Red Wave Radio

by **Moocows hate spa** » Fri, 11 Dec 1998 04:00:00

(This message is being posted and emailed to abuse contacts at Bellsouth,
DejaNews, and Hotmail. The use of multiple morph accounts is, in all
likelihood, a violation of DejaNews' Acceptable Use Policy, and the
revenge-spamming is most certainly a violation of AUPs of all the ISPs
involved.)

Dear sirs:

I came on rec.radio.swap fairly recently, and in one of the threads there
was a considerable amount of controversy concerning a "Robert Cruz"

my-dejanews.com) was claiming that Mr. Cruz had reneged on a swap deal.

I emailed both parties, trying to get each side of the story. I was
willing to let it be "just an Internet dispute" till today.

Today, starting at approximately 12 pm EST, someone using at least three
Miami-area POPs of Bellsouth began a rather large revenge-spam apparently
aimed at Mr. Cruz. (I was able to determine Mr. Cruz was *not* the source
of these posts; Mr. Cruz uses aegis.bst.bellsouth.com to connect to
Dejanews and thus to post to Usenet, and uses a Hotmail address in reply.)

In further analysis of headers, I discovered that the revenge-spams were

dejanews.com; I further discovered that a third "morph" DejaNews account
may be owned by the same person using a Hotmail address.

The headers of posts on Airnews from one of the POPs in question are
included below. Included as well will be a chronological listing of the
"interesting" bits, in the section to Bellsouth and Dejanews (below).

Bellsouth/DejaNews:

Please, both systems, respectively check your system logs and find out
the following:

Bellsouth--which user was at the IP at the time listed in the X-Article-
Creation-Date header.

DejaNews--which email address(es) the accounts in question are registered

Chronological list follows:

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 21:49:02 1998 GMT

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 21:55:51 1998 GMT

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 21:55:51 1998 GMT

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:01:45 1998 GMT

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:05:29 1998 GMT

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:24:22 1998 GMT

Please cancel the accounts responsible, and it would be appreciated in
this case if Mr. Cruz could receive courtesy copies of the abuse reports.

Hotmail:

com and presently doing a revenge spam against Mr. Cruz has a Hotmail
morph account for the purpose of obtaining multiple DejaNews accounts.
Please examine your system for morph accounts, and close them if found.

Smokingun20:

I will not suffer a revenge-spammer's account to live. Please be
forewarned that any denial of service attacks against this account will
result in the loss of your accounts at the very least for net.abuse, and
possibly criminal proscecution under 18 USC 1030 ibid as well as relevant
Florida and Kentucky computer crimes statutes.

-moo

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.

airnews.net!newsfeed.direct.ca!news-peer.gip.net!news.gsl.net!gip.net!
news.maxwell.syr.edu!nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

>Newsgroups: rec.radio.swap
>Subject: Re: I'm sick and tired of being ......REWARD IF FOUND!!!!!Robert

you are busted pal...

>Date: Thu, 10 Dec 1998 21:55:51 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 34

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 21:55:51 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253244

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.

airnews.net!nntp.giganews.com!news-feeds.jump.net!nntp2.dejanews.com!
nnrp1.dejanews.com!not-for-mail

>Newsgroups: rec.radio.swap
>Subject: i am convinced that robert cruz is a thief-get out of here
>Date: Thu, 10 Dec 1998 22:34:27 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 8

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:34:27 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253255

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.

airnews.net!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!nntp2.
dejanews.com!nnrp1.dejanews.com!not-for-mail

- Show quoted text -

>Newsgroups: rec.radio.swap
>Subject: i robert cruz am offering $4000 for this or these persons
involved dead....
>Date: Thu, 10 Dec 1998 21:49:02 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 11

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 21:49:02 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253238

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal11.

airnews.net!uunet!in5.uu.net!newsfeed.cwix.com!204.238.120.130!
news-feeds.jump.net!nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

- Show quoted text -

>Newsgroups: rec.radio.swap
>Subject: Robert Cruz has posted up the truth now everyone has witnessed
the truth
>Date: Thu, 10 Dec 1998 22:05:29 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 7

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:05:29 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253246

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.

airnews.net!newsfeed.direct.ca!newsfeed.wli.net!news.maxwell.syr.edu!
nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

>Newsgroups: rec.radio.swap
>Subject: The hell with all of you people and david ill get you.......
>Date: Thu, 10 Dec 1998 22:24:22 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 8

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:24:22 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253248

>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.

airnews.net!nntp.giganews.com!news-feeds.jump.net!nntp2.dejanews.com!
nnrp1.dejanews.com!not-for-mail

- Show quoted text -

>Newsgroups: rec.radio.swap
>Subject: The real Robert Cruz has finally arrived and in route to
jail,,,BYE BYE
>Date: Thu, 10 Dec 1998 22:01:45 GMT
>Organization: Deja News - The Leader in Internet Discussion
>Lines: 7

>NNTP-Posting-Host: 209.214.2.86
>X-Article-Creation-Date: Thu Dec 10 22:01:45 1998 GMT
>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
209.214.2.86
>Xref: news-f.iadfw.net rec.radio.swap:253245

by **Gary** » Sat, 12 Dec 1998 04:00:00

Moocow...YOU 'DA MAN!

Nice job, now everybody can settle down (hopefully)

Gary

>(This message is being posted and emailed to abuse contacts at Bellsouth,
>DejaNews, and Hotmail. The use of multiple morph accounts is, in all
>likelihood, a violation of DejaNews' Acceptable Use Policy, and the

*****************************Technical stuff
snipped************************************

by **Marty Duplisse** » Sat, 12 Dec 1998 04:00:00

Tried to send you this via E-mail but can't figure out your spam guard.

Thank you so much! I believe Mr. Cruz should get this DH's real name and
address.

-----Original Message-----

Newsgroups: rec.radio.swap
Date: Thursday, December 10, 1998 5:46 PM
Subject: Info on revenge-spam posts and related material

>(This message is being posted and emailed to abuse contacts at Bellsouth,
>DejaNews, and Hotmail. The use of multiple morph accounts is, in all
>likelihood, a violation of DejaNews' Acceptable Use Policy, and the
>revenge-spamming is most certainly a violation of AUPs of all the ISPs
>involved.)

>Dear sirs:

>I came on rec.radio.swap fairly recently, and in one of the threads there
>was a considerable amount of controversy concerning a "Robert Cruz"

>my-dejanews.com) was claiming that Mr. Cruz had reneged on a swap deal.

>I emailed both parties, trying to get each side of the story. I was
>willing to let it be "just an Internet dispute" till today.

>Today, starting at approximately 12 pm EST, someone using at least three
>Miami-area POPs of Bellsouth began a rather large revenge-spam apparently
>aimed at Mr. Cruz. (I was able to determine Mr. Cruz was *not* the source
>of these posts; Mr. Cruz uses aegis.bst.bellsouth.com to connect to
>Dejanews and thus to post to Usenet, and uses a Hotmail address in reply.)

>In further analysis of headers, I discovered that the revenge-spams were

>dejanews.com; I further discovered that a third "morph" DejaNews account
>may be owned by the same person using a Hotmail address.

>The headers of posts on Airnews from one of the POPs in question are
>included below. Included as well will be a chronological listing of the
>"interesting" bits, in the section to Bellsouth and Dejanews (below).

>Bellsouth/DejaNews:

>Please, both systems, respectively check your system logs and find out
>the following:

>Bellsouth--which user was at the IP at the time listed in the X-Article-
>Creation-Date header.

>DejaNews--which email address(es) the accounts in question are registered

>Chronological list follows:

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 21:49:02 1998 GMT

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 21:55:51 1998 GMT

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:01:45 1998 GMT

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:05:29 1998 GMT

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:24:22 1998 GMT

>Please cancel the accounts responsible, and it would be appreciated in
>this case if Mr. Cruz could receive courtesy copies of the abuse reports.

>Hotmail:

>com and presently doing a revenge spam against Mr. Cruz has a Hotmail
>morph account for the purpose of obtaining multiple DejaNews accounts.
>Please examine your system for morph accounts, and close them if found.

>Smokingun20:

>I will not suffer a revenge-spammer's account to live. Please be
>forewarned that any denial of service attacks against this account will
>result in the loss of your accounts at the very least for net.abuse, and
>possibly criminal proscecution under 18 USC 1030 ibid as well as relevant
>Florida and Kentucky computer crimes statutes.

>-moo

><headers follow>

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.
>airnews.net!newsfeed.direct.ca!news-peer.gip.net!news.gsl.net!gip.net!
>news.maxwell.syr.edu!nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: Re: I'm sick and tired of being ......REWARD IF FOUND!!!!!Robert
>you are busted pal...
>>Date: Thu, 10 Dec 1998 21:55:51 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 34

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 21:55:51 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253244

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.
>airnews.net!nntp.giganews.com!news-feeds.jump.net!nntp2.dejanews.com!
>nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: i am convinced that robert cruz is a thief-get out of here
>>Date: Thu, 10 Dec 1998 22:34:27 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 8

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:34:27 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253255

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.
>airnews.net!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!nntp2.
>dejanews.com!nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: i robert cruz am offering $4000 for this or these persons
>involved dead....
>>Date: Thu, 10 Dec 1998 21:49:02 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 11

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 21:49:02 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253238

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal11.
>airnews.net!uunet!in5.uu.net!newsfeed.cwix.com!204.238.120.130!
>news-feeds.jump.net!nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: Robert Cruz has posted up the truth now everyone has witnessed
>the truth
>>Date: Thu, 10 Dec 1998 22:05:29 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 7

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:05:29 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253246

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.
>airnews.net!newsfeed.direct.ca!newsfeed.wli.net!news.maxwell.syr.edu!
>nntp2.dejanews.com!nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: The hell with all of you people and david ill get you.......
>>Date: Thu, 10 Dec 1998 22:24:22 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 8

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:24:22 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253248

>>Path: news-f.iadfw.net!cabal1.airnews.net!news.airnews.net!cabal10.
>airnews.net!nntp.giganews.com!news-feeds.jump.net!nntp2.dejanews.com!
>nnrp1.dejanews.com!not-for-mail

>>Newsgroups: rec.radio.swap
>>Subject: The real Robert Cruz has finally arrived and in route to
>jail,,,BYE BYE
>>Date: Thu, 10 Dec 1998 22:01:45 GMT
>>Organization: Deja News - The Leader in Internet Discussion
>>Lines: 7

>>NNTP-Posting-Host: 209.214.2.86
>>X-Article-Creation-Date: Thu Dec 10 22:01:45 1998 GMT
>>X-Http-User-Agent: Mozilla/3.01 (Win95; I)
>>X-Http-Proxy: 1.0 x5.dejanews.com:80 (Squid/1.1.22) for client
>209.214.2.86
>>Xref: news-f.iadfw.net rec.radio.swap:253245