Spammer Bust

Phil Howard phil at
Fri Sep 5 19:43:20 UTC 1997

I previously replied to these words of Mark E Larson ...

> Thought people would be interested in this article.

and add the following...

I went back and pulled up copies of this spam that I received.  I received
about 12 copies of it.  But what I received did not named RUSTnet, so I guess
he was generating numerous variations to perhaps try to distribute the load
enough to slow down the ISPs coming back to him.  That means perhaps many
others have been blamed, as well.  I found copies claiming to be from some
fake names, and one from hotmail.

One copy of this same spam (but who knows if it is or is not really the
same spammer) I got appeared to be from PSI.  It came from a PSI connection
and used Earthlink as a mail hop.  I complained to abuse at and they
sent back a reply claiming the mail came from Earthlink.  Well, literally
I did get it from Earthlink, but it originated from PSI's IP address,
unless Earthlink faked the IP (but then why would they leave their own
address on it).

That's why I tend to believe a lot of ISPs ... and more often the BIGGER
ones than the smaller ones ... don't know what is going on.  Of course, the
problem the bigger ones have is that even though they do have a few people
that do know, they have tons of poorly trained people that are the "front
line" for everything from customer support to abuse at

Equipment vendors like Cisco, though, are much, much better at this.  I guess
that's because they know they are always dealing with professionals (well,
maybe for most of the calls).

Phil Howard KA9WGN   +-------------------------------------------------------+
Linux Consultant     |  Linux installation, configuration, administration,   |
Milepost Services    |  monitoring, maintenance, and diagnostic services.    |
phil at +-------------------------------------------------------+

More information about the NANOG mailing list