FYI One of my lists got hit this morning. ---------------------------------------------------------------- Elliott Parker Bitnet: 3ZLUFUR@CMUVM List Owner, PCORPS-L and CARR-L Internet: [log in to unmask] Department of Journalism Less certain possibilities: Central Michigan University [log in to unmask] Mt. Pleasant, MI 48859 USA CompuServe: 70701,520 Office tele: +1 517 774 3196 The WELL: [log in to unmask] ======================================================================= 258 Return-Path: <[log in to unmask]> Received: from CMUVM (NJE origin SMTP@CMUVM) by CMUVM.CSV.CMICH.EDU (LMail V1.2a/1.8a) with BSMTP id 2552; Thu, 1 Jun 1995 14:26:56 -0400 Received: from pobox.com by CMUVM.CSV.CMICH.EDU (IBM VM SMTP V2R2) with TCP; Thu, 01 Jun 95 14:26:51 EDT Received: (from nobody@localhost) by pobox.com (8.6.11/8.6.9) id NAA23415; Thu, 1 Jun 1995 13:41:14 -0400 Date: Thu, 1 Jun 1995 13:41:14 -0400 Message-Id: <[log in to unmask]> To: [log in to unmask] From: [log in to unmask] (Pobox-O-Matic) Subject: spam ************************************************************ * a FAQ regarding the * * LONELY LILY SPAM * * May 31st, 1995 * * from the pobox.com system administrator * ************************************************************ This document was prepared as a form response to the many letters received as a result of the "Lonely Lily" spam. It represents the best of my knowledge about the whole situation, though there may be inaccuracies and exceptions, for which I apologize in advance and accept complete culpability. This document can be accessed: * by sending email to [log in to unmask] * on the WWW at http://pobox.com/pobox/spam.txt * by fingering [log in to unmask] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | "I love the smell of spam in the morning ..." | | --- Colonel Kilgore, Apocalypse Now, paraphrased. | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ************************************************************ *** Do you know about the "Lonely Lily" spam? ************************************************************ Yes, we know about it. It was posted all over Usenet around 17:53 Hong Kong Time (0953 GMT, I think) on May 31st, 1995. A copy can be found at the end of this message. (A spam is a message posted multiple times to irrelevant newsgroups.) We at pobox.com don't condone such abuses of the Internet. The latest news indicates that it is also being sent to mailing lists. This is a tad worse, now, because the header information that pins the blame on hk.super.net and asiaonline.net is now gone, so it looks like pobox.com is the sole originator. ************************************************************ *** Please take disciplinary action against Sylvia Wong. ************************************************************ We can't. [log in to unmask] (Sylvia Wong) is not a user here and never has been. The header was forged; while the message appears to come from pobox.com, it really doesn't. ************************************************************ *** Where did it really come from? ************************************************************ A close reading of the headers will reveal that the spam was posted from an ordinary SLIP account on hk.super.net, which is an Internet Access Provider in Hong Kong. The "From:" and "Reply-To:" headers were forged by the spammer. The identity of the spammer is not known to me. hk.super.net has been contacted. As of 12:39am EDT, I'm still waiting for them to get back to me. Hong Kong is approximately 12 hours ahead of the American East Coast. Path: news.primenet.com!news.sprintlink.net!cs.utexas.edu!swrinde!gatech!psinntp!psinn tp!psinntp!psinntp!nntp.hk.super.net!tst.hk.super.net!usenet Organization: Hong Kong SuperNET Message-ID: <[log in to unmask]> NNTP-Posting-Host: slip80.hk.super.net The spam also has been sighted at asiaonline.net. Path: novdpd!zilker.net!cs.utexas.edu!news.sprintlink.net!psgrain!news.hklink.net!news .asiaonline.net!usenet Message-ID: <[log in to unmask]> NNTP-Posting-Host: ip115.asiaonline.net ************************************************************ *** Can the spam be cancelled? ************************************************************ Chris Lewis <[log in to unmask]> has cancelled the article from 156 newgroups; more cancellations are expected. His cancel message can be accessed with the URL news:[log in to unmask] Soon, we hope, this spam will be no more than a bad memory in your mind. And even though it wasn't our fault, we're sorry you had to read it. As of 12:46 EDT on June 1st, the spam seems to continue unabated. Please don't send me requests for cancellation. ( rest deleted )