SUCCESS!

Boo-yah! Down another one goes... I found a registrar who's actually taking
action against one of our spammers.

Here's the message from InterCosmos.com:
Thanks for the information. We have put the domain tecmnsd.info on
registrar-hold. So the domain will stop resolving.
Donny

I sent them back a message, telling them about the spammer having other
URLs registered through them, 5 of them, so I may just get this spammer
shut down wholesale.

Here's hoping, anyway.

Thank you.  Registrar action can be another effective way to pressure
the spammers.

news:laaQc.459$of6.157@newssvr29.news.prodigy.com...

My mistake, only two of the spammer's 5 domains were registered with
InterCosmos.com, but they're gone now... all Registrars should be as
responsive as InterCosmos.com. That's damned impressive. Now we wait for
the DNS changes to propagate, and they'll be off the air.

So, we should see:
http://www.tecmnsd.info/ES001/

http://www.mdnfdkk.info/OE017/

going away.

What's funny is that even though the domains are on Registrar hold, meaning
that DNS won't resolve for them anymore, my DNS server's still got the
required information to hit them with SpamVampire. So, nobody can visit,
except for me. And I'm visiting a lot. And I'm not allowing my DNS server
to update that DNS record, so I'll be able to continue hitting them for as
long as that server is serving those websites, even if DNS won't point
anyone else to them.

I've got to be hell on the poor spammers... nobody can visit their websites
except the one they don't want to have visit under any circumstances... too
much fun. But, it's all part of striking fear into the hearts of spammers
everywhere. If I can become world-famous in spammer circles as someone to
avoid, I'll have accomplished my goal.

news:lPaQc.471$sx6.383@newssvr29.news.prodigy.com...

That's the Russian Spam Gang.

Intercosmos is DirectNIC. How did you contact them? What did you tell them?

How about going after the nameserver for lots of them- LIONSTAM.BIZ?

news:mDbQc.4499$Mg1.2542@bignews4.bellsouth.net...

Yep, that's the Russian Spam Gang... I've been hammering the living hell
out of their websites with my SpamVampire
(http://www.hillscapital.com/an­tispam/index.htm feel free to grab the
source code and set up your own).

?

I sent the LART to a...@intercosmos.com, with a note at the top that they
were the registrar, and that they should check the registration information
for the site, and terminate it if it was found that the registration
information was invalid.

Tried that... the email address obtained by doing a dig on Lionstam.biz
bounces.

news:GdcQc.494$g57.177@newssvr29.news.prodigy.com...

Hooo-BOY, we're going after these scumbags in a big way! I just got another
spam from them on a new domain they'd registered with InterCosmos. It's
already down...

http://ndffzzy.hksdhdj.info/ES­001/?affiliate_id=234170&campa­ign_id=404

Man, when Donny at InterCosmos decides to bork a site, he doesn't mess
around.

#begin  Ale...@invalid.domain.exe (or was it Alexis.com)
 message <mDbQc.4499$Mg1.2...@bignews4.­bellsouth.net> reply:

<SNIP>

 have several such replies from Intercosmos, when CC:ing DirectNIC on spams.
But in all other cases I get their standard "we are just a Registrar, contact
ISPs" answer. No idea what triggers that "lucky" reply.

Dolphin.

--
 URL: http://www.DolphinWave.org
Mail: on the web page (no spam)
 ICQ: 6615461

He didn't happen to give you his last name did he?

Jeff

Have Donny take a look at:

http://groups.google.com/group­s?&scoring=d&q=%22%2FOE017%2F%­22
http://groups.google.com/group­s?&scoring=d&q=%22%2FES001%2F%­22

He'll find plenty more...

Sample:

KLCBHGF.BIZ

klcbhgf.biz
IP Addresses:   61.128.198.12
IP Country:     CHINA
Reverse IP Lookup:      IP hosts 25 domains

Hosting Company Name:  
ICANN Registrar:        INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM
Creation Date:  Jul 7 2004
Expiry Date:    Jul 6 2005

61.128.198.12 - IP hosts 25 Total Domains ...
Showing 1 - 25 out of 25

        Domain Name
1       AEAMDGI.INFO.
2       BDEAHCHA.INFO.
3       BHGNCGE.INFO.
4       BJCKKBFF.INFO.
5       CAIBGJC.BIZ.
6       CBIDABJ.INFO.
7       CKLIBCDN.INFO.
8       ENLDLID.INFO.
9       FDGFDBI.BIZ.
10      FKMJECB.INFO.
11      FMLAECCJ.BIZ.
12      GHCCLCCC.BIZ.
13      IHJJFJDF.INFO.
14      INCBGGC.INFO.
15      JJGLCLLJ.INFO.
16      KFJLFJKA.BIZ.
17      KIHGGCF.INFO.
18      KJFDMJE.INFO.
19      KLCBHGF.BIZ.
20      LDDEKFAN.INFO.
21      MFCALEL.BIZ.
22      MHCNJCNN.INFO.
23      MKJFKBE.INFO.
24      MMHLIFID.BIZ.
25      NFKIIJL.INFO.

or

http://www.polarbeach.com/topi­cs/0704-Directnic.htm
http://www.polarbeach.com/topi­cs/0604-Directnic.htm

Jeff

Thanks, I forgot they are back up.

Many of those on that list that I gave for IP 61.128.198.12 are
registered at namebay.com.  It appears that BUENOCARTO.INFO has 27
domain names registered, all associated with this spam group.

BUENOCARTO.INFO doesn't appear on Polarbeach because it doesn't resolve
and they apparently only used it to sign up the other spam domains.
Here is the info:

[Note: using the whois.namebay.com server reveals the actual registrar
while whois.afilias.info does not]

contacting server whois.namebay.com

Domain Name : BUENOCARTO.INFO
Created On : 2004-07-01
Expiration Date : 2005-07-01
Status : ACTIVE
Registrant Name : Valery Binanaka
Registrant Street1 : Bolshoy Kamenniy Most 21, 14
Registrant City : Moscow
Registrant State/Province  : RU
Registrant Postal Code : 132423
Registrant Country : RU
Admin Handle : VB38284
Admin Name : Valery Binanaka
Admin Street1 : Bolshoy Kamenniy Most 21, 14
Admin City : Moscow
Admin State/Province : RU
Admin Postal Code : 132423
Admin Country : RU
Admin Phone : +7.6490189
Admin Email : valerybinan...@mail.ru
Tech Handle : VB38284
Tech Name : Valery Binanaka
Tech Street1 : Bolshoy Kamenniy Most 21, 14
Tech City : Moscow
Tech State/Province : RU
Tech Postal Code : 132423
Tech Country : RU
Tech Phone : +7.6490189
Tech Email : valerybinan...@mail.ru
Billing Handle : VB38284
Billing Name : Valery Binanaka
Billing Street1 : Bolshoy Kamenniy Most 21, 14
Billing City : Moscow
Billing State/Province : RU
Billing Postal Code : 132423
Billing Country : RU
Billing Phone : +7.6490189
Billing Email : valerybinan...@mail.ru
Name Server : FIRST.BUENOCARTO.INFO
Name Server : SECOND.BUENOCARTO.INFO
Name Server : THIRD.BUENOCARTO.INFO
Name Server : ADDON.BUENOCARTO.INFO
Registrar Name : NAMEBAY
Registrar WebSite : http://www.namebay.com

FIRST.BUENOCARTO.INFO = 221.143.42.209 / HANARO
SECOND.BUENOCARTO.INFO = 221.139.2.84 / HANARO
THIRD.BUENOCARTO.INFO = 61.128.198.10 / CHINANET-CQ
ADDON.BUENOCARTO.INFO = 219.146.151.49 / CHINATELECOM-sd

Total Domains Trend - BUENOCARTO.INFO

Weeks      Total Domains        
08/02/04        27      
07/26/04        27      
07/19/04        27      
07/12/04        19      

[snip]

Forgot:

221.143.42.209 - IP hosts 16 Total Domains ...
Showing 1 - 16 out of 16

        Domain Name
1       AGBBALIE.INFO.
2       ALDICIJH.INFO.
3       CNHDCDAI.INFO.
4       GCABMEBM.INFO.
5       JGANMNBJ.BIZ.
6       JMKGGCGJ.INFO.
7       KEJNBFGI.BIZ.
8       KFDLAMJL.INFO.
9       LINGELAL.BIZ.
10      LJLHHDJN.INFO.
11      LNBJIHCN.INFO.
12      MAGCNMKG.BIZ.
13      NLHJBIGK.INFO.
14      OEM101.BIZ.
15      SOFTARIUM.INFO.
16      SOFTCDS.BIZ.

221.139.2.84 - IP hosts 4 Total Domains ...
Showing 1 - 4 out of 4

        Domain Name
1       JLBLBIB.INFO.
2       LEMCHFJ.INFO.
3       LJMBJHD.INFO.
4       MLKCNCL.INFO.

219.146.151.49 - IP hosts 21 Total Domains ...
Showing 1 - 21 out of 21

        Domain Name
1       ACLBKCDC.INFO.
2       AFFILIATESERVICE.BIZ.
3       BDCNGLJJ.BIZ.
4       BEAUTY-ANGEL.BIZ.
5       BEAUTY-ANGEL.NET.
6       CGNACMG.INFO.
7       CHEAPESTSOFT.BIZ.
8       ETERNAL-BEAUTY.BIZ.
9       ETERNAL-BEAUTY.NET.
10      FIFCAIJN.INFO.
11      HELPALOT.BIZ.
12      IFBCCCH.INFO.
13      ILDLIGG.BIZ.
14      KJMBKCK.BIZ.
15      OUTSPOKENTEENPORN.BIZ.
16      OUTSPOKENTEENPORN.NET.
17      SOFTWORKX.BIZ.
18      TEENME.BIZ.
19      TGFIND.NET.
20      THESNAKEKING.BIZ.
21      TINYAMERICA.BIZ.

In news.admin.net-abuse.email - article <10h2v3jgbdgo434
@corp.supernews.com>, on Wed, 04 Aug 2004 17:18:16 -0700, glgxg
says...

...
[snip]

What else shows up on the following IP,

Canonical name: sfi.propylene3479pi11s.us
Addresses:
  221.143.42.37

it and it's name servers seem to be tied via a...@sanita77.biz

Domain Name:                                 PROPYLENE3479PI11S.US
Domain ID:                                   D6497094-US
Sponsoring Registrar:                        ENOM, INC.
Domain Status:                               ok
Registrant ID:                               613D6E481933A837
Registrant Name:                             tiiri konkretno
Registrant Organization:                     Uno More
Registrant Address1:                         Briezha 5-6
Registrant City:                             Riga
Registrant State/Province:                   Riga
Registrant Postal Code:                      LV 1021
Registrant Country:                          Latvia
Registrant Country Code:                     LV
Name Server:                                 NS3.AIRMARAMBA.BIZ
Name Server:                                 NS2.AUDI56SEW.BIZ
Created by Registrar:                        ENOM, INC.
Domain Registration Date:                    Mon Aug 02 07:44:46 GMT
2004

#begin  g...@mfire.invalid.com.exe (or was it glgxg.com)
 message <10h2upkl937d...@corp.supernew­s.com> reply:

<SNIP>

<SNIP>

It actually does, just the encoded way (no idea why they do it like that):

$ jwhois BUENOCARTO.INFO
[Querying whois.afilias.info]
[whois.afilias.info]
<...>
Domain ID:D6033888-LRMS
Domain Name:BUENOCARTO.INFO
Created On:01-Jul-2004 16:04:15 UTC
Last Updated On:02-Jul-2004 07:00:33 UTC
Expiration Date:01-Jul-2005 16:04:15 UTC
Sponsoring Registrar:R123-LRMS <== Note
<...>

http://www.afilias.info/whois_­search/sponsoring_registrars

<QUOTE>
R123-LRMS       Namebay cuitasse[AT]namebay.com
</QUOTE>

Ah... thanks for that!  I went nuts trying to figure that out before
finally stumbling on namebay directly.

Re: SUCCESS!

Re: SUCCESS!

And another one down, and another one down, another one bites the dust.
Hey, spammy, we're gonna get you, too. Another one bites the dust!

bjbmdbe.info is now dead. Another Russian Spam Gang domain gone... and this
one, they didn't even get a chance to send any spam for. InterCosmos is
killing them off preemptively now. I've got them searching through their
records for the email addresses the Russian Spam Gang has used to register
other domains, and they're killing any off that were registered with those
email addresses.

This is too much fun... 4 spammer domains killed off (and possibly quite a
few more once they find them) in two days... the Russian Spam Gang has got
to be wondering what's going on.

People, if you want to help kill off an egregious spammer in a vicious,
brutal bloodletting, then I urge you to contact InterCosmos with any
Russian Spam Gang spam you've gotten, and to set up your own SpamVampire
(http://www.hillscapital.com/an­tispam/index.htm grab the source code) and
hit them as hard as you can for the domains they didn't register through
InterCosmos.

We've got a chance right now to kill off a major spam ring that's been
sending out hundreds of millions of spams, for mortgages, fake viagra,
penis enlargement, and pirated software.

I wouldn't get quite so excited... you are talking about INTERCOSMOS
MEDIA GROUP, INC. after all.

BTW:

http://groups.google.com/group­s?&scoring=d&q=KLCBHGF.BIZ

Now on:

08/05/04 18:39:43 dns KLCBHGF.BIZ
Canonical name: KLCBHGF.BIZ
Addresses:
  201.3.240.226

Checking server [whois.neulevel.biz]
Results:
Domain Name:                                 KLCBHGF.BIZ
Domain ID:                                   D7323980-BIZ
Sponsoring Registrar:                        INTERCOSMOS MEDIA GROUP,
INC. D.B.A. DIRECTNIC.COM
Domain Status:                               ok

reading URL KLCBHGF.BIZ
contacting host klcbhgf.biz [201.3.240.226] on port 80

HTTP/1.1 200 OK
Date: Fri, 06 Aug 2004 00:35:53 GMT
Server: Apache/1.3.31 (Unix) PHP/4.3.7 mod_accel/1.0.31 mod_ssl/2.8.18
OpenSSL/0.9.7d
X-Powered-By: PHP/4.3.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

201.3.240.226 - IP hosts 11 Total Domains ...
Showing 1 - 11 out of 11

        Domain Name
1       ALEBDCD.INFO. <== INTERCOSMOS
2       AMLGJLBC.BIZ. <== NameBay
3       CIMCAHH.BIZ. <== NameBay
4       DMBLMIFF.INFO. <== NameBay
5       EDJIHJEM.INFO. <== NameBay
6       FJLLDAF.INFO. <== NameBay
7       FMMBHGN.BIZ. <== NameBay
8       GINCBDC.INFO. <== NameBay
9       HBEBLBN.BIZ. <== INTERCOSMOS
10      LDEBHBE.INFO. <== INTERCOSMOS
11      MBHCACD.INFO. <== NameBay

news:10h5pmeso20qe7d@corp.supernews.com...

OK, now how do I do that? How do I get a server to give up all the domains
it's hosting? Teach me, please.

http://whois.webhosting.info/2­01.3.240.226

Just be advised that it's a snapshot type database lookup, so it can
have a time lag. You need to look up the individual names for
verification via other standard tools.

<...>
For the record, here are some domains, IPs, and DNS for others from
the same asshat (a...@sanita77.biz):

shingle6722dryg.us (subdomain snipped b/c it's so weird I'm sure it's
a tracking method) at 221.143.42.37 using
NS3.AIRMARAMBA.BIZ and NS2.AUDI56SEW.BIZ

Order page is www.123prescription.biz at 222.55.10.19 using
NS1.AIRMARAMBA.BIZ  and NS1.B2002BUKA.BIZ

ns1.b2002buka.biz = 221.143.42.92 using NS1.MOSKVA66.BIZ and
NS2.MOSKVA66.BIZ

ns1.moskva66.biz = 218.66.101.152 and ns2.moskva66.biz =
218.66.17.132.

ns1.airmaramba.biz (222.55.10.19) uses
NS1.BEER99.BIZ = 219.234.95.68 and NS1.LUNOMUN.BIZ = 61.145.118.248

...

That's just what I did... I found seven URLs, all pointing to the same IP
address hosted out of Brazil, all with the same exact web pages hawking
mortgage quotes, penis enlargement, viagra, and pirated software.

So far I've gotten 4 of the Russian Spam Gang's websites shut down:
http://www.tecmnsd.info
http://www.mdnfdkk.info
http://www.hksdhdj.info
http://www.bjbmdbe.info

And by tomorrow, I'll have the following Russian Spam Gang websites shut
down:
AEAMDGI.INFO
BHGNCGE.INFO
ENLDLID.INFO
FDGFDBI.BIZ
KJFDMJE.INFO
KLCBHGF.BIZ
NFKIIJL.INFO

If anyone finds any Russian Spam Gang spam in their Inbox, or comes across
one of their websites, post here, so we can compile a complete list of
their domains. We'll try to get as many of them shut down as possible.

The ones we can't get shut down, we'll drop into the SpamVampire, and
hammer the hell out of.

news:10h62ne6onlfdf9@corp.supernews.com...

Too cool! I've been looking for a way to do that for quite some time now.
Thanks.

BTW, how many domains is average to be hosted on one machine? Our web host
has 344 on our machine, yet they say that it's not worth it to upgrade the
mail server that goes along with that web server so it reports Source IP
addresses correctly. Are they blowing smoke up my ass, as I suspect they
are?

news:dsFQc.934$GF4.909@newssvr29.news.prodigy.com...

You know what's amazing? I'm hitting spamvertised websites hosted out of
China and Brazil, but I keep seeing a BellSouth IP address showing up in my
IDS/IRS... hmmm... spammy is trying to figure out who's costing them so
much, perhaps? BellSouth is out of Florida.

It's adsl-80-85-61.asm.bellsouth.ne­t, IP address 65.80.85.61.

Hey, spammy, I don't care where you host your websites, if you spam our
domain, I'm hitting them and getting them borked. If you think you can stop
me, think again... you've become a major cost of doing business, so now I
am YOUR cost of doing business. And I'm not going away until you do. Get
used to it, like we've all had to get used to putting up with your spew.

You stop spamming our domain, I'll stop hitting your spamvertised websites.
That's the deal. No negotiations.

You do know that BellSouth offers service in more states than just
Florida, don't you Mr. Anonymous, "I know so much about the Internet,
spammers and fighting spam, but I don't know what SPEWS S2134 means."

Have you no shame, Bob, following up your own post in NANAE.  Are you
*sure* that you aren't a spammer involved in a pissing contest with
some Florida spammers/competitors.  If you were a true spam fighter
you wouldn't offer to stop hitting spammy's spamvertised websites once
he stopped spamming your domain.

What is your domain anyway?  It shouldn't be a problem mentioning it
if spammy already knows what it is.  You keep referring to "we" and if
you have partners in this one lone website.  Do you perhaps have a
frog in your pocket?

You are posting from,

NNTP-Posting-Host: 63.207.207.234

Pac Bell Internet Services PBI-NET-7 (NET-63-192-0-0-1)
                                  63.192.0.0 - 63.207.255.255

STAN FISHER SBCIS-100531-182148 (NET-63-207-207-232-1)
                                  63.207.207.232 - 63.207.207.239

So, Stan, why do you also go by the name of Bob and what do you need 8
IP's for if you only have one website?

CustName:   STAN FISHER
Address:    303 Second Street
City:       San Francisco
StateProv:  CA
PostalCode: 94107
Country:    US
RegDate:    2000-06-01
Updated:    2000-06-01

NetRange:   63.207.207.232 - 63.207.207.239
CIDR:       63.207.207.232/29
NetName:    SBCIS-100531-182148
NetHandle:  NET-63-207-207-232-1
Parent:     NET-63-192-0-0-1
NetType:    Reassigned
Comment:    
RegDate:    2000-06-01
Updated:    2000-06-01

Hmm, you've had this /29 for four years and you've just started
posting in NANAE sounding like either a tenured regular or a tenured
spammer.  Bob, did you hijack this IP block from Stan?

Your posting IP resolves to   151.164.243.21

        60 ms   70 ms   84 ms   64.200.89.70    
washdc5lcx1-pos11-0.wcg.net.    245     UNITED STATES
11      61 ms   70 ms   79 ms   64.200.95.114  
washdc5lcx1-sbc-pos.wcg.net.    244     UNITED STATES   Unix: 23:39:44. 26
12      60 ms   69 ms   79 ms   151.164.191.137
bb2-p2-0.hrndva.sbcglobal.net.  243     UNITED STATES   Unix: 23:39:44.214
13      68 ms   75 ms   85 ms   151.164.243.21  
bb1-p6-0.hrndva.sbcglobal.net.  242     UNITED STATES   Unix: 23:39:45.267

::::    or are you this spammer?    ::::

 Google Search: 151.164.243.21

http://groups.google.com/group­s?q=151.164.243.21&hl=en&lr=&i­e=UTF-8&s...

::::    which leads to    ::::

Registrant:
 none>>>>>>>>>>>>>>>>>>>>>>>>>>­ATTN: DIRECTNIC.COM
 1516 Horrell Ave
 Mckinleyville, CA 95519
 US

 Domain Name: THEANSWERTO.COM

Monteforte, Patrick &amp;amp; Tracy  gtp...@northcoast.com
    1516 Horrell Ave
    Mckinleyville, CA 95519
    US
    707-840-9517

 Registration Service Provider:
    Intercosmos Media Group Inc. dba directNIC.com,
supp...@directnic.com
    504 679 5173
    http://www.directnic.com

 Record last updated on 20-Mar-2002.
 Record expires on 02-Sep-2002.
 Record Created on 02-Sep-2000.

::::    NEW REGISTRATION    ::::

Registration Service Provided By: WTPowers
Contact: doma...@wtpowers.com

Domain name- theanswerto.com

Nameservers-
    NS3.PLUGIT.COM
    NS4.PLUGIT.COM

Start of registration- Sat Sep 02 2000 00:41:28
Registered through- Thu Sep 02 2004 00:41:28

Registrant Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Administrative Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Billing Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Technical Contact-
   WTPowers
   Patrick Monteforte   (p...@wtpowers.com)
   +1.7078409517
   FAX- +1.7078399559
   2617 Northbaink RD
   PO Box 2490
   Mckinleyville, CA 95519
   US

Say, Bob, aren't you that "phool" who claims to be new here?

Google Groups: View Thread "[proxy hijacking] theplanet.com /
valueweb.net / atr..."

<http://groups.google.com/group­s?hl=en&lr=&ie=UTF-8&threadm=2­f0f6d90.0...>

Say what?  You're new here?  Oh, really!

If you are new here then why do you know so much about whois, LARTing,
dig, reporting chains, etc.?

Let's have a look and see if it's you and examine some of the cr@p you
have been spewing in NANAE the last few days.  Seems you have been
having a bit of a go with the good folks in NANAE.

Google Search: author:Anonym...@domain.invali­d

<http://groups.google.com/group­s?hl=en&lr=&ie=UTF-8&q=author:­Anonymous...>

It would appear that you know a great deal about spammers and fighting
spam for someone who claims to be new here, "don'tja," Bob?

:: Re: How Millionaire gets 20,000 visitors a day

:: Re: repost Morely if UUNET is Bad then WHY are you WORSE???

Why would someone as "clued" as you use such an address then, hmm,
Bob?

Say, Bob, didn't you say that 100% of your spam in the last month was
from that Russian spam gang?  Make up your mind, Bob!

:: Re: webrider.ru - Russian Spam Gang

Interesting, Bob, you know all of this but you don't know that S2134
refers to a SPEWS record number.  Total cr@p, Bob, just more and more
pure 100% prime government inspected bullsh!t from you.

:: Re: Reveal who is behind SPEWS

That's about the same kind of believable cr@p you have been spewing
here in NANAE the last few days.  Why, Bob, why are you acting like
such a "phool" claiming to be so concerned about a Russian spam gang
and that *you* are responsible for "inspiring" InterCosmos.com to
cancel spammy's domains.  You do realise that most people don't know
that InterCosmos.com is DirectNIC.com and that a...@DirectNIC.com
uses a DirectNIC email address, not an InterCosmos.com address, don't
you, Bob?  How about you post some of the email, along with headers
adnd responses, you have been sending (sic) to DirectNic.com
concerning this Russian spam gang.

:: Re: SUCCESS!

You're full of cr@p, Bob.  Prove it!  Post your email exchange with
DirectNic.com complete with headers.  Otherwise, it's all just spammer
speak coming from an idiot/k00k like yourself.

:: Re: Spam Surge?

...

read more »

Ouch.  Picture me falling backwards off a fence (John Cleese as Fool)
once again.

Still, there's nothing to be gained by the spammer from knowing how its
done.  The best and ultimately the only defense is to stop spamming (or
to stop using abuse to spam, which makes blocklists real easy and real
powerful.)  It's a temporary defense to move to another form of abuse
(like to open proxy abusde and then to spam zombie abuse), but if people
start combating that abuse the spammers (Hi, Bob) lose.  It's not the
spammers knowing the tools agaist them that hurts, its the lack of
practitioners of the art.

Uh, what's Book 13 of Sun-Tzu?  Go into the enemy's camp and play dumb,
play the novice, get the enemy to talk?   Human engineering?  No sweat -
the secrets aren't the "how" but the "where" - and that's only if the
user chooses the secret route.

One mode of honeypot counter-attack is to PUBLISH the honeypot IPs on a
web page.  Most of them, with some ringers thrown in.  Like Nimitz said:
"Send them our latitude and longitude."

On 2004-08-06, Sun Tsu <bananana...@spamblocked.com> wrote:

What kind of crack are you smoking? That's one of sbcglobal's backbone
routers, searching for references to is isn't going to give you anything
useful, it just turns up a lot of traceroutes that happen to go through it.

--
Andrew, Supernews
http://www.supernews.com - individual and corporate NNTP services

news:2f0f6d90.0408061546.7fd0be7b@posting.google.com...
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>

ROTFLMAO! God, Sun Tsu, you do the best impression of a crazy person that
I've /ever/ seen! That was hilarious! Thanks for making me laugh so hard...
I haven't laughed like that in ages.

news:GdcQc.494$g57.177@newssvr29.news.prodigy.com...

Well, I tried it and they just tell me to go after the host. Maybe you're
perfuming your notes? :)

Here's another, please sic 'em-

eknmeem.info

I talked to someone else wanting to coordinate efforts. Wonder how you 2 and
others could hook up
at some place where people like your angry little jilted lover Sun Tsu won't
get in the way  :)

Maybe set up a members-only board somewhere?

- Alexis, schmelexis

Sun Tsu wrote something I reckon...

Must be Friday... checks calendar... yep it is.  Probably a full moon
somewhere as well.

Sun - get some sun, relax, enjoy your weekend & cool your jets.

news:ghWQc.2721$yB3.125@newssvr29.news.prodigy.com...

And just in case you're wondering... no, I'm not a spammer. And I /am/ a
relative UseNet newby (newbie? newbee? whatever.)... I had enough trouble
just figuring out how to get NANAE to load into my newsgroup reader. I
never used usenet back in the days when it was all the rage.

As for the SPEWS listing numbers... I'm unfamiliar with a lot of things, so
I ask questions about them to learn. I am also familiar with a lot of
things, and I offer my advice on those things. Having never visited SPEWS
before, I didn't know how they kept track of which spammer was which. Now I
know.

As for the InterCosmos correspondence, here's a snippet (names, email
addresses and IP addresses of the innocent munged to protect against usenet
k00ks):

Received: from icmail.intercosmos.net [xxx.xxx.xxx.xxx] by mail.xxxxxx.com
with ESMTP
  (SMTPD32-6.06) id AD1050209E1; Fri, 06 Aug 2004 12:08:48 -0400
Received: (qmail 6031 invoked by uid 306); 6 Aug 2004 16:05:23 -0000
Received: from xxxx...@intercosmos.com by icmail.intercosmos.net by uid 51
with qmail-scanner-1.20
 (clamuko: 0.65. spamassassin: 2.63.
Clear:RC:0(204.251.2.111):SA:0­(3.2/5.0):.
 Processed in 0.145533 secs); 06 Aug 2004 16:05:23 -0000
X-Spam-Status: No, hits=3.2 required=5.0
Received: from unknown (HELO donnyxxx)
(xxxxxxx...@intercosmos.com@xx­x.xxx.xxx.xxx)
  by 0 with SMTP; 6 Aug 2004 16:05:23 -0000
From: "Donny Xxxxxxxxxx" xxx...@intercosmos.com
To: xxxxxxxxxx...@xxxxxxxxxxxxx.co­m
Subject: RE: Hi, Donny. Got a whole batch of them for you to check out...
ADDENDUM
Date: Fri, 6 Aug 2004 11:05:42 -0500
MIME-Version: 1.0
Content-Type: text/plain;
 charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2149
Thread-Index: AeL7A46u+d5tqnJpQTfS2x5I4cbtng­BZ2TtA
In-Reply-To:
<IMFEKIJDNQIKEHMBMPBNDFCJDHBB.­xxxxxxxxxxx...@xxxxxxxxxxxxx.c­om>
X-Qmail-Scanner-Message-ID: <11029183346627...@icmail.inte­rcosmos.net>
Message-Id: <20040806120815.SN02...@icmail­.intercosmos.net>
X-RCPT-TO: xxxxxxxxxxx...@xxxxxxxxxxxxxx.­com
X-UIDL: 4785
Status: U

All of them are now on hold.

Donny

<snip>

Happy now? Does that assuage your insanity? No, probably not...

God, I've spun up a net k00k, and his crap-flinger is directed at me...
<sigh>

Rich, now I know why you get so much enjoyment out of watching Brad doing
his little crazy dance... it's incredibly funny.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It is, but eventually it just becomes a waste of time.  I advise you to prime
your killfile, for eventual action :-)

- --Russell

- --
Russell Miller          - President, Duskglow Consulting, LLC
rmil...@duskglow.com    - http://www.duskglow.com
Le Mars, IA             - +1 712 546 5886
Official NANAE SPEWS Puppet extraordinaire
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBFD3eURTA4VCI9OARAnUsAJ­97NcZOGvLGBRtrkp71GecHeGNKVACd­GGvu
3k1UCn/t4kQDfTrurRmcn4o=
=Aq/f
-----END PGP SIGNATURE-----

news:8xWQc.2909$923.627@bignews1.bellsouth.net...

Oh, if you're a chick, I think I'm in love... you just uncovered yet
another server of theirs (222.233.52.109). The one I was working on was
201.3.240.226. This one is hosted on HanaNet, mine is hosted on
BrasilTelecom.

Ok, here's what you do.

1) Do a DNS lookup on the domain name.
    In this case, that domain resolves to 222.233.52.109.

2) Do a lookup on WHOIS.webhosting.info:
    http://whois.webhosting.info/2­22.233.52.109
    This doesn't show anything right now... check back tomorrow, after the
server updates, to see if there are any new entries. It also helps to
converse with people here to get the domain names of the Russian Spam
Gang... there is strength in numbers. I'm looking for other methods of
figuring out what websites a server is hosting.

3) Take any FQDN's that you know belong to that IP address that are
registered through InterCosmos, and add /OE017/, /MC021/, /MS020/, and
/ES001/ to that:
http://www.eknmeem.info/OE017/ (pirated software)
http://www.eknmeem.info/MC021/ (penile enlargement)
http://www.eknmeem.info/MS020/ (mortgage quotes)
http://www.eknmeem.info/ES001/ (viagra)

Yep, that is definitely a Russian Spam Gang website.

Now, write up a full LART, and report it to abuse at Intercosmos.com, and
CC it to Donny at InterCosmos (I think you can figure out the email
address...). Tell Donny it's another Russian Spam Gang website. After he
visits the sites and recognizes the content, he should put them on
Registrar Hold status.

All the Russian Spam Gang spamvertised websites that I know of were
registered through either InterCosmos, or NameBay. I'm still trying to get
a contact at NameBay that will act. Once I do, I'll let everyone here know
what it is.

If anyone has a contact at NameBay, let us know, so we can get these
spammer scum shut down.

news:10h5pmeso20qe7d@corp.supernews.com...

I've got to thank you for letting me know about these... you are the reason
I was able to inform InterCosmos about so many of the Russian Spam Gang's
websites and get them shut down.

Thanks for teaching me how to figure out which websites a server is
hosting... that is going to come in very handy in getting the RSG shut down
completely.

Do you have any more tricks up your sleeve? I don't have all the knowledge
that Sun Tsu attributes to me, but I've got a burning malice toward all
things spam, and I believe in taking action and getting things done.

Go after the host/owner, just like you would if a abuse@webserver
doesn't work.  Get the IP address(es) of the DNS servers and then
use traceroute and whois (on the IP address).

--
The suespammers.org mail server is located in California.  So are all my
other mailboxes.  Please do not send unsolicited bulk e-mail or unsolicited
commercial e-mail to my suespammers.org address or any of my other addresses.
These are my opinions, not necessarily my employer's.  I hate spam.

news:HeKdnQ6b6eVH74ncRVn-rg@megapath.net...

I tried that, but every email address I tried just bounced, even the abuse@
and postmaster@ addresses. Isn't there some requirement that the people
running the DNS servers have a valid contact address, as well? Who do I
report to if they don't? How do I find that DNS server's upstream provider?

Andrew - Supernews <andrew+non...@supernews.com> wrote in message <news:slrnch8at5.1pnu.andrew+nonews@trinity.supernews.net>...

Temper, temper, Andrew.

It's simply the result of a tracert designed in accordance with Book
13.  Read it, you might learn something interesting and realise that
you are collateral damage.  Spammers use your posting service just
like normal folks do.

Unless you can vouch for Bob personally, you have nothing to
contribute.

Reread the entire article and come back when you can see past your own
nose/self-interest and post anything that contradicts the facts.

If you believe anything that Bob the bafoon's is spewing, you ae a
disappointment.

Take some time off, Andrew, you need it.

Have a nice weekend.

Cheers,

Sun

--
Cui nun senti raggiuni, nun pò fari cosi cu raggiuni.

news:nm%Qc.2791$kT5.2@newssvr29.news.prodigy.com...
<snip>

Well, it's not the Russian Spam Gang, but it's a spammer...

I am sorry (tins) to report the demise of goforvalue.com... a website that
suffered mightily as the SpamVampire sunk its fangs deep into its veins and
drew its very life from it. Burn in Hell, goforvalue.com. You will not be
missed.

Agreed.  Bob is well versed is spamming and defending against being
stopped.

Good guess, Brad.  Book 13 is entitled, "Espionage" and discusses the
five agents and the role each plays.

If you need any further information, email the posting address.  It
works just fine.

Bob's funny.  His entertainment value alone is worth the read.

Cheers,

SuN

--
"No poor bastard every won a war by dying for his country.  He won the
war by making the other poor bastard die for his.
-General George Patton

news:2f0f6d90.0408070014.449f515b@posting.google.com...

Sun, you're such a nut... God, you should go on the stand-up comedy
circuit... you're hilarious. I literally laughed until my sides hurt on
that first post.

It started off great... you sounded sane, then just for the comedy effect,
you tore off into this wild tangent that rollicked hither and yon, tying
bits of history together like you were writing a Forrest Gump movie. Man,
you are good.

Thanks for the laughs.

How would a blind person know if it were a full moon?  Wait a sec,
where did all of this hair come from and the big sharp teeth, and why
is salava dripping....

Awooooooooooo...............

You too, g-meister, and while you are relaxing read all of Bob the
spammer's posts and be sure to come back on Monday and point out
specifically why you believe Bob is anything other than a spammer.

That is, if you can?

You must have missed all of his contradictions and other tell tale
signs of FUD.

Have a good weekend.  Oh, when you decide to do some real
investigative work to disprove anything posted, call DirectNic.com and
ask for Donny, if there really is a Donny, and ask him to verify Bob's
bullsh!t story.

To contact us via telephone:
 Our telephone number: +1 (504) 679-5170
 Our telephone support hours: 7 am to 7 pm Central Standard Time
Monday - Friday
 Our fax number: +1 (504) 566-0484

Cheers,

SuN

--
Cui veni appressu, si cogghi lu pruvulazzu.

news:5b0Rc.2801$if6.2408@newssvr29.news.prodigy.com...

This one IS a Russian Spam Gang spamvertised website, acting as an
'affiliate' (read: spammer for hire) for 888casino.com.

I regret (tinr) to inform you that casinoderome.com has now shuffled off
its mortal coil. The SpamVampire was simply too much for its mother-site to
bear, causing its mother-site (888casino.com) to terminate its affiliate
status, thus ending its life.

Farewell, casinoderome.com...

news:2f0f6d90.0408070041.5770e5ac@posting.google.com...

He can call Donny if he likes... he can call me, and I'll give him the full
name to ask for. He doesn't need to verify who I am, as he's already called
and spoken to me.

You're quickly slipping off your foundations, Sun. Get help... comedy
relief is so hard to find, we don't want to lose you.

Well, well, well, if it isn't Miller the arsehole/k00k/trool trolling
Bananaposts again.  Didn't you get the memo from Ferguson?

Have you learnt how to write a proper LART as of yet, or have you
determined if GoDaddy received the one LART you have ever attempted in
your long illustrious spam fighting carrer (sic)?  Probably not.  :(

Say, Miller, what ever happened to your mentor in the Jamie baiting
and troll toying "biz," Marc Dufour?  He just dropped off the face of
the earth after 24 JUN 2004 and no one knows or cares what happend to
him after *years* of posting almost daily.

You are doing a supurb job as his replacement.

Aren't you the least bit curious what happened to him since your nose
couldn't have been any farther up his arse?

Say, when's your next dentist's appointment?  Everyone (tine) is on
the edge of their seats just waiting to read more of your personal
details posted in NANAE.  Don't let everyone down, amigo!

"Tell us how you really feel."

Oh, thanks for opening your mouth and confirming the obvious about you
once again.

DING!

SWITCH!

Cheers,

SuN

--
It is better to remain silent and only thought a fool then it is to
open one's mouth and remove all doubt.

On 7 Aug 2004 01:14:37 -0700, bananana...@spamblocked.com (Sun Tsu)
wrote:

  Andrew has *never* posted anything that has made suspicious of his
motives in any way. You have posted a lot of stuff that just gets me to
scratching my head wondering what the heck your point is. An abundance
of references to your own posts in Google don't prove anything. That's
just circular. Book 13? You're a whack job.

  You're a whack job.

  Did he say anything about believing anything that "Bob" said? I don't
think so.

  That's what you'd like to think. But you're a whack job. Probably
smoking some good stuff like Andrew speculated.

  Yes, Andrew, please do.

Steve Baker

On 2004-08-07, Sun Tsu <bananana...@spamblocked.com>

My lack of tolerance for fools is legendary.

For those not familiar with Art of War, Book 13 discusses the art of
espionage, which Sun Tzu considers vital to warfare.

I don't see anything there about traceroutes, but I did notice this:

  " Only the wisest ruler can use spies; only the most benevolent and upright
    general can use spies, and only the most alert and observant person can
    get the truth using spies. "  [trans: sonshi.com]

Giles, additionally, quotes certain Chinese commentators on the required
characteristics of the spies themselves.

It should go without saying that observing the dispositions of the enemy
requires accurate observational skills. Then, as Sun Tzu points out in the
passage quoted above, actually _interpreting_ those observations in order
to draw useful conclusions and formulate strategy requires skill in itself.
So if you're going to look at a traceroute and draw conclusions from it, then
you'd better understand exactly what it is that you're looking at.

You said:

Firstly, the term "resolves to" isn't meaningful in that context. An IP
address can be said to resolve to a domain name or vice versa, but saying
that an IP resolves to another IP makes no sense. If what you actually
meant was "the last IP I see on a traceroute to the posting IP is ...",
then the statement makes sense but is not useful, since that IP is a
router in Herndon VA while the poster's IP is clearly in San Francisco
(easily confirmed from multiple sources).

To go on and suggest that a trace passing through a major backbone router
then implies some sort of connection with other people simply based on
traces that happen to pass through the same router is serious folly,
certainly not in accordance with the quoted passage.

I think it was about 10 years ago that I first read Art of War.

I'm sure there are or have been spammers who are users of ours either via
personal accounts or via ISPs who outsource to us. We go to considerable
lengths to ensure that we are not used for spamming or spam support, and we
do a better job of that than, say, Google.

However, we will not comment on the identity of our users under any
circumstances.

You've posted no facts worthy of contradiction. All I see from you is
unsupported assumptions.

You've apparently assumed that this newsgroup is the only place where
spammer-tracking is discussed or knowledge of network tools is available
(it's quite possible for someone to be competent with the tools despite
being new to the group).

You've apparently assumed that everyone engaged in fighting spam must
automatically know all about SPEWS. I've got news for you: many of them
don't even know about _Spamhaus_, despite it's much higher media profile
and wider usage. This newsgroup isn't the center of the spam-fighting world
(though used properly it is still one of the better resources).

You've assumed that you can identify someone from their posting style.
There's a tendency that I see all the time in this group and elsewhere for
people to assume that everything is the fault of their own particular pet
enemy; this is most visible every time Hipcrime makes a visit, when that
happens there is _always_ someone who assumes that it's an attack on _them_
by their own personal nemesis. After seeing this happen enough times, and
seeing enough laughable mistaken accusations of sock-puppetry, one learns
to ignore (or at best, defer judgement) on all such claims in the absence of
real evidence.

Your claims are inconsistent anyway since you've stated both that one poster
is a sock of another, and that one of those posters is quoting the other to
make an x-no-archive post visible on Google. I'm sure you can see the problem
with that.

Fortunately, I don't need to believe anything that anyone says in this group.

You've certainly done a good job of showing why I shouldn't believe anything
_you_ claim, though.

--
Andrew, Supernews
http://www.supernews.com - individual and corporate NNTP services

"Andrew - Supernews" <andrew+non...@supernews.com> wrote in message

Ok, more possibly dumb questions... what is a sock puppet, in usenet terms?
And what is x-no-archive?

There was no disrespect displayed or directed toward Andrew in that
post, yet Andrew showed disrespect.  Facts are facts, Steve.

Accusing someone of smoking crack without proof is a serious
accusation and a suspicious motive regardless of his rationale.  That
puts him in league with spammers.

 Google Search: Banananane crack

http://groups.google.com/group­s?hl=en&lr=&ie=ISO-8859-1&q=ba­nanananae...

The only other person to do such a stupid thing is a well documented
spammer who has his very own SPEWS record, SPEWS S1106.

A tracert is a tracert is a tracert.  Why would anyone have an
emotional outburst against anyone else who simply posts *facts*
without investigating those facts first?  Spammy plays "tricjs" with
routing or have you forgotten?

No one attacked Andrew, yet Andrew attacked another spam fighter.
Andrew doesn't need you to speak for him and you obviously can't speak
for Bob, the spammer.  Therefore you had nothing to contribute to this
thread, yet you felt obligated for whatever reason to display your
lack of emotional control by posting a personal rant without
provocation.  :(

Now, Steve, if you actually want to do something useful and can't
understand too much information presented in one article, do some
googling on your own or do you have to be spoon fed the facts in the
fight against spam like some ignorant newbie to NANAE.

Just because *you* can't put two and two together doesn't mean someone
else can't.  Shouldn't you be directing your rage against spammy?  No
one mentioned you, so why the outburst of emotion?  If one wants to be
effective in the fight against spam, one can't become personally
involved nor can one be affected by anything someone ignorant of the
facts has to say.

Can you vouch for Bob?  Can you disprove anything that was posted?
Can you understand that someone other than a spammer doesn't just pop
in to NANAE with all of the solutions.  Are you that blind to believe
spammy's bullsh!t without question?

Here's your chance to either prove or disprove the facts.  Are you up
for the challenge, Steve?

Spammny registered /29's using 303 Second Street in San Francisco and
is most likely related to globalofferz.biz, a *most* egregious
pills/pron spammer.  Can you find any of his other /29's or link him
to any SPEWS records?

You should be able to construct that google search on your own but you
aren't acting much like an intelligent spam fighter today, so here it
is for you.

 Google Search: "303 Second Street"

<http://groups.google.com/group­s?hl=en&lr=&ie=ISO-8859-1&scor­ing=d&q=%...>

He also may have posted as a...@globalofferz.biz using the very same
line of bullsh!t he is posting as Mr. Anonymous.  Can you find it or
your own or are you going to wait until someone who can do it does it
for you?

Here's a clue.  Read the articles referenced below and demonstrate
that you are a true spam fighter who can actually research spammers
and post useful information, or don't, and admit that you are just
simply someone who whines in NANAE and makes noise.  Contribute to the
cause rather than helping spammy obfuscate.

 Google Search: a...@globalofferz.biz john drupling

<http://groups.google.com/group­s?q=admin%40globalofferz.biz+j­ohn+drupl...>

Now, here's another clue that you will actually have to think about to
follow, "Is the sate of California a spam source?"

OK, Steve, now you have some clues, no *proof,* that Bob is a spammer.
 Either follow them and prove or disprove the accusation, or apologise
for your rude behaviour.

Just because some NANAE regulars "think" they know how to research
spammers doesn't mean that they do, nor does it mean that others can't
find what they haven't a clue as to how to find.

Ask yourself why you felt the need to be rude to someone else in a
matter which did not involve you.

TheBanana(tm) is a spam fighter, not a spam figher fighter.  You will
find no posts made by theBanana which is against SPEWS, Spamhaus or
*any* other spam fighter unless that poster either trolled
BananaPosts(tm) with some ulterior motive, such as the k00k/troll Marc
Dufour AKA Etaoin Shrdlu AKA S...@SS.org, or attacked this poster first.
 *Whomever* attacks first *will* be dispatched with all deliberate
speed.  This means *anyone,* be it spammer or no, if said poster
insists on contributing to FUD which can only help spammy.

If you do not understand what has just been said or should you wish to
continue this dialog, please take it to email.  NANAE is not the
proper forum for personal attacks and/or rude comments against other
spam fighters, such as the ones mentioned above.  That is how spammers
respond in NANAE, not gentlemen and ladies.

It is expected that not all posters have the self control to refrain
from making posts which are simply displays of their lack of self
discipline which results in nonproductive emotional outbursts
manifested as rants, no matter how short, which *do not* contribute to
the spam fighting effort one iota.  This posting email address is
always left open for such communications and also for "friendly" email
exchanges, which do take place with some NANAE posters.

There is *no* justification for such unwarranted and unsubstantiated
personal attacks and once made, the poster should expect a suitable
response.  There is no room for such immature behaviour in something
as time consuming and serious as spam fighting.  Other froups exists
for casual posters who just want to chit chat, make personal attacks
against others, tell "cute" stories, debate inane topics such as the
weather, seek personal gratification by seeing his or her words
printed on a computer screen, or for those who thrive on the attention
they seek and so desperately need to feel fulfilled.

Now you sound like a spammer and/or someone who can't control his
emotions and/or someone who forgot how to exhibit proper manners and
employ good interpersonal skills in hos posts.  :(

It was a sincere gesture which is more than you seem to be able to
muster.

Have nice weekend, Steve.

Cheers,

SuN

--
Cui nun senti raggiuni, nun pò fari cosi cu raggiuni.

Steve, your last name doesn't sound Sicilian, so here's the
translation.
Who doesn't listen to reason, can't do things with reason.

news:2f0f6d90.0408070947.2a80e0f9@posting.google.com...
<snip>
<snip>
<snip>
<snip>

Ah, well. At least it keeps him off the streets and away from the sane
people...

news:Es8Rc.2196$ru5.445@newssvr27.news.prodigy.com...

And another one... What is FUD?

On 2004-08-07, Anonymous <Anonym...@domain.invalid> wrote:

For "sock puppet" see http://catb.org/~esr/jargon/ht­ml/S/sock-puppet.html
(where you will also find many other definitions of terms seen here)

x-no-archive is a non-standard header used by the Google (formerly Deja)
archive; it allows a poster to specify that the article should not be
archived (or indeed visible on Google at all). Other Usenet sites ignore
the header completely.

FUD has the same meaning here as in the entire rest of the computing
industry ("Fear, Uncertainty and Doubt", originally used by Gene Amdahl to
refer to IBM sales tactics).

--
Andrew, Supernews
http://www.supernews.com - individual and corporate NNTP services

Although their voices have been largely abated, that's what the
spews supporters in Nanae do. They act as sock puppets to each
other on behalf of their beloved blocklist.

I may volunteer to serialize some examples of this spews puppetism
in Q4/04... just for the laugh.

Moris <prita...@REMLINK.yahoo.co.uk> wrote in
news:5QaRc.95700$28.77939@fe1.news.blueyonder.co.uk:
[...snip...]

Will the be before or after you tell us [TINU]
which laws SPEWS has violated that you have promised
to do Real Soon Now for many, many months?

What's your rush? Are you late to school? ;-)

Btw, who is 'us'? There is no 'us' in Nanae. It must exist in your
wild imagination.

Funny, this guy knows how to use "BTW", but has no idea what "TINU" meant!
LOL

Andrew - Supernews <andrew+non...@supernews.com> wrote in message <news:slrnch9f0d.1pnu.andrew+nonews@trinity.supernews.net>...

Your lack of common sense and good judgement is also legenday now as
well.  You made a personal attack when none was made upon youself.
You were foolish and therefore you should now have no tolerence for
yourself.

Saying someone smokes crack is unwise, unprofessional and cause to
snip your post unread.  Your lack of proper respect and manners and
refusal to review *facts* is now also equally well known.  What ever
promped you to side with spammny is your cross to bear.

Read the response to Steve Baker's post which he made in your defense
when no attack was made.  If you want to have a pissing contest in
NANAE instead of taking it to email, so be it.  One more "regular" who
doesn't think before he posts is of no consequence to someone who is
focused on fighting spam.

The facts speak for themselves.  If you can disprove them, please do.
They will be posted in due course if neither you nor Steve can find
them on your own.  Too much time has already been expended in anwering
your and Steve's foolish posts as well as dealing with Bob's and his
puppet's posts.  One would think that you two would know what the
purpose of NANAE is and one wonders what would make someone like you
act as you as have without provocation and first performing due
diligence to disprove the facts presented.

Nothing was said about you personally, Andrew, and yet you made an
unwarranted and unprovoked attack on someone.  You were wrong, Andrew,
and are proably not man enough to admit it.

[snippidy dippidy snip unread personal attack post]

Now, about Bob the spammer.  Just because you can't understand *facts*
and do proper research to verify them is no reason to assume that
anyone else can't ferret out the facts.  Each of us (tinu) contributes
by doing what we each do best.

The clues are in the response to Steve Baker's post as previously
stated.  It must be the cyclic "sun spots" that is bringing out the
foolishness and evil in those who have no reason otherwise to act
recklessly by making such false accusations and such careless and ill
prepared posts.

Right back atcha, Andrew.

It's not about believing anyone, Andrew, it's about understanding
*facts.*

Do the research and see what you missed before you posted your
*foolish* and unprofessional claim of someone smoking crack, just as
if you were some spanked spammer.  That attitude serves spammy, not
NANAE, even if you can't comprehend that concept.

You may have read Sun-Tzu but you don't understand his philosophy nor
can you apply it; you can only copy his words and quote them without
understanding their meaning.  You are engaging in a battle which is
not yours.  You have wrongfully accused someone of smoking crack.  Do
you honestly that that rediculous statement would be what Sun-Tzu
would do?  Show cause for your inappropriate actions and do the proper
research on Bob.

Send email if you like unless you think it better to proceed in NANAE
when it is generally believed that posts such as yours have no place
here.

The facts are there and if you need help in finding them, seeing them,
and understanding them, that too can be arranged.

You might want to spend your time seeking out Bob's true identity and
not wasting it on a personal vendetta.  Start by googling on "303
Second Street" and see if you can dertemine on your own how Bob's
address used to register his /29 is related to one of the *most*
egregious spammers ever discussed in NANAE.  See if you can ferret out
how many SPEWS records it is linked/related to.

Your inability to do such research and make the connection is no
reason or excuse for such an emotional outburst and unwarranted attack
on another poster.  There is *nothing* you can post to justify what
you have done, Andrew, but you are welcome to try if that is your
pleasure.

The sig is specifically for you, Andrew.  The translation can be found
in the sig in the response to Steve's post.

The choice is yours to either help prove the accusations about Bob or
disprove them.  This is not about you although you may mistakenly
believe that fallacy.  If you truly do understand Sun-Tzu, then you
would know that a good commander should never fight a battle which is
not his nor should he engage in warfare unless it is necessary.

At least you understand Book 13 even if you refuse to believe that
spammy does indeed gather intel from posting in NANAE via trolls and
k00ks and you should have noticed in reading NANAE how many people
respond to such posts without thinking.  It is the gullibility of well
meaning people that spammy capitalises upon.  This is also how spammy
steals accounts and credit card information from newbies.  No one is
expected to see and identify such Book 13 techniques in posts if not
properly trained.  Just because you don't have such traning and
experience does not mean someone else does not.

Do as you see fit, Andrew.  Email if you like and wish to learn what
is known about Bob and has not yet been posted, but remember, making
another post as you have been making in this thread only serves
spammy.

There is no quarrel here for you, Andrew, unless you choose to create
one.  Choose wisely.

Cheers,

SuN

--
Cui nun senti raggiuni, nun pò fari cosi cu raggiuni.

Really? You seem to possess a profound knowledge of non-sensical
terms used by the spews supporters.

If you are referring to acronyms commonly used by this group (incidentally
summarized in a FAQ I'm sure you're well aware of), I'd say it's up to the
participants to determine which, if any, are "non-sensical".

Obviously, you believe "TINU" has some sort of relationship with SPEWS
and/or is unique to NANAE.
I find this quite amusing.

You're either a complete newcomer to newsgroups (doubt it), or you're just
another one of those nutbars that troll the group, hoping to somehow find
the meaning of their miserable, purposeless lives through pointless KOOKing
(more likely).  Those who find themselves sooo frustrated by the
"non-sensical" ways of the participants shouldn't be reading their posts and
trying to argue about stuff they don't know enough about anyway.

They really should just get a life.
ROFL

news:2f0f6d90.0408071346.4feee14c@posting.google.com...
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>
<snip>

Boy, Sun, you just keep ramping up the humour... I split a gut again,
reading that last post... wait'll I tell Scott and Sanford about this. It
won't be hard, seeing as how we're all sharing the same email address...
;-)

On Sat, 7 Aug 2004 19:34:25 -0400, "SpammersAreTheScumOfTheEarth!­"

Perhaps if you read this your classification decision will be easier:
http://www.pearlgates.net/nana­e/kooks/moronis.shtml
It's been 9 months since that FAQ was first written.

According to what you've shown me, my analysis was pretty good, considering
I've been "away" from this group long enough not to be acquainted with this
particular loser.

Don't worry, I catch up pretty quickly!
(Don't I?)
;)

- Brent

On 2004-08-07, Sun Tsu <bananana...@spamblocked.com> wrote:

303 Second Street, San Francisco is a large office building. One of the
companies that has offices there is ... Pacbell (SBC).

A quick check of whois data for a variety of Pacbell end-user DSL blocks
seems to show that Pacbell are not listing the user's address in most of
their WHOIS entries for DSL /29s, but instead are listing the address of a
nearby Pacbell office. Random sampling suggests that in the surrounding /16,
at least a quarter of all assigned netblocks show the 303 second street
address, and some other pacbell /16s show similar results. (Someone with
bulk WHOIS access could do the analysis better than I can.)

So once again, you're drawing conclusions from inadequate (or indeed
nonexistent) data.

If you draw enough unsupported conclusions, you can probably link that /29
to anyone on the planet. The question is not whether you can play
"six degrees" with any given spammer but whether the relationships actually
_mean_ anything more significant than "has a Pacbell DSL line with static IPs
in the SF area".

I can't reproduce your logic because I can't reliably guess exactly _which_
unsupported leaps you've made at any given step.

I don't need to justify myself to you, fortunately.

You are clearly so certain that you are right that you refuse to re-examine
your evidence - and this obviously has a bearing on how seriously you can
be taken when you make assertions that are not independently supported.

False dichotomy - I don't have to do either. Rebutting a proof isn't the
same thing as a disproof - but it may be equally helpful, in showing you
errors in your assumptions.

I don't ever recall saying anything either way on this topic.

I'm sure some spammers have tried this approach (I'm not sure whether by
using the singular "spammy" you are referring to a specific spammer or just
using a sloppy rhetorical shorthand - if the latter, it's a dangerous habit
to get into).

What matters in such cases is _what is said_, not _who is responded to_.

Unfortunately "training" can also lead you to see things which simply
aren't there. Critical thinking and reality checks are important too, and
you seem to be missing out on that.

--
Andrew, Supernews
http://www.supernews.com - individual and corporate NNTP services

In article <5QaRc.95700$28.77...@fe1.news­.blueyonder.co.uk>,

More wishful thinking again.  Don't tell me, let me guess:

SPEWS days are numbered as are their supporters in NANAE.

"voices have been largely abated" is *textbook* trolling in action.  I
guess the suggestion is somehow Moris controls who posts and when.  I
maybe you are suggesting you have chased SPEWS supporters out of NANAE.

There is anger in your tone.  It is unmistakable.

At least you would be contributing more than this anti-SPEWS rhetoric.

I thought you had turned over a new leaf, but you seem to have gone back
to your trademark kook-muppet-fanatic-speak.

You are welcome to your opinion of course, but people should know that
you are only here as an anti-SPEWS troll.  You offer not even a well
formed or articulate anti-SPEWS argument.

news:AzXQc.2745$O44.1819@newssvr29.news.prodigy.com...

***SMOOCH***

I had trouble with lag there. I got it now.
Lionstam.biz lists 37 domains, but can't see details?

Why do you do that? They use the same /OE017/ etc. on all their sites?
I do a google for OE017 and get tons of sites.

OK.
Why can't they just query their database for all emails ending in 'mail.ru'?

Their main webpage isn't even up.
No PTR records exist for 80.247.64.240
Missing reverse DNS entry!??!
SPAM issues please email to t...@levelip.it

No Namebay contacts respond, ICANN should shut them down.

-Alexis, waving her +3 Wand of Effective Grue Management

Nope. Worthless abbreviations like 'tanih' are NOT acronyms and
they are only used by the spews supporters.

They are non-sensical as they do not carry any meaning. No-one
has an obligation to read the Faq before visiting Nanae.

Besides, can you see 'tanih' listed in the Faq? No? YOU LOSE.

Wrong assessment.

Keep on wanking.

You are entitled to your own worthless opinions.

No frustration at all. Nanae is a public newsgroup, it's open to
differing opinions and is read equally by the laymen as well as
the spews wankers, and simple trolls like you.

So you should.

Sure!

Whose MORPH (or sock puppet) are you?

That Faq by a spews supporter, you mean?

What did you expect? A welcoming letter?

The way things are progressing, yep, I think so.

Maybe to your brain?

Your barking won't change the end results.

So I am a troll because I am anti-spews?

ROTFL...!

I don't have to.

No warfare is necessary, as Sun Tzu quite rightly pointed out. Read the text.

news:n4rRc.1272$8I4.1100@bignews4.bellsouth.net...

Right back atcha, babe. :-)

There won't be any details on the whois.webhosting.info lookup. But, if you
cut-and-paste each domain with the /OE017/, /MC021/, /MS020/, and /ES001/
addendums, if they come up, they are definitely Russian Spam Gang
websites... it's a lot of work, but getting them shut down is worth it.

Yes, on every website I've seen for these guys, they use the same
subdirectories... makes them pretty easy to find, no?

?

I asked Donny to do that, I'm not sure if he did, though. He will bork a
site if he sees that it's identical to a site you've already submitted spam
about, even if you just send him the URL, and you didn't get any spam
advertising it.

Send all the reports to ICANN, with a note that NameBay is unreachable by
email, their website is down, and all that... if they get enough of these
reports, they'll do something about it. They're not too enthusiastic about
doing NameBay's job for them, so if all NameBay-registered spamvertised
website spam is forwarded to ICANN, something will get done about it, or
ICANN will get buried in spam reports.

ROFL
Is this guy FOR REAL!!?!?
ROFL
Somebody, PLEASE!  Get me some OXYGEN!
He's absolutely KILLING ME!!
ROFL

Andrew - Supernews <andrew+non...@supernews.com> wrote in message news:<slrnchbo2m.

Glad to see that you can do research, albeit not thorough.  Now please
explain why you did *no* research before making a personal attack in
NANAE unprovoked.

You are suggesting that SBC is part of the problem and not part of the
solution.  Had you been thorough in your research you would have
noticed that more than one /29 is registered to 303 Second Street and
you completely overlooked the fact that spammy frequently registers
his IP blocks either in bogus names or in real names that belong to
someone other than himself.

You have neither proved nor disproved anything, but only added to the
obfuscation.

Well, you did prove one thing, Andrew, that your sole purpose in
posting in this thread is simply to satisfy a personal vendetta and
not to fight spam.

Did you bother to trace "303 Second Street" to any Sightings or SPEWS
records?  No. What you did was perfornm only enough research to
justify *your* point of view and to satisfy yourself which is why the
rest of your post was snipped unread.  You haven't sufficiently
demonstrated why anyone should take you serious in your misguided and
immature continuation of a personal vendetta.

Your inability to understand reality is clouded by your emotional need
to be right and to have it domonstrated in NANAE.  This was never
about you, Andrew, but you seem to want it to be, or need it to be.

No amount of words and FUD can make up for what you did.  Either admit
your mistake in NANAE or take it to email.  You are *still* on your
personal crusade and you *still* don't understand how to investigate
properly.  You don't have enough experience to know what you are
talking about.

Andrew, you made a false accusation manifested in a personal attack on
someone who didn't deserve it.  You were *wrong* and as previously
posted, you aren't man enough, or mature enough, to admit your
mistake, especially here in NANAE.

Adults admit when they make mistakes and apologise for them.  You
aren't acting like an adult in this matter.  Either address that issue
or stop posting in this thread.  Serious spam fighters don't have time
for your childish game.

Cheers,

SuN

--
É cchiù la spisa chi la prisa.

<RoseAnneRoseAnnaDanna>
"Nevermind"
</RoseAnneRoseAnnaDanna>

Everyone has been working too hard lately and a weekend holiday was in
order.  So it was off to "Hell" for the weekend for the entire "gang"
and "Oh Lordy" were we (tinu) ever surprised to find that Hell is
currently frozen over!

It appears that Donny *is* a real person, and he responded to email to
a...@DirectNIC.com, a phenomenon which is most likely responsible for
the current, drastic and sudden change in Hell's normal climatic
condition.

Bob, Bob, Bob, (no one is sure if that is his name or his hobby)
however, still smells badly.

Some things to consider are:

1 - DirectNIC has traditionally been a registrar of choice for
spammers

2 - DirectNic has consistetntly *refused* to take *any* action against
spammers

3 - Does their abuse department work weekends?

4 - A recent BananaArticle(tm) in NANAE about DirectNIC.com

For the benefit of those who read NANAE and are Google challenged
and/or too lazy to click on links and read them with any
understanding, the article is quoted below.  Why are the two domains
mentioned still being served DNS by DirectNIC.com, when one is
referenced by suspected trojanned boxen and the other is being used by
AOL niche pr0n spammers and is referenced by a link on a *stolen* AOL
account?

www.PornStation.Org, is being spammed by trojanned boxen

http://free-singles-usa.com, is referenced by AOL niche pr0n spammers

The thread which this article was posted in is a *very* long thread
and an interesting read.

<http://groups.google.com/group­s?q=g:thl3278184813d&dq=&hl=en­&lr=&ie=U...>

::  <quote>  ::

That's quite interesting.  Is DirectNic.com a spammer hiding under
another name or are they protecting a client/spammer such as Ronnie
Scelson.

Scelson is suspect because of two things.

1 - He has stated that his current servers are located in an
    office building in downtown New Orleans.  DirectNic is
    located in downtown New Orleans which is less than
    30 minutes from Scelson's home in Slidell, Louisiana.

2 - Scelson has claimed to have pioneered Windows messaging.

And this morning an AOL niche pr0n spammer was spamming via a *stolen*
AOL account, StarryEyeChic018

FROM AOL Lobby Chat Room 1

::::  THE BAIT    ::::

StarryEyeChic018:  Hi roomies, anyone looking to find a new
love/partner ? :) Check out my profile! ;)

That AOL users profile is:

Name: Jennifer Thomas
Location: EAST COAST
Marital Status: LOOKING STILL
Hobbies & Interests: I love to meet new people and have a good time.
Favorite Gadgets: If you are interested in meeting eligible singles in
your local area you should check out this site!
Occupation: Search picture profiles by zipcode for Free START BY
CLICKING HERE

::::  THE HOOK    ::::

http://free-singles-usa.com

FREE-SINGLES-USA.COM

SSL Cert:  No valid SSL on this Host, Get Secure
Website Status:  Parked
Parked at:  DirecttNic
Server Type:  tigershark/3.0.113 (dn2.directnic.com)

::   tigershark is a server developed by DirectNic.com

http://www.directnic.com/about­/products/tigershark.php

IP Address:  204.251.10.202
IP Location:  Louisiana - Hammond - Zipa Llc <--- *is* DirectNic.com /
Sigmund Solares

directNIC makes this information available "as is," and does not
guarantee
its accuracy.

Registrant:
Webchasm
PO BOX 4421
Bethlehem, PA 18018
US
610-434-2003

Domain Name: FREE-SINGLES-USA.COM

Administrative Contact:
Herceg, SJ webmas...@webchasm.com
PO BOX 4421
Bethlehem, PA 18018
US
610-434-2003

Technical Contact:
Herceg, SJ webmas...@webchasm.com
PO BOX 4421
Bethlehem, PA 18018
US
610-434-2003

Record expires on 02-01-2005
Record created on 02-01-2004

Domain servers in listed order:
NS0.DIRECTNIC.COM 204.251.10.100
NS1.DIRECTNIC.COM 206.251.177.2

which redirects to:

http://www.findromance.com/ind­ex2.php?affil=1840

© AzoogleAds.com, All Rights Reserved.

Registrant:
   Azoogle.com INC
   140 Allstate Parkway
   Suite 505
   Markham, ONTARIO L3R5Y8
   CA

   Domain Name: FINDROMANCE.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Azoogle.com INC
      Joseph Speiser
      140 Allstate Parkway
      Suite 505
      Markham, ONTARIO L3R5Y8
      CA
      9059460300
      8886663120 [fax]
      a...@azoogleads.com

   Domain created on 22-Oct-2001
   Domain expires on 22-Oct-2004
   Last updated on 17-Sep-2003

   Domain servers in listed order:

   NS1.1500V.NET                
   NS2.1500V.NET                

::  </quote>  ::

Interesting how Bob, Bob, Bob, popped, popped, popped onto the NANAE
scene shortly after this post was began posting about how "wonderful"
DirectNIC.com is and how he is so well connected that *he* can get
domains "shut down" when DirectNIC traditionally refused to take any
action against spammers in the past.

The above article could very well be as responsible for DirectNIC's
current actions as anything Bob, Bob, Bob has done, done, done.

Cheers,

SuN

--
Pinky - "What are we gonna do tomorrow, Brain?"
Brain - "Same thing we do everyday, try and take over the world."

<slrncha7h1.1pnu.andrew+non...­@trinity.supernews.net>

<gQ8Rc.2203$qI5....@newssvr27.­news.prodigy.com>

<fQ8Rc.2202$qI5.2...@newssvr27­.news.prodigy.com>

<2f0f6d90.0408070947.2a80e...@­posting.google.com>

<Es8Rc.2196$ru5....@newssvr27.­news.prodigy.com>

<slrnch9f0d.1pnu.andrew+non...­@trinity.supernews.net>

<1259h0do3ht9bqn2inv5fptrl3pvn­32...@4ax.com>

<2f0f6d90.0408070119.5c42...@p­osting.google.com>

<CX0Rc.2804$Ww6.2...@newssvr29­.news.prodigy.com>

<0U0Rc.2803$hw6.1...@newssvr29­.news.prodigy.com>

<2f0f6d90.0408070041.5770e...@­posting.google.com>

<Aw0Rc.2802$Do6...@newssvr29.n­ews.prodigy.com>

<2f0f6d90.0408070025.49cdd...@­posting.google.com>

<5b0Rc.2801$if6.2...@newssvr29­.news.prodigy.com>

<2f0f6d90.0408070014.449f5...@­posting.google.com>