- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] how to detect spambots - SPAMTrusted
by Frank Gadegast 16 Mar '09

16 Mar '09

Jeffrey Race wrote: > This simple wheel reinvented many times; need only to apply > current knowledge. If someone will work with me we can > submit the described RFC as is or improved as needed > > > <http://www.camblab.com/misc/univ_std.txt> > based on > <http://www.camblab.com/nugget/spam_03.pdf> > Great. I see two points here: - the group should define regulations to force RIPE-members to detect spam originating from their own IPs - the group should force members to have a working abuse email address (its sad, that the once defined abuse-mailbox field in RIPEs whois never made it to be a needed field, this should be changed ASAP) Our own blacklist under http://www.dnsbl.de sends out thousands of spam reports daily to the email addresses of the network administrators found in RIPEs whois. Most email address do not work (user unknown, mailbox full aso), a lot do send auto-replier with ticket numbers (telefonica is great with this), but never an email, that the case has been solved, most do not react. Currently there are only 2% answering or fixing the problem. Why do we not recommend to implement a system at RIPE, where abuse reports could be CCed to (including the netblock and the email address a report was sent too, the system then could check, if it was the right address and store a timestamp, any ISP should then be informed how he could send an email to RIPE to inform that hes working on it or that the case was fixed) so that RIPE can messure, wich ISP is really fixing abuse cases ? And: if any ISP collects more than 100 cases that are open for more than two weeks without any reaction, the problem network blocks are simply revoked by RIPE ;o) RIPE should be able to implement such a harsh system, because any member signed to not pollute the internet already. Kind regards, Frank > > Jeffrey Race > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

14 35

passive botnet tracker
by Dr. Alexander K. Seewald 09 Mar '09

09 Mar '09

We've built and run a prototype passive botnet tracking system in Austria for the last year. A journal paper is pending and should be ready for the conference - hopefully only a week away from the final version. The gist: Based on a darknet (i.e. unused IP addresses), we analyze incoming packets and classify them into (currently eight) different spambot types based on learned idiosyncrasies of packet and protocol, and reference data (currently by Marshall). The system is based on machine learning techniques, scales extremely well, and can utilize all kinds of reference data. However, to track all spambots worldwide (according to ShadowServer's estimates), we need about 1.5 million unused IP addresses. In times of IPv4 shortage, that is quite a tall order. Unfortunately, spammers have not switched to IPv6 yet - in the full past year, we could not find a single IPv6 packet originating from a spambot. This will probably change in the future, but until we have enough sample data to train our models, IPv6 cannot be used reliably. Lack of reference data (i.e. known botnets, bot types, DDoS/spam sending activity etc.) has been our greatest obstacle so far. We intend to extend the system towards TCP/IP stack fingerprinting (for those bots which have their own stack) and towards true botnet tracking (e.g. by analyzing access patterns & timings) Any comments are welcome. We will try to be at RIPE-58, provided we can get a small talking slot there - half an hour should suffice. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

12 17

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

5 4

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

Re: [anti-abuse-wg] passive botnet tracker (combined reply)
by Dr. Alexander K. Seewald 04 Mar '09

04 Mar '09

Peter, I think that focussing just on spam is misleading. Although it is currently the most profitable use of botnets, other uses are already demonstrated, such as DDoS, distributed password/encryption cracking, phishing - which could work without spam in several scenarios (e.g. changing HOSTS on the local PC, hacking DNS servers, etc..) - and most of these would tend to give spammers a way to make money without spam. So it is important to find out what they are doing and how many there are. Frank, I applaud your system. By your fast response you even get rid of the problem with static vs. dynamic IP addresses. As long as the major business for botnets is spam, this will continue to work. Of course if only a small set of providers use it, spammers will simply stop using your mailserver to send spam, once it begins to hurt them. Yes, it is relatively trivial to get the IP from the full mail headers (although it is safer to check the IP during the SMTP conversation - I once did a test and there was a difference of about 1% where IP addresses did not match) I even once wrote a system in 2004 to analyze each mail, check whois, find out the abuse email address and send an automatically generated abuse report there... used it for a few months, but as there was absolutely no reponse (well, some email providers complained that they cannot control what their users do...) I stopped it. Our system could be used in a similar way, but tracks even inactive bots which are currently not used to send out spam. Of course they need to generate some other traffic, the nature of which is currently not well understood. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

1 0

Call for Agenda Items for RIPE 58
by Brian Nisbet 02 Mar '09

02 Mar '09

Colleagues, As you may have seen, registration has opened for RIPE 58 in Amsterdam. With this in mind I'd like to solicit agenda items for the WG session. We would be especially interested in anti-abuse experiences which involved interaction with government or evolution of legislation, but I do not, in any way, intend to be restrictive. If you have a presentation or any information that you think may be of interest to the working group, please let Richard or I know. Regards, Brian.

1 0

JKHY Attack via RIPE Users
by Mark Mason 25 Feb '09

25 Feb '09

Ripe Anti-Abuse, On day number 2 of a attack. Can you mitigate any of the following addresses coming from the RIPE network ARIN space? Se1/0 89.208.176.155 Null 216.116.87.90 11 0E7D 0D67 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0707 05F1 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0C9C 0DEE 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B4D 0ACB 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0CF0 0D7A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0EDC 0E41 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B04 0C30 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F4E 08E0 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FB0 0AD3 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D53 083A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E58 0B77 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B49 0E75 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E5B 0B4C 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 1010 049D 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 09C0 129E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0918 12E7 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 1040 0B9A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E10 0474 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0BF2 1197 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E6A 041B 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 08A9 1288 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0C80 0674 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0901 03DF 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D0A 0781 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 09A6 00D7 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D98 0425 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F24 077E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 091C 11B2 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FC9 0093 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F6D 10A0 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D64 02F9 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E9B 10BA 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FAC 11B9 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0CB3 12A1 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FDB 0231 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F3D 12BF 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0DC9 013E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0EB1 121F 1039 Se1/0 113.61.25.33 Null 216.116.87.90 11 1121 0654 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0AF2 122F 1028 Se1/0 122.105.216.108 Null 216.116.87.90 11 092C 0932 1028 Se1/0 213.149.11.88 Null 216.116.87.90 11 0E48 0827 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0D65 0B9C 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0CB2 0A4B 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 05F5 1140 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 09D9 010B 1028 Se1/0 62.154.194.202 Null 216.116.87.90 11 071F 07F8 1028 Se1/0 58.141.17.44 Null 216.116.87.90 11 0B7F 0798 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0A95 125F 1028 Se1/0 113.61.27.91 Null 216.116.87.90 11 1388 06DD 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 087F 00B4 1028 Se1/0 96.60.68.113 Null 216.116.87.90 11 0884 00BA 1028 Se1/0 115.133.196.157 Null 216.116.87.90 11 1001 10FA 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 0C69 0B06 1028 Se1/0 222.253.249.145 Null 216.116.87.90 11 1227 0AF0 1028 Se1/0 89.252.232.245 Null 216.116.87.90 11 0C24 02AE 1028 Se1/0 195.130.48.60 Null 216.116.87.90 11 04E2 11EF 1028 Se1/0 122.105.216.108 Null 216.116.87.90 11 094B 0970 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 0F2E 03E8 1028 Se1/0 189.17.142.70 Null 216.116.87.90 11 09E0 10DB 1028 Se1/0 124.254.219.51 Null 216.116.87.90 11 1304 0CA8 1028 Se1/0 89.105.137.1 Null 216.116.87.90 11 0A50 0FF3 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 08C0 102D 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 04C3 031D 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 049A 1345 1028 Se1/0 116.1.68.214 Null 216.116.87.90 11 0A9E 0CCC 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 0421 03F5 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0C57 1359 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0DD8 12D4 1028 Se1/0 94.64.52.186 Null 216.116.87.90 11 0B4A 0765 1028 Se1/0 123.22.11.226 Null 216.116.87.90 11 07DC 0D34 1028 Se1/0 200.61.42.236 Null 216.116.87.90 11 B819 0232 1028 Se1/0 79.116.168.178 Null 216.116.87.90 11 0A9A 0656 1028 Se1/0 58.153.110.2 Null 216.116.87.90 11 0992 102A 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 0F6B 085B 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 12E3 054A 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 1100 0DAB 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 0447 03E1 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 1031 0C9E 1028 Se1/0 123.22.11.226 Null 216.116.87.90 11 07DA 0D5F 1028 Se1/0 89.252.232.245 Null 216.116.87.90 11 0CA8 026E 1028 Se1/0 217.27.145.246 Null 216.116.87.90 11 A8F5 0BDF 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0D06 0BA3 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0B21 0440 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0A9F 0C35 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 05F9 011B 1028 Se1/0 119.236.7.65 Null 216.116.87.90 11 09D0 0056 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 FB95 0F70 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 1355 047F 1028 Se1/0 62.154.194.202 Null 216.116.87.90 11 0687 0616 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0A8E 0238 1028 Se1/0 61.216.232.191 Null 216.116.87.90 11 EB2F 1054 1028 Se1/0 88.216.105.58 Null 216.116.87.90 11 390D 0576 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 059D 1154 1028 Se1/0 75.165.194.154 Null 216.116.87.90 11 0D69 0835 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0AB9 1212 1028 Se1/0 58.213.231.201 Null 216.116.87.90 11 05D0 130B 1028 Kind Regards, Mark Mason JHA Communications - Network Engineer jack henry & ASSOCIATES Office 417.235.6652 Ext. 350501 Cell 417.669.1605 Fax 260.665.9454 NOTICE: This electronic mail message and any files transmitted with it are intended exclusively for the individual or entity to which it is addressed. The message, together with any attachment, may contain confidential and/or privileged information. Any unauthorized review, use, printing, saving, copying, disclosure or distribution is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email and delete all copies.

3 2

Thunderbird automatic SPAM reporting to ISP
by Jérôme Bouat 09 Dec '08

09 Dec '08

Hello, I would like to develop a SPAM fighting extension of the Thunderbird email client. On the contrary of existing plugins, this new plugin would allow each end-user to report SPAM directly to the right ISP instead of delegating it to a centralized service. This solution distributes the cost between all the spam reporters. For that, I need to know which ISP hosts a given IP. Of course, I can write a wrapper of the http://www.db.ripe.net/whois portal. However I'm searching a more efficient way. For example, we could use a compressed database file on ripe.net (or on bittorrent network) and local caching on each email client. I would like to discuss this with the list and provide the most efficient solution for everyone. Thanks for your advise. Regards.

2 1

Fw: Re: Fw: Even presidents use it (KMM81093521V2514L0KM)
by Geoff Brown 13 Nov '08

13 Nov '08

I'm getting this spam email can you take a look at it please --- On Tue, 11/11/08, Geoff Brown <geoff.brown(a)talk21.com> wrote: From: Geoff Brown <geoff.brown(a)talk21.com> Subject: Fw: Re: Fw: Even presidents use it (KMM81093521V2514L0KM) To: abuse(a)ornage.es Date: Tuesday, 11 November, 2008, 8:41 PM --- On Tue, 11/11/08, Yahoo! Mail <abuse(a)yahoo.com> wrote: From: Yahoo! Mail <abuse(a)yahoo.com> Subject: Re: Fw: Even presidents use it (KMM81093521V2514L0KM) To: "Geoff Brown" <geoff.brown(a)talk21.com> Date: Tuesday, 11 November, 2008, 11:21 AM Hello, Thank you for writing to Yahoo! Mail. I understand your frustration in receiving unsolicited email. While we investigate all reported violations against the Yahoo! Terms of Service (TOS), in this particular case the message you received was not sent through the Yahoo! Mail system. Yahoo! has no control over activities outside its service, and therefore we cannot take action. You may try contacting the sender's email provider, by identifying the sender's domain and contacting the administrator of that domain. The sender's provider should be in a better position to take appropriate action against the sender's account. The email message itself does contain some information relating to the sender's identity. Yahoo! includes the originating Internet Protocol (IP) address in the full Internet headers of all messages sent through Yahoo! Mail, so that we will have information regarding the origin of messages sent through our system. The originating IP address should be located in the very last "Received" line of the full Internet headers and corresponds to the sender's Internet Service Provider (ISP). Please see the following URL for more assistance: http://help.yahoo.com/help/us/mail/spam/spam-05.html Once you have identified the IP address, you can conduct an IP lookup to determine which ISP provides this person with Internet access. One such lookup tool you may want to try is: http://www.arin.net/whois/ You can then attempt to contact that ISP to report any abuse activities occurring within their service. In addition, please visit the following website for useful tools to combat spam: http://antispam.yahoo.com/ Please let me know if you still need assistance so I may assist you further. Your patience during this process is greatly appreciated. Thank you again for contacting Yahoo! Mail. Regards, Elmer Yahoo! Customer Care 54980104 For assistance with all Yahoo! services please visit: http://help.yahoo.com/ Original Message Follows: ------------------------- Hi I'm getting this spam - allegedly from my own email address - I haven't tried to unsubscribe due to the nature of the message - and I doubt the authenticity - they can't even spell special. Even presidents use it Monday, 10 November, 2008 2:27 AM >From geoff.brown(a)talk21.com Mon Nov 10 02:27:24 2008 Return-Path: <geoff.brown(a)talk21.com> Authentication-Results: mta802.mail.ird.yahoo.com from=talk21.com; domainkeys=neutral (no sig) Received: from 85.60.43.16 (EHLO 215.pool85-60-19.dynamic.orange.es) (85.60.43.16) by mta802.mail.ird.yahoo.com with SMTP; Mon, 10 Nov 2008 02:27:22 +0000 To: <geoff.brown(a)talk21.com> Subject: Even presidents use it From: <geoff.brown(a)talk21.com> View contact details MIME-Version: 1.0 Importance: High Content-Type: text/html Content-Length: 2015 --- On Mon, 10/11/08, geoff.brown(a)talk21.com <geoff.brown(a)talk21.com> wrote: From: geoff.brown(a)talk21.com <geoff.brown(a)talk21.com> Subject: Even presidents use it To: geoff.brown(a)talk21.com Date: Monday, 10 November, 2008, 2:27 AM If you are unable to see the message below, click here to view. You have received this message because you opted in to receives ClickCulture pecial offers via email. Login to your member account to edit your email subscription . Click here to unsubscribe. PLEASE DO NOT REPLY - This is being sent from an unattended mailbox. Copyright © 2008 ClickCulture, Inc. All rights reserved. 3739-210 NATIONAL DR, Raleigh, NC 27612

2 1

Re: [anti-abuse-wg] Fw: Re: Fw: Even presidents use it
by Thor Kottelin 13 Nov '08

13 Nov '08

> Date: Tue, 11 Nov 2008 20:58:32 +0000 (GMT) > From: Geoff Brown <geoff.brown(a)talk21.com> > To: anti-abuse-wg(a)ripe.net > Subject: [anti-abuse-wg] Fw: Re: Fw: Even presidents use it > I'm getting this spam email can you take a look at it please > Received: > from 85.60.43.16 (EHLO 215.pool85-60-19.dynamic.orange.es) > (85.60.43.16) > by mta802.mail.ird.yahoo.com with SMTP; Mon, 10 Nov 2008 02:27:22 > +0000 I suggest writing to abuse(a)es.francetelecom.com. For the future, I suggest using Spamcop, as it will analyze and report junk mail for you. -- Thor Kottelin http://www.anta.net/

1 0