|
|
|
|
||||
|
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
 |
|
|||||||
| Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
|
Thread Tools |
07-20-2002, 11:16 AM
|
#1 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
What the fuck?! Someone spammed FOR me for a program I haven't launched?!
Oh my god
so I come home from lunch and open outlook some motherfucker spammed disguising the from address as "[email protected]" the x's represent random numbers when it really didn't come from my mailservers. Whoever it is obviously is being malicious because they spammed with this message: "Attention Webmasters make money with us today! http://www.sinempire.com/index2_sinbucks.html http://www.sinempire.com/index2_sinbucks.html" I haven't even launched SinBucks all this is is a URL of a "Coming Soon" page on my corporate b2b website. SO, I have 5000 returned E-mails in my outlook and presumably more on the way. Whoever the fuck you are I'm going to hunt you down and I can guarantee your goal of attempting to cause trouble for me will fail miserably. Brad
__________________
President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad 71 industry awards for hosting and professional excellence since 1999 
|
|
|
|
07-20-2002, 11:17 AM
|
#2 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
If anyone can help me nail the perpetrator with certainty I'll offer a $1000 reward.
Brad |
|
|
|
|
07-20-2002, 11:25 AM
|
#3 |
|
Confirmed User
Join Date: Feb 2002
Location: Free Speech Land
Posts: 9,484
|
Post the headers of the message(s) if you want help finding them.
Spammer!  |
|
|
|
|
07-20-2002, 11:38 AM
|
#4 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
I'm getting thousands of returned emails and I *think* this is the original header:
Received: from thor.valueweb.net ([216.219.254.23]:53004 "EHLO thor.valueweb.net") by relay04.valueweb.net with ESMTP id <S139999AbSGTQ2K>; Sat, 20 Jul 2002 12:28:10 -0400 Received: from 201.190.252.64.snet.net ([64.252.190.201]:25639 "HELO regionalymca.org") by thor.valueweb.net with SMTP id <S354772AbSGTQ2F>; Sat, 20 Jul 2002 12:28:05 -0400 Received: from onemails6477.com [194.212.27.115] by regionalymca.org [127.0.0.1] with SMTP (MDaemon.v2.7.SP4.R) for <[email protected]>; Sat, 20 Jul 2002 12:23:51 -0700 From: [email protected] To: [email protected] CC: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] Date: Sat, 20 Jul 2002 11:28:42 -0600 Subject: Make the $$ Opportunity MIME-Version: 1.0 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-MDaemon-Deliver-To: [email protected] X-Return-Path: [email protected] Message-Id: <[email protected]> |
|
|
|
|
07-20-2002, 11:38 AM
|
#5 |
|
Confirmed User
Join Date: Apr 2002
Location: Paradise
Posts: 1,837
|
Them scumbags ain't easy to catch, but I hope you do
__________________
ICQ 146104506 <p> <a href="http://sexsentry.com"</a><img src="http://sexsentry.com/pics/sentry2.gif" alt="All new Sentry. More options and more exposure and more ways to make even more money by using Sentry Elite and try our new create your own custom entrance script and so many more features, many are still in development, but awesome changes are going on at Sex Sentry!"> </p> |
|
|
|
|
07-20-2002, 11:41 AM
|
#6 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
I'm working on it with Verio as we speak. I've never even done bulk E-mail.
Brad |
|
|
|
|
07-20-2002, 11:44 AM
|
#7 |
|
we'll miss you our friend. RIP
Industry Role:
Join Date: Sep 2001
Location: Fernie, BC
Posts: 25,115
|
damn. that's really fucked up.
__________________
we'll miss you our friend. RIP |
|
|
|
|
07-20-2002, 11:49 AM
|
#8 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
I mean, what the fuck... All that I can speculate is that either:
A) An underhanded hosting company is pissed at me for taking some of their business. B) I cancel SinTalk affiliates all the time for non-performance. Recently I've cancelled a few foreign webmasters for breaking marketing rules and being non-revenue producing. Whatever their reason obviously someone else is jealous or hell-bent about something and has a desire to cause harm to my network. Brad |
|
|
|
|
07-20-2002, 11:53 AM
|
#9 |
|
Confirmed User
Join Date: Mar 2002
Location: Everett, WA
Posts: 2,201
|
don't lie, SPAMMER!
 (before you get all pissy I'm j/k Brad)
__________________
SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, then you may use a 624x80 instead of a 120x60. |
|
|
|
|
07-20-2002, 11:53 AM
|
#10 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
64.252.190.201 is an open relay that the spammer found recently. 90% it's not an anonymous one
Static ADSL Pool - MRDNCT Rback6 (NETBLK-SBC064252190000020418) 2701 W. 15th St. PMB 236 Plano, TX 75075 US Netname: SBC064252190000020418 Netblock: 64.252.190.0 - 64.252.191.255 Coordinator: Southwestern Bell Internet Services (ZS44-ARIN) [email protected] 888-212-5411 Contact [email protected] first of all and inform him that his mail server is abused. He might be helpful and check who used his mail server today. (expect me while i was testing it two min ago hehe). There's a possibility to have been abused from 100 spammers though which will make things harder. |
|
|
|
|
07-20-2002, 11:55 AM
|
#11 |
|
Confirmed User
Join Date: Mar 2002
Location: Maryland
Posts: 5,228
|
damn thats weird,hope you get it worked out....or else you can go to hell spammer!
__________________
CashTheChecks.com -coming soon- "Exclusive sites for Exclusive Webmasters" ICQ-119966868,add me first don't message |
|
|
|
|
07-20-2002, 11:55 AM
|
#12 | |
|
Confirmed User
Join Date: Feb 2002
Location: Free Speech Land
Posts: 9,484
|
Quote:
 |
|
|
|
|
|
07-20-2002, 11:59 AM
|
#13 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
just a sec, ithink i got a mistake!
|
|
|
|
|
07-20-2002, 12:00 PM
|
#14 |
|
Confirmed User
Industry Role:
Join Date: Jun 2002
Posts: 562
|
it was i who did it, can i have the 1000 bucks now? :)
__________________
Simply the best site for Gay Porn Pictures ever |
|
|
|
|
07-20-2002, 12:02 PM
|
#15 |
|
GFY HALL OF FAME DAMMIT!!!
Join Date: Jan 2002
Location: that 504
Posts: 60,840
|
I like the word THOR. (216.219.254.23)
CyberGate, Inc. (NETBLK-GATE-CIDR-3) 3250 W. Commercial Blvd. Suite 200 Ft. Lauderdale, FL 33309 US Netname: GATE-CIDR-3 Netblock: 216.219.128.0 - 216.219.255.255 Maintainer: CYBG Coordinator: Administrator, CyberGate Network (CN313-ARIN) [email protected] 954-334-8080
__________________
 Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com -  recent work - About me
|
|
|
|
|
07-20-2002, 12:02 PM
|
#16 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
oh its return mail?
then its ok this is your ip 216.219.254.23 right? |
|
|
|
|
07-20-2002, 12:04 PM
|
#17 |
|
Confirmed User
Join Date: Feb 2002
Location: Free Speech Land
Posts: 9,484
|
Did anyone reading this thread get the spam?
|
|
|
|
|
07-20-2002, 12:04 PM
|
#18 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
that 216.219..... IP range is not mine.
Brad |
|
|
|
|
07-20-2002, 12:07 PM
|
#19 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
hm from the above IPs only 64.252.190.201 is an open relay
this means you can put it in your outlook as smtp server and send mail from it without having to login at all. |
|
|
|
|
07-20-2002, 12:09 PM
|
#20 |
|
we'll miss you our friend. RIP
Industry Role:
Join Date: Sep 2001
Location: Fernie, BC
Posts: 25,115
|
wow soul, i'm going to have to contract you out the next time i want to track something down. good work :)
__________________
we'll miss you our friend. RIP |
|
|
|
|
07-20-2002, 12:11 PM
|
#21 |
|
Confirmed User
Join Date: Mar 2002
Location: Mass Ass
Posts: 5,294
|
you paid your spammer well
__________________
|
|
|
|
|
07-20-2002, 12:14 PM
|
#22 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
the secure way to get the real ip is to mail all these people asking them to copy/paste you (not forward) the headers of the mail they received
you should see then Return-Path: <[email protected] > Received: from [domain] (IP) check to whom the IP belongs and contact him,the IP is the open relay the spammer used. The admin of this relay maybe will be able to help you. I still believe it's the 64.252.190.201 but in order to be sure. Give him the money to make him search for the IP of the sender. I think it will take him long time (if there's such log file) |
|
|
|
|
07-20-2002, 12:15 PM
|
#23 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
lol
Verio should hire Soul_Rebel it sounds like he's quicker then they are. Christ, if I did send out spam it would be counter-intuitive to promote a "coming soon" page on my business to business website. Any rational person would have put a paysite or circle jerk or something. Besides which, this obviously didn't go to a webmaster list it looks like the general public was the recipients. Brad |
|
|
|
|
07-20-2002, 12:17 PM
|
#24 | |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
Quote:
thanks, it's pretty simple, but at the end it only depends on the admin of the abused server. In some cases the spammers are using their isp smtp server but this is very rare since they'll close them within a day. |
|
|
|
|
|
07-20-2002, 12:17 PM
|
#25 | |
|
Confirmed User
Join Date: Feb 2002
Location: Free Speech Land
Posts: 9,484
|
Quote:
|
|
|
|
|
|
07-20-2002, 12:19 PM
|
#26 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
Christ, it looks like I should turn my catch-all off for SinEmpire.
Here's some more shit from 'returned' mail: -----Original Message----- From: Mail Delivery Subsystem [mailto:MAILER-DAEMON@polaris] Sent: Saturday, July 20, 2002 2:59 PM To: [email protected] Subject: Warning: could not send message for past 4 hours ********************************************** ** THIS IS A WARNING MESSAGE ONLY ** ** YOU DO NOT NEED TO RESEND YOUR MESSAGE ** ********************************************** The original message was received at Sat, 20 Jul 2002 07:46:58 -0700 from kirchhoff.Stanford.EDU [171.64.162.60] ----- The following addresses had transient non-fatal errors ----- <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> ----- Transcript of session follows ----- 451 <[email protected]>... uyccable.uucp.netcom.com: Name server timeout 451 <[email protected]>... ixks.net: Name server timeout <[email protected]>... Deferred: Connection refused by memphispharaohs.com. <[email protected]>... Deferred: Connection refused by mailer.tightrope.it. <[email protected]>... Deferred: Operation timed out with mx.pld.net. ... while talking to chaos.access-one.com.: <<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org') ... while talking to apollo.access-one.com.: >>> QUIT <<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org') <[email protected]>... Deferred: Connection reset by apollo.access-one.com. ... while talking to mxpool01.netaddress.usa.net.: >>> QUIT <<< 550 Mail from 64.169.97.36 refused. Please refer to http://mail-abuse.org/rss for an explanation. <[email protected]>... Deferred: Invalid argument <[email protected]>... Deferred: Connection refused by gateway1.delphi.com. Warning: message still undelivered after 4 hours Will keep trying until message is 5 days old |
|
|
|
|
07-20-2002, 12:19 PM
|
#27 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
hehe Sin it seems you have an evil enemy!
|
|
|
|
|
07-20-2002, 12:20 PM
|
#28 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
I have two cats but I think they were upstairs looking out the window when this all happened... but I can interrogate them to see if they're the culprits.
|
|
|
|
|
07-20-2002, 12:21 PM
|
#29 | |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
Quote:
|
|
|
|
|
|
07-20-2002, 12:23 PM
|
#30 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
<<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org')
... while talking to apollo.access-one.com.: >>> QUIT <<< 550 This system is configured to reject mail from 64.169.97.36 [64.169.97.36] (Host blacklisted - Found on Realtime Black List server 'relays.ordb.org') the guy is using more than one open relay, so it's a pro spammer. This time the server checked the new relay (64.169.97.36) againsted a live blacklist located at relays.ordb.org The bad news....probably he sending A LOT of mails |
|
|
|
|
07-20-2002, 12:24 PM
|
#31 |
|
Confirmed User
Join Date: Feb 2002
Location: Free Speech Land
Posts: 9,484
|
Wasn't there a GFY user who was busted for doing this before? Spamming for people to get them in trouble? I don't remember the details, but I seem to remember that someone did this to some other GFY member(s) some time ago.
|
|
|
|
|
07-20-2002, 12:28 PM
|
#32 |
|
HAL 9000
Industry Role:
Join Date: May 2001
Posts: 34,515
|
contact your hosting co telling them what's going on because they might receive some urgent calls about it. Also if he sends a lot of mails your IP block will end up that the idiots that run spamhaus.org. They collect all the ips and add the in to a huge listt that they share in real time with isps and admins. In some cases (very serious ones) your IP can be blocked at major IPs which means they surfers wont be able to access your site. But I think this scenario is not so possible at the moment.
|
|
|
|
|
07-20-2002, 12:30 PM
|
#33 |
|
GFY HALL OF FAME DAMMIT!!!
Join Date: Jan 2002
Location: that 504
Posts: 60,840
|
Yeah someone was spamming under peoples affiliate codes to get them in trouble... and his name was.....
__________________
Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me
|
|
|
|
|
07-20-2002, 12:35 PM
|
#34 |
|
GFY HALL OF FAME DAMMIT!!!
Join Date: Jan 2002
Location: that 504
Posts: 60,840
|
<img src=http://69khz.com/images/sexymail.jpg>
Me and Sexymail are cool now though, he uses other peoples names now. Hope you nail the fucker to the cross Brad. If you need any numbers tracked secretively hit me up on icq.
__________________
Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me
|
|
|
|
|
07-20-2002, 12:46 PM
|
#35 |
|
Confirmed User
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,813
|
The unfortunate thing is that presuming this happened through a relay even though that relay will surely be shut down the guy that exploited it will almost certainly never be caught.
Fortunately with Verio I've got their premier group for support and their security guys are working on it. I don't know what they'll come up with but they'll obviously know by looking at all of the evidence that none of this spam came from any of my networks despite the fact that the spam tries to implicate that my sinempire.com is both the sender and beneficiary of such 'traffic'. What I wonder about is how thorough some of the anti-spam consortiums are when they do their research to block networks and IP addresses. Argh.. I'm certain that the perp is either someone here on the GFY community that doesn't like me OR a foreign affiliate that I cancelled in one of my programs. It would defy logic that this is a random incident - it's clearly malicious but obviously ill-conceived since they didn't even pick a 'commerce' page to send the traffic to and the english in the spam wasn't very good. I've cancelled a few foreign affiliates for spamming their SinTalk lines and it's possible one of them was pissed off enough to do this - I guess I'll just have to wonder. I had this chinese or korean affiliate that I cancelled last week who was claiming he had 500k daily visitors... well, I looked at his shit-ass website and it didn't add up.... Who knows. Anyways, it's Saturday... so I'm off to a b'day party to hopefully have some fun - Ciao! Thanks for everyone's help and support - if I get more info I'll share it. Brad
__________________
President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad 71 industry awards for hosting and professional excellence since 1999
|
|
|
|
|
07-20-2002, 01:51 PM
|
#36 |
|
Confirmed User
Join Date: Jul 2002
Location: ~ C A N A D A ~
Posts: 2,123
|
Since the url in the spam is taking surfers to a "coming soon page" - you could replace that page with a page explaining someone was sending e-mails on your behalf.
That way people are less likely to complain because they understand it wasn't you.
__________________
<a href="http://www.pornopayouts.com/?rid=pp3076">PornoPayouts</a> Tons of Hosted Galleries. |
|
|
|
