Re: Please relax for just a moment,

Brian Lloyd <brian@lloyd.com> Tue, 10 October 1995 19:41 UTC

Received: from ietf.nri.reston.va.us by IETF.CNRI.Reston.VA.US id aa18825; 10 Oct 95 15:41 EDT
Received: from CNRI.Reston.VA.US by IETF.CNRI.Reston.VA.US id aa18821; 10 Oct 95 15:41 EDT
Received: from pucc.Princeton.EDU by CNRI.Reston.VA.US id aa17320; 10 Oct 95 15:41 EDT
Received: from PUCC.PRINCETON.EDU by pucc.PRINCETON.EDU (IBM VM SMTP V2R2) with BSMTP id 6213; Tue, 10 Oct 95 15:40:37 EDT
Received: from UNMVMA.UNM.EDU (NJE origin MAILER@UNMVMA) by PUCC.PRINCETON.EDU (LMail V1.2a/1.8a) with BSMTP id 3055; Tue, 10 Oct 1995 15:40:35 -0400
Received: from UNMVMA.UNM.EDU (NJE origin LISTSERV@UNMVMA) by UNMVMA.UNM.EDU (LMail V1.2a/1.8a) with BSMTP id 4834; Tue, 10 Oct 1995 13:40:02 -0600
Received: from UNMVMA.UNM.EDU by UNMVMA.UNM.EDU (LISTSERV release 1.8b) with NJE id 0371 for ISN-WG@UNMVMA.UNM.EDU; Tue, 10 Oct 1995 13:40:00 -0600
Received: from UNMVMA (NJE origin SMTP@UNMVMA) by UNMVMA.UNM.EDU (LMail V1.2a/1.8a) with BSMTP id 4828; Tue, 10 Oct 1995 13:38:24 -0600
Received: from hugo.lloyd.com by unmvma.unm.edu (IBM VM SMTP V2R2) with TCP; Tue, 10 Oct 95 13:38:24 MDT
Received: from [158.222.3.3] by hugo.lloyd.com with smtp (Smail3.1.29.1 #5) id m0t2kVQ-001uddC; Tue, 10 Oct 95 12:38 PDT
X-Sender: brian@hugo.lloyd.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Message-ID: <v01530501aca0790823b7@[158.222.3.3]>
Date: Tue, 10 Oct 1995 12:38:28 -0700
Reply-To: "IETF WG on internet school networking (ISN)" <ISN-WG@unmvma.unm.edu>
X-Orig-Sender: "IETF WG on internet school networking (ISN)" <ISN-WG@unmvma.unm.edu>
Sender: ietf-archive-request@IETF.CNRI.Reston.VA.US
From: Brian Lloyd <brian@lloyd.com>
Subject: Re: Please relax for just a moment,
To: Multiple recipients of list ISN-WG <ISN-WG@unmvma.unm.edu>

If you look at the headers on the original message you will see that the
offending message was generated from what appears to be a port on a
terminal server.  The message was delivered to a machine named
bud.indirect.com and then forwarded to bob.indirect.com.  The destination
address to which an interested party is supposed to reply is
travel@indirect.com.  The common thread here is "indirect.com".

Sooo ...

I sent off the following message to postmaster@bud.indirect.com,
postmaster@bob.indirect.com and travel@indirect.com:

>We are preparing to actively carpet bomb your systems with email for posting
>SPAM email.  The headers show that the actual email was delivered from what
>appears to be a port on a terminal server.  If you have been hacked and the
>SPAM mail was not authorized, please let us know so we can abort the carpet
>bomb.  You have about 4 hours to respond.

It has been about three hours and I have not received a response.  Perhaps
some of you would like to set up carpet bomb scripts on your servers too.

For those of you with really diabolical minds you might want to write your
script so that the mail looks like a legitimate query for information.
Give them valid telephone numbers for fictitious individuals.  The
cruise/travel company then wastes their money contacting thousands of
nonexistant people and may then think twice before subscribing to a SPAM
mail service again.


Brian Lloyd, President                         Lloyd Internetworking
brian@lloyd.com                                3461 Robin Lane, Suite 1
http://www.lloyd.com                           Cameron Park, CA  95682
(916) 676-1147 - voice                         (916) 676-3442 - fax