Tracing SPAM: "forum_announcer@hotmail.com"

Trojan

Hey guys,

I just got my first spam at an address I thought was clean... trying to see where it got harvested.

Anyone familiar with this mail? (I.e. did it come from boards or quake related?)

Return-Path: <forum_announcer@hotmail.com>
Received: from hotmail.com (f176.law15.hotmail.com [64.4.23.176])
	by #.#.com with ESMTP id TAA04052
	for <#@#.com>; Fri, 27 Apr 2001 19:30:07 +0100
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Fri, 27 Apr 2001 11:29:19 -0700
Received: from 216.106.196.70 by lw15fd.law15.hotmail.msn.com with HTTP;	Fri, 27 Apr 2001 18:29:18 GMT
X-Originating-IP: [216.106.196.70]
From: "Forum Announcer" <forum_announcer@hotmail.com>
Subject: Check it out....
Date: Fri, 27 Apr 2001 14:29:18 -0400
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Bcc:
Message-ID: <F176A2aiVklUVhjNIjm000042ce@hotmail.com>
X-OriginalArrivalTime: 27 Apr 2001 18:29:19.0988 (UTC) FILETIME=[F960EB40:01C0CF47]
X-UIDL: eZK!!T$m!!F`*!!e;8"!

RR-Forums have now placed the most impressive site ever to the base of the 
Forum page.

Visit the Forum and find out what it is.

[url="http://pub16.ezboard.com/brrelectronics53132"]http://pub16.ezboard.com/brrelectronics53132[/url]


Guaranteed you will bookmark this invaluable site.

Click on the area mapping too, its SO DETAILED right down to your street 
names.

UK only Ordinance Mapping

_________________________________________________________________
Get your FREE download of MSN Explorer at [url="http://explorer.msn.com"]http://explorer.msn.com[/url]

Hopefully Bounce Spam Mail will work ...

The ba$tards....

Al.

Coyote

well they just spam every word in the world
to hotmail.com and see if it works.
i have gotten a few emails with over 500 Coyotexxxx@hotmail.com (x=diff things)
and i could see all the other emails it went to.
i just think they spam hotmail wiht mills of emails

Coyote

Trojan

<font face="Verdana, Arial" size="2">Originally posted by Coyote:
well they just spam every word in the world to hotmail.com and see if it works.
</font>

The addressee was not @hotmail.com (but the sender was). No, the definitely harvested this clean (and fairly new) address from somewhere..

Al.

Coyote

well the only thing i can think of is
if someone setup a hotmail account
and used the way you can setup outlook
to check and send email, made a program to
send loads of spam useing the hotmail pop
account, other that that i do not know.

yossarin

I'm not at all convinced that hotmail doesn't sell their own addresses - remember the whole license thing they had ?

a quick trace on 216.106.196.70:
...
p8-0-0.nchicago2-core0.bbnplanet.net [4.0.6.2]
chi2-e3-0305.atlink.nap.net [207.112.240.250]
216.106.199.162
216.106.196.70

these http://www.nap.net/ guys seem to be an ISP - maybe you could get on their case adn say you seem to have been spammed from one of their ip addresses - their whois:

Registrant:
NAP.NET, LLC (NAP2-DOM)
5007 S. Howell
Milwaukee, WI 53207-6157
US

Domain Name: nap.net

Administrative Contact, Billing Contact:
Birkenheier, Sue J (SJB5) sjb@NAP.NET
NAP.NET, LLC
5007 S HowellAve
Milwaukee, WI 53207
+1 414 747 8747
Technical Contact:
Operations Center, Nap.net Network (NNO3) noc@NAP.NET
NAP.NET, LLC
5007 S. Howell Ave
Milwaukee, WI 53207
414-747-8747 / 1-800-801-3920 (FAX) 414-747-8778

Record last updated on 03-Apr-2001.
Record expires on 04-Jul-2001.
Record created on 03-Jul-1995.
Database last updated on 27-Apr-2001 08:09:00 EDT.

Domain servers in listed order:

NS2.NAP.NET 206.54.224.1
NS3.NAP.NET 207.112.248.82


is it worth complaining though ?spammers prpbably using some free account or summat.


[This message has been edited by yossarin (edited 27-04-2001).]

satchmo

yeah I got that mail today too, at my @tcd.ie address. I already get some spam so I didn't really think much of it. I've never been part of the online Quake scene, so it's not that. Any other ideas?

yossarin

hey Jazz, I'll bet you can't resist saying "wow". I'll bet you a tenner...

[This message has been edited by yossarin (edited 27-04-2001).]

satchmo

I'd take that bet, if only I had a tenner...


[This message has been edited by Jazz (edited 28-04-2001).]

Kali

got the same thing as well .. @dcu.ie address.

actually went to the site mentioned.. one extremely crap board with popup ads everywhere and a very low member count.

kayos

yep just got it to my dol.ie account it must be something to do with the boards

kayos

satchmo

*******s

yossarin

it could be a spider/robot - but the details pages are dynamic so a spider couldn't get to them...cloud or deVore could look at the stats to see it we've been visited.

Celt

I got this in the email i use for the boards.

Lenny

I got the same email in my hotmail account

satchmo

I'd say that 'members' link at the bottom of the page is the most likely culprit. While it's true that spiders from the major search engines like google don't follow certain CGI links, it would be quite easy to write a script that would harvest the emails from this page.

hmmm

Hobbes

You shouldn't make your address visible on this site anyway. If the person really wants to contact you they could use the forums.

Btw... pray to god that ezboard do not have your email address or you will be spammed to death (Even if you told them not to spam you).

root

Complain to this isp

@Link Networks (NETBLK-LINK-BLK)
2220 Campbell Creek Blvd
Richardson, TX 75082
US

Netname: LINK-BLK
Netblock: 216.106.192.0 - 216.106.255.255
Maintainer: LNKN

Coordinator:
@Link Networks (ZL37-ARIN) IP_ADMIN@LINK-US.NET
972.367-3403

Domain System inverse mapping provided by:

NS.DSLNET.COM 209.100.160.5
NS2.NAP.NET 206.54.224.1