[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
XPOST Porno spam info
Thought this might be of interest as we are all suffering w/ the
porno-spam garbage lately
---------------------------------------------------------------
NNTP-Posting-Host: 207.236.51.133
NNTP-Posting-Date: Wed, 22 Apr 1998 13:42:57 EDT
Just FYI, an update on the what's going on with the porno-spam police:
In one bit of good news, Deja News appears to be filtering out these
messages, or blocking the server altogether, as I'm not seeing any of
these postings there anymore, though I'm still seeing them in Netscape
and Forte Free Agent. Bravo, Deja News! :-)
Per the suggestion of ScamBusters, I forwarded several of these posts
to myself, to get the NNTP-Posting-Host, whose ISP is 206.145.13.39; I
then looked that up, and found this: dialup19.black-hole.com (the main
source, as it turns out, for most of these mass porno postings we've
been getting this week; it was a different one over the weekend ...
more about that in a minute). Anyway, I then looked up black-hole.com
on Whois, and found the following:
Black Hole Internet BLACK-HOLE-DOM
1640 Lake Drive West
Chanhassen, MN 55317
Domain Name: BLACK-HOLE.COM
Administrative Contact, Technical Contact, Zone Contact:
Perrill, Dave DP911 Dave.Perrill@BLACK-HOLE.COM
(612)361-5557 (FAX) (612)361-6211
Billing Contact:
Billing Department BD35-ORG Billing@BLACK-HOLE.COM
(612)361-5557
Fax- (612)944-6694
Record last updated on 24-Oct-97.
Record created on 23-Feb-96.
Database last updated on 22-Apr-98 03:58:52 EDT.
Domain servers in listed order:
NS1.BLACK-HOLE.COM 206.145.13.1
NS2.BLACK-HOLE.COM 206.145.13.2
*****
I have since forward all of this information, along with quite a few
of these postings, to Bell Global Solutions. Hopefully, they will take
action to block this server from mine.
In a related event, I got the following response, re: another spammer
posting porno ads in all the newsgroups over the weekend:
Return-Path: <cchilds@on.bell.ca>
Date: Mon, 20 Apr 1998 18:29:52 -0400
From: Crystal Childs <cchilds@on.bell.ca>
Subject: Re: mass porno postings on newsgroups
Thank you for the notifications and information regarding the spamming
incidents you are experiencing. Please be assured that these actions
will be thoroughly investigated. Attached in this message is a copy
of
Bell Global Solutions Acceptable Use Policy/Netiquette procedures as
well as Bell Global Solutions Internet Abuse address. Any updates of
this situation will be directed to you promptly.
Regards,
Crystal Childs
Bell Solutions
Customer Service
(613)781-7717 tel.
(613)781-1453 fax.
customerservice@on.bell.ca
>
> Bell Global Solutions:
>
> I'm a RipNET customer in Brockville, Ontario, who had e-mailed you
> yesterday about mass pornographic postings that were showing up on all
> the newsgroups I subscribe to. I e-mailed ScamBusters, to see if there
> was any information they could provide on possibly blocking this group
> or individual from my server. She came up with the following
> information, which I hope will be helpful to you.
>
> >Feedback Question: Have you received any complaints about
> >nobody@nowhere33.yet, a spammer who's mass-posting pornography ads on all
> >the newsgroups? Normally, I tend to ignore such postings, but these are
> >hard to ignore. This person is mass-posting at least a dozen new messages
> >a day, with very graphic subject lines, to *all* the various newsgroups I
> >subscribe to ... and then some. Is there any way to track this turkey down
> >and block him/her from my ISP? It's obvious to me that nowhere33.yet
> >doesn't exist as a server; are there any resources available to track this
> >individual/group down and report them to my server, their server, and
> >anyone else who might be able to help? Thanks! :-)
>
> I forwarded one of his posts to myself to see the headings of
> his message and found this:
>
> Path:
> news.dx.net!uunet!in3.uu.net!nntp.inet.fi!news.novogroup.com!nowhere33.yet
>
> Looks like it's coming from novogroup.com in Finland.
> Here's the info from Whois. I hope it helps. Let me know.
>
> KT-Datacenter Ltd NOVOGROUP-DOM
> PL 38
> HELSINKI, 00381
> FI
>
> Domain Name: NOVOGROUP.COM
>
> Administrative Contact:
> Virmala, Tarja TV429 Tarja.Virmala@NOVOGROUP.COM
> +358 0 5067 2418 (FAX) +358 0 5067 2370
> Technical Contact, Zone Contact:
> Petri, Laitinen LP2379 Petri.Laitinen@NOVOGROUP.COM
> +358 9 5067 2736 (FAX) +358 9 5067 2270
> Billing Contact:
> Syvanne, Ari-Pekka AS60 Ari-Pekka.Syvanne@NOVOGROUP.COM
> +358 0 5067 2665 (FAX) +358 0 5067 2270
>
> Record last updated on 04-Feb-98.
> Record created on 19-Feb-97.
> Database last updated on 20-Apr-98 04:03:58 EDT.
>
> Domain servers in listed order:
>
> NS.NOVOGROUP.COM 192.58.67.64
> JUHA.FI 192.58.67.1