I previously replied to these words of Mark E Larson ...
Thought people would be interested in this article.
http://www.pcmike.com/Special%20Reports/High%20School%20Spammer.html
and add the following... I went back and pulled up copies of this spam that I received. I received about 12 copies of it. But what I received did not named RUSTnet, so I guess he was generating numerous variations to perhaps try to distribute the load enough to slow down the ISPs coming back to him. That means perhaps many others have been blamed, as well. I found copies claiming to be from some fake names, and one from hotmail. One copy of this same spam (but who knows if it is or is not really the same spammer) I got appeared to be from PSI. It came from a PSI connection and used Earthlink as a mail hop. I complained to abuse@psi.net and they sent back a reply claiming the mail came from Earthlink. Well, literally I did get it from Earthlink, but it originated from PSI's IP address, unless Earthlink faked the IP (but then why would they leave their own address on it). That's why I tend to believe a lot of ISPs ... and more often the BIGGER ones than the smaller ones ... don't know what is going on. Of course, the problem the bigger ones have is that even though they do have a few people that do know, they have tons of poorly trained people that are the "front line" for everything from customer support to abuse@whoever.net. Equipment vendors like Cisco, though, are much, much better at this. I guess that's because they know they are always dealing with professionals (well, maybe for most of the calls). -- Phil Howard KA9WGN +-------------------------------------------------------+ Linux Consultant | Linux installation, configuration, administration, | Milepost Services | monitoring, maintenance, and diagnostic services. | phil at milepost.com +-------------------------------------------------------+