anybody else been spammed by "no-ip.com" yet?

as a coauthor of rfc2136, my curiousity is always
piqued when spammers use the technology. can i get
private forwards of other similar messages? (see
below.)

(and yes, i'll also be in touch with level3, who
serves 166.90.15.236, from whence this message came.)

(time was, anyone who could use postfix and php would
also know better than to spam, or at least, to spam *me*.
<grump> <grumble>.)

re:

------- Forwarded Message

Return-Path: nobody@www.no-ip.com
Delivery-Date: Fri May 3 07:44:25 2002
Return-Path: <nobody@www.no-ip.com>
Delivered-To: vixie@as.vix.com
Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30])
  by as.vix.com (Postfix) with ESMTP id 2360D28B6B
  for <vixie@as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT)
  (envelope-from nobody@www.no-ip.com)
Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236])
  by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718
  for <vix@vix.com>; Fri, 3 May 2002 14:44:25 GMT
  env-from (nobody@www.no-ip.com)
Received: by www.no-ip.com (Postfix, from userid 99)
  id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT)

If you feel like you don't have enough spam, I'd be happy to let you have
some of mine. :slight_smile:

Not me, but I am getting an awful lot of emails from this one person, to
my nanog address lately:

Return-Path: <test@sohu.com>
Delivered-To: silverwraith.com-lists-nanog@silverwraith.com
Received: (qmail 21586 invoked from network); 3 May 2002 03:09:28 -0000
Received: from unknown (HELO sohu.com) (203.240.184.78)
  by apple.silverwraith.com with SMTP; 3 May 2002 03:09:28 -0000

no spam. But I just took apart an IRC controlled botnet
that used their service.
(The trojan was a basic 'floodnet' binary and was distributed
via email... )

[snip]

I hate to sound like the big idiot here, but what exactly in the email
you received indicates no-ip.com spammed? It looks to me like you just
have some secret "admirer" who thought you wanted a no-ip.com account,
and no-ip.com emailed you to confirm that you do want the account.

Vivien

Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we
used to send similar emails to people signing up for an account,
although nowadays instead of sending them an initial password we send a
confirm URL instead.

I got some of these a few weeks ago. I believe these test messages are sent to find the non-deliverables in their mailing list. Right after I got these test messages, they started sending quite a bit of spam. I filtered sohu.com and it went away.

Not me, but I am getting an awful lot of emails from this one person, to
my nanog address lately:

Return-Path: <test@sohu.com>
Delivered-To: silverwraith.com-lists-nanog@silverwraith.com
Received: (qmail 21586 invoked from network); 3 May 2002 03:09:28 -0000
Received: from unknown (HELO sohu.com) (203.240.184.78)
  by apple.silverwraith.com with SMTP; 3 May 2002 03:09:28 -0000
Reply-To: test@sohu.com
Return-Path: test@sohu.com
From: richard <test@sohu.com>
To: <lists-nanog@silverwraith.com>
Subject: test
Sender: richard <test@sohu.com>
Mime-Version: 1.0
Content-Type: text/html; charset="ks_c_5601-1987"
Date: Fri, 3 May 2002 12:09:13 +0900

    [ The following text is in the "ks_c_5601-1987" character set. ]
    [ Your display is set for the "ISO-8859-1" character set. ]
    [ Some characters may be displayed incorrectly. ]

test

>
> as a coauthor of rfc2136, my curiousity is always
> piqued when spammers use the technology. can i get
> private forwards of other similar messages? (see
> below.)
>
> (and yes, i'll also be in touch with level3, who
> serves 166.90.15.236, from whence this message came.)
>
> (time was, anyone who could use postfix and php would
> also know better than to spam, or at least, to spam *me*.
> <grump> <grumble>.)
>
> re:
>
> ------- Forwarded Message
>
> Return-Path: nobody@www.no-ip.com
> Delivery-Date: Fri May 3 07:44:25 2002
> Return-Path: <nobody@www.no-ip.com>
> Delivered-To: vixie@as.vix.com
> Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30])
> by as.vix.com (Postfix) with ESMTP id 2360D28B6B
> for <vixie@as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT)
> (envelope-from nobody@www.no-ip.com)
> Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236])
> by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718
> for <vix@vix.com>; Fri, 3 May 2002 14:44:25 GMT
> env-from (nobody@www.no-ip.com)
> Received: by www.no-ip.com (Postfix, from userid 99)
> id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT)
> To: vix@vix.com
> Subject: Your password for no-ip.com
> From: No-IP Registration <webmaster@no-ip.com>
> Reply-To: webmaster@no-ip.com
> X-Mailer: PHP/4.1.2
> Message-Id: <20020503145440.4A10F833A4@www.no-ip.com>
> Date: Fri, 3 May 2002 07:54:40 -0700 (PDT)
>
> Hello,
>
> Welcome to No-IP.com.
> Your number one stop for dynamic dns services.
>
> Your password is: jnMgta
>
> To logon to no-ip.com go to http://www.no-ip.com/ and enter your email
> address and the password above. Once you logon you may change your
> password by clicking the "Change Password" link.
>
> Remember that you can use our dynamic update client to keep our system
> is sync with your IP address. These clients are available at
> http://www.no-ip.com/downloads.php
>
> Also, keep in mind that No-IP offers services for use with personal
> domain names. This service, No-IP Plus, allows you to use YOUR domain
> name with our dynamic dns, and other facilities. More information on
> this and other services is at http://www.no-ip.com/services.php.
>
> If you have any further questions about this service, please refer to
> our FAQ at http://www.no-ip.com/faq.php. If the FAQ doesn't answer your
> question(s) contact us at support@no-ip.com.
>
> Enjoy!
>
> The No-IP Team
> webmaster@no-ip.com
> http://www.no-ip.com/
>
> ------- End of Forwarded Message
>

--
Avleen Vig
Work Time: Unix Systems Administrator
Play Time: Network Security Officer
Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf

Best Regards,

Simon

I'm seeing 5-10 of these every day to one of my addresses, even after I blocked their test address at the smtp port with a 550 permanent failure response. Out of sight, out of mind. :-|>

[snip]

I hate to sound like the big idiot here, but what exactly in the email
you received indicates no-ip.com spammed? It looks to me like you just
have some secret "admirer" who thought you wanted a no-ip.com account,
and no-ip.com emailed you to confirm that you do want the account.

  Holy shit! Duck! Did you see that! Those pigs had wings!
Man! Were they ever crusing!

  The entire idea (assuming that you weren't being totally
factious - given the absurdity of the idea, I have to allow for even
that possibility) is so rediculous as to set new records. Have you ever
met "some secret admirer who thought..."? Yes, I have. They are ALL
practical jokers who like to fill in your name and address in the
"Cleveland Institute of Electronics" information requests in the back
of matchbook covers. In order words, moronic practical jokers who
are more interesting in having fun by screwing you over than by whether
you are interested in some stupid service. I'm not totally sure which
is worse. The idea that lamers would use that stupid excuse that some
"secret admirer" just thought you were dying for their wares or the
even more stupid idea that they (said lamers) would be so overtly stupid
as to believe any such individual was doing anying more beneficent than
forking you over for shits and giggles. Both (lamers and "secret
admirers") deserve appropriate comphensation. Battonado would be good
for warm ups. Keel hauling (slow) would be definitely on the agenda.
A nice, VERY slow, garrote would finish the job.

  If I haven't made my point, this is it... NO ONE. NO BODY!
would be so lame or STUPID as to do something so assinine without
checking with me first. Anyone who did so was NOT someone with my
best interest in mind and certainly not a friend or "secret admirer".
Anyone doing that would be tracked down and made to pay consequences.
That very thing insures that nobody would do such a thing by accident,
honestly thinking I would be interesting in something like that (besides,
I don't associate with people having IQ's less than half their age).

  To raise that straw man is a fraud. It doesn't happen. To use
that excuse is to buy into the fraud. If someone SERIOUSLY thought I
was interested in something like that, they would tell me and THEY would
personally send me a message and a URL. No anonymous bullshit. No
adding my name to bullshit spammer lists. NOBODY does that. NOBODY with
half the intelligence that God gave a rock!

  And... Yes, I HAVE had assholes pull the "Cleveland Institute
of Electronics" trick on me. That's what infuriates me about this bullshit
and why I know it's all a lie. They paid the price dearly FOR YEARS AFTER!

Vivien

Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we
used to send similar emails to people signing up for an account,
although nowadays instead of sending them an initial password we send a
confirm URL instead.

  So it appears you wised up...

  Yeah, I help run a system with over 100 mailing lists and over
10,000 subscribers to one or more of those mailing lists. You learn.
We learned YEARS ago. No open subscriptions. Confirm everything. We
got tired of half the planet subscribing Rep N. Gingrich to all of our
mailing lists. We may have had really REALLY good information and service,
but I honestly DON'T think he as interested and those 100,000 "secret
admirers" really didn't think they were doing him a favor.

  The "secret admirer" thing is so rare it makes the lottery look
like a sure bet. Hell! It makes Schroeder's cat look immortal. It's
an excuse and a fraud. That's all it ever was and that's all it will
ever be.

--
Vivien M.
vivienm@dyndns.org
Assistant System Administrator
Dynamic DNS Network Services
http://www.dyndns.org/

  Mike

Perhaps you completely missed the point.

In this case, "secret admirer" = someone who dislikes Vixie and knows
getting unwanted email sent to his address will more than likely rattle
his bones. In other words, "not someone with his best interest in mind."

It's not like Paul has a history of spam fighting or anything that would
make him a target towards something like this.. nah..

From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On
Behalf Of Michael H. Warfield
Sent: May 3, 2002 10:22 PM
To: Vivien M.
Cc: 'Paul Vixie'; nanog@nanog.org
Subject: Re: anybody else been spammed by "no-ip.com" yet?

[snip your total misunderstanding of the secret admirer thing, as "PS"
already posted a well-worded explanation of what I wanted to say. No
need to waste people's time repeating things in a less polite fashion]

> Random disclaimer: Yes, we're a competitor of
no-ip.com's... And yes,
> we used to send similar emails to people signing up for an account,
> although nowadays instead of sending them an initial
password we send
> a confirm URL instead.

  So it appears you wised up...

How is it different whether you use an initial password or a confirm URL
to confirm? The old emails said "Here's your initial password. Log in
with it within 48 hours to confirm the account. If someone else
requested the account, do nothing and it'll be deleted along with any
trace of your email address in 48 hours."

  Yeah, I help run a system with over 100 mailing lists
and over 10,000 subscribers to one or more of those mailing
lists. You learn. We learned YEARS ago. No open
subscriptions. Confirm everything. We got tired of half the
planet subscribing Rep N. Gingrich to all of our mailing
lists. We may have had really REALLY good information and
service, but I honestly DON'T think he as interested and
those 100,000 "secret admirers" really didn't think they were
doing him a favor.

We've been confirming every user we've had for the past three years or
so, which is pretty much how long we've been around (for the first few
months, we used a totally different system/database, but all records of
that are gone now. Every one of our users right now has a confirmed
email address.). I may be dumb, but I don't see how giving the user a
password to confirm as opposed to a random confirmation URL is being a
spammer. What one DOES with unconfirmed accounts, no matter the
confirmation method, determines whether one is a spammer, and that may
very well have been what angered Mr. Vixie with no-ip.com's email as it
didn't specify that the account would be deleted unless Mr. Vixie
actually took action to keep it.

  The "secret admirer" thing is so rare it makes the
lottery look like a sure bet. Hell! It makes Schroeder's
cat look immortal. It's an excuse and a fraud. That's all
it ever was and that's all it will ever be.

Your lack of ability to read and interpret posts is even more rare than
the winning lottery combination, too, you know...

Vivien

> If I haven't made my point, this is it... NO ONE. NO BODY!
> would be so lame or STUPID as to do something so assinine without
> checking with me first. Anyone who did so was NOT someone with my
> best interest in mind and certainly not a friend or "secret admirer".
> Anyone doing that would be tracked down and made to pay consequences.
> That very thing insures that nobody would do such a thing by accident,
> honestly thinking I would be interesting in something like that (besides,
> I don't associate with people having IQ's less than half their age).

Perhaps you completely missed the point.

  Damn! Guilty as charged.

In this case, "secret admirer" = someone who dislikes Vixie and knows
getting unwanted email sent to his address will more than likely rattle
his bones. In other words, "not someone with his best interest in mind."

  Ah yes! I fell prey to my own traps and foibles! Mea culpa.

  A few <Sarcasm> tags might have helped, but, I will admit, this
this a button push for me and I didn't think about it being sarcastic.
No! Actually, it would have lost it's effect if you had pointedly made
to <Sarcasm>. As such... Well done! I am hoisted on my own petard.

It's not like Paul has a history of spam fighting or anything that would
make him a target towards something like this.. nah..

  And I fall into the same category as Paul in that case.

  Mike

Well I just started getting a *LOT* of these (read 30+ an hour) to my
nannog list address. Am I going to have to start filtering all emails
from net.tw ?:

Return-Path: <ucD4xv@hotmail.com>
Delivered-To: silverwraith.com-lists-nanog@silverwraith.com
Received: (qmail 38418 invoked from network); 3 May 2002 21:15:41 -0000
Received: from 61-220-202-229.hinet-ip.hinet.net (HELO Hacker)
(61.220.202.229)
  by apple.silverwraith.com with SMTP; 3 May 2002 21:15:41 -0000
Received: from kimo
        by saturn.seed.net.tw with SMTP id iHhWXQgWgHOu7kU5MupXr0;
        Sat, 04 May 2002 05:16:24 +0800
Message-ID: <dOO5A0cBPTks@mail.ht.net.tw>