Re: More on SPAMing-- Garage Doors

[Tom Greene <cowgod@idt.net>]

Rubywand wrote:
> 
>      Maybe you and Scott have some ideas about the source of the Garage Doors
> spam (and interpreting search results). Here is the heading info ...
> 
> >>
> Path:
> 
> typhoon01.swbell.net!cyclone.swbell.net!cyclone.pbi.net!205.252.116.205!howland.erols.net!newsfeed.tli.de!news-raspail.gip.net!news.gsl.net!gip.net!news5-gui.server.ntli.net!news11-gui.server.ntli.net!ntli.net!not-for-mail
> 
>               From: digogrjp@which.net
>         Newsgroups: comp.sys.apple2
>             Subject: ROLLER GARAGE DOORS
>               Date: 18 Nov 1999 22:19:36 GMT
>        Organization: Which Online Usenet Service
>              Lines: 13
>        Message-ID: <811u1o$h8r$5047@nclient3-gui.server.which.net>
>  NNTP-Posting-Host: p29-bantam-gui.tch.which.net
>            X-Trace: nclient3-gui.server.which.net 942963576 17691
> 194.168.102.29 (18 Nov 1999 22:19:36 GMT)
>     X-Complaints-To: postmaster@which.net
>  NNTP-Posting-Date: 18 Nov 1999 22:19:36 GMT
>         x-no-archive: yes
>       X-Newsreader: Microsoft Outlook Express 4.72.2106.4
>        X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
>               Xref: cyclone.swbell.net comp.sys.apple2:32650
> 

I'd say which.net is the most likely source.

<snip>

> which.net
> 
> ADDRESS               QUERY      ACTUAL NAME        AUTH TYPE   TTL
> OTHER
> ns1.cableol.net.   , which.net , which.net.         , A , NS  , 7200  ,

<snip snip. Had to cut this because my news server wouldn't allow me to
post with so much quoted text>

>      Based upon the above, where is the best place (or places) to email abuse
> complaints?
> 
The above info doesn't really help too much. It shows the name servers
(NS), start of authority (SOA), and mail exchangers (MX), but that
doesn't mean much in the case of finding spammers.