[ADMIN] Recent spam message

5 posts ยท Feb 20 1998 to Feb 21 1998

From: Jonathan white <jw4@b...>

Date: Fri, 20 Feb 1998 10:26:06 +0000

Subject: [ADMIN] Recent spam message

A couple of people have been in touch with me about a message they received
via the list that was a 'spam' message (i.e. an advert unrelated to the list
content).

If people are going to complain about this *PLEASE* remember not to use
the 'reply' function of your mailer - that will send your complaint to
the list itself, which will probably generate more irrelevant traffic than the
original spam. Instead, send it direct to..

ee99qq@ix.netcom.com

which is the address the message originated from.

As it is, this address is *not* one of the list subscribers and therefore
shouldn't have been able to post it. I'm looking into the situation. I hate to
throw stones but we *do* have a couple of subscribers from ix.netcom.com on
the list. If they could get in touch with me via private email so I can make
sure I'm not looking in the wrong place I'd be obliged.

                        TTFN
                                Jon

From: Tim Jones <Tim.Jones@S...>

Date: Fri, 20 Feb 1998 10:58:32 -0000

Subject: RE: [ADMIN] Recent spam message

On Friday, February 20, 1998 10:26 AM, Jonathan white
> [SMTP:jw4@bolton.ac.uk] wrote:
FYI

All the headers were forged - this isn't a real email address
neither is the one in the message.

If you look at the advert that was sent it was for a web harvester This shows
the real dangers of having email addresses in web pages

I suggest that FT page owners remove the mailto and address tags otherwise you
are sooner or later likely to become a victim of spam.

Especially if you are  quoting someone elses address - like the contacts
pages. I'd scramble them using a non obvious method (web bots are wise to
simple insertions) I'd also appreciate my address being removed or protected
on any pages out there.

sincerely

From: Matthew Seidl <seidl@v...>

Date: Fri, 20 Feb 1998 07:33:10 -0700

Subject: Re: [ADMIN] Recent spam message

> On Fri, 20 Feb 1998 10:26:06 +0000, Jonathan white writes:

Just to chime in a bit, this is NOT where the message is from.

Received: from mach3ww.com by rimmer.acs.bolton.ac.uk (MX V4.2 AXP) with SMTP;
          Fri, 20 Feb 1998 07:39:10 +0000
Received: from default (1Cust163.tnt14.lax3.da.uu.net [153.37.91.163]) by
          mach3ww.com (8.8.8/8.8.7) with SMTP id BAA23793; Fri, 20 Feb
1998
          01:36:34 -0600

Looks like the injection point was off of uunet.net (they run a LOT of modems,
not surprising), and the first relay was mach3ww.com.

I would suggest complaining to: abuse@uunet.net, postmaster@uunet.net,
mach3@MACH3WW.COM, abuse@mach3ww.com

I would guess you'd get no reponse from mach3ww.com, but that's where I'd
start.

If you would like more info about reading headers like this, take a look at
the links page off my lawsuit page (URL in sig).

From: Jonathan white <jw4@b...>

Date: Fri, 20 Feb 1998 14:48:05 +0000

Subject: Re: [ADMIN] Recent spam message

Upon examination, it appears the list was set to allow anyone to post. This
has now been changed so that only subscribers may post messages. THis
*may*
give some people problems i.e. getting posts but not being able to post
replies. If you do suffer from that problem, get in touch via private email
and I'll try and sort out any problems.

                        TTFN
                                Jon

From: Allan Goodall <agoodall@a...>

Date: Sat, 21 Feb 1998 00:35:21 GMT

Subject: Re: [ADMIN] Recent spam message

On Fri, 20 Feb 1998 14:48:05 +0000, Jonathan white <jw4@bolton.ac.uk>
wrote:

> Upon examination, it appears the list was set to allow anyone to post.
This
> has now been changed so that only subscribers may post messages.

Thanks for changing that, Jon. That should protect us in the future.
Occassionally we get someone posting a "subscribe" command to the list instead
of the request address, so will those people get a bounce or will their
messages just go into limbo? Either way, this is good protection from spam.

I agree that some bot probably picked up the list's address from a web site. I
suggest that web sites should have the mailing list server's address as a
mailto (to help new people subscribe) but the mail address itself should just
be text with no mailto tag.