Slashdot Mirror

No more excuses.

1. Netstat: Standard inclusion in both windows and *nix, spits out a summary of all the netowork connections that are currently active, and where they're going. Downside, won't detect dormant programs.
2. Samspade : excellent network tools suite, from simple pings to remote port scans (use responsibly, of course!). Web based and downloadable version
3. Starup Manager . Freeware software for windows that scans all your startup menu and registry entires so you can see every things that has been told to start with your computer. Enable/Disable/remove them ect.
4. Wintop . (Part of the MS kernel toys pack). Windows version of the *nix "top" program, shows everything currently running on your computer. useful for finding the little hidden programs that don't want you to know they're there.

I guess they planned to bring it out as a computer rpg, but never got to it.

(See it for yourself at samspade. org.)

Anyone could become a Spam Bounty Hunter using e-z online tools such as Sam Spade (it even has a ... plug-ing (?) ... for IE. I've used this site for tracking down a number of spammers and 31337 "attackers".

I tried to find out where the server for the .cx domain could be located. Here are the results of a traceroute done from the nice tools page of SamSpade.Org:

1 206.117.161.1 (206.117.161.1) [AS226] 1 ms
2 isi-acg.ln.net (130.152.136.1) [AS226] 2 ms
3 triton.cerf.net (198.32.146.20) [AS226] 3 ms
4 atm11-0.lax-bb1.cerf.net (134.24.29.17) [AS1740] 8 ms
5 pos8-0-155M.lax-bb4.cerf.net (134.24.32.230) [AS1740] 3 ms
6 so1-0-0-622M.dfw-bb2.cerf.net (134.24.29.78) [AS1740] 40 ms
7 pos2-0-622M.chi-bb4.cerf.net (134.24.46.82) [AS1740] 64 ms
8 pos1-0-622M.nyc-bb8.cerf.net (134.24.32.214) [AS1740] 86 ms
9 pos1-0-0-155M.nyc-bb3.cerf.net (134.24.32.226) [AS1740] 84 ms
10 gxn-gw.nyc-bb5.cerf.net (134.24.130.114) [AS1740] 84 ms
11 hs8-0-0-llb-ny1.TH1.core.rtr.xara.net (194.143.164.161) [AS5413/AS5519] 157 ms
12 gb6-0-0-llb-x-many.TH25.core.rtr.xara.net (194.143.163.132) [AS5413/AS5519] 157 ms
13 gb6-0-0-llb-x-many.TH7.core.rtr.xara.net (194.143.163.131) [AS5413/AS5519] 157 ms
14 se0-xfs-d416-th7.planet3.cust.rtr.xara.net (195.224.216.227) [AS5519] 163 ms
15 ChiefWiggum.planet-three.net (195.224.98.130) [AS5519] 165 ms
16 * * *

Also, all the hosts that I could find and that seemed to be related to the top-level .cx domain (DNS, mail servers, etc.) are aliases for some machines in the domain .planet-three.net.

And whois reports the following for planet-three.net:

Planet Three Ltd (PLANET-THREE4-DOM)
3A West Point
Warple Way
London, London W3 0RG
UK

Domain Name: PLANET-THREE.NET

Administrative Contact, Technical Contact, Zone Contact:
Registration, Domain (RD696-ORG) domreg@PLANET-THREE.NET
0870 729 5444
Fax- 0870 729 5445
Billing Contact:
Departmet, Accounts (DA11900-OR) billing@PLANET-THREE.NET
0870 729 5444
Fax- 0870 729 5445

Record last updated on 04-Feb-2000.
Record created on 05-Jan-1999.
Database last updated on 20-Feb-2000 12:45:15 EST.

But the location of the DNS servers should not matter, because the DNS can map a domain name to an IP address that is located anywhere in the world. So you can keep your server in a cool and dry room without having to worry about the weather in the Christmas Island.

Spamcop sends lots of message, supposedly on the behalf of Spamcop users, that are both nonsense complaints, and totally misdirected.

As a direct result of every single Spamcop abuse report we've ever received being totally bogus (misdirected and/or nonsense), we refuse all email connectivity from Julian Haight's domains and networks. We don't have the time or the desire to fix his system for him.

If Julian ever gets his act together, and writes a tool that lusers can have "fun" with when firing off complaints without those complaints being 100% misdirected and nonsense, we'll probably let his systems talk to ours again. However, until he re-engineers Spamcop into a conservative tool for assisting in crafting legitimate abuse reports, he and his lusers are just SOL when it comes to getting through to us.

In the end, if you're complaining about abuse in order to have "fun", you probably need to take a break. :-) And don't use Spamcop anyway. Use something responsible like Sam Spade instead.

It seems like that I did not start to receive spam until I started to post on Slashdot.

When I set up this account, the above email address got persistently spammed from home.net. No amount of complaining worked. I guess home.net aren't too clued in.

The spam I receive is not to any email address I have, but rather to another dumbqwerty@msn.com, how can this be so???

You need to look at your "Recepient:" line in the headers. That'll tell you which email address it was really sent to. Most spammers put a fake address in the "To:" field and bcc to their victims.

Every spam has a different 'remove email address' meaning that I must be on a million spam lists and me getting off them all is not a tractable possiblity. Why can't there be one list that these 'generic' spammers would have to check before doing my inbox?? Perhaps it could be federal law.

Never, EVER reply to a "remove" address. They only exist to harvest working email addresses.

Why can't there be a way to 'triangulate' packets to find a physical location for lawbreakers, and give them hard time so other spammers would be scared?? (is scared spammer an oxymoron??)

Nope, spammers are such lower order life forms that they're incapable of fear. They're about four steps below script-kiddies and have many of the same traits. They don't understand how to do what they do; they're just running someone else's program. Despite the fact that they keep losing accounts (and getting verbally abused if they post 1-800 numbers) they *still* think that spamming works.

Doesn't MSN and AOL have ways to keep track of ip addresses they assign dynamically, and thus trace spam??

Yes they do, or at least they have logs and can tell who posted what and when. You need to complain to the right people and send them the full mail headers. Check out http://www.samspade.org for info on how to track through headers.

dave

mx.icp.rssi.ru is an OPEN RELAY used by spammers to hide their tracks. Complain to postmaster@rssi.ru about it and send this spam to them, with full headers.

The spammer is hosted via intra.ru. Send mail to abuse@intra.ru and postmaster@intra.ru with the full headers and spam and say "You have a spammer on your system which is compromizing security and profits. Please remove."

Also, visit The Radparker Relay Spam Stopper to block the relay on subscribed systems.

---
Spammed? Click here for free slack on how to fight it!

...have a look at Sam Spade. I think it's better anyway.