At 05:25 PM 5/3/2002 +0100, you wrote: I got some of these a few weeks ago. I believe these test messages are sent to find the non-deliverables in their mailing list. Right after I got these test messages, they started sending quite a bit of spam. I filtered sohu.com and it went away.

Not me, but I am getting an awful lot of emails from this one person, to my nanog address lately:

Return-Path: <test@sohu.com> Delivered-To: silverwraith.com-lists-nanog@silverwraith.com Received: (qmail 21586 invoked from network); 3 May 2002 03:09:28 -0000 Received: from unknown (HELO sohu.com) (203.240.184.78) by apple.silverwraith.com with SMTP; 3 May 2002 03:09:28 -0000 Reply-To: test@sohu.com Return-Path: test@sohu.com From: richard <test@sohu.com> To: <lists-nanog@silverwraith.com> Subject: test Sender: richard <test@sohu.com> Mime-Version: 1.0 Content-Type: text/html; charset="ks_c_5601-1987" Date: Fri, 3 May 2002 12:09:13 +0900

[ The following text is in the "ks_c_5601-1987" character set. ] [ Your display is set for the "ISO-8859-1" character set. ] [ Some characters may be displayed incorrectly. ]

test

On Fri, 3 May 2002, Paul Vixie wrote:

...

as a coauthor of rfc2136, my curiousity is always piqued when spammers use the technology. can i get private forwards of other similar messages? (see below.)

(and yes, i'll also be in touch with level3, who serves 166.90.15.236, from whence this message came.)

(time was, anyone who could use postfix and php would also know better than to spam, or at least, to spam *me*. <grump> <grumble>.)

re:

------- Forwarded Message

Return-Path: nobody@www.no-ip.com Delivery-Date: Fri May 3 07:44:25 2002 Return-Path: <nobody@www.no-ip.com> Delivered-To: vixie@as.vix.com Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30]) by as.vix.com (Postfix) with ESMTP id 2360D28B6B for <vixie@as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT) (envelope-from nobody@www.no-ip.com) Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236]) by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718 for <vix@vix.com>; Fri, 3 May 2002 14:44:25 GMT env-from (nobody@www.no-ip.com) Received: by www.no-ip.com (Postfix, from userid 99) id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT) To: vix@vix.com Subject: Your password for no-ip.com From: No-IP Registration <webmaster@no-ip.com> Reply-To: webmaster@no-ip.com X-Mailer: PHP/4.1.2 Message-Id: <20020503145440.4A10F833A4@www.no-ip.com> Date: Fri, 3 May 2002 07:54:40 -0700 (PDT)

Hello,

Welcome to No-IP.com. Your number one stop for dynamic dns services.

Your password is: jnMgta

To logon to no-ip.com go to http://www.no-ip.com/ and enter your email address and the password above. Once you logon you may change your password by clicking the "Change Password" link.

Remember that you can use our dynamic update client to keep our system is sync with your IP address. These clients are available at http://www.no-ip.com/downloads.php

Also, keep in mind that No-IP offers services for use with personal domain names. This service, No-IP Plus, allows you to use YOUR domain name with our dynamic dns, and other facilities. More information on this and other services is at http://www.no-ip.com/services.php.

If you have any further questions about this service, please refer to our FAQ at http://www.no-ip.com/faq.php. If the FAQ doesn't answer your question(s) contact us at support@no-ip.com.

Enjoy!

The No-IP Team webmaster@no-ip.com http://www.no-ip.com/

------- End of Forwarded Message

-- Avleen Vig Work Time: Unix Systems Administrator Play Time: Network Security Officer Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf

Best Regards, Simon -- ###

Well I just started getting a *LOT* of these (read 30+ an hour) to my nannog list address. Am I going to have to start filtering all emails from net.tw ?: Return-Path: <ucD4xv@hotmail.com> Delivered-To: silverwraith.com-lists-nanog@silverwraith.com Received: (qmail 38418 invoked from network); 3 May 2002 21:15:41 -0000 Received: from 61-220-202-229.hinet-ip.hinet.net (HELO Hacker) (61.220.202.229) by apple.silverwraith.com with SMTP; 3 May 2002 21:15:41 -0000 Received: from kimo by saturn.seed.net.tw with SMTP id iHhWXQgWgHOu7kU5MupXr0; Sat, 04 May 2002 05:16:24 +0800 Message-ID: <dOO5A0cBPTks@mail.ht.net.tw> From: goodluck@ms16.hinet.net To: 8qw_y15 Subject:goodluck everyone TLxzltPT08kAVaZWfJvsidzt On Fri, 3 May 2002, Simon Higgs wrote:

At 05:25 PM 5/3/2002 +0100, you wrote:

I got some of these a few weeks ago. I believe these test messages are sent to find the non-deliverables in their mailing list. Right after I got these test messages, they started sending quite a bit of spam. I filtered sohu.com and it went away.

...

Not me, but I am getting an awful lot of emails from this one person, to my nanog address lately:

Return-Path: <test@sohu.com> Delivered-To: silverwraith.com-lists-nanog@silverwraith.com Received: (qmail 21586 invoked from network); 3 May 2002 03:09:28 -0000 Received: from unknown (HELO sohu.com) (203.240.184.78) by apple.silverwraith.com with SMTP; 3 May 2002 03:09:28 -0000 Reply-To: test@sohu.com Return-Path: test@sohu.com From: richard <test@sohu.com> To: <lists-nanog@silverwraith.com> Subject: test Sender: richard <test@sohu.com> Mime-Version: 1.0 Content-Type: text/html; charset="ks_c_5601-1987" Date: Fri, 3 May 2002 12:09:13 +0900

[ The following text is in the "ks_c_5601-1987" character set. ] [ Your display is set for the "ISO-8859-1" character set. ] [ Some characters may be displayed incorrectly. ]

test

On Fri, 3 May 2002, Paul Vixie wrote:

...

as a coauthor of rfc2136, my curiousity is always piqued when spammers use the technology. can i get private forwards of other similar messages? (see below.)

(and yes, i'll also be in touch with level3, who serves 166.90.15.236, from whence this message came.)

(time was, anyone who could use postfix and php would also know better than to spam, or at least, to spam *me*. <grump> <grumble>.)

re:

------- Forwarded Message

Return-Path: nobody@www.no-ip.com Delivery-Date: Fri May 3 07:44:25 2002 Return-Path: <nobody@www.no-ip.com> Delivered-To: vixie@as.vix.com Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30]) by as.vix.com (Postfix) with ESMTP id 2360D28B6B for <vixie@as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT) (envelope-from nobody@www.no-ip.com) Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236]) by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718 for <vix@vix.com>; Fri, 3 May 2002 14:44:25 GMT env-from (nobody@www.no-ip.com) Received: by www.no-ip.com (Postfix, from userid 99) id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT) To: vix@vix.com Subject: Your password for no-ip.com From: No-IP Registration <webmaster@no-ip.com> Reply-To: webmaster@no-ip.com X-Mailer: PHP/4.1.2 Message-Id: <20020503145440.4A10F833A4@www.no-ip.com> Date: Fri, 3 May 2002 07:54:40 -0700 (PDT)

Hello,

Welcome to No-IP.com. Your number one stop for dynamic dns services.

Your password is: jnMgta

To logon to no-ip.com go to http://www.no-ip.com/ and enter your email address and the password above. Once you logon you may change your password by clicking the "Change Password" link.

Remember that you can use our dynamic update client to keep our system is sync with your IP address. These clients are available at http://www.no-ip.com/downloads.php

Also, keep in mind that No-IP offers services for use with personal domain names. This service, No-IP Plus, allows you to use YOUR domain name with our dynamic dns, and other facilities. More information on this and other services is at http://www.no-ip.com/services.php.

If you have any further questions about this service, please refer to our FAQ at http://www.no-ip.com/faq.php. If the FAQ doesn't answer your question(s) contact us at support@no-ip.com.

Enjoy!

The No-IP Team webmaster@no-ip.com http://www.no-ip.com/

------- End of Forwarded Message

-- Avleen Vig Work Time: Unix Systems Administrator Play Time: Network Security Officer Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf

Best Regards,

Simon

-- ###

-- Avleen Vig Work Time: Unix Systems Administrator Play Time: Network Security Officer Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf

On Fri, 3 May 2002, Michael H. Warfield wrote:

If I haven't made my point, this is it... NO ONE. NO BODY! would be so lame or STUPID as to do something so assinine without checking with me first. Anyone who did so was NOT someone with my best interest in mind and certainly not a friend or "secret admirer". Anyone doing that would be tracked down and made to pay consequences. That very thing insures that nobody would do such a thing by accident, honestly thinking I would be interesting in something like that (besides, I don't associate with people having IQ's less than half their age).

Perhaps you completely missed the point. In this case, "secret admirer" = someone who dislikes Vixie and knows getting unwanted email sent to his address will more than likely rattle his bones. In other words, "not someone with his best interest in mind." It's not like Paul has a history of spam fighting or anything that would make him a target towards something like this.. nah..

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Michael H. Warfield Sent: May 3, 2002 10:22 PM To: Vivien M. Cc: 'Paul Vixie'; nanog@nanog.org Subject: Re: anybody else been spammed by "no-ip.com" yet?

On Fri, May 03, 2002 at 05:08:44PM -0400, Vivien M. wrote: [snip your total misunderstanding of the secret admirer thing, as "PS" already posted a well-worded explanation of what I wanted to say. No need to waste people's time repeating things in a less polite fashion]

...

Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we used to send similar emails to people signing up for an account, although nowadays instead of sending them an initial password we send a confirm URL instead.

So it appears you wised up...

How is it different whether you use an initial password or a confirm URL to confirm? The old emails said "Here's your initial password. Log in with it within 48 hours to confirm the account. If someone else requested the account, do nothing and it'll be deleted along with any trace of your email address in 48 hours."

Yeah, I help run a system with over 100 mailing lists and over 10,000 subscribers to one or more of those mailing lists. You learn. We learned YEARS ago. No open subscriptions. Confirm everything. We got tired of half the planet subscribing Rep N. Gingrich to all of our mailing lists. We may have had really REALLY good information and service, but I honestly DON'T think he as interested and those 100,000 "secret admirers" really didn't think they were doing him a favor.

We've been confirming every user we've had for the past three years or so, which is pretty much how long we've been around (for the first few months, we used a totally different system/database, but all records of that are gone now. Every one of our users right now has a confirmed email address.). I may be dumb, but I don't see how giving the user a password to confirm as opposed to a random confirmation URL is being a spammer. What one DOES with unconfirmed accounts, no matter the confirmation method, determines whether one is a spammer, and that may very well have been what angered Mr. Vixie with no-ip.com's email as it didn't specify that the account would be deleted unless Mr. Vixie actually took action to keep it.

The "secret admirer" thing is so rare it makes the lottery look like a sure bet. Hell! It makes Schroeder's cat look immortal. It's an excuse and a fraud. That's all it ever was and that's all it will ever be.

Your lack of ability to read and interpret posts is even more rare than the winning lottery combination, too, you know... Vivien -- Vivien M. vivienm@dyndns.org Assistant System Administrator Dynamic DNS Network Services http://www.dyndns.org/