Mersenne Digest           Thursday, 18 March 1999      Volume 01 : Number 534


----------------------------------------------------------------------

From: "James Smith" <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 11:02:33 -0000
Subject: Mersenne: Database search

This is a multi-part message in MIME format.

- ------=_NextPart_000_000C_01BE7065.A851E620
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

I don't know about anyone else, but for me the
http://project.vobis.de/gimps/ page hasn't been working for ages.  Can I
offer to host it on my server, or is the server not the problem?

- --
James Smith
[EMAIL PROTECTED]


- ------=_NextPart_000_000C_01BE7065.A851E620
Content-Type: application/octet-stream;
        name="Jay.vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
        filename="Jay.vcf"

BEGIN:VCARD
VERSION:2.1
N:Smith;James;Edward
FN:Jay
NICKNAME:Jay
ORG:Xsite Limited
TITLE:Technical Director
TEL;WORK;VOICE:0113 2047001
TEL;WORK;FAX:0113 2047001
ADR;WORK;ENCODING=3DQUOTED-PRINTABLE:;;Odeon Suite=3D0D=3D0APavillion =
Business Centre=3D0D=3D0AStanningley Road;Pudsey;We=3D
st Yorkshire;LS28 6NB;UK
LABEL;WORK;ENCODING=3DQUOTED-PRINTABLE:Odeon Suite=3D0D=3D0APavillion =
Business Centre=3D0D=3D0AStanningley Road=3D0D=3D0APudsey=3D
, West Yorkshire LS28 6NB=3D0D=3D0AUK
ADR;HOME:;;54 Oatland Towers;Leeds;West Yorkshire;LS28 1SB;UK
LABEL;HOME;ENCODING=3DQUOTED-PRINTABLE:54 Oatland Towers=3D0D=3D0ALeeds, =
West Yorkshire LS28 1SB=3D0D=3D0AUK
X-WAB-GENDER:2
URL:http://www.xsite.ltd.uk/james
URL:http://www.xsite.ltd.uk/
EMAIL;PREF;INTERNET:[EMAIL PROTECTED]
EMAIL;INTERNET:[EMAIL PROTECTED]
EMAIL;INTERNET:[EMAIL PROTECTED]
REV:19990317T110233Z
END:VCARD

- ------=_NextPart_000_000C_01BE7065.A851E620--

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Henrik Olsen <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 12:32:28 +0100 (CET)
Subject: Re: Mersenne: LL testing

On Tue, 16 Mar 1999, Brian J Beesley wrote:

<snips> 
> Suggestion, would you consider changing your filter rules to let 
> through messages whose subject header contains the key word 
> "mersenne" irrespective of origin? I doubt many "spammers" would 
> deliberately change their message format to sneak by that rule.
> 
> Regards
> Brian Beesley

The problem is that the list software doesn't block spam sent to it, so
adds Mersenne: to the subject before spamming us all.

So far I've seen two messages sent through the list server, both of which
would have been stopped if the server was configured to reject mail
without Sender/From fields.

I would also suggest adding checks at least for the MAPS RBL list of known
unrepentant spamsites.

- -- 
Henrik Olsen,  Dawn Solutions I/S
URL=http://www.iaeste.dk/~henrik/
Get the rest there.

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Jason Stratos Papadopoulos <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 08:47:42 -0500 (EST)
Subject: Re: Mersenne: Spam

On Tue, 16 Mar 1999, Luke Welsh wrote:

> Hi All--
> 
> As most of you know, Majordomo has always been configured to
> bounce posts from people who are not subscribed to the list.
> In the past, this has caught all the spam (and I have saved it
> all, anybody want copies?)  Well, one spam did get through
> at the dawn of the Age Of Spam.

On the heels of this message came another spam. If this pisses you
off, you can complain to the postmaster at the ISP responsible.

<header-reading 101>

Look at the full header of the message, all of it. If you don't normally
see the full header, use unix mail or configure your reader to show it
to you.

The first parts is a (possibly large) list of Received: transactions, i.e.

Received: from acid.base.com (adsl-209-233-24-120.dsl.pacbell.net
        [209.233.24.120])
        by po2.glue.umd.edu (8.9.3/8.9.0.Beta6) with ESMTP id DAA20440
        for <[EMAIL PROTECTED]>; Wed, 17 Mar 1999 03:35:53 -0500 (EST)
From: [EMAIL PROTECTED]
Received: (from majordomo@localhost)
        by acid.base.com (8.8.5/8.8.5) id VAA12996
        for mersenne-outgoing; Tue, 16 Mar 1999 21:52:01 -0800
Received: from www.bull.net (www.bull.net [192.90.127.17])
        by acid.base.com (8.8.5/8.8.5) with ESMTP id VAA12992
        for <[EMAIL PROTECTED]>; Tue, 16 Mar 1999 21:52:00 -0800
Received: from pegase.bull.fr (pegase.bull.fr [192.44.49.46]) by
       www.bull.net (8.8.2/8.8.2) with ESMTP id GAA70746; Wed, 17 Mar 1999
       06:49:48 +0100
Received: from dzbull.frdz.bull.fr (dzbull.frdz.bull.fr [129.184.3.21])
        by pegase.bull.fr (8.9.2/8.9.1) with ESMTP id GAA38362;
        Wed, 17 Mar 1999 06:35:58 +0100

It's the last Received: line that's of interest, because that's the
first server the message was routed through. None of the rest usually
matters, since spammers bounce messages all over the place to try
and hide their tracks. Likewise, the Reply-To field is always bogus.
(Is it becoming clear the sort of people we're dealing with?)

After you have a name to pin these people to, use "whois" on a Unix
system to tell you more about the ISP. Here, "whois bull.net" gives
lots of contact info (bull.net appears in one of the Received:'s, and
almost no spam originates from outside the US, so I'm ignoring the
French address bull.fr).

So send your politely-worded message to postmaster@<whatever host name>
and quote the full message. For uunet (the culprit in what started this
all), send mail to [EMAIL PROTECTED]; for AOL, try [EMAIL PROTECTED]

Almost no spam gets sent with the tacit approval of the underlying ISP,
and most ISPs are anxious to kill spammers. The more people who complain,
the better. Apologies if I insulted anyone's intelligence; I'm posting
this on the off-chance someone doesn't know it already.

jasonp

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Rudy Ruiz <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 11:31:58 -0800
Subject: Mersenne: Re: Mersenne Digest V1 #533

This is a multi-part message in MIME format.
- --------------F11E753162973CC610C9F250
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
Hello Everyone!
<p>I know this is probably a World Record for "late response" but I was
reading --for the first time-- the thread on "Noll's Islands" and found
this: (I found no replies to the specific matter brought by Jeff Luck so
I guess my comments, though 2+ years late, are --nevertheless-- pertinent)&nbsp;
:)
<p>Any thoughts criticism, praise, counterexample, comments would be appreciated!
<br>Note that the attachment M(1-370_pattern is read best with notepad's
font Impact (size 8)
<p>Rodolfo
<blockquote TYPE=CITE>
<pre>Jeff Luck ([EMAIL PROTECTED])
Wed, 04 Sep 1996 17:05:47 -0600&nbsp;

&nbsp;&nbsp;&nbsp; "Re: Mersenne: Noll's island theory..."&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;

Along with Noll's island theory, has anybody noticed that 8 of the 34 known
Mersennes start with the digits 10, 11, 12, and 13?&nbsp; That's 23% -- of data
points that should only contain 4%.&nbsp; Yea, I know there are a few statistical
holes in that observation, but still....</pre>
</blockquote>

<p><br>My suggestion: (also please look at attachment M(1-37)_pattern
<br>&nbsp;
<br>&nbsp;&nbsp; There is a technique for assessing the "naturalness" of
economic data.
<br>This technique, known as Benford's Law, demonstrates that the
<br>first digits of naturally occurring phenomena do not occur with equal
<br>frequency.&nbsp; In fact, lower digits occur with greater frequency
in
<br>tabulated natural data than larger digits.&nbsp; If data do not conform
to
<br>Benford's Law, then questions arise about the process that generated
it.
<br>This test is analogous to standard tests for randomness but, as
<br>Benford's law makes clear, pure randomness may not be the
<br>appropriate criterion.
<blockquote TYPE=CITE>&nbsp;
<br>From: Conrad Curry &lt;[EMAIL PROTECTED]>
<br>Date: Wed, 17 Mar 1999 01:48:56 -0600 (EST)
<br>Subject: Re: Mersenne: Chance of a Mersenne prime
<p>>
<br>> > Since I joined the project 10 months ago, we have found no
<br>> >new Mersenne primes
<br>>[...other stuff deleted for brevity's sake...]
<p>&nbsp; Regarding Noll's island theory, now that p has grown large is
it
<br>possible the pattern (756839, 859433), (1257787, 1398269), (2976221,
<br>3021377) continues (ie groups of two separated by gaps)?&nbsp; This
would
<br>suggest the next Mersenne prime would be found after a gap perhaps
p>6M.
<br>For more see the archives <a 
href="http://www2.netdoor.com/~acurry/mersenne/">http://www2.netdoor.com/~acurry/mersenne/</a>
<br>Search for "Noll* island".
<br>&nbsp;</blockquote>
</html>

- --------------F11E753162973CC610C9F250
Content-Type: text/plain; charset=us-ascii;
 name="M(1-37)_pattern.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="M(1-37)_pattern.txt"

Patterns on mersenne exponents by R.Ruiz  February 6, 1998

NOTE:
This table is set with font Impact. It will become disalingned with other fonts
****************************************************************************************************************

By  * S t a r t i n g*  digits:                                                        
                                                                *Benford Index
1 { 107, 110503, 11213, 1257787, 127,1279, 13, 132049, 1398269, 17, 19, 19937...}      
  12/37  32%   Log2      = 30%
2 { 2, 216091, 21701, 2203, 2281, 23209, 2976221...}                                   
                     7/37  19%    Log1.5    =18%
3 { 3, 3021337, 31, 3217...}                                                           
                                          4/37  11%    Log1.33  =12%
4 { 4253, 4423, 44497...}                                                              
                                         3/37    8%    Log 1.25 =10%
5 { 5, 521...}                                                                         
                                                     2/37    5%   Log 1.2   = 8%
6 { 607 ,61...}                                                                        
                                                    2/37    5%   Log 1.17   = 7%
7 { 7, 756839...}                                                                      
                                                   2/37    5%   Log 1.14  = 6%
8 { 859433, 86243,89...}                                                               
                                          3/37    8%   Log 1.125= 5%
9 { 9689, 9941...}                                                                     
                                                 2/37    5%   Log 1.1 1 = 5%
 
(*) Benford Index is defined as Log(10)  B  
     Where B is  the ratio {greatest numer in gap/smallest number in gap}


#########################################

By form 4n-1 or 4n+1 (all Mersenne exponents except 2 belong to either one or the 
other)

                        >>>>4n-1<<<<  42%
 
[ 3,7,19,31,107,127,607,1279,2203,4423,86243,11503,216091,756839,127787 ] 15 of 36 =42%

                        >>>>4n+1<<<< 58%

 [ 
5,13,17,61,89,521,2281,3217,4253,9689,9941,11213,19937,27701,23209,44497,132049,859433,1398269,
 2976221,3021377 ] 21 of 36 =58%
 
This alternate forms creates 2 endings for perfect numbers:
 Those who have as ending digits 28     (created by form 4n-1) and 
  those who have as ending digits    6 (  created by form 4n+1)
 
As According to Sophie Germain's if a number of the form p=4n-1 has a SG prime (i.e 
2P+1 is prime)
then M(p) <> 0 (mod 2p+1) this could (perhaps?)explain the slight abundance of 
Mersenne prime with p=4n+1
over those with p=4n-1
- --------------F11E753162973CC610C9F250--

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Henrik Olsen <[EMAIL PROTECTED]>
Date: Thu, 18 Mar 1999 00:22:15 +0100 (CET)
Subject: Re: Mersenne: Spam

On Wed, 17 Mar 1999, Jason Stratos Papadopoulos wrote:
> > As most of you know, Majordomo has always been configured to
> > bounce posts from people who are not subscribed to the list.
> > In the past, this has caught all the spam (and I have saved it
> > all, anybody want copies?)  Well, one spam did get through
> > at the dawn of the Age Of Spam.
> 
> On the heels of this message came another spam. If this pisses you
> off, you can complain to the postmaster at the ISP responsible.
> 
> <header-reading 101>
> 
> Look at the full header of the message, all of it. If you don't normally
> see the full header, use unix mail or configure your reader to show it
> to you.
> 
> The first parts is a (possibly large) list of Received: transactions, i.e.
> 
> Received: from acid.base.com (adsl-209-233-24-120.dsl.pacbell.net
>         [209.233.24.120])
>         by po2.glue.umd.edu (8.9.3/8.9.0.Beta6) with ESMTP id DAA20440
>         for <[EMAIL PROTECTED]>; Wed, 17 Mar 1999 03:35:53 -0500 (EST)
> From: [EMAIL PROTECTED]
> Received: (from majordomo@localhost)
>         by acid.base.com (8.8.5/8.8.5) id VAA12996
>         for mersenne-outgoing; Tue, 16 Mar 1999 21:52:01 -0800
> Received: from www.bull.net (www.bull.net [192.90.127.17])
>         by acid.base.com (8.8.5/8.8.5) with ESMTP id VAA12992
>         for <[EMAIL PROTECTED]>; Tue, 16 Mar 1999 21:52:00 -0800
> Received: from pegase.bull.fr (pegase.bull.fr [192.44.49.46]) by
>        www.bull.net (8.8.2/8.8.2) with ESMTP id GAA70746; Wed, 17 Mar 1999
>        06:49:48 +0100
> Received: from dzbull.frdz.bull.fr (dzbull.frdz.bull.fr [129.184.3.21])
>         by pegase.bull.fr (8.9.2/8.9.1) with ESMTP id GAA38362;
>         Wed, 17 Mar 1999 06:35:58 +0100
> 
> It's the last Received: line that's of interest, because that's the
> first server the message was routed through. None of the rest usually
> matters, since spammers bounce messages all over the place to try
> and hide their tracks. Likewise, the Reply-To field is always bogus.
> (Is it becoming clear the sort of people we're dealing with?)
Slight correction, it originated with adsl-209-233-24-120.dsl.pacbell.net,
a dialup connection, with the rest of the headers faked, so it's actually
(in this case) the first of the received lines that are the correct one.

Remember that it's only for mailers that follow the rules it's the last
Received line that's the originator, spammers don't follow the rules.

- -- 
Henrik Olsen,  Dawn Solutions I/S
URL=http://www.iaeste.dk/~henrik/
Get the rest there.

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Gordon Irlam <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 16:10:20 -0800
Subject: Re: Mersenne: Spam

> So far I've seen two messages sent through the list server, both of which 
> would have been stopped if the server was configured to reject mail
> without Sender/From fields.

Correct.  We have a spam filter in place.  It successfully blocks
several spam messages sent to the list each day.  Unfortunately this
filter is not managing to block spams that don't include a From
address.  Messages without a From address are getting a From address
added that make it look like they came from the list, and are then being
allowed through by the filter.

I need to look into this and try and fix it.

> Slight correction, it originated with adsl-209-233-24-120.dsl.pacbell.net,
> a dialup connection, with the rest of the headers faked, so it's actually
> (in this case) the first of the received lines that are the correct one.

No.  adsl-209-233-24-120.dsl.pacbell.net is simply another name for
mailhost.base.com, the machine hosting the mailing list.  It is also not
a dialup, but instead a permanent ADSL line.

Checking my sendmail logs I can confirm the spam orginally came from
192.90.127.17.  www.bull.net.  Since Bull is a respected company, either
someone broke into their system, or bull doesn't have mail relaying
disabled, and someone is simply relaying via there.

Sendmail log:

    Mar 16 21:52:01 acid sendmail[12992]: VAA12992: from=<>, size=2847,
class=0, pri
=32847, nrcpts=1, msgid=<[EMAIL PROTECTED]>,
proto=ESMTP, rel
ay=www.bull.net [192.90.127.17]

                                      regards,
                                               gordoni (list admin)
________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: [EMAIL PROTECTED]
Date: Wed, 17 Mar 1999 19:15:36 EST
Subject: Mersenne: Moo

Thanks for everyone's replies to my posts. I'll try to hunt down those
resources.

<<The fact that you, a $1000 computer and a suitably optimized 
program could now do the test in a millisecond or two is irrelevant.>>
Auuugh! Now I'm just going to have to see how fast I can run an LL test on
M(127) by hand. Square roots by hand are fun, but LL tests... heh heh.

<<Hmm. I prefer to send replies of specific interest to the enquirer 
only. I guess there are some other people on the list who might be 
interested enough to justify this broadcast?>>
I thought so.

<<Suggestion, would you consider changing your filter rules to let 
through messages whose subject header contains the key word 
"mersenne" irrespective of origin? I doubt many "spammers" would 
deliberately change their message format to sneak by that rule.>>
I'd love to, but AOL won't let me do that, and I'm too lazy to switch. In a
month I'll try dropping my filters. On Christmas Eve I was spoofed and was
subscribed to a trillion mailing lists. Nasty.

S.T.L.
________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: Henrik Olsen <[EMAIL PROTECTED]>
Date: Thu, 18 Mar 1999 00:22:15 +0100 (CET)
Subject: Re: Mersenne: Spam

On Wed, 17 Mar 1999, Jason Stratos Papadopoulos wrote:
> > As most of you know, Majordomo has always been configured to
> > bounce posts from people who are not subscribed to the list.
> > In the past, this has caught all the spam (and I have saved it
> > all, anybody want copies?)  Well, one spam did get through
> > at the dawn of the Age Of Spam.
> 
> On the heels of this message came another spam. If this pisses you
> off, you can complain to the postmaster at the ISP responsible.
> 
> <header-reading 101>
> 
> Look at the full header of the message, all of it. If you don't normally
> see the full header, use unix mail or configure your reader to show it
> to you.
> 
> The first parts is a (possibly large) list of Received: transactions, i.e.
> 
> Received: from acid.base.com (adsl-209-233-24-120.dsl.pacbell.net
>         [209.233.24.120])
>         by po2.glue.umd.edu (8.9.3/8.9.0.Beta6) with ESMTP id DAA20440
>         for <[EMAIL PROTECTED]>; Wed, 17 Mar 1999 03:35:53 -0500 (EST)
> From: [EMAIL PROTECTED]
> Received: (from majordomo@localhost)
>         by acid.base.com (8.8.5/8.8.5) id VAA12996
>         for mersenne-outgoing; Tue, 16 Mar 1999 21:52:01 -0800
> Received: from www.bull.net (www.bull.net [192.90.127.17])
>         by acid.base.com (8.8.5/8.8.5) with ESMTP id VAA12992
>         for <[EMAIL PROTECTED]>; Tue, 16 Mar 1999 21:52:00 -0800
> Received: from pegase.bull.fr (pegase.bull.fr [192.44.49.46]) by
>        www.bull.net (8.8.2/8.8.2) with ESMTP id GAA70746; Wed, 17 Mar 1999
>        06:49:48 +0100
> Received: from dzbull.frdz.bull.fr (dzbull.frdz.bull.fr [129.184.3.21])
>         by pegase.bull.fr (8.9.2/8.9.1) with ESMTP id GAA38362;
>         Wed, 17 Mar 1999 06:35:58 +0100
> 
> It's the last Received: line that's of interest, because that's the
> first server the message was routed through. None of the rest usually
> matters, since spammers bounce messages all over the place to try
> and hide their tracks. Likewise, the Reply-To field is always bogus.
> (Is it becoming clear the sort of people we're dealing with?)
Slight correction, it originated with adsl-209-233-24-120.dsl.pacbell.net,
a dialup connection, with the rest of the headers faked, so it's actually
(in this case) the first of the received lines that are the correct one.

Remember that it's only for mailers that follow the rules it's the last
Received line that's the originator, spammers don't follow the rules.

- -- 
Henrik Olsen,  Dawn Solutions I/S
URL=http://www.iaeste.dk/~henrik/
Get the rest there.

________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

From: "John R Pierce" <[EMAIL PROTECTED]>
Date: Wed, 17 Mar 1999 23:12:29 -0800
Subject: Re: Mersenne: Spam (detailed, long, and probably off topic)

> Checking my sendmail logs I can confirm the spam orginally came from
> 192.90.127.17.  www.bull.net.  Since Bull is a respected company, either
> someone broke into their system, or bull doesn't have mail relaying
> disabled, and someone is simply relaying via there.

No, not quite.

Time for Spam Fighter 201...

here are the FULL headers...

Received: from acid.base.com (adsl-209-233-24-120.dsl.pacbell.net
[209.233.24.120])
 by scruz.net (8.8.5/1.34) with ESMTP id AAA15619
 for <[EMAIL PROTECTED]>; Wed, 17 Mar 1999 00:34:55 -0800 (PST)
 (envelope-from [EMAIL PROTECTED])
From: [EMAIL PROTECTED]
Received: (from majordomo@localhost)
 by acid.base.com (8.8.5/8.8.5) id VAA12996
 for mersenne-outgoing; Tue, 16 Mar 1999 21:52:01 -0800
Received: from www.bull.net (www.bull.net [192.90.127.17])
 by acid.base.com (8.8.5/8.8.5) with ESMTP id VAA12992
 for <[EMAIL PROTECTED]>; Tue, 16 Mar 1999 21:52:00 -0800
Received: from pegase.bull.fr (pegase.bull.fr [192.44.49.46]) by www.bull.net
(8.8.2/8.8.2) with ESMTP id GAA70746; Wed, 17 Mar 1999 06:49:48 +0100
Received: from dzbull.frdz.bull.fr (dzbull.frdz.bull.fr [129.184.3.21])
 by pegase.bull.fr (8.9.2/8.9.1) with ESMTP id GAA38362;
 Wed, 17 Mar 1999 06:35:58 +0100
Date: Wed, 17 Mar 1999 06:35:58 +0100
Message-Id: <[EMAIL PROTECTED]>
Received: from primus ([208.251.61.175]) by dzbull.frdz.bull.fr
          (Post.Office MTA v3.5.2 release 221 ID# 511-52867U100L2S100V35)
          with SMTP id fr; Wed, 17 Mar 1999 06:43:28 +0100
To: [EMAIL PROTECTED]
Subject: Mersenne: --= Free Software Club =--
Sender: [EMAIL PROTECTED]
Precedence: bulk
X-UIDL: f6f1c18dd2bd83da11bd17890e05a416

Ok.  The first two "Received" headers are merely the list serve rdoing its
thing.  The next one is where the list server got the message from
www.bull.net.  The next two appear to be internal firewall type relays at
bull.fr   The message-id is consistent with this

But, note the LAST Recieved line?  "from primus ([208.251.61.175]) by ..." ?

Ok, the 'primus' part is what the spammer's bulk mail program replied with on
the 'HELO' command.  But, the part in the [ ]'s was logged by the recieving
server.  And guess who 208.251.61.175 is?

 $ nslookup -q=PTR 208.251.61.175
 ...   1Cust175.tnt2.ithaca.ny.da.uu.net

the spammers friend, DA.UU.NET.

The account undoubtably was terminated about 2 hours after the spam was sent,
but since those dialup nodes are used by literally dozens of different ISPs on
a sort of 'lease' basis, and many of these ISP's have free 30 day trial
accounts, the spammer merely needs to sign up again, and pump out as many
relays off of innocent european and asian servers as he can.  At least the
dzbull.frdz.bull.fr actually logged the source IP address.

Another relatively new stunt of these spammers....  Note the advertised
website?
    http://3634122867 ?
funny address, eh?  Traditional lookup tools tend to choke on those.  Well,
convert that decimal integer 3634122867 into hex, and its D89C5073.  Now break
that into bytes-er-octets... D8.9C.50.73  Now convert those back to decimal
(ugh, what tangled webs these spammers weave), and its 216.156.80.115.  A
 $ whois -h whois.arin.net 216.156.80.115
will show its owned by '9netave.com' who is a legitmate ISP and web hosting
company.  A bit more poking will discover that this web account has already
been disabled, rendering the spam useless.  But, grrrr, the spammers latest
'trick' seems to be to use 1-800 numbers instead of email addresses or
websites, and we have nowhere to complain to ("The Phone Company" ?  Hah!)...

Anyways, when I got the spam, I promptly sent my standard complaint form to
... [EMAIL PROTECTED], [EMAIL PROTECTED], and [EMAIL PROTECTED] with a CC: to
[EMAIL PROTECTED] (the Federal Trade Commission claims to use that address to track
unsolicited email activities).

Thanks for your patience.  We now return you to your regularly scheduled
programming.

- -jrp


________________________________________________________________
Unsubscribe & list info -- http://www.scruz.net/~luke/signup.htm

------------------------------

End of Mersenne Digest V1 #534
******************************

Reply via email to