Subject:     Re: REMOVE ME FROM YOUR SPAM LIST - [Fwd: Free Live Sex!!!]
Date:        1/19/98 8:13 AM
To:          cheron@fda.net

I also recieved this little porno spam, but they used different sources to originate.
I would take it you need me to confirm some stuff for you?

On 1/19/98 6:31 AM, Cheri sent the following ASCII stream:

>Received: from kinsey.fia.net (root@mail.fia.net [206.171.100.7]) by 
>ns2.fda.net (8.8.5/8.7.3) with ESMTP id UAA22607 for <cheron@fda.net>; 
>Sun, 18 Jan 1998 20:47:21 -0800 (PST)
>From: alyssa_g18@hotmail.com
>Received: from ns1.library.knaw.nl (ip003.library.knaw.nl [192.87.107.3]) 
>by kinsey.fia.net (8.8.5/8.7.3) with ESMTP id UAA11270 for 
><cheron@fia.net>; Sun, 18 Jan 1998 20:46:04 -0800 (PST)
>Received: from hotmail.com (usr33-dialup33.mix2.Atlanta.mci.net 
>[166.55.59.33])
>          by ns1.library.knaw.nl (8.8.4/8.8.4) with SMTP
>	  id EAA25681; Mon, 19 Jan 1998 04:05:28 +0100
>Date: Mon, 19 Jan 1998 04:05:28 +0100
>To: alyssa_g18@hotmail.com
>Subject: Free Live Sex!!!
>Reply-to: alyssa_g18@hotmail.com
>Comments: Authenticated sender is <alyssa_g18@hotmail.com>
>Received: from hotmail.com (hotmail.com [000.000.000.000]) by hotmail.com 
>(0.0.0./0.0.0.) with SMTP id AAA000000 for <alyssa_g18@hotmail.com>; Sun, 
>18 Jan 1998 22:8:48 -0500 (EST)
>Message-Id: 0000000000.AAA000@hotmail.com

>nslookup 192.87.107.3
Server:  dns.mediacity.com
Address:  205.216.172.10

Name:    ip003.library.knaw.nl
Address:  192.87.107.3
This resolves, showing me the relaying server. The name suggests a dial-up, yet 
the IP address suggests a server at this location. There are no addressing rules 
as far as where where servers are located, the only rules really involve netmasking 
and which addresses become reserved as broadcast and wire addressing.

Unlike mine, yours shows an apparently source of origination because of the better 
server hijacked this time.
>nslookup 166.55.59.33
Server:  dns.mediacity.com
Address:  205.216.172.10

Name:    usr33-dialup33.mix2.Atlanta.mci.net
Address:  166.55.59.33

Lots of spam comes out of Atlanta for some reason.

When complaining to MCI, use these addresses. I do!
abuse@internetmci.com
postmaster@internetmci.com
spamcomplaints@mci.net

Let's probe that relaying service:
>whois 192.87.107.0
Bibliotheek der Koninklijke Nederlandse (NET-KNAW-LIB)
   Joan Muyskensweg 25
   NL - 1096 CJ  Amsterdam
   Netherlands

   Netname: KNAW-LIB
   Netnumber: 192.87.107.0

   Coordinator:
      Kock, Hans  (HK33)  surf331@KUB.NL
      +31 20 6685511

   Domain System inverse mapping provided by:

   NS1.KNAW.NL                  192.87.107.3
   NS1.SURFNET.NL               192.87.106.101

   Record last updated on 28-Apr-94.
   Database last updated on 19-Jan-98 04:01:57 EDT.

WOW! I wasn't expecting that kind of information when trying to look-up a Netblock.
Let be dig deepeer based on what it gave me:
>whois KNAW-LIB
Bibliotheek der Koninklijke Nederlandse (NET-KNAW-LIB)
   Joan Muyskensweg 25
   NL - 1096 CJ  Amsterdam
   Netherlands

   Netname: KNAW-LIB
   Netnumber: 192.87.107.0

   Coordinator:
      Kock, Hans  (HK33)  surf331@KUB.NL
      +31 20 6685511

   Domain System inverse mapping provided by:

   NS1.KNAW.NL                  192.87.107.3
   NS1.SURFNET.NL               192.87.106.101

   Record last updated on 28-Apr-94.
   Database last updated on 19-Jan-98 04:01:57 EDT.

Complain to that address as well.

That should pretty much do it.

Please see this URL on my web site for more information on this spam, especially see 
the lookups:
http://www.studio42.com/kill-the-spam/1998/reports/1998-pornospam1.html#alyssa_g18-1
Or go to my site normally, select 1998 Porno Spam 1 and head towards the bottom.

You're definately getting better at reporting spams.

What I do is I do not alter the subject, but add this to the front: EMAIL SPAM:
Hey, it works for me. I'm not suggesting you change your method, but when dealing with Netcom, 
this seems to net me better response.

I've figure out how to add spam-assistance reports to my site, but I'll get to it this weekend.. 
This one will go online there too.

How goes the search for DNS utilties? I'm currently "evaluating" CyberKit. Not great, but it 
does work. I prefer the Win95 traceroute and ping.