What the fuck?! Someone spammed FOR me for a program I haven't launched?! - GoFuckYourself.com - Adult Webmaster Forum

X

Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#1

What the fuck?! Someone spammed FOR me for a program I haven't launched?!

07-20-2002, 10:16 AM

Oh my god

so I come home from lunch and open outlook

some motherfucker spammed disguising the from address as "[email protected]" the x's represent random numbers when it really didn't come from my mailservers. Whoever it is obviously is being malicious because they spammed with this message:

"Attention Webmasters make money with us today!

http://www.sinempire.com/index2_sinbucks.html

http://www.sinempire.com/index2_sinbucks.html"

I haven't even launched SinBucks all this is is a URL of a "Coming Soon" page on my corporate b2b website. SO, I have 5000 returned E-mails in my outlook and presumably more on the way.

Whoever the fuck you are I'm going to hunt you down and I can guarantee your goal of attempting to cause trouble for me will fail miserably.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Tags: None
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#2

07-20-2002, 10:17 AM

If anyone can help me nail the perpetrator with certainty I'll offer a $1000 reward.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Mr.Fiction

Confirmed User

Join Date: Feb 2002

Posts: 9484
Share

Post
#3

07-20-2002, 10:25 AM

Post the headers of the message(s) if you want help finding them.

Spammer!

Don't be lazy, protect free speech: ACLU | Free Speech Coalition | EFF | IMPA
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#4

07-20-2002, 10:38 AM

I'm getting thousands of returned emails and I *think* this is the original header:

Received: from thor.valueweb.net ([216.219.254.23]:53004 "EHLO thor.valueweb.net") by relay04.valueweb.net with ESMTP id <S139999AbSGTQ2K>; Sat, 20 Jul 2002 12:28:10 -0400
Received: from 201.190.252.64.snet.net ([64.252.190.201]:25639 "HELO regionalymca.org") by thor.valueweb.net with SMTP id <S354772AbSGTQ2F>; Sat, 20 Jul 2002 12:28:05 -0400
Received: from onemails6477.com [194.212.27.115] by regionalymca.org [127.0.0.1] with SMTP (MDaemon.v2.7.SP4.R) for <[email protected]>; Sat, 20 Jul 2002 12:23:51 -0700
From: [email protected]
To: [email protected]
CC: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected]
Date: Sat, 20 Jul 2002 11:28:42 -0600
Subject: Make the $$ Opportunity
MIME-Version: 1.0
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-MDaemon-Deliver-To: [email protected]
X-Return-Path: [email protected]
Message-Id: <[email protected]>

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
reddawg

Confirmed User

Join Date: Apr 2002

Posts: 1837
Share

Post
#5

07-20-2002, 10:38 AM

Them scumbags ain't easy to catch, but I hope you do

Last edited by reddawg; 07-20-2002, 10:41 AM.

ICQ 146104506
<p>
<a href="http://sexsentry.com"</a><img src="http://sexsentry.com/pics/sentry2.gif" alt="All new Sentry. More options and more exposure and more ways to make even more money by using Sentry Elite and try our new create your own custom entrance script and so many more features, many are still in development, but awesome changes are going on at Sex Sentry!">
</p>
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#6

07-20-2002, 10:41 AM

I'm working on it with Verio as we speak. I've never even done bulk E-mail.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
quiet

we'll miss you our friend. RIP

Join Date: Sep 2001

Posts: 25115
Share

Post
#7

07-20-2002, 10:44 AM

damn. that's really fucked up.

we'll miss you our friend. RIP
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#8

07-20-2002, 10:49 AM

I mean, what the fuck... All that I can speculate is that either:

A) An underhanded hosting company is pissed at me for taking some of their business.

B) I cancel SinTalk affiliates all the time for non-performance. Recently I've cancelled a few foreign webmasters for breaking marketing rules and being non-revenue producing.

Whatever their reason obviously someone else is jealous or hell-bent about something and has a desire to cause harm to my network.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
XXXPaysiteDesign

Confirmed User

Join Date: Mar 2002

Posts: 2201
Share

Post
#9

07-20-2002, 10:53 AM

don't lie, SPAMMER!

(before you get all pissy I'm j/k Brad)

SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, then you may use a 624x80 instead of a 120x60.
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#10

07-20-2002, 10:53 AM

64.252.190.201 is an open relay that the spammer found recently. 90% it's not an anonymous one

Static ADSL Pool - MRDNCT Rback6 (NETBLK-SBC064252190000020418)
2701 W. 15th St. PMB 236
Plano, TX 75075
US

Netname: SBC064252190000020418
Netblock: 64.252.190.0 - 64.252.191.255

Coordinator:
Southwestern Bell Internet Services (ZS44-ARIN) [email protected]
888-212-5411

Contact [email protected] first of all and inform him that his mail server is abused. He might
be helpful and check who used his mail server today. (expect me while i was testing it two min ago hehe).
There's a possibility to have been abused from 100 spammers though which will make things harder.

Last edited by Theo; 07-20-2002, 10:55 AM.
Comment
nocostporn

Confirmed User

Join Date: Mar 2002

Posts: 5228
Share

Post
#11

07-20-2002, 10:55 AM

damn thats weird,hope you get it worked out....or else you can go to hell spammer!

CashTheChecks.com -coming soon-
"Exclusive sites for Exclusive Webmasters"
ICQ-119966868,add me first don't message
Comment
Mr.Fiction

Confirmed User

Join Date: Feb 2002

Posts: 9484
Share

Post
#12

07-20-2002, 10:55 AM

Originally posted by Soul_Rebel
64.252.190.201 is an open relay that the spammer found recently. 90% it's not an anonymous one

Static ADSL Pool - MRDNCT Rback6 (NETBLK-SBC064252190000020418)
2701 W. 15th St. PMB 236
Plano, TX 75075
US

Netname: SBC064252190000020418
Netblock: 64.252.190.0 - 64.252.191.255

Coordinator:
Southwestern Bell Internet Services (ZS44-ARIN) [email protected]
888-212-5411

Contact [email protected] first of all and inform him that his mail server is abused. He might
be helpful and check who used his mail server today. (expect me while i was testing it two min ago hehe).
There's a possibility to have been abused from 100 spammers though which will make things harder.

Don't be lazy, protect free speech: ACLU | Free Speech Coalition | EFF | IMPA
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#13

07-20-2002, 10:59 AM

just a sec, ithink i got a mistake!
Comment
CharlieBrown

Confirmed User

Join Date: Jun 2002

Posts: 562
Share

Post
#14

07-20-2002, 11:00 AM

it was i who did it, can i have the 1000 bucks now?

Simply the best site for Gay Porn Pictures ever
Comment
Fletch XXX

GFY HALL OF FAME DAMMIT!!!

Join Date: Jan 2002

Posts: 60840
Share

Post
#15

07-20-2002, 11:02 AM

I like the word THOR. (216.219.254.23)

CyberGate, Inc. (NETBLK-GATE-CIDR-3)
3250 W. Commercial Blvd. Suite 200
Ft. Lauderdale, FL 33309
US

Netname: GATE-CIDR-3
Netblock: 216.219.128.0 - 216.219.255.255
Maintainer: CYBG

Coordinator:
Administrator, CyberGate Network (CN313-ARIN) [email protected]
954-334-8080

Want an Android App for your tube, membership, or free site?

Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#16

07-20-2002, 11:02 AM

oh its return mail?
then its ok
this is your ip 216.219.254.23 right?
Comment
Mr.Fiction

Confirmed User

Join Date: Feb 2002

Posts: 9484
Share

Post
#17

07-20-2002, 11:04 AM

Did anyone reading this thread get the spam?

Don't be lazy, protect free speech: ACLU | Free Speech Coalition | EFF | IMPA
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#18

07-20-2002, 11:04 AM

that 216.219..... IP range is not mine.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#19

07-20-2002, 11:07 AM

hm from the above IPs only 64.252.190.201 is an open relay
this means you can put it in your outlook as smtp server and send mail from it without having to login at all.
Comment
quiet

we'll miss you our friend. RIP

Join Date: Sep 2001

Posts: 25115
Share

Post
#20

07-20-2002, 11:09 AM

wow soul, i'm going to have to contract you out the next time i want to track something down. good work

we'll miss you our friend. RIP
Comment
hyper

Confirmed User

Join Date: Mar 2002

Posts: 5294
Share

Post
#21

07-20-2002, 11:11 AM

you paid your spammer well
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#22

07-20-2002, 11:14 AM

the secure way to get the real ip is to mail all these people asking them to copy/paste you (not forward) the headers of the mail they received

you should see then
Return-Path: <[email protected] >
Received: from [domain] (IP)

check to whom the IP belongs and contact him,the IP is the open relay the spammer used. The admin of this relay maybe will be able to help you. I still believe it's the 64.252.190.201 but in order to be sure.

Give him the money to make him search for the IP of the sender. I think it will take him long time (if there's such log file)
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#23

07-20-2002, 11:15 AM

lol

Verio should hire Soul_Rebel it sounds like he's quicker then they are.

Christ, if I did send out spam it would be counter-intuitive to promote a "coming soon" page on my business to business website. Any rational person would have put a paysite or circle jerk or something. Besides which, this obviously didn't go to a webmaster list it looks like the general public was the recipients.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#24

07-20-2002, 11:17 AM

Originally posted by quiet
wow soul, i'm going to have to contract you out the next time i want to track something down. good work

thanks, it's pretty simple, but at the end it only depends on the admin of the abused server. In some cases the spammers are using their isp smtp server but this is very rare since they'll close them within a day.
Comment
Mr.Fiction

Confirmed User

Join Date: Feb 2002

Posts: 9484
Share

Post
#25

07-20-2002, 11:17 AM

Originally posted by SinEmpire
lol

Verio should hire Soul_Rebel it sounds like he's quicker then they are.

Christ, if I did send out spam it would be counter-intuitive to promote a "coming soon" page on my business to business website. Any rational person would have put a paysite or circle jerk or something. Besides which, this obviously didn't go to a webmaster list it looks like the general public was the recipients.

Brad

Do you have a cat? Maybe he was fucking with your keyboard while you were sleeping. They are tricky little animals.

Don't be lazy, protect free speech: ACLU | Free Speech Coalition | EFF | IMPA
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#26

07-20-2002, 11:19 AM

Christ, it looks like I should turn my catch-all off for SinEmpire.

Here's some more shit from 'returned' mail:

-----Original Message-----
From: Mail Delivery Subsystem [mailto:MAILER-DAEMON@polaris]
Sent: Saturday, July 20, 2002 2:59 PM
To: [email protected]
Subject: Warning: could not send message for past 4 hours

**********************************************
** THIS IS A WARNING MESSAGE ONLY **
** YOU DO NOT NEED TO RESEND YOUR MESSAGE **
**********************************************

The original message was received at Sat, 20 Jul 2002 07:46:58 -0700
from kirchhoff.Stanford.EDU [171.64.162.60]

----- The following addresses had transient non-fatal errors -----
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>

----- Transcript of session follows -----
451 <[email protected]>... uyccable.uucp.netcom.com: Name server timeout
451 <[email protected]>... ixks.net: Name server timeout
<[email protected]>... Deferred: Connection refused by memphispharaohs.com.
<[email protected]>... Deferred: Connection refused by mailer.tightrope.it.
<[email protected]>... Deferred: Operation timed out with mx.pld.net.
... while talking to chaos.access-one.com.:
<<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org')
... while talking to apollo.access-one.com.:
>>> QUIT
<<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org')
<[email protected]>... Deferred: Connection reset by apollo.access-one.com.
... while talking to mxpool01.netaddress.usa.net.:
>>> QUIT
<<< 550 Mail from 64.169.97.36 refused. Please refer to http://mail-abuse.org/rss for an explanation.
<[email protected]>... Deferred: Invalid argument
<[email protected]>... Deferred: Connection refused by gateway1.delphi.com.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#27

07-20-2002, 11:19 AM

hehe Sin it seems you have an evil enemy!
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#28

07-20-2002, 11:20 AM

I have two cats but I think they were upstairs looking out the window when this all happened... but I can interrogate them to see if they're the culprits.

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#29

07-20-2002, 11:21 AM

Originally posted by Soul_Rebel
hehe Sin it seems you have an evil enemy!

Wow, I must be doing something right then

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#30

07-20-2002, 11:23 AM

<<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org')
... while talking to apollo.access-one.com.:
>>> QUIT
<<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org')

the guy is using more than one open relay, so it's a pro spammer. This time the server checked the new relay (64.169.97.36) againsted a live blacklist located at relays.ordb.org

The bad news....probably he sending A LOT of mails
Comment
Mr.Fiction

Confirmed User

Join Date: Feb 2002

Posts: 9484
Share

Post
#31

07-20-2002, 11:24 AM

Wasn't there a GFY user who was busted for doing this before? Spamming for people to get them in trouble? I don't remember the details, but I seem to remember that someone did this to some other GFY member(s) some time ago.

Don't be lazy, protect free speech: ACLU | Free Speech Coalition | EFF | IMPA
Comment
Theo

HAL 9000

Join Date: May 2001

Posts: 34515
Share

Post
#32

07-20-2002, 11:28 AM

contact your hosting co telling them what's going on because they might receive some urgent calls about it. Also if he sends a lot of mails your IP block will end up that the idiots that run spamhaus.org. They collect all the ips and add the in to a huge listt that they share in real time with isps and admins. In some cases (very serious ones) your IP can be blocked at major IPs which means they surfers wont be able to access your site. But I think this scenario is not so possible at the moment.
Comment
Fletch XXX

GFY HALL OF FAME DAMMIT!!!

Join Date: Jan 2002

Posts: 60840
Share

Post
#33

07-20-2002, 11:30 AM

Yeah someone was spamming under peoples affiliate codes to get them in trouble... and his name was.....

Want an Android App for your tube, membership, or free site?

Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me
Comment
Fletch XXX

GFY HALL OF FAME DAMMIT!!!

Join Date: Jan 2002

Posts: 60840
Share

Post
#34

07-20-2002, 11:35 AM

<img src=http://69khz.com/images/sexymail.jpg>

Me and Sexymail are cool now though, he uses other peoples names now.

Hope you nail the fucker to the cross Brad.
If you need any numbers tracked secretively hit me up on icq.

Last edited by Fletch XXX; 07-20-2002, 11:42 AM.

Want an Android App for your tube, membership, or free site?

Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me
Comment
Brad Mitchell

Confirmed User

Join Date: Nov 2001

Posts: 9813
Share

Post
#35

07-20-2002, 11:46 AM

The unfortunate thing is that presuming this happened through a relay even though that relay will surely be shut down the guy that exploited it will almost certainly never be caught.

Fortunately with Verio I've got their premier group for support and their security guys are working on it. I don't know what they'll come up with but they'll obviously know by looking at all of the evidence that none of this spam came from any of my networks despite the fact that the spam tries to implicate that my sinempire.com is both the sender and beneficiary of such 'traffic'.

What I wonder about is how thorough some of the anti-spam consortiums are when they do their research to block networks and IP addresses.

Argh.. I'm certain that the perp is either someone here on the GFY community that doesn't like me OR a foreign affiliate that I cancelled in one of my programs. It would defy logic that this is a random incident - it's clearly malicious but obviously ill-conceived since they didn't even pick a 'commerce' page to send the traffic to and the english in the spam wasn't very good.

I've cancelled a few foreign affiliates for spamming their SinTalk lines and it's possible one of them was pissed off enough to do this - I guess I'll just have to wonder.

I had this chinese or korean affiliate that I cancelled last week who was claiming he had 500k daily visitors... well, I looked at his shit-ass website and it didn't add up.... Who knows.

Anyways, it's Saturday... so I'm off to a b'day party to hopefully have some fun -

Ciao! Thanks for everyone's help and support - if I get more info I'll share it.

Brad

President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Comment
.:Frog:.

Confirmed User

Join Date: Jul 2002

Posts: 2123
Share

Post
#36

07-20-2002, 12:51 PM

Since the url in the spam is taking surfers to a "coming soon page" - you could replace that page with a page explaining someone was sending e-mails on your behalf.
That way people are less likely to complain because they understand it wasn't you.

<a href="http://www.pornopayouts.com/?rid=pp3076">PornoPayouts</a>
Tons of Hosted Galleries.
Comment

Previous template Next

Working...