Telenor - ignoring complaints, allowing their spammers to experiment with their spamware, repeatedly spam various Usenet-harvested e-mail addresses to no end! online.no, telenor.net, telenor.com, nextra.no, nextra.com, [80.212.0.0 - 80.212.255.255], [85.164.0.0 - 85.167.255.255], [130.67.0.0 - 130.67.255.255], [148.122.0.0 - 148.122.255.255], [193.213.0.0 - 193.213.255.255]: Access denied! ======= My 1st complaint ======= From: Admin Reply-To: abuse-Oct@2003.dolphinwave.org Organization: Private person To: , uce@ftc.gov, nanas-sub@cybernothing.org, abuse@online.no, abuse@telenor.net Subject: [email] Spamming attempts (Usenet harvest: the spammer learns the spamware)! Date: Fri, 17 Oct 2003 22:15:29 +0200 User-Agent: KMail/1.5 X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200310172215.14419@2003.dolphinwave.org> Status: RO X-Status: S Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-KMail-EncryptionState: N X-KMail-SignatureState: N Multiple spamming attempts from the spammer, who obviously still doesn't know how to use the spamware. The first spam had no message body, at all, and was routed through the ISP's mailserver. The second one already has the typical spamware's template in the message body, which the spammer did not replace with their spam message. The spammer spams my e-mail address, used for spam complaints in this month only, and freshly harvested from the news.admin.net-abuse.sightings Usenet group (abuse-oct@2003... - tagged!). Note the "X-Mailer: Email Collector & Sender by SBZ systems" headers - the obvious spamware sign. Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Note: to prevent further "experiments" of this abuser, the abuser's IP was just added to my access denied tables. If this abuse will not be stopped by online.no, the whole [80.212.0.0/16 and 148.122.0.0/16] IP ranges will follow in there. Spammer: ti121210a080-1798.bb.online.no [80.212.7.6] Abused mailserver (the first spamming): mail44-s.fg.online.no [148.122.161.44] ======= FIRST SPAM WAS (NO MESSAGE BODY) ======= Received: from mail44.fg.online.no (mail44-s.fg.online.no [148.122.161.44]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id h9HHYQbu010902 for ; Fri, 17 Oct 2003 19:34:52 +0200 Received: from fujitsu-siemens.smtp.online.no (ti121210a080-1798.bb.online.no [80.212.7.6]) by mail44.fg.online.no (8.9.3p2/8.9.3) with SMTP id TAA20226 for ; Fri, 17 Oct 2003 19:34:12 +0200 (MEST) Message-Id: Date: Fri, 17 Oct 2003 18:47:17 +0200 X-Priority: 3 From: "scritto" Reply-To: scritto@scritto.com X-Mailer: Email Collector & Sender by SBZ systems To: irene@valleyupp.fsnet.co.uk MIME-Version: 1.0 Subject: =?ISO-8859-1?B??= Content-Type: text/TEXT; charset=ISO-8859-1 Content-Transfer-Encoding: base64 X-AntiVirus: checked by AntiVir Milter 1.0.4; AVE 6.22.0.1; VDF 6.22.0.8 Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: ======= SECOND SPAM WAS ======= Received: from ti121210a080-1798.bb.online.no (ti121210a080-1798.bb.online.no [80.212.7.6]) by mail.dolphinwave.org (8.12.8/8.12.8) with SMTP id h9HJ9Fbu022377 for ; Fri, 17 Oct 2003 21:09:51 +0200 Message-Id: <200310171909.h9HJ9Fbu022377@mail.dolphinwave.org> From: "John Doe" To: Subject: New message Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0034_01C221EC.6C64F7B0" Date: Fri, 17 Oct 2003 21:09:41 +0200 Reply-To: "John Doe" X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-Priority: 3 (Normal) X-AntiVirus: checked by AntiVir Milter 1.0.4; AVE 6.22.0.1; VDF 6.22.0.8 Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Hello, Your messageClick here text... -- With best regards, Your name ? === And more spamming attempts, against other Usenet-harvested "e-mail" === === addresses, that really are my Usenet posts' Message-IDs (GMT+0200) === Oct 17 19:35:34 orca sendmail[11003]: h9HHZCbu011003: <200310110103.h9b13kxa0256 43@###>... User unknown Oct 17 19:35:35 orca sendmail[11003]: h9HHZCbu011003: from= , size=113, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail44-s.fg.online .no [148.122.161.44] Oct 17 19:35:35 orca sendmail[10999]: h9HHZAbu010999: <200310150948.h9f9mnbu0202 57@###>... User unknown Oct 17 19:35:35 orca sendmail[10999]: h9HHZAbu010999: from= , size=113, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail44-s.fg.online .no [148.122.161.44] === And the spammer still experiments on the Usenet harvested addresses === === My 2nd complaint === From: Admin Reply-To: abuse-Oct@2003.dolphinwave.org Organization: Private person Subject: [email] [BLOCK] Persostent Telenor spammer! [Fwd:] Date: Sat, 18 Oct 2003 13:59:54 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1719320 X-KMail-Link-Type: forward To: , uce@ftc.gov, nanas-sub@cybernothing.org, abuse@online.no, hostmaster@online.no, abuse@telenor.net, hostmaster@telenor.net, postmaster@nextra.com, abuse@nextra.cz, abuse@nextra.com X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200310181359.54393@2003.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: This is already the THIRD spam flood from this online.no abuser, despite on my complaints sent to online.no and telenor.net yesterday, and archived on Google: http://groups.google.com/groups?selm=200310172215.14419%402003.dolphinwave.org ATTENTION: Telenor! For ignoring abuse reports and allowing your proved abusers to repeatedly spam my mailservers, your whole 80.212.0.0/16, 148.122.0.0/16 and 193.213.0.0/16 IP ranges are blocked from accessing of my mailservers ever again! Spammer: ti121210a080-1764.bb.online.no [80.212.6.228] Abused mailserver: mail45-s.fg.online.no [148.122.161.45] ---------- Forwarded Message ---------- Received: from mail45.fg.online.no (mail45-s.fg.online.no [148.122.161.45]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id h9I1t6bu008968 for ; Sat, 18 Oct 2003 03:55:17 +0200 Received: from hotmail.com (ti121210a080-1764.bb.online.no [80.212.6.228]) by mail45.fg.online.no (8.9.3p2/8.9.3) with SMTP id DAA27829; Sat, 18 Oct 2003 03:55:01 +0200 (MEST) Message-Id: <200310180155.DAA27829@mail45.fg.online.no> From: "john" To: Subject: Sender: "john" Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 8bit Date: Sat, 18 Oct 2003 03:55:01 +0200 X-AntiVirus: checked by AntiVir Milter 1.0.4; AVE 6.22.0.1; VDF 6.22.0.9 Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: 18.10.2003 03:48:11 ------------------------------------------------------- ======= OTHER SPAMMING ATTEMPTS, SPAMMING MY USENET MESSAGE-IDS ======= Oct 18 03:55:28 orca sendmail[9016]: h9I1tMbu009016: <200310150948.h9f9mnbu020257@###>... User unknown Oct 18 03:55:28 orca sendmail[9017]: h9I1tMbu009017: <200310110103.h9b13kxa025643@###>... User unknown Oct 18 03:55:28 orca sendmail[9016]: h9I1tMbu009016: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:04:00 orca sendmail[10059]: h9I23pbu010059: <200310111943.h9bjhlxa004088@###>... User unknown Oct 18 04:04:01 orca sendmail[10059]: h9I23pbu010059: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:05:29 orca sendmail[10241]: h9I25Pbu010241: <200310041928.h94js5lr031559@###>... User unknown Oct 18 04:05:29 orca sendmail[10241]: h9I25Pbu010241: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:05:29 orca sendmail[10233]: h9I25Mbu010233: <200310081404.h98e3tdu019850@###>... User unknown Oct 18 04:05:29 orca sendmail[10233]: h9I25Mbu010233: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:05:34 orca sendmail[10253]: h9I25Ubu010253: <200310051422.h95emxlr007260@###>... User unknown Oct 18 04:05:34 orca sendmail[10253]: h9I25Ubu010253: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:07:00 orca sendmail[10412]: h9I26tbu010412: <200310010601.h9161nlr010398@###>... User unknown Oct 18 04:07:00 orca sendmail[10412]: h9I26tbu010412: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:07:02 orca sendmail[10415]: h9I26tbu010415: <200310051630.h95gujlr023630@###>... User unknown Oct 18 04:07:02 orca sendmail[10415]: h9I26tbu010415: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] Oct 18 04:10:39 orca sendmail[10816]: h9I2AXbu010816: <200309282249.h8smnwdo002972@###>... User unknown Oct 18 04:10:40 orca sendmail[10816]: h9I2AXbu010816: from=, size=104, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail45-s.fg.online.no [148.122.161.45] ======= PREVIOUS SPAMS WERE ======= Received: from mail44.fg.online.no (mail44-s.fg.online.no [148.122.161.44]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id h9HHYQbu010902 for ; Fri, 17 Oct 2003 19:34:52 +0200 Received: from fujitsu-siemens.smtp.online.no (ti121210a080-1798.bb.online.no [80.212.7.6]) by mail44.fg.online.no (8.9.3p2/8.9.3) with SMTP id TAA20226 for ; Fri, 17 Oct 2003 19:34:12 +0200 (MEST) Message-Id: Date: Fri, 17 Oct 2003 18:47:17 +0200 X-Priority: 3 From: "scritto" Reply-To: scritto@scritto.com X-Mailer: Email Collector & Sender by SBZ systems To: irene@valleyupp.fsnet.co.uk MIME-Version: 1.0 Subject: =?ISO-8859-1?B??= Content-Type: text/TEXT; charset=ISO-8859-1 Content-Transfer-Encoding: base64 X-AntiVirus: checked by AntiVir Milter 1.0.4; AVE 6.22.0.1; VDF 6.22.0.8 Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Received: from ti121210a080-1798.bb.online.no (ti121210a080-1798.bb.online.no [80.212.7.6]) by mail.dolphinwave.org (8.12.8/8.12.8) with SMTP id h9HJ9Fbu022377 for ; Fri, 17 Oct 2003 21:09:51 +0200 Message-Id: <200310171909.h9HJ9Fbu022377@mail.dolphinwave.org> From: "John Doe" To: Subject: New message Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0034_01C221EC.6C64F7B0" Date: Fri, 17 Oct 2003 21:09:41 +0200 Reply-To: "John Doe" X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-Priority: 3 (Normal) X-AntiVirus: checked by AntiVir Milter 1.0.4; AVE 6.22.0.1; VDF 6.22.0.8 Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Hello, Your messageClick here text... -- With best regards, Your name ? Oct 17 19:35:34 orca sendmail[11003]: h9HHZCbu011003: <200310110103.h9b13kxa025643@###>... User unknown Oct 17 19:35:35 orca sendmail[11003]: h9HHZCbu011003: from=, size=113, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail44-s.fg.online.no [148.122.161.44] Oct 17 19:35:35 orca sendmail[10999]: h9HHZAbu010999: <200310150948.h9f9mnbu020257@###>... User unknown Oct 17 19:35:35 orca sendmail[10999]: h9HHZAbu010999: from=, size=113, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mail44-s.fg.online.no [148.122.161.44]