faber at POP.HASKINS.YALE.EDU
Mon Jun 5 17:58:39 UTC 2000
J. Katherine Rossner wrote:
>At 10:10 AM 6/5/00 -0700, Peter McGraw wrote:
>>Darn! Excuse me, everybody--I thought I was replying to the spammer.
>You're excused, for my part, but you might want to note for the future that
>replying directly to a spammer is NOT a good idea in any case: it only
>tells him/her that your email address is a valid one!
>Better is to use whatever command your mailer has for showing full headers
>(in Eudora, that means clicking on the "blah blah blah" button next to the
>.sigs one), then forward the full-header copy to the administration or
>"root" at the originating Internet connection, with a note that this is
>spam and requesting that they deal with the sender.
>Our spammer, for example, seems to have forged an AOL return address; "full
>headers" appears to indicate that he was a UGA student. It's not quite
>clear to me whether that's the real originating address or one related to
>the listserv, but I did send a copy to root at uga.edu, with apologies if I'm
Nope...All of the UGA stuff has to do with the listserve that
processes ADS-L mail. These two header lines indicate where the mail
reached UGA from:
At 11:40 AM -0500 6/5/00, Jeff Rothlisberger wrote:
>Received: from kx2.lh.net (kx2.lh.net [188.8.131.52]) by crockett.cc.uga.edu
> (8.9.3/8.9.3) with ESMTP id MAA31238 for
><ADS-L at UGA.CC.UGA.EDU>; Mon,
> 5 Jun 2000 12:42:22 -0400
>Received: from reznor ([184.108.40.206]) by kx2.lh.net (InterMail
> 201-232-116-110 license fa447d7e5453d7b15649594624cecde5) with SMTP
> id <20000605164052.PPWL336.kx2 at reznor> for <ADS-L at UGA.CC.UGA.EDU>;
Whois gives the following information, for both IP numbers in these headers:
Whois user[@<whois.server>]: 220.127.116.11
Lighthouse Communications, Inc. (NETBLK-LHNET-BLK-01)
1707 Financial Center
Des Moines, IA 50309
Netblock: 18.104.22.168 - 22.214.171.124
Manske, Bryan (BM2003-ARIN) manske at LH.NET
515-244-1115 (FAX) 515-244-0972
Domain System inverse mapping provided by:
ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
Record last updated on 16-Jun-1999.
Database last updated on 5-Jun-2000 05:44:17 EDT.
The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.
* Whois complete 6/5/00 1:53:32 PM *
This is who to complain to, if you think they'd pay any attention (I don't).
Alice Faber new, improved email: faber at pop.haskins.yale.edu
Haskins Laboratories old email, if you must: faber at haskins.yale.edu
New Haven, CT 06511 USA tel: (203) 865-6163 x258; fax (203) 865-8963
More information about the Ads-l