Re: More on SPAMing

[Rubywand <rubywand@swbell.net>]

News system writes ...
> 
> In article <38251E05.CBDE9070@idt.net>, Tom Greene  <cowgod@idt.net> wrote:
> >Here's what I know about reading usenet headers. I can't guarantee that
> >this info is 100% correct, but it has served me well. :)
> >
> >
> >> Path: typhoon01.swbell.net!cyclone.swbell.net!bos-service1.ext.raytheon.com!cambridge1-snf1.gtei.net!cam-news-hub1.bbnplanet.com!news.gtei.net!newsfeed.mathworks.com!wn3feed!worldnet.att.net!wnmaster1!not-for-mail
> >
> >The Path: line above is one place to look to see where the message came
> >from. It shows all the news servers that the message went through to get
> >from the spammer to you. The last server in the line should be the news
> >server the spammer posted to. In this case, it seems to have been posted
> >via worldnet.att.net.
> 
> Actually, the last machine was "wnmaster"...don't know if that's one of
> AT&T's boxen or not.  It might be (wn->Worldnet?), but then it might not be.
> If you look at the Path line of this message, the last host (which is the
> one from which this message originated) is chakotay.ncc74656.org.  This
> hostname won't resolve against any DNS server; it's my Linux server, which
> has a private IP address (192.168.100.1, if you're curious) and communicates
> with MindSpring's news server through pppd and suck.  (Suck is a package
> that allows you to grab small newsfeeds and post replies by making your news
> server pretend that it's a client (it doesn't use the NEWNEWS and IHAVE
> commands when communicating with servers).
> 
> (Why go to this trouble?  I don't like the Win9x-based newsreaders I've
> tried.  I prefer trn, but it runs a bit slow over a dial-up connection.  I
> use suck and INN to maintain four days' worth of selected (non-binaries,
> except for comp.binaries.apple2) newsgroups for "offline reading."  One
> other advantage is that it makes spammers' lives more difficult; the only
> place my real email address shows up is in my .sig, and it's obscured
> somewhat heavily.  The URL for my website is in cleartext, but how many
> spammers follow URLs from Usenet to harvest email addresses in webpages?)
> 
> >Note that this line can have spoofed entries on it, usually at the end.
> 
> OK, so you didn't forget this.  My bad. :-)
> 
> >> Organization: AT&T WorldNet Services
> >
> >Many times organization line is added by the news server the message was
> >posted to. I know the server for my provider adds the following line:
> >'Organization: IDT (Best News In The World)'
> 
> Many newsreaders will allow you to change this.  If an Organization line is
> present when you post an article, most news servers will respect it and
> leave it alone.  Note that MindSpring didn't overwrite mine, but left it as
> "USS Voyager NCC-74656, Delta Quadrant."
> 
> >> Message-ID: <800pqi$5i6$551@bgtnsc01.worldnet.att.net>
> >
> >Again, this shows that the message was posted to an att.net news server.
> >I'm almost certain this line cannot be faked.
> 
> Message IDs can be generated by the reader, but I suspect that most of 'em
> leave that job to the server.  Note that the ID of this message is something
> along the lines of <blahblah@chakotay.ncc74656.org>.  That was generated by
> my (private) news server and left alone by MindSpring's server.
> 
> You can also achieve the same effects by telnetting to port 119 on a news
> server and POST your message directly.  If you were truly evil, you could
> put names of a few random servers (culled from other posts, if you like) in
> the Path line of your message.  Back in the day, I had some macros between
> ProTERM and AppleWorks/UltraMacros that served as a crude offline news
> reader; it worked by telnetting to my ISP's news server to grab and post
> news.
> 
>   _/_
>  / v \
> (IIGS(  Scott Alfter (salfter at (yo no quiero spam) delphi dot com)
>  \_^_/  http://people.delphi.com/salfter


     Thanks for the additional info!



Rubywand