Gossamer Forum
Home : General : Internet Technologies :

How to stop this spam?

Quote Reply
How to stop this spam?
hi,

Today i received this email - one of many coming from some japanese site that has kindly signed one of my addresses up - and their script is even putting "MAILER-DAEMON@newzealand.co.nz" as the from address. Two questions for anyone that can help...

1. How can I stop it?
2. What does it say? Crazy

Thanks,

r.





Return-Path: <root@nz2.newzealand.co.nz>
Received: (from root@localhost)
by nz2.newzealand.co.nz (8.11.0/linuxconf) id g4FHKsp14549
for advertising@nz2.newzealand.co.nz; Thu, 16 May 2002 05:20:54 +1200
Received: from www ([61.145.145.124])
by nz2.newzealand.co.nz (8.11.0/linuxconf) with SMTP id g4FHKpH14545
for <advertising@newzealand.co.nz>; Thu, 16 May 2002 05:20:52 +1200
From: MAILER-DAEMON@newzealand.co.nz
Message-Id: <200205151720.g4FHKpH14545@nz2.newzealand.co.nz>
To: advertising@newzealand.co.nz
Subject: OICQ***DICO /**ͫ6***=Ϋ**** *http://www.1695.net http://www.51dico.com *Ӗ*ʣ
Sender: EmailSender@newzealand.co.nz
Mime-Version: 1.0
Content-Type: text/html; charset="GB2312"
Date: Thu, 16 May 2002 01:09:10 +0800
X-UIDL: ihf"!^T@"!,!a"!O-E"!

<x-html><!x-stuff-for-pete base="" src="" id="0" charset="GB2312"><HTML><HEAD>
</HEAD><FRAMESET border=0 frameBorder=0 frameSpacing=0 rows=100%,*>
<FRAME marginHeight=5 marginWidth=10 name=easymain src="http://www.1695.net">
</FRAMESET>
</HTML>
<p></p>

<p>&lt;&lt;---*/*կ*̺**Ì*---&gt;&gt;<br>
----------------------------------------------------------------<br>
*կ--******;ծ*۠*<br>
ͫ100Mȃ350/ͣ**+5*=<br>
<a href="http://www.263nic.com" target="_blank">http://www.263nic.com</a>/<br>
----------------------------------------------------------------<br>
攠****ޖSMTP*****գʒ****<br>
*̺**կ˺**<a href="http://seekeasy.onchina.net"
target="_blank">http://seekeasy.onchina.net</a> </p>

</x-html>
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
Not sure what it says but put:

61.145.145.124

...in /etc/hosts.deny
Quote Reply
Re: [Paul] How to stop this spam? In reply to
In Reply To:
Not sure what it says but put:

61.145.145.124

...in /etc/hosts.deny



thanks again paul!

i have just noticed that 2 of the spam emails coming through are coming from the same network...

61.145.145.252
61.145.145.124

do you know what i'd enter to block everything from 61.145.145.*

?

thanks

regan.
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
This may help you:

http://spam.abuse.net/adminhelp/ip.shtml
Quote Reply
Re: [Paul] How to stop this spam? In reply to
In Reply To:
This may help you:

http://spam.abuse.net/adminhelp/ip.shtml



thanks for that!

r.
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
This particular mail is Chinese, not Japanese. Run a report at SpamCop to find out where it originates.

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

According to my own observations top spamming networks are located in China, Korea, Russia and Poland.
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
In Reply To:
This particular mail is Chinese, not Japanese. Run a report at SpamCop to find out where it originates.

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

According to my own observations top spamming networks are located in China, Korea, Russia and Poland.




i checked out http://spamcop.net - that's a great resource as well!

couldn't find in there where you found the...

Network: chinanet.cn.net
Website referenced in spam: srit.com.cn

I did do a check on their list and it is a spam site, but it only returned confirmation of the ip i put in, not anything about srit.com.cn etc?

cheers,
regan.
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
SpamCop is really great. It became a daily routine to trace back spam. Smile

Here's what I get on the mail you posted:

61.145.145.124 (Administrator of network where email originates):
anti-spam@ns.chinanet.cn.net
postmaster@chinanet.cn.net

http://seekeasy.onchina.net (Administrator of network hosting website referenced in spam):
llz@srit.com.cn

http://www.263nic.com (Administrator of network hosting website referenced in spam):
abuse@a-1.net.cn
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
In Reply To:
SpamCop is really great. It became a daily routine to trace back spam. Smile

Here's what I get on the mail you posted:

61.145.145.124 (Administrator of network where email originates):
anti-spam@ns.chinanet.cn.net
postmaster@chinanet.cn.net

http://seekeasy.onchina.net (Administrator of network hosting website referenced in spam):
llz@srit.com.cn

http://www.263nic.com (Administrator of network hosting website referenced in spam):
abuse@a-1.net.cn


Whats the URL of the page you're submitting on to get those? Are you a registered paying user of spamcop and seeing something i can't?

cheers,
regan.
Quote Reply
Re: [ryel01] How to stop this spam? In reply to
I signed up to one of their reporting accounts, a free account that is. The only disadvantage is a nagging screen that redirects you to the reporting page after a few seconds. Generally, their servers are veeery slow, especially right now, when people in the US start to check their mails and report back.
Quote Reply
Re: [Tho:mas] How to stop this spam? In reply to
just signed up too - thanks for the reference. Smile

regan.