3:23 p.m.
Suddenly last week I downloaded from a POP server 255 messages of which
over 200 were spam.
After a little study of the evolution setup it became clear that someone
had captured my e-mail address and was filling my mail queue with spam.
They advertised different services but the form of the messages made it
clear they had only one source. However identical spam message had
different Mail Ids and seemed to come from a different address.
Using spamassassin I got thsio spam under control, However
Is there someway from the mail header to deduce the origin of the
messages?
--
=======================================================================
Nobody's gonna believe that computers are intelligent until they start
coming in late and lying about it.
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam(a)sbcglobal.net
3:49 p.m.
Am 26.08.2012 22:47, schrieb Heinz Diehl:
On 26.08.2012, Aaron Konstam wrote:
> Is there someway from the mail header to deduce the origin of the
> messages?
Yes, the "Received:" headers. Please post the _full_ header of one of
these mails.
they do indicate NOTHING
the only TRUSTABLE received-header is the one from YOUR server
all other machines before can write what they like in mail headers
no, this is not theory, this is how email works and things are
4:37 p.m.
On 26.08.2012, Reindl Harald wrote:
all other machines before can write what they like in mail headers
You can claim to be who you want to while connecting to a mailserver,
but you can't fake the IP from which you are connecting. It is
logged by the mailserver while connecting between two square brackets.
The usual format used in Received: headers is
name (dns-name [ip-address])
"Name" is easy to forge. "Dns-name" is what a reverse lookup on
ip-adress delivers. "Ip-adress" reflects the IP of the machine which
connected to the mailserver which generated this Received: header.
no, this is not theory, this is how email works and things are
Ok, so please show me the evidence of your statement.
4:46 p.m.
Am 26.08.2012 23:37, schrieb Heinz Diehl:
On 26.08.2012, Reindl Harald wrote:
> all other machines before can write what they like in mail headers
You can claim to be who you want to while connecting to a mailserver
yes
but you can't fake the IP from which you are connecting.
not to the one you are connecting
but you can not trust headers before your own MTA
It is logged by the mailserver while connecting between two square
brackets.
i know this
The usual format used in Received: headers is
name (dns-name [ip-address])
i know this
"Name" is easy to forge. "Dns-name" is what a
reverse lookup on
ip-adress delivers. "Ip-adress" reflects the IP of the machine which
connected to the mailserver which generated this Received: header.
> no, this is not theory, this is how email works and things are
Ok, so please show me the evidence of your statement
what did you not understand
your MTA get a connection and have the IP of the last machine involved
in mail tzransmission, bit all other received headers before YOOR
machine are nOT trustable because i can write whatever i want
and how many received-headers i want and submit the message
directly to your MTA
you have NO WAY to say if they are forged or not
10:38 a.m.
On 27.08.2012, Reindl Harald wrote:
your MTA get a connection and have the IP of the last machine
involved
in mail tzransmission, bit all other received headers before YOOR
machine are nOT trustable because i can write whatever i want
and how many received-headers i want and submit the message
directly to your MTA
You can't supress the Received header which is generated by the
receiving mailserver when you're delivering your mail. All your faked
headers will be beneath this one, because every MTA writes its
Received: on top of the existing one(s), so there is a fine line from the
sender to the receiver which can follows in both ways.
So unless you are connecting via an anonymizing service as e.g. the tor
network, it will be of little effect to add some fake Received
headers to hide your ass.
9:09 a.m.
On Sun, 2012-08-26 at 22:47 +0200, Heinz Diehl wrote:
On 26.08.2012, Aaron Konstam wrote:
> Is there someway from the mail header to deduce the origin of the
> messages?
Yes, the "Received:" headers. Please post the _full_ header of one of
these
FULL HEADER
X-apparently-to: akonstam(a)sbcglobal.net via 67.195.15.99; Sat, 25 Aug
2012 15:51:36 +0000
X-yahoofilteredbulk: 184.172.130.36
Received-spf: pass (domain of pos81n-nds-36.positionstrends.com
designates 184.172.130.36 as permitted sender)
X-ymailisg: d9fU0DcWLDtnonTz69mlLZZpv4J2TEVP4eCpTCdEOKOG7_jN
63wKkHAoGqLLsgYabJSAvbf0GhdkTgr7yNYIw9V73tbtULoyKr1lC.8JRf8z
XGRAC75ybWhFZbbi_8pH_VvMpLRDNK5S9TsKA83wZNBLCyZainVUXZlpT5uG
4IehJy6cWl3gBFgNNktxwOpVUhJRZLZMRkbfm1z5EZtNCFe4Eq7lFecwX40S
LAbnhSAZRV3o5ilk2bDtdC3lghCaTn6QwHJJCBufD73vLm4FupP9piFT9QZU
cg9IQabMlLKhKj2Qb1S2m29FZ7JPBLF3Xi06dslDmjpnHUUwq3ipdnlry6.Z
JcYX9FAtbnZwzIjH1Rqj7HJRnInFJNQ..8pgT2AwY.HXkNKtalrcv7xB38h6
lYbmIji3TE.LTtsvs9ZSn6QeGxrMyAWIg9L_GiOr4UarPWoUfLKA0BDFU2TH
fjiUyZzNDDkk8JpFfGeyfjPGbf0OYFbCWjECnUWHBaf.ms6UekgEhBWYIctw
3wsosSTcNGbKtD4_iGDr6B_uYKEIEhZcAK5Mb_oHNaZyqA_Q9jdHVsAfeF71
o.PQ7mNFLae4_6VtUi4NT80bRpIjA.rkc_9Oln4N2AnhTkXNhyvD0WkmtMhD
ckR0i9JrP2V3fFy.YFwuP_Xuu5REqB0a6ffXKsYHdlA4HvJ32y6E8m8uI8oS
JQAVok.hdbMPcN2HPRnX33dtMo.ARNC0wuZfCVmwkpYJc9BSXvyUL4B2jpdg
sB12NlZpDrui7Auepm_VgDC_OeSLNuL4.SMx1VcJ4B0gmuwmJ6KbrV31tnzK
ipfGwWO512HX3nmlGwdbU_JejvUu.KFQ_qlsvRiiMohplzM6SRib2robog1z
sUpgUbqdPNZ9_TZRvDawLqhpdMAuRjCTbnBvBl0Iyoa1e4i1wPYGjEJ7iiiU
bfdH534hHZM1JUnI7xABUKbyAFdyCihXu_NX1FkLj9Pxjck9K.XQPKPM08Sk
ZL_5sacEs17mWpniMbaGP7hX3hnIx1cLaVkZ06dMhLkY5Z6Hedjtu0wHBlcu
hR.wudgFGotZEyQ7yPwKm.G.EsIofmHCJsYm3ljYGJLTVSUf9VxOLVCND4RO
vUjurf2W4KxmWfHFKqUSRh7_zh.2PiB9YVU7KVcW9UGjbus4GS0tYjjl6hr4
4YaTFDthAiTiac9PcLFsJD79.QiG.RdGIoUm9e.PBsjrp_afcHgkJ2Sb6Jz_
rVgubTDgpzASj92mSdJqZiyaZK92EGu_2YM6LJzWcmueKKUMtoIb6Ql6OPIH
.ORaRTc6iAD6tXRcnyjfQ2hDAcPxCAPzQdeW35ZrikWD2EaVysgAzXvPEFX.
Ww2yxwArIpXjEP5jB7LdKrwQm4yXEmTDLWyVwvPr9ffOnm.IDi5qQNIdqdWQ
gvHsQnTeZayR41T_IAOb1wYE0kjrCLUDL9WDFXAWEfleVAWWXAQc1v0cToRw
LD7p6h0LdCOVwsyw8ksEGtlaZ7HqD5fCZQ--
X-originating-ip: [184.172.130.36]
Authentication-results: mta1050.sbc.mail.ne1.yahoo.com
from=pos81n-nds-36.positionstrends.com; domainkeys=pass (ok);
from=positionstrends.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO pos81n-nds-36.positionstrends.com)
(184.172.130.36) by mta1050.sbc.mail.ne1.yahoo.com with SMTP; Sat, 25
Aug 2012 15:51:30 +0000
Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=key1;
d=positionstrends.com;
h=Message-ID:List-Help:List-Unsubscribe:Reply-To:From:To:Subject:Content-Type:Date;
i=Smartphone(a)pos81n-nds-36.positionstrends.com; bh=mdbd7McvaNzoBR8s/nkmKNxr/Hw=;
b=nJjJoCwY2kV0Ts0CmGcGXQUyReMerZm7CtJq3ymvPxGarzByEUyFl7mTF1/SyHrqwXFJRS7Gke6W
owye3N/AE3FvvE+s75dodIYvnWJMQq8zRwb0/CxKOuApxKvtVmoYpECKgHsJ4hRcm/J/jdzl4eU0
27p0vyjnnFRLgN6kcBo=
Domainkey-signature: a=rsa-sha1; c=nofws; q=dns; s=key1;
d=positionstrends.com; b=VHFtAiA0/X/phdObLNz4uyG/FzDP/1GGPd9wIGOq
+f7LDlKm948SIuglS5JsjTRZDjvqSrdHCPNX
c7izLj2DTKfSzhv3KF9vd6ymHeFoyC1UBYBhYsVzd9TVVuEwmxzRoR7vX4
+Li7cPVaL8ftwQkhSN jIuuraEQ7TV+oBqF9D0=;
Message-id: <7.26.48978.4032257916(a)pos81n-nds-36.positionstrends.com>
List-help: Help <http://www.positionstrends.com>
List-unsubscribe: Unsubscribe <http://www.positionstrends.com/u.php>
Reply-to: Smartphone <Smartphone(a)pos81n-nds-36.positionstrends.com>
From: Smartphone <Smartphone(a)pos81n-nds-36.positionstrends.com>
To: akonstam(a)sbcglobal.net
Subject: The latest information on buying a smartphone
X-Info:
YWtvbnN0YW1Ac2JjZ2xvYmFsLm5ldDsxODQuMTcyLjEzMC4zNjsxMTsxNzMyOzA7Njk3
Content-type: multipart/alternative;
boundary="1345905517.De44c27914.949"; charset="us-ascii"
Date: Sat, 25 Aug 2012 11:51:30 -0400 (08/25/2012 10:51:30 AM)
X-evolution-pop3-uid: AGMPw0MAALcdUDj0iAwFrzKOIJ8
X-evolution-source: 1345746672.1451.2@cyrus
Mime-version: 1.0
--
=======================================================================
Doctors and lawyers must go to school for years and years, often with
little sleep and with great sacrifice to their first wives. -- Roy G.
Blount, Jr.
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam(a)sbcglobal.net
10:20 a.m.
On 27.08.2012, Aaron Konstam wrote:
Received: from 127.0.0.1 (EHLO pos81n-nds-36.positionstrends.com)
(184.172.130.36) by mta1050.sbc.mail.ne1.yahoo.com with SMTP; Sat, 25
Aug 2012 15:51:30 +0000
Somebody claiming to be "pos81n-nds-36.positionstrends.com" with the
IP adress 184.172.130.36 posted this mail to one of the Yahoo
mailservers.
[root@wildsau ~]# whois 184.172.130.36
[Querying whois.arin.net]
[Redirected to rwhois.theplanet.com:4321]
[Querying rwhois.theplanet.com]
[rwhois.theplanet.com]
%rwhois V-1.5:003fff:00 rwhois.softlayer.com (by Network Solutions,
Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NETBLK-SOFTLAYER.184.172.128.0/18
network:Auth-Area:184.172.128.0/18
network:Network-Name:SOFTLAYER-184.172.128.0
network:IP-Network:184.172.130.32/29
network:IP-Network-Block:184.172.130.32-184.172.130.39
network:Organization;I:Brick Run Media
network:Street-Address:209 West 20th 3A
network:City:New York
network:State:NY
network:Postal-Code:10011
network:Country-Code:US
network:Tech-Contact;I:sysadmins@softlayer.com
network:Abuse-Contact;I:abuse@fulltimedo.com
network:Admin-Contact;I:IPADM258-ARIN
network:Created:20120125
network:Updated:20120125
network:Updated-By:ipadmin@softlayer.com
So the spammer is in the netblock of "softlayer.com", most probably a
customer of them. Write a complaint to "abuse(a)fulltimedo.com" with a
copy to "sysadmins(a)softlayer.com", including one of the spam emails
incl. the full header.
10:30 a.m.
On 08/27/2012 11:20 PM, Heinz Diehl wrote:
So the spammer is in the netblock of "softlayer.com", most
probably a
customer of them. Write a complaint to "abuse(a)fulltimedo.com" with a
copy to "sysadmins(a)softlayer.com", including one of the spam emails
incl. the full header.
You may also want to note.....
[egreshko@meimei ~]$ host positionstrends.com
positionstrends.com has address 184.172.130.36
positionstrends.com mail is handled by 0 mail.positionstrends.com.
And since you've noted the whois....
network:Organization;I:Brick Run Media
it isn't surprising that "spam" is coming from that address.
Good luck in getting them to stop.... :-) :-)
--
Programming today is a race between software engineers striving to build bigger and better
idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far,
the Universe is winning. -- Rick Cook, The Wizardry Compiled
11:54 a.m.
On Mon, 2012-08-27 at 23:30 +0800, Ed Greshko wrote:
Good luck in getting them to stop.... :-) :-)
Yes, reporting spam to someone in control of sending spam, isn't going
to work, you'll get even more of it.
I'm not saying /that/ person is, I'll let someone else make a definitive
accusation, but it's something that you have to check for before making
any spam reports. Been there, done that before.
These days, I rarely ever bother reporting spam. Chances are that
thousands of others have seen the spam, several will have reported it,
and various mail services' automatic spam detectors found it and dealt
with it (such as informing the various block lists that program various
different anti-spam systems).
Any ISP ought to be in a very good position to identify spam with a much
higher degree of certainty than any user. They'll be bombarded with it,
lots of identical messages (99% that they'll be spam), and to lots of
addresses that don't really exist on their network (dictionary attacks,
which will be a 100% certainty of being spam). Service providers may
well get thousands of spams a minute, don't think that they don't do
something to minimise it.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
12:33 p.m.
Am 27.08.2012 19:08, schrieb Heinz Diehl:
On 27.08.2012, Tim wrote:
> Yes, reporting spam to someone in control of sending spam, isn't going
> to work, you'll get even more of it.
[....]
I gave up reporting spam many years ago, and let crm114 sort out most
of it..
abuse(a)isp.tld helps normally because they are not
amused get too many complaints about the same customer
3:22 p.m.
On Mon, 2012-08-27 at 17:20 +0200, Heinz Diehl wrote:
On 27.08.2012, Aaron Konstam wrote:
> Received: from 127.0.0.1 (EHLO pos81n-nds-36.positionstrends.com)
> (184.172.130.36) by mta1050.sbc.mail.ne1.yahoo.com with SMTP; Sat, 25
> Aug 2012 15:51:30 +0000
Somebody claiming to be "pos81n-nds-36.positionstrends.com" with the
IP adress 184.172.130.36 posted[akonstam@cyrus ~]$
However if I try to do the same thing to the address 75.103.120.181
which the address of origin of another of these spams I get a much less
satisfying response:
whois 75.103.120.181
[Querying whois.arin.net]
[Redirected to rwhois1.crystaltech.com:4321]
[Querying rwhois1.crystaltech.com]
[Unable to connect to remote host]
[akonstam@cyrus ~]$
--
=======================================================================
Four thousand different MAGNATES, MOGULS & NABOBS are romping in my
gothic solarium!!
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam(a)sbcglobal.net
3:29 p.m.
On 27.08.2012, Aaron Konstam wrote:
whois 75.103.120.181
[Querying whois.arin.net]
[Redirected to rwhois1.crystaltech.com:4321]
[Querying rwhois1.crystaltech.com]
[Unable to connect to remote host]
If all fails, try tracing it (tcptraceroute, in this case).
These are the last four hops:
[....]
21 38.104.116.78 (38.104.116.78) 409.450 ms 409.391 ms 409.295 ms
22 cr-edge1-ge-2-0.crystaltech.com (216.119.107.21) 409.206 ms 409.195 ms 409.329 ms
23 216.197.122.66 (216.197.122.66) 409.242 ms 409.155 ms 409.140 ms
24 spo-oom-181.sportsclubroom.com (75.103.120.181) <rst,ack> 409.586 ms 409.500 ms
409.412 ms
3:38 p.m.
On 08/27/2012 01:22 PM, Aaron Konstam wrote:
whois 75.103.120.181
[Querying whois.arin.net]
[Redirected to rwhois1.crystaltech.com:4321]
[Querying rwhois1.crystaltech.com]
[Unable to connect to remote host]
[akonstam@cyrus ~]$
If you can't get the info you need directly, try an indirect route, such
as this:
[joe@khorlia ~]$ nslookup 75.103.120.181
Server: 207.217.77.82
Address: 207.217.77.82#53
Non-authoritative answer:
181.120.103.75.in-addr.arpa name = spo-oom-181.sportsclubroom.com.
Authoritative answers can be found from:
120.103.75.in-addr.arpa nameserver = NS1.WEBCONTROLCENTER.com.
120.103.75.in-addr.arpa nameserver = NS2.WEBCONTROLCENTER.com.
[joe@khorlia ~]$ whois sportsclubroom.com
[Querying whois.verisign-grs.com]
[Redirected to whois.directnic.com]
[Querying whois.directnic.com]
[whois.directnic.com]
Registration and WHOIS Service provided by Directnic.com
DNC Holdings, Inc. provides the data in the directNIC.com Registrar WHOIS
database for informational purposes only. The information may only be
used to assist in obtaining information about a domain name's registration
record. The use of this data for any other purpose without prior written
consent by DNC Holdings, Inc. is expressly forbidden.
By submitting a WHOIS query, you agree to all the terms and limitations
herein and that you will use this data only for lawful purposes. You also
agree that under no circumstances will you use this data to:
(a) allow, enable, or otherwise support the transmission by email,
telephone, or facsimile of mass, unsolicited, commercial advertising or
solicitations, including, but not limited to, spam, to entities other than
the data recipient's own existing customers;
(b) enable high volume, automated, electronic processes that send queries
or data to the systems of any Registry Operator or ICANN-accredited
registrar or
(c) enable any automated or robotic processes to collect or compile data
for any purpose, including data mining.
DNC Holdings makes this information available "as is", and provides no
guarantee
or warranty as to its accuracy.
Registrant:
Direct Privacy ID ACF57
P.O. Box 6592
Metairie, LA 70009
US
1-504-355-0082
Domain Name: SPORTSCLUBROOM.COM
Administrative Contact:
Direct Privacy ID ACF57, Domain Name Proxy Service, Inc
sportsclubroom.com(a)domainnameproxyservice.com
P.O. Box 6592
Metairie, LA 70009
US
1-504-355-0082
Technical Contact:
Direct Privacy ID ACF57, Domain Name Proxy Service, Inc
sportsclubroom.com(a)domainnameproxyservice.com
P.O. Box 6592
Metairie, LA 70009
US
1-504-355-0082
Record last updated 09-08-2011 03:34:13 PM
Record expires on 07-08-2013
Record created on 07-08-2011
Domain servers in listed order:
NS1.SPORTSCLUBROOM.COM 65.110.72.76
NS2.SPORTSCLUBROOM.COM 75.103.120.141
The compilation, repackaging, dissemination, or other use of this WHOIS
data is expressly prohibited without the prior written consent of
DNC Holdings, Inc.
DNC Holdings reserves the right to terminate your access to its WHOIS
database in its sole discretion, including without limitation, for
excessive querying of the database or for failure to otherwise abide by
this policy.
DNC Holdings reserves the right to modify these terms at any time.
NOTE: THE WHOIS DATABASE IS A CONTACT DATABASE ONLY.
LACK OF A DOMAIN RECORD DOES NOT SIGNIFY DOMAIN AVAILABILITY.
4261
days inactive
4262
days old
14 comments
6 participants
participants (6)
-
Aaron Konstam -
Ed Greshko -
Heinz Diehl -
Joe Zeff -
Reindl Harald -
Tim