Newsgroup: it.news.net-abuse
Titolo: [ lunghetto] telefonare a 1-212-465-3248

; Sat, 7 Apr 2001 11:14:43 +0200
Possible spammer: 194.65.92.41
[show] "nslookup 
41.92.65.194.dul.maps.vix.com
." (checking ip) not found
[show] "nslookup 
soe.OE.ordeng.pt
" (checking ip) ip = 194.65.92.41
Taking name from IP...
[show] "nslookup 194.65.92.41" (getting name) no name
[show] "nslookup 
41.92.65.194.rbl.maps.vix.com
." (checking ip) not found
[show] "nslookup 
41.92.65.194.inputs.orbs.org
." (checking ip) ip =
127.0.0.2
blocked by ORBS
[show] "nslookup 
41.92.65.194.dul.maps.vix.com
." (checking ip) not found
[show] "nslookup 
41.92.65.194.inputs.orbs.org
." (checking ip) ip =
127.0.0.2
194.65.92.41 is an open relay - saving header for proof.
Received line accepted
Received: from 807k8j (
p241-219.du.netdirect.net
 [209.212.219.241]) by
soe.OE.ordeng.pt
 with SMTP (Microsoft Exchange Internet Mail Service
Version 5.5.2653.13) id HY67LMN8; Sat, 7 Apr 2001 10:15:59 +0100
[show] "nslookup 
41.92.65.194.dul.maps.vix.com
." (checking ip) not found
Possible spammer: 209.212.219.241
[show] "nslookup 
p241-219.du.netdirect.net
" (checking ip) ip =
209.212.219.241
[show] "nslookup 
241.219.212.209.rbl.maps.vix.com
." (checking ip) not
found
[show] "nslookup 
241.219.212.209.inputs.orbs.org
." (checking ip) not
found
Chain test:
soe.OE.ordeng.pt
 =? 
soe.OE.ordeng.pt
[show] "nslookup 
soe.OE.ordeng.pt
" (checking ip) ip = 194.65.92.41
[show] "nslookup 
soe.OE.ordeng.pt
" (checking ip) ip = 194.65.92.41
ips are identical
soe.OE.ordeng.pt
 and 
soe.OE.ordeng.pt
 have close IP addresses - chain
verified
[show] "nslookup 
241.219.212.209.dul.maps.vix.com
." (checking ip) not
found
[show] "nslookup 
241.219.212.209.inputs.orbs.org
." (checking ip) not
found
209.212.219.241 has already been sent to ORBS
Received line accepted
Tracking message source:
209.212.219.241
:
[show] "nslookup 209.212.219.241" (getting name) 209.212.219.241 =
p241-219.du.netdirect.net
[show] "nslookup 
p241-219.du.netdirect.net
" (checking ip) ip =
209.212.219.241
abuse.net
 
p241-219.du.netdirect.net
 = 
ab...@voyager.net
,
postm...@netdirect.net
paranoid reverse DNS passes - using 
ab...@voyager.net
,
postm...@netdirect.net
Statistics:
postm...@netdirect.net
 score:22
ab...@voyager.net
 score:727
209.212.219.241 score:2
Possible open relay: 194.65.92.41
[show] "nslookup 
41.92.65.194.inputs.orbs.org
." (checking ip) ip =
127.0.0.2
[show] "nslookup 194.65.92.41" (getting name) no name
[show] "dig -x 194.65.92.41 soa" (digging for start of authority) -
d...@mail.telepac.pt
abuse.net
 
mail.telepac.pt
 = 
postm...@mail.telepac.pt
,
ab...@mail.telepac.pt
Found email 
address:mailbi...@yahoo.com
[show] "dig 
yahoo.com
 mx" (digging for mail exchanger) Found
mailserver:
mx1.mail.yahoo.com
. = 216.136.129.14
abuse.net
 
yahoo.com
 = 
ab...@yahoo.com
[show] "nslookup 
yahoo.com
" (checking ip) ip = 216.115.108.245
abuse.net
 
shortcut:ab...@yahoo.com
Please make sure this email IS spam:
UNIVERSITY DIPLOMAS
Obtain a prosperous future, money earning power,
View full message
Report Spam to:
Re:194.65.92.41 (Administrator of network with open relays)
   To: 
ab...@mail.telepac.pt
 (Notes)
   To: 
postm...@mail.telepac.pt
 (Notes)
Re:194.65.92.41 (ORBS open relay automated testing system)
   To: 
rel...@orbs.org
 (Notes)
Re:209.212.219.241 (Administrator of network where email originates)
   To: 
postm...@netdirect.net
 (Notes)
   To: 
ab...@voyager.net
 (Notes)
Re:mailbi...@yahoo.com
 (Administrator of network hosting email
address referenced in spam)
   To: 
ab...@yahoo.com
 (Notes)

 
1-212-465-3248
A parte il dialup e il relay usati nello spam, di "University
Diplomas" e' noto circa tutto.  La fabbrica di lauree si
chiama Brentwick University ed e' un business con un giro 
stimato di circa 200M$ all'anno.
Vedere ad esempio l'articolo sul Washington Post
http://www.washingtonpost.com/wp-dyn/articles/A3087-2000Oct13.html
http://www.washingtonpost.com/wp-dyn/articles/A3147-2000Oct13.html
o gli altri a 
http://www.acsh.org/publications/priorities/1203/doctorate.html
http://www2.newsquest.co.uk/local_london/archive/2000/11/29/enfieldnews2RM.html
Secondo 
http://dailynews.yahoo.com/h/pt/20010227/co/thanks_dr_yournamehere_1.html
ora si chiamano "University of Devonshire".
Vedi anche
http://distancelearn.miningco.com/education/distancelearn/library/blpages/blexposeschools.htm
per altre operazioni "sospette" nel campo dell'educazione.
Crimine e truffe sono dietro a gran parte dello spam in circolazione.
furio ercolessi
Spin - Gestione antispam

 sgas wrote:
accipicchia ! grazie !
clap clap e disegnino ascii con riverenza
:-)
se mi puoi levare una curiosita'... dove avevi quelle url?
Perchè io con google avevo trovato solo mailing list
sgas

 Perchè io con google avevo trovato solo mailing list
Ho cercato con keywords: brentwick washington post
e le keywords... le avevo nella testa per averle lette
da qualche parte tempo addietro.
