Google Groups Home
Help | Sign in
Message from discussion SUCCESS!
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
Sun Tsu  
View profile
 More options Aug 6 2004, 7:46 pm
Newsgroups: news.admin.net-abuse.email
From: bananana...@spamblocked.com (Sun Tsu)
Date: 6 Aug 2004 16:46:07 -0700
Local: Fri, Aug 6 2004 7:46 pm
Subject: Re: SUCCESS!

"Anonymous" <Anonym...@domain.invalid> wrote in message <news:asGQc.942$5E4.870@newssvr29.news.prodigy.com>...
> "Anonymous" <Anonym...@domain.invalid> wrote in message
> news:dsFQc.934$GF4.909@newssvr29.news.prodigy.com...
> > If anyone finds any Russian Spam Gang spam in their Inbox, or comes
>  across
> > one of their websites, post here, so we can compile a complete list of
> > their domains. We'll try to get as many of them shut down as possible.

> > The ones we can't get shut down, we'll drop into the SpamVampire, and
> > hammer the hell out of.

> You know what's amazing? I'm hitting spamvertised websites hosted out of
> China and Brazil, but I keep seeing a BellSouth IP address showing up in my
> IDS/IRS... hmmm... spammy is trying to figure out who's costing them so
> much, perhaps? BellSouth is out of Florida.

> It's adsl-80-85-61.asm.bellsouth.net, IP address 65.80.85.61.

You do know that BellSouth offers service in more states than just
Florida, don't you Mr. Anonymous, "I know so much about the Internet,
spammers and fighting spam, but I don't know what SPEWS S2134 means."

> Hey, spammy, I don't care where you host your websites, if you spam our
> domain, I'm hitting them and getting them borked. If you think you can stop
> me, think again... you've become a major cost of doing business, so now I
> am YOUR cost of doing business. And I'm not going away until you do. Get
> used to it, like we've all had to get used to putting up with your spew.

> You stop spamming our domain, I'll stop hitting your spamvertised websites.
> That's the deal. No negotiations.

Have you no shame, Bob, following up your own post in NANAE.  Are you
*sure* that you aren't a spammer involved in a pissing contest with
some Florida spammers/competitors.  If you were a true spam fighter
you wouldn't offer to stop hitting spammy's spamvertised websites once
he stopped spamming your domain.

What is your domain anyway?  It shouldn't be a problem mentioning it
if spammy already knows what it is.  You keep referring to "we" and if
you have partners in this one lone website.  Do you perhaps have a
frog in your pocket?

You are posting from,

NNTP-Posting-Host: 63.207.207.234

Pac Bell Internet Services PBI-NET-7 (NET-63-192-0-0-1)
                                  63.192.0.0 - 63.207.255.255

STAN FISHER SBCIS-100531-182148 (NET-63-207-207-232-1)
                                  63.207.207.232 - 63.207.207.239

So, Stan, why do you also go by the name of Bob and what do you need 8
IP's for if you only have one website?

CustName:   STAN FISHER
Address:    303 Second Street
City:       San Francisco
StateProv:  CA
PostalCode: 94107
Country:    US
RegDate:    2000-06-01
Updated:    2000-06-01

NetRange:   63.207.207.232 - 63.207.207.239
CIDR:       63.207.207.232/29
NetName:    SBCIS-100531-182148
NetHandle:  NET-63-207-207-232-1
Parent:     NET-63-192-0-0-1
NetType:    Reassigned
Comment:    
RegDate:    2000-06-01
Updated:    2000-06-01

Hmm, you've had this /29 for four years and you've just started
posting in NANAE sounding like either a tenured regular or a tenured
spammer.  Bob, did you hijack this IP block from Stan?

Your posting IP resolves to   151.164.243.21

        60 ms   70 ms   84 ms   64.200.89.70    
washdc5lcx1-pos11-0.wcg.net.    245     UNITED STATES
11      61 ms   70 ms   79 ms   64.200.95.114  
washdc5lcx1-sbc-pos.wcg.net.    244     UNITED STATES   Unix: 23:39:44. 26
12      60 ms   69 ms   79 ms   151.164.191.137
bb2-p2-0.hrndva.sbcglobal.net.  243     UNITED STATES   Unix: 23:39:44.214
13      68 ms   75 ms   85 ms   151.164.243.21  
bb1-p6-0.hrndva.sbcglobal.net.  242     UNITED STATES   Unix: 23:39:45.267

::::    or are you this spammer?    ::::

 Google Search: 151.164.243.21

http://groups.google.com/groups?q=151.164.243.21&hl=en&lr=&ie=UTF-8&s...

::::    which leads to    ::::

Registrant:
 none>>>>>>>>>>>>>>>>>>>>>>>>>>ATTN: DIRECTNIC.COM
 1516 Horrell Ave
 Mckinleyville, CA 95519
 US

 Domain Name: THEANSWERTO.COM

Monteforte, Patrick &amp;amp; Tracy  gtp...@northcoast.com
    1516 Horrell Ave
    Mckinleyville, CA 95519
    US
    707-840-9517

 Registration Service Provider:
    Intercosmos Media Group Inc. dba directNIC.com,
supp...@directnic.com
    504 679 5173
    http://www.directnic.com

 Record last updated on 20-Mar-2002.
 Record expires on 02-Sep-2002.
 Record Created on 02-Sep-2000.

::::    NEW REGISTRATION    ::::

Registration Service Provided By: WTPowers
Contact: doma...@wtpowers.com

Domain name- theanswerto.com

Nameservers-
    NS3.PLUGIT.COM
    NS4.PLUGIT.COM

Start of registration- Sat Sep 02 2000 00:41:28
Registered through- Thu Sep 02 2004 00:41:28

Registrant Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Administrative Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Billing Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Technical Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Say, Bob, aren't you that "phool" who claims to be new here?

Google Groups: View Thread "[proxy hijacking] theplanet.com /
valueweb.net / atr..."

<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=2f0f6d90.0...>

> Ok, I'm new here, so I'm not familiar with the language, and these may be
> dumb questions, but I'll ask anyway... What is S2134? Is it the tracking
>number for a particular SPEWS-blocked spammer? Where do I find these?

Say what?  You're new here?  Oh, really!

If you are new here then why do you know so much about whois, LARTing,
dig, reporting chains, etc.?

Let's have a look and see if it's you and examine some of the cr@p you
have been spewing in NANAE the last few days.  Seems you have been
having a bit of a go with the good folks in NANAE.

Google Search: author:Anonym...@domain.invalid

<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&q=author:Anonymous...>

It would appear that you know a great deal about spammers and fighting
spam for someone who claims to be new here, "don'tja," Bob?

:: Re: How Millionaire gets 20,000 visitors a day

> Big deal, I've never spent a dime on advertising either, my website's been
> as high as around 2000, and I didn't spam to get there. I'm also ranked #12
> for our second-best search term and #21 for our best search term on Google.
> It's called website optimization and creating content people want to read.
> Get a life and a clue.

:: Re: repost Morely if UUNET is Bad then WHY are you WORSE???

> Man, you'd be amazed at how many people are using the email address of
> 'anonym...@domain.invalid'. No wonder I get so much spam... I've got
> Sanford Wallace AND Scott Richter right in my Inbox!

Why would someone as "clued" as you use such an address then, hmm,
Bob?

Say, Bob, didn't you say that 100% of your spam in the last month was
from that Russian spam gang?  Make up your mind, Bob!

:: Re: webrider.ru - Russian Spam Gang

> Yes, but he's not getting those addresses out of the blue,
> or from his Contacts list, he's getting them (I would assume,
> since this is how I do it) from doing WHOIS and abuse.net
> lookups on the URL and IP address of the abusing domain.
> If those addresses are listed there, then I'd say LART away.

Interesting, Bob, you know all of this but you don't know that S2134
refers to a SPEWS record number.  Total cr@p, Bob, just more and more
pure 100% prime government inspected bullsh!t from you.

:: Re: Reveal who is behind SPEWS

> The reason I hate spammers is because my dear departed
> mother was raped by a spam gang. I guess all those penis
> enlargement, viagra and porn ads they were sending finally
> got to be too much for them to bear, and they grabbed
> the nearest moving object to vent their frustrations on,
> which happened to be my mother, God rest her poor
> over-humped soul.
> She expired giving birth to me, the unholy product of
> the evil seed of a thousand spammers, risen from the
> very bowels of hell itself to wreak vengeance upon the
> spammers of the world in revenge for my dear departed
> mother.

That's about the same kind of believable cr@p you have been spewing
here in NANAE the last few days.  Why, Bob, why are you acting like
such a "phool" claiming to be so concerned about a Russian spam gang
and that *you* are responsible for "inspiring" InterCosmos.com to
cancel spammy's domains.  You do realise that most people don't know
that InterCosmos.com is DirectNIC.com and that ab...@DirectNIC.com
uses a DirectNIC email address, not an InterCosmos.com address, don't
you, Bob?  How about you post some of the email, along with headers
adnd responses, you have been sending (sic) to DirectNic.com
concerning this Russian spam gang.

:: Re: SUCCESS!

> bjbmdbe.info is now dead. Another Russian Spam Gang
> domain gone... and this one, they didn't even get a chance
> to send any spam for. InterCosmos is killing them off
> preemptively now. I've got them searching through their records
> for the email addresses the Russian Spam Gang has used
> to register other domains, and they're killing any off that were
> registered with those email addresses.
> This is too much fun... 4 spammer domains killed off
> (and possibly quite a few more once they find them) in two
> days... the Russian Spam Gang has got to be wondering
> what's going on.

You're full of cr@p, Bob.  Prove it!  Post your email exchange with
DirectNic.com complete with headers.  Otherwise, it's all just spammer
speak coming from an idiot/k00k like yourself.

:: Re: Spam Surge?

> Yes, our rolling monthly spam receival rate went from
> 8 per month for all 15 of our email addresses, to around
> 50 / month. Approximately 93% of this is attributable to
> the Russian Spam Gang.

Make up your mind, Bob, is it 100% or 93% ?

And, Bob, we?  Do you have a frog in your pocket or are you talking
about your sock puppet, bfs, who used to be tube...@hotmail.com?  Oh,
wait, that's not a sock puppet, it's *you* "idnit," Bob and Mr.
Anonumous is the real sock puppet.

:: Re: [mainsleaze] Now Target is spamming

> There was a Sam's Club store in the town that remained open
> after Wal-Mart  closed... that's the store that sells Wal-Mart's
> merchandise returns and cheaper merchandise. I think it was
> another Walton family member that started Sam's Club, Sam
> Walton's brother, if I remember correctly.

You are talking out of your arse again, Bob.  You keep fabricating
"facts" on the fly, sounding much like those pr0n spammers that try to
con AOL newbies into downloading trojan spamming viri disguised as
FREE webcam viewers.

> So, it could be a massive effort to launder Wal-Mart stockholder
> money, using it to build the privately owned Sam's Clubs stores
> and ensure their success.
> Now, that's some fuel for the conspiracy kooks...
> let's see where they go with it.

Bob, *you* are the conspiracy k00k!

:: Re: Godaddy http://www.kevinsmit#.us domains

> No, I get the 'honor' of dealing almost exclusively with the Russian
> Spam Gang. All the rest of the spammers, I've hammered so hard
> they leave our domain alone. These Russian scumbags seem to
> have no brains. I got three of their sites shut down just today, and
>I'm sure they're going to try spamming our domain again, even after
> I wrote them telling them it was me doing them all the damage.

You know, Bob, it all makes sense now.  You are spouting, "down with
the Russian spam gang!" and "look at me, I'm a super fscking spam
fighter who got the Russian spam gang's domains shut down at
Intercosmos.com!"  And at the very same time you question the link
between SPEWS S2134 and thePlanet.com;  why is that, Bob?  Is it
because Phil Doroff / SPEWS S2134 and the Russian spam gang are
competitors?

You follow spam fighting and the Russian spam gangs, don't you, Bob?
Remember almost one year ago when spammy was DDoSing Spamhaus,
Osirusoft, Monkeys.com and a few other anti-spam sites, that
Spamhaus.org said that it was two different spam gangs doing the DDoS
attacks, one Russian and one American?

Hmm, let's see, Phil Doroff of SPEWS S2134 is suspect in some of those
DDoS attacks as was a Russian spam gang.  Now here you are in NANAE
thumping yo' little chest and alerting the entire world how successful
a spam fighter you are,  bragging about how badly you are hurting
spammers, especially the Russian spam gang recently posted about here
in NANAE, and at the very same time questioning the only poster who is
linking SPEWS S2134 and thePlanet.com together.

Oh, yea, let's not forget that also at the very same time you are
saying that you are *new* here in NANAE and don't understand how to
interpret SPEWS S2134.  One thing is for sure, Bob, you have the very
same stench of humour that the "isoles" of the old isolate.net spam
gang have and the same entertainment value that John Morrison Johnson
and Joshua Dean Stewart of SPEWS S1620 / S1758 have.

Say, Bob, where are those two "isoles" anyway.  They were very vocal
at one time in NANAE too, just like you, always making posts talking
about themselves, how "intelligent" they were, how they were anti-spam
and always trying to impress the good folks of NANAE and baffle them
with bullsh!t.  You are just as "whacked" as they are, maybe even more
so.

:: Re: [proxy hijacking] theplanet.com / valueweb.net / atrivo.com

>"bfs" <b...@nowhe.re> wrote in message

news:Xns953CDB7517AA91116243242@24.25.9.43...

>> As for the other references I've found, we have atrivo, various
>> apnic and ripe networks, uunet, and abovenet. No theplanet
>> connection to S2134 anywhere that I can see.
> Ok, I'm new here, so I'm not familiar with the language, and these
> may be dumb questions, but I'll ask anyway... What is S2134?
> Is it the tracking number for a particular SPEWS-blocked
> spammer? Where do I find these?

Now see, Bob; see how stupid you look/sound when the good folks of
NANAE can plainlysee all of the cr@p you have spewed in NANAE in one
post.

Here you are responding to your own sock puppet who made three posts
in the very same thread with either a one-time posting addresses or as
a X-No-archieve poster.

Correction, bfs isn't your sock puppet, it's *you* Bob and *this* is
simply an alias you created within the last few days to have a go with
some of the regulars.  It's your form of amusement.  You are a
spammer, Bob, plain and simple and you used to post as
tube...@hotmail.com and an expose' on you is forthcoming.  Soon, Bob,
very soon.   :-)

So you know everything there is to know about spam fighting, you are a
one k00k dog and pony show that single-handedly is putting a Russian
spam gang in their place, you are trying to persuade people to use
Spam vampire, and yet you don't know if S2134 "is a tracking number
for a particular SPEWS-blocked spammer?"

You've been busted, Bob!   :(

Here you are following up to your very own post which was made by you,
bfs, with X-No-Archieve causing it not to be available via google.

<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=bxkQc.628%...>

bfs <b...@nowhe.re> wrote in message <news:Xns953BBB8BFD083091116243242@216.168.3.30>...
> bananana...@spamblocked.com (Sun Tsu) wrote in
> news:2f0f6d90.0408040637.3c7d14a4@posting.google.com:

>> No surprise here since thePlanet.com has been hosting Phil Doroff /
>> SPEWS S2134 / five-elements.com / reflected.net, whom many
>> believe makes good use of a cadre of trojanned boxen in his
>> spamming enterprise.

> You've mentioned theplanet in reference to S2134 at least a
> couple of times in recent memory, but I still don't see where
> they have anything at all to do with that listing.

> For the benefit for those of us who aren't getting it,
> can you please illustrate where S2134 and theplanet
> have anything to do with each other?

And here's your sock puppet's third post in that very same thread
where you morphed from "b...@nowhe.re" to "r...@nowhe.re"...

::::    <quote>    ::::

rss <r...@nowhe.re> Bob, who read the previous article but wouldn't
answer the questions posed to him, morphed once again, changed his

initials and wrote:
> bananana...@spamblocked.com (Sun Tsu) wrote in
> news:2f0f6d90.0408050912.1f1a053e@posting.google.com:

> > why are you so concerned?

Bob, you forgot to answer the above question.  :(

Why?

> Why can't you just answer a simple question?

You go first.

You seem afraid to answer these questions as well, Bob.  Why is that?

> Oh, and Bob, you are no stranger to NANAE, yet you used
> a one-time email address to make your post in this thread.
> Why, Bob?  Why the mystery?
> Who is Bob and why is he so concerned about
> Mr. Doroff and SPEWS S2134 being linked to thePlanet.com?  

Let's hear it, Bob.  What is your concern with SPEWS S2134?
Are you a sock puppet for Doroff?

>  WTF is your problem?

No problem, Bob.  You need to answer a few questions
before anyone will take you seriously, that's all.

> You're a bit of a head case, aren't you? My fault for not noticing the
> spamblocked.com address, I suppose.

What's your problem with spamblocked.com?  You afraid of Morely or
just a spanked spammer who is intimidated by someone like him who
doesn't take any sh!t from k00ks like you?

Do you have some sort of problem with this posting address as well?

Say, Bob, why do you keep morphing posting email addresses, and why
did you drop your initials this time?  You must be some kind of head
case, or be involved with "head" in some other way.

Bob, is that your name or what you do?

You're a bad dog!

Cheers,

SuN

--
A cani tintu catina curta.

Do you speak Sicilian, Bob?
If not, it says, "To bad dogs, a short chain is placed."
It means you are unreliable and can't be believed.

::::    </quote>    ::::

OK, Bob, you changed your initials from post to post from 'bfs' to
'rss'  but kept the domain "nowhe.re"

The 'b' to 'r' is easy, you changed the 'b' for Bob to 'r' for Robert.
 Whys the change from "f" to "s" with your middle intial?  Did you
decide to change your middle name from "fscktard" to "sh!thead?"

:: Re: New Bout of x-no-archive stalker (wilhelp) SPAM <-- Tietjens
...

> God, OK, enough... we get it already. Your message has been read,
> those who choose to believe you do so, and those who don't, don't.
> Let it rest, please...

Interesting, Bob, what one k00k says about a troll, especially what
one k00k who used x-no-archieve commenting on someone else who uses
x-no-archieve.  This is particularly in light of the fact of what you
have said about spamblocked.com under your Nom-de-NANAE, bfs.  Hmm,
another comment concerning spamblocked.com, eh Bob.  Who and what you
post about says a great deal about your motives for being here in
NANAE.

> There has to be something in your life that has a higher precedent than
> chasing after a couple of people who are supposedly spammers, or at the
> very least, a more effective means of doing so... I mean, if I were chasing
> down a spammer, I'd contact the spammer-hunters group I belong to, we'd dig
> up every detail on his life, we'd figure out his schedule and his business
> and personal associations, where he lives, where he works, what his habits
> are, we'd hack into his computers and gather information (if for no other
> reason than to publicly embarrass him if he tries to fight us), we'd sniff
> his wireless network if he's got one and capture any data he's sending or
> receiving, we'd do all sorts of stuff, but we definitely wouldn't spend all
> (or even any) of our time trying to publicly humiliate him in an online
> newsgroup, where a person's credibility is nearly nil starting out, and
> usually only rises if we're well known enough to make a large impact on
> that particular sub-sector of the online genre, and often falls to below
> nil if we say or do something that makes people believe we're a kook or
> troll. It's not an effective use of our time, and it accomplishes
> absolutely nothing toward our ultimate goal... the end to spam.

Spoken like  *true* chickenboner, Bob.  There's that "we" again.  Just
how many frogs do you have in your "widdle itty bitty" pants pockets.
You talk cr@p, Bob.  You *are* cr@p, Bob!  You pr0n spammers all have
that "thingie" about being such great orators and just love to see
your words in print "above the line" as Stewart like to say.  And you
"get off" by pretending to be some "hot babe" in a chat room on AOL
whilst talking to a *male* about sex.  Talk about the "bottom" of the
barrel.  Bubba's gonna like yo' spammy arse when his "thingie" gets to
your bottom.  You're a botton, right Bob, you should "feel" right at
home as Bubba's b!tch.

> I think you have to stop, sit back from the keyboard for a minute,
> and quietly, calmly ask yourself, "What is my ultimate goal?
> What do I want to get out of this endeavor, and is this the
> most effective means of going about it?"

Sounds reasonable, Bob, if one can be honest with oneself and others.
What is *your* ultimate goal and why are *you* here now in NANAE?  Is
it to persuade others to help eliminate your competition, a particular
Russian spam gang?

> Hope this helps...

Take your own advice, Bob.  After all, it's worth what you paid for
it.  Maybe that's why it didn't help you.

:: Re: 66.209.64.0/19 removal

> Something you might also have a conceptual error about is that
> the DNS servers don't ISSUE the IP addresses to the web servers...
> they're merely translating between a FQDN and an IP address... even if
> the DNS server is down, if that website can be accessed via its IP address,
> you'll be able to access it. That's why a lot of spammers are moving to using
> IP addresses instead of URLs, they cut out the possibility of the Registrar
> or DNS provider cutting them off from the DNS servers, thus effectively
> cutting them off from the web. Notice I didn't say 'cutting them off from
> the internet'. The internet and the web are two different things. You
> can be cut off from the web, and still able to access the 'net, but if
> you're cut off from the 'net, there's no way you're getting on the web.

You "Shirley" know a great deal about what spammers are doing these
days, "don'tcha," Bob.  All of that knowledge about the web and the
Internet and you still couldn't figure out how SPEWS creates their
record designations.  You are pathetic, Bob and *very* Rules 1-3
challenged.

:: Re: SPEWS Periodic Weedout, Ezzi.net

::::    <quote>    ::::

"bananananae" <banana_na...@yahoo.co.uk> wrote in message

news:630e418f.0408042026.35852aa7@posting.google.com...

> You are an entertaining writer.  How about you entertain us (TINU)
> with a good story, good enough to convince the FBI, why a tracert to
> your posting IP resolves to

> ::: 17 47 ms 57 ms 67 ms 65.125.237.66  proxy04-node142.fbi.gov.

Unless he IS the FBI... oooh, now we'll have the conspiracy nuts
coming out
of the woodwork!

Here, let's wind them up a bit, and see where they spin:

NANAE IS BEING WATCHED BY THE FBI !!!

That ought to do it... stand back, everyone, while the kooks and
trolls
gyrate.

::::    </quote>    ::::

There's that isolate.net stench of humour again, Bob.  You *are* one
of those k00ks and trolls that you speak of.  Are you still gyraing
for us (tinu), Bob?

:: Re: SPEWS - Please remove our IP from your List

::::    <quote>    ::::

"brad.madison" <brad.madi...@mail.tds.net> wrote in message

news:41112700.8030207@mail.tds.net...

> Years ago, when all here were saying uu.net was unresponsive, I very
> easily and simply (took two short, simple requests) got them to remove
> the account for Rizler.  If you do the right thing and present the right
> evidence you can get spammer accounts removed.  As a side efect you also
> educate the ISPs into reaizing that their comlicity is glaringly
> visible, with all the potential bad publicity that entails.

Hi, Brad.

How did you do it with uu.net? I'm always on the lookout for
effective
techniques, if I can tweak my LART reports so they get a better
response,
based upon what I learn from you (or anyone able to get uu.net,
savvis.net,
hanaro.net, telefonica.br, etc. to respond), that'd be great.

Thanks for any help you can provide...

::::    </quote>    ::::

Where are your LARTS posted, Bob?  You talk the talk, but you don't
seem able to walk the walk, or at least prove it to any believable
degree.  Admit it, Bob, you are just here to pump NANAE regulars for
information, intel for your cause which is spamming and spam support
and of course, trying to motivate folks to help "take out" your
competition.

Be honest, Bob, you've read Sun-Tzu, haven't you, and you are
practicing Book 13.

:: Re: AOL User spamming AOL Users via Windows Messaging Serivce

"Chris U" <pressedpork.animal.spamt...@myrealbox.com> wrote in message

news:o141h0tlr3mri3g3b0q6mcgo9ehj9q06tq@4ax.com...

>> Domain: spw4a.com
>> Registrant
>> Gary Preston
>> Gary Preston
>> Gary...@AOL.com
>> Secure Computer, LLCPO Box 583
>> Mamaroneck, New York 10543 US
>> +1.9145171382
>Looks like it's time to send a LART to Eliot Spitzer, the NY State
Attorney
> General. He's anti-spam, his office should do something about it.
> Try this address:
> http://www.oag.state.ny.us/internet/onlineformspage.html

There's that "isole" stench of humour, again, Bob.  You're making fun
of Spitzer since he settled with Snotty, "orangeya?"  Hmm, maybe you
know Snotty personally, do you, Bob?

:: Re: Ricon Associates Mortgage spamming thru open proxy

"Bananas in the Falklands" <banana....@fk.nospam> wrote in message
news:ceokk2$a7b$1@sparta.btinternet.com...

>> My proxy pot had this deposited in it by Ricon Associates LLC
(whoever
>> they be) for destinations elsewhere and it was one of several
dropped to
>> my proxy via host-81-190-197-201.gizycko.mm.pl (81.190.197.201)
> What proxy pot do you use? I'm running JackPot, but the proxypot on it
> doesn't seem to fool proxy spammers, so I'm only getting relay spammers.

So that's it.  You are doing all of this to gather intel for "them."
You're one of "them" and not one of us (tinu).  Shame on you, Bob.
You *are* here on a Book 13 (Sun-Tzu, The Art of War) mission.

:: Re: spam@uce

> Well, considering that they're struggling with just what
> they've got now, I'd say with more than double the amount,
> it'd put them out of business for a while. I'd let them get the
> u...@ftc.gov and s...@uce.gov issue worked out first. Then,
> I'd call the FTC at (202) 326-2000, and ask to be forwarded to
> the whoever is in charge of the email servers for u...@ftc.gov and
> s...@uce.gov, and get permission to forward your received
> spam to them.

Well, aren't you the helpful little chickenboner, Bob.  The best place
to hide is in plain sight, "idnit."  Perhaps you aren't that stupid
after all.  Wait, you made that stupid chickenboner comment about
spamblocked.com so you really *are* that stupid.

> And, if you can, create an overall aggregate of which ISPs' IP
> addresses are sending you the spam, and submit a report at
> http://www.econsumer.gov/english/index.html.  Hopefully, the
> spammers are located in one of the member countries, and
> something will get done about it.

Send the FTC a list of which ISP's are sending the spam?  Well, that
won't impact the spammers who use stolen resources such as trojanned
boxen, now will it?  You funny, Bob, very funny.

::  SpamVampire...

> I learned about aa419.org's Lad Vampire a while back, and
> used it for a while to be sure it was effective. After learning
> that it was, indeed, effective, I decided that since the source
> code that aa419.org was using had been contributed by an
> anonymous person, that Mr. Anonymous probably wouldn't
> mind me using the code for my own purposes.

Isn't that you, aren't *you* Mr. Anonymous?  You're a spammer and
spammers steal whatever they want from the Internet, code, images,
resources, don't they, Bob?

> I reworked the code so it runs just as well from the local
> computer as it does from a website, fixed the errors so it
> would validate as HTML 4.01 Strict, and added a throttle
> so it didn't take all the available bandwidth.
> It is my belief (validated by experience) that data draining of
> spamvertised websites to such an extent that spamming your
> domain is a negative-income proposition results in the spammers
> leaving you alone. Our spam receival rate has dropped from
> around 3000/month at the beginning of this year to less than
> 50 per month now. I had been using FriedSpam.net in
> the past, and still do for some websites, but this is a faster
> and more effective means of hitting the spamvertised websites.

Amazing, absolutely fscking amazing that someone could know so much
about coding and the Internet and not know how SPEWS designates its
records.  Wait, Bob, now you are talking about multiple domains and
websites.  Previously you spoke in the singular.  That's typical of a
spammer, vacillating between singular and plural.

The experience you talk about was most likely gained from the other
end.  You've learned what makes a spammer listwash and stop
domain/return address forging certain folk in spam runs from having
those things done to you.

> Feel free to grab the source code and use it for your own purposes:
> http://www.hillscapital.com/antispam/index.htm

What's in it for you?

:: Re: newbe question

::::    <quote>    ::::

"IntentionallyLeftBl...@no.no" <intentionallyleftbl...@no.no> wrote in
message news:Xns9539ED130267GoTo@212.83.64.166...

> Somebody suggested to me that the best way to fight spam is to response to
> each and every spam mail by going to their site and filling out the
> form/questionnaire with bogus info, incluing bogus name, e-mail, crdit card
> info, etc.

Yes, it's effective, but only if you find a way to strip the URL down
so
any identifying information that can be traced back to you is no
longer
there.

For instance, say a spam is advertising the following URL:
http://www.spamvertisedwebsite.com/01209ldio1kco/
or:
http://www.spamvertisedwebsite.com/?uid=01209lkio1kco

Then you'd have to strip out that last part or change it so it can't
be
traced back to your email address, causing you to get more spam, and
possibly get attacked by the spammer.

It is best if you visit the spamvertised website via anonymous proxies
(use
an anonymous proxy rotator program like MultiProxy), and in a browser
that's been locked down so any scripting capabilities are either
disabled
or are under your immediate control.

Of course, it's time consuming, and it becomes more effective if more
people do it, so invite your friends to join you in a Saturday night
form-flood party. Get chips, dip, music, and have a contest to see who
can
fill in the most forms in a certain amount of time. Winner takes the
prize
(perhaps a 'Spammers suck' T-shirt?).

The spammers will never know that it's all coming from the same
computer or
computers, since the anonymous proxy rotator program is changing the
IP
addresses they see on a random basis. Thus, since they don't know that
it's
all from the same computer, they'll have to take the time to track
down
each lead and verify it, costing them time and money.

In the whole scheme of things, it's a small annoyance to the spammers.
But,
if that's as far as you're willing to go to take down spammers, then
every
contribution to the cause is appreciated.

::::    </quote>    ::::

This is a particularly revealing post by you, Bob.  Once again, you
responded to a one-time poster.

 Google Search: author:intentionallyleftbl...@no.no

<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&q=author:intention...>

Results 1 - 1 of about 2 for author:intentionallyleftbl...@no.no  

That would be two posts in the same thread for this one-time poster
who was clever enough to use a posting email address like
"IntentionallyLeftBl...@no.no" in a thread about "filling out the
form/questionnaire with bogus info, including bogus name, e-mail,
crdit card info, etc" *and* this one-time poster made almost the
identical post twice in the same thread.

Let's have a look at them, shall we.

::::    <quote>    ::::

From: intentionallyleftblank (intentionallyleftbl...@no.no)
Subject: newbe question

View this article only  
Newsgroups: alt.spam
Date: 2004-08-02 13:11:46 PST

Hi All,

I'm pretty much of a newbe here, so I hope this question makes some
sense.

Someone I know, suggests to respond to each and every spam you receive
by going to their website and filling out their forms with *bogus*
answers
(including false name, crdit card details., etc.). If everybody would
do
so, then the spammer would spent whole day sifting through all of
these
bogus responses, just to find the real ones. Is that right? Or is she
wrong?

Any response much appreciated.

[and]

From: IntentionallyLeftBl...@no.no (intentionallyleftbl...@no.no)
Subject: newbe question

View this article only  
Newsgroups: alt.spam
Date: 2004-08-02 14:08:14 PST

Hi All,

I am a newby, so I hope this question makes sense.

Somebody suggested to me that the best way to fight spam is to
response to
each and every spam mail by going to their site and filling out the
form/questionnaire with bogus info, incluing bogus name, e-mail, crdit
card
info, etc.

On the other hand, a general principle is that you should not lie.
What do
you think?

Best regards,

<void>

::::    </quote>    ::::

Interesting, in one post the OP spelt newbie as "newbe" and in another
"newby" which is odd, Bob, just like you.

Also interesting is the great detail with which you gave to a "newbie"
who you must admit, would have no idea what you were talking about.
It would appear that your response was intended for others and that
the information you gave was bogus.

Lettuce (tinl) think about the validity of what you have posted.  You
know so much about spamming, spammers and the Internet and yet you
misled everyone about filling out forms.  First of all, the only forms
that require the information you mentioned would be mortgage forms
which one arives at if one clicks on a spamvertised link in mortgage
spam.

Hmm, Phil Doroff / SPEWS S2134 / bitpushers / five-elements /
reflected.net is a mortgage spammer who used to spam via *stolen* AOL
accounts, but has recently switched to other means of delivery and has
also moved back to LMIHosing.com resources.

 Google Search: SPEWS S2134 mortgage

Results 1 - 10 of about 67 for SPEWS S2134 mortgage

<http://groups.google.com/groups?hl=en&lr=&ie=ISO-8859-1&scoring=d&q=S...>

As you can see, Phil changes spamvertised domains on a regular basis,
which is the MO for both LMIHosting and five-elements / reflected.net
/ SPEWS S2134.

 Google Search: SPEWS S2134 mortgage LMIHosting

Results 1 - 8 of about 17 for SPEWS S2134 mortgage LMIHosting

<http://groups.google.com/groups?hl=en&lr=&ie=ISO-8859-1&scoring=d&q=S...>

LMIHosting is generally regarded as a morph of the isolate.net spam
gang.  From

 http://www.spews.org/html/S2170.html

Spammers & spammer hosts.

<http://groups.google.com/groups?selm=20031012221913.29999.00000249%40...>

::::    <quote>    ::::

Spamhaus tells us (TINU) that there are under 200 hard core spammers
in ROKSO
who are responsible for 90% of the spam received by Europe and North
America.
SPEWS has almost 3,000 records.  This implies that some ROKSO and
other
spammers must have more than one record in SPEWS under an alias.
Spammers
morph when one identity becomes known or have more than one criminal
enterprise
of their own, or in partnership with other chickenboners.  It's hard
to tell
some players even with a programme.  There's no greater reason to
morph than
being sued.  What happens to a spammer/spam gang when it gets sued?
What
happens to their resources?  Speaking of John Doe defendants...

What ever happened to those bad boy spammers known as isolate.net?
Dan Ivans
never appeared in NANAE to defend himself, nor has he posted anywhere
about
anything that anyone knows of.  Known porn spammer and highly
suspected AOL
account thief John Johnson of SPEWS S1620, known to some as John Doe,
claims to
know all about young Dan, even giving an interview about the MSN vs.
isolate.net lawsuit.  John says Dan did it for the money.  Dan says he
didn't
do it and he's not a spammer and there could be some truth to that.
He could
simply be a spam supporter profiting from someone else pulling his
strings
and/or pretending to be him while using his name(s) and Internet
resources.
What has happened to isolate's net space?

Maybe this, which just found its way into spam traps set up last year
to
monitor the spew and movements of isolate.net and verynicetits.com,
spamvertising

[snip]

These name servers implicate other spammers and/or SPEWS records, but
who is
John Doe.  That doesn't sound very Hispanic.  In fact, it sounds like
someone
who is trying to hide his identity or who has been sued, or *both*  
In a round
of recent MSN lawsuits, MSN sued isolate.net and defendants "John
Doe's 1 - 20"
 They were sued, but never identified.  Remember Tony Montana and the
Principality of Sealand (SPEWS S2134) who used a bastardization of
Steve
Lindford/Spamhaus' address on Taggs Island to register their spammy
domains at
DirectNic.com (InterCosmos.com).  How arrogant and Rule 3 challenged
was it for
Dan Ivans to register all of those spamming domains in his real name?
Smell
familiar?  It's the pungent isolate.net stench of humour.  Their MO is
to
taunt, to tease.  It's more than a "bidniz" for them, it's a sickness.
 They
seem to feel a need to harass and annoy anyone who attempts to stand
in their
way of forcing anyone and everyone worldwide to accept their spew,
their will
at the expense of all others.  They appear to have a control issue.
It shan't
be long before mental health professionals announce that spamming is a
mental
disease.

Here's another John Doe registration.

domain: IMPROVEITNOW.COM.BR
owner: John Doe Enterprises
ownerid: 077.337.733/0001-40
responsible: John Doe Enterprises
address: r das camelias, 123,
address: 12460-035 - sao jose - sp

[snip]

Are these spammers known as lmihosting.com really the isolate.net
defendants.
They are using their IP's and MO.  If it's not them, they know who is.
 The
evidence suggests a strong connection/working relationship.  It will
indeed be
very interesting to learn who John Doe and his 19 clones are when MSN
drags
them into court.

::::    </quote>    ::::

Now, Bob, consider that an AOL niche spammer, which Phil Doroff is as
well as Johnson and Stewart, wouldn't care about the IP from which
their spam was sent because it is either sent from a *stolen* AOL
account or a controlled trojanned box.

AOL niche spammers harvest fresh email addresses nightly/daily in AOL
chat rooms and AOL users rarely, if ever, report spam outside of AOL.
This means that everything you have said in the last few days is
irrelevant when it comes to AOL niche spammers and it lends credence
to theory that you you are simply trying to increase revenues whilst
at the same time causing harm to your competitors.

Now let's examine why you would be recommending that people fill out
bogus mortgage forms a bit more closely.  Spammers don't check the
mortgage forms except to see that they appear legimate/valid enough so
that whomever they sell them to won't complain.  You just advised
everyone to fill out multiple form with "real" sounding/looking
information using an IP randomiser so that each "bogusly" filled out
form would appear to be from a different person/lead so that your
profits, you *are* most likely a mortgage spammer, Bob, will increase
since you are paid per lead.

Aren't you ashamed of yourself for trying to "phool" everyone in NANAE
and alt.spam into making money for you and doing your bidding by
helping to curb your competitors' spamming activities.

:: Re: spammer honeypots

::::    <quote>    ::::

"Jack" <j...@nospam.jackpot.uk.net> wrote in message

news:cel4ve$8tp$1$8302bc10@news.demon.co.uk...
...but regrettably I'm not in a position to support it properly at the
moment (and I haven't been for about a year now). If some Java
developer
is interested in taking it on, I will gladly provide the source.

Oh, hi, Jack! I didn't realize that was you. Yeah, JackPot is running
great... spammy is still filling the mail queue pretty quickly, no
matter
how big I make it, but I'm assuming that since JackPot just drops the
message when the mail queue is filled, there's no way for it to be
relayed,
so I might as well just let it run with a full mail queue.

If anyone is interested in running JackPot, I give a hearty
recommendation
to do so... every spam we can prevent being delivered is another barb
in
the spammers' collective ass. If you want to get a look at what the
logfiles look like, you can check mine out:
http://63.207.207.234:52/hcm/hosts.html?sort=ip

I use several antispam techniques... JackPot is a big part of it, but
I've
also redone the code from aa419.org's Lad Vampire (used to hit 419
sites),
and added a throttle so it doesn't take all the available bandwidth.
You
can check that out here:

http://www.hillscapital.com/antispam/index.htm

Feel free to grab the source code and use it against your own
spammers. The
code runs just as well from the local computer as it does from a web
page.

    -SpamSlayer

::::    <quote>    ::::

This is your second post in NANAE as Mr. Anonymous and you still
hadn't quite figured out how to properly quote the poster you are
responding to.  At least you did improve with practice, but you were
still quite easy to spot/identify as a troll/k00k.

All of that talk about running Jackpot and where are the results of
your efforts posted in NANAE to help the cause?  Oh, wait, *your*
cause in learning and running Jackkpot was to successfully code a
detection routine to defeat/avoid Jackpot for spamwear.  You're a
fake, Bob, and everyone knows it now.  Those who do utilise honeypots
do so to help the collective spam fighting effort, not just themselves
and they don't make a phool of themselves posting in NANAE as you have
done.

:: Strike back against the spammers...

::::    <quote>    ::::

Hi, all.

I've taken the Lad Vampire (aa419.org) code (used to hit 419 sites),
and
changed it for my own uses. I use it to hit spamvertised websites.
Here's
the logic:

For businesses:
If you cost a spammer more money (in increased bandwidth and hosting
bills)
than they can 'earn' from spamming your domain, the spammer will leave
your
domain alone. I've proven this with our domain. At the beginning of
the
year, we received over 3000 spams/month for all our email addresses.
We are
now at 47 / month, and have been as low as 8 / month (we've got one
exceptionally stupid Russian spammer that I'm trying to knock a clue
into).

For individuals:
If you cost a spammer more money (in increased bandwidth and hosting
bills)
than they can 'earn' spamming you (let's hope the amount they can earn
is
$0), then they'll listwash you, and not spam you anymore.

This all hinges upon the spammee contacting the spammer, and telling
them
that their website(s) will be hit because they spammed an off-limits
email
address or domain. You can get the spammer's email address by doing a
WHOIS
on the spamvertised website URL, and looking for the Registrant's
email
address. This should be the spammer's email address. If your
nasty-gram
email to this address goes through, you've warned the spammer to leave
you
alone (use an email address other than the one you usually use), and
if it
bounces or is an address of an innocent bystander, you can contact
their
Registrar, and get the website registration yanked for invalid
registration
information, effectively shutting down that website.

It really works better than anything else I've tried, and I've tried
it
all.

Anyway, feel free to grab the source code and enter in the URLs of the
spammers bothering you. The source code is public domain, since it was
originally donated to aa419.org by an anonymous donor, and I'm
releasing my
code changes as public domain, as well. Have fun.

http://www.hillscapital.com/antispam/index.htm

::::    </quote>    ::::

Hmm, there's that, "Hi, all" again that your other socks used to set
up some of your responses.  You may have read Book 13, but you simply
aren't that good at this sort of subterfuge, Bob.

This was your first post as Mr. Anonymous and *no one* responded to
it, so you kept trying until you garnered an audience and some folks
fell for your FUD.  But now everyone can see what you are doing here
in NANAE, so your audience will be a little more skeptical and a
little more cautious, except, of course, for those in NANAE who enjoy
toying with trolls like you.

To view Bob's BIG picture even more clearly, read "all" of Bob's posts
in NANAE.  The Google results used in preparing this post only listed
Bob's last post in each thread.  Bob's quite the funny man and he is
an entertaining read.  Unfortunately, he's just not believable in the
slightest.

Bob, you are either a mortgage spammer yourself or you support, or
have a vested interest in, the mortgage spam industry.  Tell us (tinu)
the truth, Bob, you're here with a hidden agenda, "orangeja?"

Cheers,

SuN

--
Essiri sempri lu santu fora la chiesa.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.

Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2008 Google