Slashdot Mirror

You know, the same RIAA pirate a lot of whale songs, themselves. Shamelessly stealing them by recording whales' broadcasts, and then re-selling as their own products:

http://www.dolphinwave.org/Audio/cd1.html

No one can compromise an OS that hasn't even been released yet.

Really?
http://news.com.com/First+potential+virus+risk+for +Windows+Vista+found/2100-7349_3-5819428.html

But then, Microsoft did the same claim about their Windows XP, touting it to be the most secure version of Windows, and even rolling such funny ads as this one, promoting XP:
http://www.dolphinwave.org/Media/Local/msbanner_12 .gif

And then there was MS Blast, probably the most devastating blast against Windows at those times...

Now they claim it to be not just the most secure Windows, but the most secure OS! Imagine the magniture of the next upcoming hit it will take...

His head is much smaller in person.

ftp://ftp.dolphinwave.org/pub/Microsoft/BillGHead. jpg

Is it?

The 21st century equivalent is to yell "Tier 1 ISPs don't care about spam victims!"

And you are so right! Here is Cogent supporting spammers:

http://www.dolphinwave.org/spam/Cogent.txt

And Level3 is not any better than that, ignoring their spammers just as well, forwarding all complaints directly to the spammers.

The script below will firewall incoming connection attempts from China and Korea IP ranges (I've mirrored them from blackholes.us and they are small, so I hope the server will survive the effect). The best way is always to mirror the data you pull from the Internet locally, so you can still have a copy of it if the original place goes down (for maintenance, as with blackholes.us, for example).

#wget http://www.dolphinwave.org/spam/mirror/china.txt.b z2
#wget http://www.dolphinwave.org/spam/mirror/korea.txt.b z2
#bunzip2 -q china.txt.bz2 korea.txt.bz2
#iptables -N BUBBLENET
#for IPRANGE in `cat china.txt | awk '{print $2}'`; do iptables -A BUBBLENET -s $IPRANGE -p TCP --syn -j DROP; iptables -A BUBBLENET -s $IPRANGE -p UDP ! --sport 53 -j DROP; done
#for IPRANGE in `cat korea.txt | awk '{print $2}'`; do iptables -A BUBBLENET -s $IPRANGE -p TCP --syn -j DROP; iptables -A BUBBLENET -s $IPRANGE -p UDP ! --sport 53 -j DROP; done
#iptables -A BUBBLENET -j RETURN
#iptables -I INPUT -j BUBBLENET
#service iptables save

To remove the block just do these:

#iptables -D INPUT -j BUBBLENET
#iptables -X BUBBLENET
#service iptables save

The script below will firewall incoming connection attempts from China and Korea IP ranges (I've mirrored them from blackholes.us and they are small, so I hope the server will survive the effect). The best way is always to mirror the data you pull from the Internet locally, so you can still have a copy of it if the original place goes down (for maintenance, as with blackholes.us, for example).

#wget http://www.dolphinwave.org/spam/mirror/china.txt.b z2
#wget http://www.dolphinwave.org/spam/mirror/korea.txt.b z2
#bunzip2 -q china.txt.bz2 korea.txt.bz2
#iptables -N BUBBLENET
#for IPRANGE in `cat china.txt | awk '{print $2}'`; do iptables -A BUBBLENET -s $IPRANGE -p TCP --syn -j DROP; iptables -A BUBBLENET -s $IPRANGE -p UDP ! --sport 53 -j DROP; done
#for IPRANGE in `cat korea.txt | awk '{print $2}'`; do iptables -A BUBBLENET -s $IPRANGE -p TCP --syn -j DROP; iptables -A BUBBLENET -s $IPRANGE -p UDP ! --sport 53 -j DROP; done
#iptables -A BUBBLENET -j RETURN
#iptables -I INPUT -j BUBBLENET
#service iptables save

To remove the block just do these:

#iptables -D INPUT -j BUBBLENET
#iptables -X BUBBLENET
#service iptables save

Summary:

Dslreports maintains an anti-spam forum, which discusses spam-fighting techniques. A recently registered user, AntiSpamCard, posts to the forum advertising its spam-fighting product, AntiSpamCard. This violates the rules of the forum, so another user, AmeritechTech, looks up the domain registration information (registration service: RegistryFly.com). It is full of false information (mostly na, na, na filled in everywhere). AntiSpamCard claims that false info is RegistryFly's fault. Further investigation leads AmeritechTech to believe AntiSpamCard are, in fact, spammers. The evidence:

- Privacy statement on antispamcard.com states that they have an opt-out policy on receiving info
- Domain listed as unwelcome here and here

From these sites, AmeritechTech discovers that antispamcard.com and putamericatowork.com are both owned by Brad Heckman in Palm Beach, FL. IP address for antispamcard.com seems to be within a block assigned to Crescive, Inc. (not to be confused with some car company), which is also mentioned on antispamcard.com. The host for this block of IPs is traci.net. Traci.net has a strict anti-spam policy. Name servers also appear to be owned by Brad, and hosted by traci.net. Registration of the domain names of the name servers also has na, na, na filled into most fields. Putamericatowork.com turns out to be hosted by aitcom.net, which has a very strict anti-spam policy. AmeritechTech also claims Brad owns spaminsurance.com, but I'm not sure why. IP in the same block (which it is) and identical layouts (can't check, antispamcard.com /.'ed), I think.

After various emails to the various hosting companies, antispamcard.com and spaminsurance.com magically have valid registration information. AmeritechTech also gets an email from Brad from igpbrad@hotmail.com (remember that email) saying the registration info is updated. Antispamcard.com registered to Brad, spaminsurance.com registered to Chad Deckard. Same guy? Associates? Who knows, but there seems to be a link (in later posts, this is contested by "mystery poster" Ry2k, but the link seems pretty strong). Hunting around for Chad Deckard stuff turns up claims on this board that he's associated with a scam to sell Kazaa "Gold", which is really just Kazaa Lite, but with a 9.95 price tag, plus it harvests your email. The site's still up, but I couldn't repeat the behaviour claimed by the message poster (posted back on Sept. 11, 2002) that takes you to infogeneratorpro.com, which seems to be the site registered to Chad. Also conspicuous is that Chad's name shows up on putamericatowork.com, a site owned by Brad (link). Also VERY conspicuous is that Brad emailed from igpbrad@hotmail.com, i.e. InfoGeneratorPro? Maybe a coincidence...

Some more looking uncovers other domains in Chad's name: infogenerator.com, usub.net, and finder-network.com. This is along with spaminsurance.com and infogeneratorpro.com. About this time Ry2k shows up to claim that Kazaa Gold was just a client of Chad's, and when Chad found out what they were doing, the account was eliminated. Ry2k claims to be a former employee of Chad's, and warns the forum of tarnishing the good name of legitimate businesses in their persuit of spammers. I go to bullet mode, as it's getting late, and I'm tired:

- Reverse look-ups on contact info for antispamcard.com produce a fax number registered to infogenerator.com.
- Domain name servers (safeidentity.net) for antispamcard.com has contact info updated to Crescive, Inc.
- Someone points out that RegisarFly.com may be shady, something about "using CNAME for their MX records". Maybe someone can fill me in...
- google groups turns up complaints about spam from