Gossamer Forum
(Advanced Search)
for
Home : General : Internet Technologies :

How to stop this spam?

May 15, 2002, 1:45 PM
ryel01
Veteran (1264 posts)
May 15, 2002, 1:45 PM
Post #1 of 11
Views: 7578
Shortcut
Quote Reply
How to stop this spam?
hi,

Today i received this email - one of many coming from some japanese site that has kindly signed one of my addresses up - and their script is even putting "MAILER-DAEMON@newzealand.co.nz" as the from address. Two questions for anyone that can help...

1. How can I stop it?
2. What does it say? Crazy

Thanks,

r.





Return-Path: <root@nz2.newzealand.co.nz>
Received: (from root@localhost)
by nz2.newzealand.co.nz (8.11.0/linuxconf) id g4FHKsp14549
for advertising@nz2.newzealand.co.nz; Thu, 16 May 2002 05:20:54 +1200
Received: from www ([61.145.145.124])
by nz2.newzealand.co.nz (8.11.0/linuxconf) with SMTP id g4FHKpH14545
for <advertising@newzealand.co.nz>; Thu, 16 May 2002 05:20:52 +1200
From: MAILER-DAEMON@newzealand.co.nz
Message-Id: <200205151720.g4FHKpH14545@nz2.newzealand.co.nz>
To: advertising@newzealand.co.nz
Subject: ±»OICQ*¸**£¨DICO œ÷‘/*‚*—…Í«Î6Œª **÷µƒ*=¬Î«¿*¢*·Œ®“ªµƒ”*ªß*° µ*http://www.1695.net ªÚhttp://www.51dico.com œ¬‘‘*Ó–¬*Ê£°
Sender: EmailSender@newzealand.co.nz
Mime-Version: 1.0
Content-Type: text/html; charset="GB2312"
Date: Thu, 16 May 2002 01:09:10 +0800
X-UIDL: ihf"!^T@"!,!a"!O-E"!

<x-html><!x-stuff-for-pete base="" src="" id="0" charset="GB2312"><HTML><HEAD>
</HEAD><FRAMESET border=0 frameBorder=0 frameSpacing=0 rows=100%,*>
<FRAME marginHeight=5 marginWidth=10 name=easymain src="http://www.1695.net">
</FRAMESET>
</HTML>
<p>°°</p>

<p>&lt;&lt;---“‘…œ” º*ƒ/»ð”Î÷–* ‘¥Õ¯¬Áº*»Ìº*ø™*¢…ÃŒÞ*ÿ---&gt;&gt;<br>
----------------------------------------------------------------<br>
÷–* ‘¥Õ¯¬Á--”Ú*°œ»*¢*·*Û**øÓ;÷˜ª·œ»ø™Õ®*Û ’*—°£<br>
…Í«Î100M–ȃ‚÷˜ª·350‘™/ƒÍ£¨ÀÕ*·º ”Ú*°+5*ˆ–=œ‰<br>
<a href="http://www.263nic.com" target="_blank">http://www.263nic.com</a>/<br>
----------------------------------------------------------------<br>
±æ” º*”…À—“* *¥¥°*ŒÞ–ËSMTP*ý¬**¢ÀÕ*˜°±*¢ÀÕ£¨’Ê’**þ÷ ¡ø°¢*þÀŸ*»°£<br>
À—“*»Ìº**®Œ™Õ¯…œ”™œ·»À ø…˺*£*<a href="http://seekeasy.onchina.net"
target="_blank">http://seekeasy.onchina.net</a> </p>

</x-html>
May 15, 2002, 1:49 PM
Paul
Veteran (19537 posts)
May 15, 2002, 1:49 PM
Post #2 of 11
Views: 7210
Shortcut
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
Not sure what it says but put:

61.145.145.124

...in /etc/hosts.deny
May 15, 2002, 2:04 PM
ryel01
Veteran (1264 posts)
May 15, 2002, 2:04 PM
Post #3 of 11
Views: 7225
Shortcut
Quote Reply
Re: [Paul] How to stop this spam? In reply to
In Reply To:
Not sure what it says but put:

61.145.145.124

...in /etc/hosts.deny



thanks again paul!

i have just noticed that 2 of the spam emails coming through are coming from the same network...

61.145.145.252
61.145.145.124

do you know what i'd enter to block everything from 61.145.145.*

?

thanks

regan.
May 15, 2002, 2:27 PM
Paul
Veteran (19537 posts)
May 15, 2002, 2:27 PM
Post #4 of 11
Views: 7219
Shortcut
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
This may help you:

http://spam.abuse.net/adminhelp/ip.shtml
May 15, 2002, 2:46 PM
ryel01
Veteran (1264 posts)
May 15, 2002, 2:46 PM
Post #5 of 11
Views: 7169
Shortcut
Quote Reply
Re: [Paul] How to stop this spam? In reply to
In Reply To:
This may help you:

http://spam.abuse.net/adminhelp/ip.shtml



thanks for that!

r.
May 16, 2002, 2:02 AM
Thomas.
Veteran (1220 posts)
Thomas.'s avatar
May 16, 2002, 2:02 AM
Post #6 of 11
Views: 7169
Shortcut
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
This particular mail is Chinese, not Japanese. Run a report at SpamCop to find out where it originates.

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

According to my own observations top spamming networks are located in China, Korea, Russia and Poland.
May 16, 2002, 3:02 AM
ryel01
Veteran (1264 posts)
May 16, 2002, 3:02 AM
Post #7 of 11
Views: 7121
Shortcut
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
In Reply To:
This particular mail is Chinese, not Japanese. Run a report at SpamCop to find out where it originates.

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

According to my own observations top spamming networks are located in China, Korea, Russia and Poland.




i checked out http://spamcop.net - that's a great resource as well!

couldn't find in there where you found the...

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

I did do a check on their list and it is a spam site, but it only returned confirmation of the ip i put in, not anything about srit.com.cn etc?

cheers,
regan.
May 16, 2002, 3:48 AM
Thomas.
Veteran (1220 posts)
Thomas.'s avatar
May 16, 2002, 3:48 AM
Post #8 of 11
Views: 7142
Shortcut
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
SpamCop is really great. It became a daily routine to trace back spam. Smile

Here's what I get on the mail you posted:

61.145.145.124 (Administrator of network where email originates):
anti-spam@ns.chinanet.cn.net
postmaster@chinanet.cn.net

http://seekeasy.onchina.net (Administrator of network hosting website referenced in spam):
llz@srit.com.cn

http://www.263nic.com (Administrator of network hosting website referenced in spam):
abuse@a-1.net.cn
May 16, 2002, 3:59 AM
ryel01
Veteran (1264 posts)
May 16, 2002, 3:59 AM
Post #9 of 11
Views: 7144
Shortcut
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
In Reply To:
SpamCop is really great. It became a daily routine to trace back spam. Smile

Here's what I get on the mail you posted:

61.145.145.124 (Administrator of network where email originates):
anti-spam@ns.chinanet.cn.net
postmaster@chinanet.cn.net

http://seekeasy.onchina.net (Administrator of network hosting website referenced in spam):
llz@srit.com.cn

http://www.263nic.com (Administrator of network hosting website referenced in spam):
abuse@a-1.net.cn


Whats the URL of the page you're submitting on to get those? Are you a registered paying user of spamcop and seeing something i can't?

cheers,
regan.
May 16, 2002, 4:04 AM
Thomas.
Veteran (1220 posts)
Thomas.'s avatar
May 16, 2002, 4:04 AM
Post #10 of 11
Views: 7176
Shortcut
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
I signed up to one of their reporting accounts, a free account that is. The only disadvantage is a nagging screen that redirects you to the reporting page after a few seconds. Generally, their servers are veeery slow, especially right now, when people in the US start to check their mails and report back.
May 16, 2002, 5:34 AM
ryel01
Veteran (1264 posts)
May 16, 2002, 5:34 AM
Post #11 of 11
Views: 7140
Shortcut
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
just signed up too - thanks for the reference. Smile

regan.