North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Spam .. Find the sender !

  • From: Jay Stewart
  • Date: Mon May 11 12:34:56 1998

Jan,

153.35.0.0/16, 153.36.0.0/16, 153.37.0.0/16 *all* belong to UU.NET and are
used for multiple nationwide ISP dialups.  Send mail to [email protected], and
consider blocking these prefixes from connecting to your SMTP servers.

Jay Stewart
Vice President
Olympia Networking Services - "Olympia's Premier ISP"
Phone (360) 753.3636  Fax (360) 357.6160  http://www.olywa.net

---------------------
C:\>whois -h whois.arin.net 153.37.0.0

UUNET Technologies, Inc. (NET-UUNETCUSTB37)
   3060 Williams Drive
   Fairfax, VA 22031

   Netname: UUNETCUSTB37
   Netnumber: 153.37.0.0

   Coordinator:
      Uunet, AlterNet - Technical Support  (OA12-ARIN)  [email protected]
      +1 (800) 900-0241
   Alternate Contact:
      UUNET Postmaster  (UUPM-ARIN)  [email protected]
      703-206-5440


   Domain System inverse mapping provided by:

   HUGIN.UU.NET                 153.39.242.112
   MUNIN.UU.NET                 153.39.242.113
   AUTH60.NS.UU.NET             198.6.2.181

   Record last updated on 21-May-97.
   Database last updated on 8-May-98 16:08:58 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and nic.ddn.mil for MILNET Information.


-----Original Message-----
From: Jan Czmok <[email protected]>
To: [email protected] <[email protected]>
Date: Monday, May 11, 1998 9:19 AM
Subject: Spam .. Find the sender !


>Hi!
>
>We got some spam mail from
>> Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
>(153.37.184.151)
>>   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
>
>and i cannot query the database (arin , ripe or radb) for the owner of
>this network.
>Any hints ?
>
>If we can find the sender, then we go for a hunt against this spammers.
>
>So far...
>
>Greetings
>
>
>Jan Czmok
>IPF.NET NOC
>
>more headers :
>
> Return-Path: [email protected]
>> Delivery-Date: Sun May 10 04:48:03 1998
>> Received: (qmail 26693 invoked from network); 10 May 1998 04:48:03
>-0000
>> Received: from claven.cse.psu.edu (HELO cse.psu.edu) (130.203.3.50)
>>   by finch.cse.psu.edu with SMTP; 10 May 1998 04:48:03 -0000
>> Received: from relay.ipf.net (relay.ipf.net [195.88.0.13]) by
>cse.psu.edu (8.8.8/8.7.3) with SMTP id AAA21505 for
><[email protected]>; Sun, 10 May 1998 00:48:02 -0400 (EDT)
>> Date: Sun, 10 May 1998 00:48:02 -0400 (EDT)
>> From: [email protected]
>> Received: (qmail 13706 invoked from network); 10 May 1998 04:47:58
>-0000
>> Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007)
>(153.37.184.151)
>>   by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000
>> To: [email protected]
>> Comments: Authenticated sender is <[email protected]>
>> Errors-To: [email protected]
>> Subject: DO YOU KNOW HIS OR HER BACKGROUND???
>> Message-Id: <[email protected]>
>