cc'ed to nanog@ FYI Paul Vixie wrote:
Today I started receiving a massive number of e-mail bounces and complaints about spam. I immediately realized that someone had abused the network in my name; sure enough, I shortly received the evidence shown below. I apologize for this form letter response, but I'm expecting another 10,000 complaints and I do not plan to send personalized replies to each one.
[Posting from home, since thats where I get nanog@, but posting with my work hat on - Reply-To: set to peter@demon.net] Please note that we were hit by the same spammer. The original message went out, claiming it was from one of our customers (another thread last week) when in actual fact it is from an address block assigned the enterprise.net. I understand that this ISP (Enterprise in the UK) has made a statement to the effect that they in turn have traced this to a Compuserve location. Since the only Recieved: header with anything useful in it has one of their IP addrs in, this is difficult to check. Just for some background, the spammer proceeded to set the Reply-To: address to a range of mail-news gateways (demon.service@news.demon.co.uk was one) and really wound people up. This range of gateways have now been permanently closed, which is in itself a great shame. I would advise other out there to check if they have similar legacy newsgroup@ type gateways operating and close them to reduce the backlash of this type of spam. Regards, -- Peter Galbavy @ Home in Wonderland http://www.wonderland.org/ http://www.whirl-y-gig.org.uk/ http://www.demon.net Be remembered not for your final destination, but for your journey.