknown

<<< 554 5.5.2 No valid recipients

--iBN7BbgX015290.1103785897/?????????????

Content-Type: message/delivery-status

Reporting-MTA: dns; ?????????????

Arrival-Date: Wed, 22 Dec 2004 23:11:34 -0500 (EST)

Final-Recipient: RFC822; abuse[at]hotmail.com

Action: failed

Status: 5.7.1

Remote-MTA: DNS; mx2.hotmail.com

Diagnostic-Code: SMTP; 550 5.7.1 Unable to relay for abuse[at]hotmail.com

Last-Attempt-Date: Wed, 22 Dec 2004 23:11:37 -0500 (EST)

--iBN7BbgX015290.1103785897?????????????

Content-Type: message/rfc822

Return-Path: <??????????>

Received: (from ??????????[at]localhost)

by ?????????????(8.12.11/8.12.11) id iBN7BYgY016714

for MSN Hotmail Technical Support <abuse[at]hotmail.com>; Wed, 22 Dec 2004

23:11:34 -0500 (EST)

Date: Wed, 22 Dec 2004 23:11:34 -0500 (EST)

From: XXXXXX X XXXXXXXXX <??????????>

Message-Id: <200412230711.iBN7BYgY016714[at]????????????>

To: MSN Hotmail Technical Support <abuse[at]hotmail.com>

Subject: Commercial Use of [bpagatpat_mr[at]hotmail.com]

MSN [Hotmail] Technical Support Personnel,

Your user bpagatpat_mr[at]hotmail.com registered or is a listed Registrant,

Administrative or Techical contact for [and spammed] commercial

domain(s) in violation of the Term "Unless otherwise specified, the

MSN Sites/Services are for your personal and non-commercial use"

of your "MSN Terms of Use" per your page http://privacy.msn.com/tou/.

*** Domain Name(s) -- Registrant/Contact email(s)

Domain Name: allwealthproductplace.com - bpagatpat_mr[at]hotmail.com bpagatpat_mr[at]h

otmail.com

Domain Name: greatshopforbuyers.com - bpagatpat_mr[at]hotmail.com bpagatpat_mr[at]hotm

ail.com

Please enforce that Term.

Thanks and Best Regards,

XXXXXX X XXXXXXXXX

??????????[at]?????????????

--iBN7BbgX015290.1103785897/?????????????--

---------------------------------------------- Type 3 -------------------------------------------------------------

From abuse[at]css.one.microsoft.com Wed Dec 22 23:23:43 2004

X-Originating-IP: 10.251.84.153

Thread-Topic: CST182816626ID - Commercial Use of [a_mistercamiling[at]hotmail.com]

X-Mailer: Microsoft CSS 2000

X-CSSTicketID: 0

thread-index: AcTov9EvH4FqC7itSbirwJdIAsojVQ==

From: "MSN Hotmail Support" <abuse[at]css.one.microsoft.com>

To: < ??????????[at]?????????????>

Cc:

Subject: RE: CST182816626ID - Commercial Use of [a_mistercamiling[at]hotmail.com]

Date: Wed, 22 Dec 2004 23:20:01 -0800

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_00D9_01C4E87C.C30EC3D0"

Content-Class: urn:content-classes:message

Importance: normal

Priority: normal

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.132

X-OriginalArrivalTime: 23 Dec 2004 07:20:01.0980 (UTC) FILETIME=[D1392FC0:01C4E8

BF]

This is a multi-part message in MIME format.

------=_NextPart_000_00D9_01C4E87C.C30EC3D0

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: 7bit

***This is an auto-generated response designed to let you know that we

have received your report, which will be investigated personally by one

of our Support Representatives within 24 hours. Your report is important

to us and we will treat it accordingly. You will receive no further

contact from MSN about this report, unless we need further information

to complete our investigation, or extenuating circumstances apply. ***

NOTE: To receive help with your Hotmail account or Hotmail issues not

related to Hotmail Abuse , please sign-in to your account and click the

"Help" link in the upper right hand corner. Here you will find a list of

our recent customer questions and a comprehensive library of self-help

articles. If you are unable to find what you need using our Help system,

you can submit a question using our support form and we'll respond to

you within 24 hours.

Unsolicited e-mail (or spam) is an issue challenging all ISPs and

web-based e-mail services. We want you to know that MSN Hotmail does not

sell its membership lists, or give permission to anyone who wishes to

send unsolicited e-mails. MSN Hotmail does not monitor or review e-mail

messages that are sent to MSN Hotmail customers, but we do provide

filtering systems which can be used by account holders to help them

control the messages delivered to their Inbox.

It's common for unsolicited e-mail to contain a forged address on the

"From:" line. This means that, while an unsolicited e-mail may appear to

have been sent from an MSN Hotmail account, it can just as easily have

been sent from another domain. The only way to determine the original

source is by investigating the e-mail header. If the message did

originate from an MSN Hotmail account, we will take immediate and

appropriate action.

In order for us to take action on your issue you please ensure that you

sent us the full header that included the X-Originating-IP and

X-Originating-Email of the MSN Hotmail account you are reporting. If you

exposed the full header and it does not contain an X-originating-IP and

X-Originating-Email, it means the message has been forged, which means

it is not from a legitimate account and we unfortunately will be unable

to take action. Additionally if the original message you sent us did not

have the full headers exposed and it does contain the X-Originating-IP

and X-Originating-Email please resubmit your request.

For instructions on how to expose full headers, report spam or Abuse to

MSN or MSN Hotmail please visit:

http://support.msn.com/solutionarticle.asp...msncom&aid=7788 or

http://www.hotmail.msn.com/cgi-bin/dasp/ua...g=EN&country=US

and refer to the sections on "Report Junk E-Mail to MSN Hotmail" and

"Report e-mail abuse to MSN Hotmail".

In addition to the actions we're going to take, if the message is not

from a Hotmail customer you should contact the sender's ISP. By looking

at the domain (this is the part after the "[at]" sign in an email address

or the last part of the server name in a URL) you will be able to find

the information you need to report the incident. For example, the email

address falseaddress001[at] falseaddress.com has a domain of

"falseaddress.com."

Once you know the domain, email the entire message (including full

headers) to "abuse[at]" that domain name and explain your situation. For

example, if you received spam from user[at]falseaddress.com, send the

original email and your complaint to abuse[at]falseaddress.com. The ISP may

have further requirements, but this is the person or group you need to

contact. As stated above please note that spammers frequently forge

their identity, and thus the ISP you contact many not be able to take

any action.

If you suspect a crime is being committed, you should report it directly

to your local police authorities. MSN Hotmail can only require its users

to conform to its Terms of Use and Subscription Agreement

(http://privacy.msn.com/tou/). MSN reports all cases of suspected child

pornography to the proper authorities.

Please do not respond to this e-mail, as any messages sent to this

address by using the "Reply" button will not receive a response. We

appreciate your understanding that due to our privacy policy, we will

not report back to you about any action taken against MSN Hotmail users.

However, we want to assure you that we will take appropriate action

against MSN Hotmail users who have violated the MSN Hotmail Terms of

Use.

To learn how to help keep children safe online go to "A Parent's Guide

to Online Safety" at http://onlinesafetyguide.msn.com

Thank you for reporting your issue to MSN Hotmail E-Mail Abuse Support!

------=_NextPart_000_00D9_01C4E87C.C30EC3D0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: 7bit

<HTML><BODY>***This is an auto-generated response designed to let you know that we have received your report, which will be investigated personally by on

e of our Support Representatives within 24 hours. Your report is important to us and we will treat it accordingly. You will receive no further contact fr

om MSN about this report, unless we need further information to complete our investigation, or extenuating circumstances apply. *** NOTE:

To receive help with your Hotmail account or Hotmail issues not related to Hotmail Abuse , please sign-in to your account and click the "Help" link in th

e upper right hand corner. Here you will find a list of our recent customer questions and a comprehensive library of self-help articles. If you are unabl

e to find what you need using our Help system, you can submit a question using our support form and we'll respond to you within 24 hours. U

nsolicited e-mail (or spam) is an issue challenging all ISPs and web-bas

ed e-mail services. We want you to know that MSN Hotmail does not sell its membership lists, or give permission to anyone who wishes to send unsolicited

e-mails. MSN Hotmail does not monitor or review e-mail messages that are sent to MSN Hotmail customers, but we do provide filtering systems which can be

used by account holders to help them control the messages delivered to their Inbox. It’s common for unsolicited e-mail to contain a

forged address on the “From:" line. This means that, while an unsolicited e-mail may appear to have been sent from an MSN Hotmail account, it can

just as easily have been sent from another domain. The only way to determine the original source is by investigating the e-mail header. If the message d

id originate from an MSN Hotmail account, we will take immediate and appropriate action. In order for us to take action on your issue you

please ensure that you sent us the full header that included the X-Orig

inating-IP and X-Originating-Email of the MSN Hotmail account you are reporting. If you exposed the full header and it does not contain an X-originatin

g-IP and X-Originating-Email, it means the message has been forged, which means it is not from a legitimate account and we unfortunately will be unable t

o take action. Additionally if the original message you sent us did not have the full headers exposed and it does contain the X-Originating-IP and X-Ori

ginating-Email please resubmit your request. For instructions on how to expose full headers, report spam or Abuse to MSN or MSN Hotmail ple

ase visit: http://support.msn.com/solutionarticle.asp...msncom&aid=7788 or http://www.hotmail.msn.com/cgi-bin/dasp/ua...ang=EN&country=

US and refer to the sections on “Report Junk E-Mail to MSN Hotmail” and “Report e-mail abuse to MSN Hotmail”. In ad

dition to the actions we’re going to take, if the message is not f

rom a Hotmail customer you should contact the sender's ISP. By looking at the domain (this is the part after the "[at]" sign in an email address or the las

t part of the server name in a URL) you will be able to find the information you need to report the incident. For example, the email address falseaddres

s001[at] falseaddress.com has a domain of "falseaddress.com." Once you know the domain, email the entire message (including full headers) to

"abuse[at]" that domain name and explain your situation. For example, if you received spam from user[at]falseaddress.com, send the original email and your complaint to abuse[at]falseaddress.com. The ISP may have further requirements, but this is the person or group you need to contact. As stated above please note

that spammers frequently forge their identity, and thus the ISP you contact many not be able to take any action. If you suspect a crime is

being committed, you should report it directly to your local police auth

orities. MSN Hotmail can only require its users to conform to its Terms of Use and Subscription Agreement (http://privacy.msn.com/tou/). MSN reports all

cases of suspected child pornography to the proper authorities. Please do not respond to this e-mail, as any messages sent to this

address by using the “Reply” button will not receive a response. We appreciate your understanding that due to our privacy policy, we will no

t report back to you about any action taken against MSN Hotmail users. However, we want to assure you that we will take appropriate action against MSN Ho

tmail users who have violated the MSN Hotmail Terms of Use. To learn how to help keep children safe online go to “A Parent’s

Guide to Online Safety” at http://onlinesafetyguide.msn.com Thank you for reporting your issue to MSN Hotmail E-Mail Abuse Sup

port!</BODY></HTML>

------=_NextPart_000_00D9_01C4E87C.C30EC3D0--

December 23, 2004

Excellent! If you can compare the email addresses up with the domains and plug them into the following scripts, you'll go far!I believe the Yahoo! Terms of Service apply worldwide.

21681[/snapback]

I think I overloaded the Yahoo mail server (it started sending '450' mailbox full try again messages back,

but they were all eventually originally dekvered or resent and delivered).

Anyway, for hotmail.com - 489 accounts, 1637 domains. No list as this board doesn't seem to take

messages that large (BTW. Hotmail's "abuse[at]" account seem to be working again -- another story, but

I've been talking to long time - both [at] Microsoft and knowing me - contacts at MS about clearing up

the rfc-ignorant.org issues for hotmail and msn -- Notice: they keep microsoft.com *perfectly* clean).

December 22, 2004

Excellent! If you can compare the email addresses up with the domains and plug them into the following scripts, you'll go far!I believe the Yahoo! Terms of Service apply worldwide.

21681[/snapback]

Complaints sent to Yahoo: 826 accounts, 2706 domains. I greatly underestimated the amount of

data I had to process - I had nearly 5G of spammer whois data. (unfortunately about a dozen were

registered *with* Yahoo itself - i.e. yahoo-inc.com and "YNS..." as nme servers - I believe these are

Yahoo "commercial" accounts). Also, some registrars "whois" data was strangely formatted so I sill

have about 500 of 16,000 spam domains to check.

I'll get to Hotmai.coml later today.

The Yahoo list of domains and accounts:

* DOMAIN * - registrant & contact emails (some dups)

Domain Name: interferencema.com - alexanderlinder[at]163.com deloprost[at]yahoo.com

Domain Name: lukebe.com - alexanderlinder[at]163.com freeeman_be[at]yahoo.com

Domain Name: baskkis.com - medservice44[at]163.com kastrikus3223[at]yahoo.com

Domain Name: forcechief.com - alexanderlinder[at]163.com sarum5an456[at]yahoo.com

Domain Name: callis4u.com - stanley[at]airspeedwireless.ca franks932[at]yahoo.ca

Domain Name: iwillsee.com - stanley[at]airspeedwireless.ca franks932[at]yahoo.ca

Domain Name: candyspage.info - msg[at]allied.org aportu89_nity[at]yahoo.com

Domain Name: amzoffrdt.com - cs[at]amazingoffersdirect.com hoooleytroo[at]yahoo.com

Domain Name: artddfrr.com - cs[at]amazingoffersdirect.com pimprevolutions6[at]yahoo.co

m

Domain Name: hotazz.biz - domainreg[at]axisww.com regs[at]pmbinc.com durkychipsat23[at]ya

hoo.com

Domain Name: luckypennyoffers.com - jimbaumhart[at]bellsouth.net sa[at]tramex.net ynou

nd344d_88[at]yahoo.com sa[at]tramex.net

Domain Name: bestnnetnst.com - cs[at]bestonthenet4u.com durnotafixxx[at]yahoo.com alex

anderlinder[at]163.com

Domain Name: bayname.net - info[at]bonusbonez.com graffstuk5[at]yahoo.com

Domain Name: chatlogic.net - info[at]bonusbonez.com johnchang26[at]yahoo.com

Domain Name: boombasket.net - info[at]bonusbonez.com pastagoe_from[at]yahoo.com

Domain Name: askmebiz.net - askmeto[at]ce.wakwak.com nofertrooman[at]yahoo.com

Domain Name: freerazorzone.com - admin[at]click-123.com freerecepts[at]yahoo.com

Domain Name: fredmiller.biz - vegi[at]comcast.net domain.billing[at]yahoo-inc.com

Domain Name: my-screename-aol.com - heidib[at]comcast.net expostgroup[at]yahoo.com

Domain Name: differentwatches.info - lauramanagement[at]consult.uk expostgroup[at]yaho

o.com

Domain Name: ipoiyt.com - contact[at]cutpricerxpills.com pravilo_takovyh[at]yahoo.com

Domain Name: dareelsethough.com - domain-contact[at]dicewebhosting.com lapuhh77[at]yah

oo.com

Domain Name: hoaereshd.info - ruslanyavorenko[at]digiverse.net nnl357[at]yahoo.com

Domain Name: impower.biz - dave[at]e360insight.com mahinosdriove[at]yahoo.com

Domain Name: bohnhardt.us - welch[at]easy.com palermobill[at]yahoo.com sa[at]tramex.net

Domain Name: faster44.com - netoperations[at]efreemail.com carla_pard1[at]yahoo.com

Domain Name: likeblue.com - sales[at]elogic.cc sales[at]bluepal.net sales[at]elogic.cc as

dgre12bana1[at]yahoo.com alexanderlinder[at]163.com

Domain Name: iynkp.biz - ivanchoras[at]email.com expostgroup[at]yahoo.com

Domain Name: authorizer.org - ukepenger[at]emailaccount.com ardeipetoti[at]yahoo.com

Domain Name: emsiweb.com - mbrown[at]emsi-mail.com kpalma[at]yahoo.com

Domain Name: entry2.info - wendy[at]execs.com vestahooleo[at]yahoo.com

Domain Name: informationrequest.net - abuse[at]expeditemg.com updates21[at]yahoo.com

Domain Name: freedinnerpass.com - support[at]expertsavings.com freedoctordrugs[at]yaho

o.com

Domain Name: easycelebs.com - legal[at]fernandezii.com easyclickusa[at]yahoo.com

Domain Name: bobnow.com - webmaster[at]financialnetcorp.com support[at]000domains.com

hernyadersya23d[at]yahoo.com

Domain Name: imsodamtired.com - juwanda[at]forpresident.com expostgroup[at]yahoo.com

Domain Name: leaflips.com - dnsadmin[at]frisbyfly.com bernandos45[at]yahoo.com

Domain Name: bigbend.us - david[at]fullmoon.us fullmoon[at]gvtc.com mamantenok34[at]yahoo

.com alexanderlinder[at]163.com support[at]speed123.com support[at]speed123.net

Domain Name: gasprinskij.info - support[at]gkg.net paulno3ck45[at]yahoo.com

Domain Name: insanesoftwareprice.com - xmasta[at]gmail.com theodinshiy343[at]yahoo.com

Domain Name: csere.info - markfergu[at]gmx.net hikalogigkasno[at]yahoo.com

Domain Name: dunlapa.info - markfergu[at]gmx.net reteryscunk[at]yahoo.com

Domain Name: electrolyticd.info - domains4sale[at]godaddy.com deribanchik56[at]yahoo.c

om

Domain Name: love3love3.com - support[at]gold-domain.com mariner345435[at]yahoo.com

Domain Name: egoldsearch.com - support[at]gold-domain.com y00938la1[at]yahoo.com

Domain Name: eurostandart.us - jimmy1[at]hehe.com domain.billing[at]yahoo-inc.com

Domain Name: ljmflnjl.info - aranilomucheda[at]hotbox.com steve5666hn[at]yahoo.com

Domain Name: debtdognoq.com - foodforcheap[at]hotmail.com absoltehomes52[at]yahoo.com

foodforcheap[at]hotmail.com

Domain Name: fineforusto.info - mgonzales662[at]hotmail.com alexanderlinder[at]163.com

serinadosku[at]yahoo.com

Domain Name: extremebuyerstore.com - dalena_mssu[at]hotmail.com dalena_mssu[at]hotmail

.com ferarry_dosky[at]yahoo.com

Domain Name: innerpharmacie.com - marvital[at]hotmail.com easterhaven_3[at]yahoo.com w

hois[at]names4ever.com

Domain Name: eveqst.com - eirokds14[at]hotmail.com eirokds14[at]hotmail.com expostgrou

p[at]yahoo.com

Domain Name: iabewrdf.info - sexygeorge6969[at]hotmail.com gopermanskiy[at]yahoo.com

Domain Name: ebatststs.info - sexygeorge6969[at]hotmail.com haivinoconiac[at]yahoo.com

Domain Name: killerwisconsin.info - whiteside1975[at]hotmail.com hundasynuok23ss[at]ya

hoo.com

Domain Name: kinejjni.info - johesephlunheit[at]hotmail.com joelparkins[at]yahoo.com

Domain Name: holyasd.info - jamiehawn[at]hotmail.com kalosandrik[at]yahoo.com malfredm

alhoy[at]yahoo.com

Domain Name: everijungle.com - katarinawitt[at]hotmail.com kitty_send[at]163.com expos

tgroup[at]yahoo.com

Domain Name: kolmndan.com - kolmeod[at]hotmail.com kolmeod[at]hotmail.com gamoverdreev

e[at]yahoo.com aljones[at]mofa.com

Domain Name: magnificentrx.com - j_ocampo49[at]hotmail.com masskritical_der[at]yahoo.c

om

Domain Name: mosteffectiveproducts.com - mister_reden_zamudio[at]hotmail.com mister

_reden_zamudio[at]hotmail.com kitty_send[at]163.com lewliskroas[at]yahoo.com

Domain Name: bestyearproduct.com - mrssusan_dal[at]hotmail.com mrssusan_dal[at]hotmail

.com palermosdd_5hasb[at]yahoo.com

Domain Name: bestproductwinner.com - msmarie_macaluyos[at]hotmail.com msmarie_macal

uyos[at]hotmail.com dongildon[at]yahoo.com

Domain Name: moreairport.com - domainman_zeng[at]hotmail.com pelington2[at]yahoo.com a

lexanderlinder[at]163.com

Domain Name: airlarry.net - chrisbrown89779[at]hotmail.com richardsdora[at]yahoo.com

Domain Name: landolimer.com - katarinawitt[at]hotmail.com serenadsky763[at]yahoo.com

Domain Name: 2upeter.com - domains[at]huntsvilleconsultants.com davidminciuna[at]yahoo

.com

Domain Name: 2upeter.com - domains[at]huntsvilleconsultants.com davidminciuna[at]yahoo

.com

Domain Name: acemarla.com - domains[at]huntsvilleconsultants.com mixenfree[at]yahoo.co

m

Domain Name: acemarla.com - domains[at]huntsvilleconsultants.com mixenfree[at]yahoo.co

m

Domain Name: lectriclime.biz - domains[at]i-global-comm.com buldoservkk_555[at]yahoo.c

om

Domain Name: julydata.net - support27[at]indiatimes.com jumanjibiz[at]yahoo.com

Domain Name: hoolamaco.biz - nospmpls[at]indiatimes.com kampo_eeasure34[at]yahoo.com

Domain Name: bestfourutoo.info - support27[at]indiatimes.com nehocusleep[at]yahoo.com

Domain Name: efigagba.info - kristoffthemilossino[at]joinmail.co expostgroup[at]yahoo.

com

Domain Name: mbsp.biz - kkhan[at]justice.com dreamcast345[at]yahoo.com wfsd[at]163.com

Domain Name: kenasa.com - kenneth[at]kennethphilips.com msn-pa-tech[at]msn.com kennych

iu123[at]yahoo.com.tw

Domain Name: e-casinobliss.net - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.

com

Domain Name: e-casinodelight.net - hostmaster[at]lemon-computing.com ligareltd[at]yaho

o.com

Domain Name: e-gamerdaily.net - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.c

om

Domain Name: e-gamernow.net - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.com

Domain Name: e-gamerreport.com - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.

com

Domain Name: e-gamingdaily.net - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.

com

Domain Name: e-hilarityreport.com - hostmaster[at]lemon-computing.com ligareltd[at]yah

oo.com

Domain Name: e-vacationoffers.net - hostmaster[at]lemon-computing.com ligareltd[at]yah

oo.com

Domain Name: hooplabeat.com - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.com

Domain Name: hoopladaily.com - hostmaster[at]lemon-computing.com ligareltd[at]yahoo.com

Domain Name: herakleitos.info - saralexca[at]lycos.com greatdud45[at]yahoo.com

Domain Name: fatefulbliss.com - robertperriera[at]lycos.com kalimonjasty[at]yahoo.com

Domain Name: covariatea.net - hopomentoser[at]lycos.com nucoolpistuk_oop0[at]yahoo.com

Domain Name: eemciiei.info - afanasiykol[at]mail.ru expostgroup[at]yahoo.com

Domain Name: badhejgh.info - anreygotvinov[at]mail.ru kammasutra_mail[at]yahoo.com

Domain Name: mbagldi.info - karneliykvachen[at]mail.ru palermotizzzaon34[at]yahoo.com

Domain Name: litany2detritus.info - rusecky[at]mail15.com mailko_gnet[at]yahoo.com

Domain Name: duckweight.com - support[at]mailcompanyx.com diamondstyle5[at]yahoo.com

Domain Name: intellectualregulatory.com - support[at]mailcompanyx.com kapel_maydste

r[at]yahoo.com

Domain Name: immediacypark.com - support[at]mailcompanyx.com loopernovsky[at]yahoo.com

Domain Name: basestagger.com - support[at]mailcompanyx.com vorona_vzgramostyah[at]yaho

o.com

Domain Name: benjaminizer.com - registrar[at]marketing4pros.com kolertroop[at]yahoo.co

m

Domain Name: mahina-kikaha.com - webmaster[at]marketingx.com cewrtuoony[at]yahoo.com

Domain Name: mikenessdirect.com - webmaster[at]marketingx.com delikatessing[at]yahoo.c

om

Domain Name: fingertwisted.com - webmaster[at]marketingx.com hoopergradis[at]yahoo.com

Domain Name: kryolnet.com - webmaster[at]marketingx.com sobhi4[at]yahoo.com

Domain Name: bigtopsavings.net - postmaster[at]mediadreamland.com hooferman777[at]yaho

o.com

Domain Name: jobyour.net - postmaster[at]mediadreamland.com unopliksantis8[at]yahoo.co

m

Domain Name: christihaas.net - aljones[at]mofa.com aljones[at]mofa.com chrissstofffer3

4[at]yahoo.com

Domain Name: mydoris.info - aljones[at]mofa.com expostgroup[at]yahoo.com

Domain Name: myelsa.info - aljones[at]mofa.com expostgroup[at]yahoo.com

Domain Name: lagrula.com - aljones[at]mofa.com hecupsdge[at]yahoo.com

Domain Name: family1st.info - lorri_kee[at]msn.com domain.billing[at]yahoo-inc.com

Domain Name: digerhuvud.net - dmorgan[at]myself.com expostgroup[at]yahoo.com

Domain Name: celestecity.com - info[at]nameinvestment.com valenki_moinew3[at]yahoo.com

Domain Name: kdfa.net - soo1996[at]naver.com soo1996[at]koreains.net miraband60[at]yahoo.

co.kr

Domain Name: meteormailer.com - mr9ab4894yx[at]networksolutionsprivateregistration.

com aa_leb[at]yahoo.com

Domain Name: mailandhost.biz - 7ef738b8e00b1946ced842abf630ca75-816186[at]owner.gan

di.net cheap_good_hosting[at]yahoo.ca support[at]gandi.net cheap_good_hosting[at]yahoo.ca

Domain Name: aus-host.com - 9f1d55350095e5f3195a5d62cefbb838-860356[at]owner.gandi.

net domainnameemail[at]yahoo.com.au

Domain Name: jocktryouts.com - b6624d262628323b4a0f987dc267dd0a-517584[at]owner.gan

di.net domains29[at]rackhosters.com masturok458f[at]yahoo.com frederickmalkis[at]yahoo.co

m

Domain Name: happyhourgirls.com - b6624d262628323b4a0f987dc267dd0a-517584[at]owner.

gandi.net domains29[at]rackhosters.com sa[at]tramex.net hunnies56[at]yahoo.com alexanderl

inder[at]163.com kitty_send[at]163.com alexanderlinder[at]163.com