Today I started receiving a massive number of e-mail bounces and
about spam. I immediately realized that someone had abused the network
name; sure enough, I shortly received the evidence shown below. I
for this form letter response, but I'm expecting another 10,000
I do not plan to send personalized replies to each one.
I'm thankful, in a way, to see this occur. It underscores the terror
spammers must be feeling based on the excellent effect we've produced
web page at http://www.vix.com/spam/, and the wonderful feedback and
rate I've received on my "real time spammer black hole" eBGP4 feed.
they forged threats in my name to every member of the U.S.Senate and
see even more evidence that I'm hurting spammers everywhere.
I'm sad if you got spammed, but I assure you that I don't ever send
e-mail other than person-to-person for a specific purpose. You'll be
another dozen times this week, probably by Sanford Wallace of
or some other fun-loving jerk who wants to steal your time and money.
visit the http://www.vix.com/spam/ web page and consider signing our
If you are an ISP, please send me private e-mail asking about my real
blackhole feed, that makes known spammer networks disappear from your
PS. Here's the first human report I received about Friday's forged
The second report (further below) shows a second spam, apparently from
someone named "Alan K Baker" who claims responsibility for both spams.
| Date: Sat, 22 Feb 1997 00:58:26 +0000 (GMT)
| From: xxx
| To: email@example.com
| cc: firstname.lastname@example.org
| Subject: Someone's faking your address in spam re: FREE GOLD!!!!
| In-Reply-To: <B0000771170@home.glasscity.net>
| Someone has been sending junk mail with your names on it (at least,
| looked at your web pages I guess it's not from you :-). Here's the
| message, including full headers. I've complained to glasscity.net. I
| suggest you use what ever legal measures you can to make them divulge
| details of the user who forged this mail. Keep fighting the good
| Mail follows below sig.
| Return-path: <email@example.com>
| Envelope-to: firstname.lastname@example.org
| Delivery-date: Sat, 22 Feb 1997 00:12:30 +0000
| Received: from mauve.csi.cam.ac.uk [22.214.171.124] (exim)
| by black.csi.cam.ac.uk with smtp (Exim 1.58 #1)
| id 0vy54n-0001c9-00; Sat, 22 Feb 1997 00:12:29 +0000
| Received: from home.glasscity.net [126.96.36.199]
| by mauve.csi.cam.ac.uk with smtp (Exim 1.58 #1)
| id 0vy54m-0002UV-00; Sat, 22 Feb 1997 00:12:28 +0000
| Received: from home.glasscity.net (188.8.131.52) by
| (EMWAC SMTPRS 0.81) with SMTP id <B0000771170@home.glasscity.net>;
| Fri, 21 Feb 1997 19:12:25 -0500
| Date: Fri, 21 Feb 1997 19:12:25 -0500
| Message-ID: <B0000771170@home.glasscity.net>
| Subject: FREE GOLD!!!!
| X-UIDL: 20934820873692863905867902837082
| Priority: normal
| X-Flags: PXU2-4R65-2264:R
| Apparently-To: <email@example.com>
| From: firstname.lastname@example.org
| Free gold! Phone, fax or email!
| Guaranteed FREE gold! 99.9% pure for first 1,000 replies!
| Phone +1 415 747 0204
| Fax +1 415 747 0106
| Promotion by:
| Vixie Enterprises
| Star Route Box 159A
| Woodside, CA 94062
| Be QUICK!!!
| Paul Vixie
| +1 415 747 0204
| From: xxx
| To: <email@example.com>
| Subject: Fw: Dear spam hater.
| Date: Fri, 21 Feb 1997 19:30:42 -0700
| I wonder if you can tell me how you show up as the source/return path
| this message below? I checked some of your news group postings and
| hardly seem like the type to mail this kind of nonsense. Any advise?
| > From:
| > To:
| > Subject: Dear spam hater.
| > Date: Friday, February 21, 1997 6:52 PM
| > HA HA HA HA
| > You are on a published list of peolple who hate commercial mail!
| > How STUPID can you get! Commercial email is just taking off - and
| going to distribute this list everywhere
| > I can to shut you whining people with nothing better to do than
| > It's BASTARDS like you who got me shut down last time - but demon
| touch me! HA HA HA!
| > I can go thru DIFFERENT servers! ANYTIME...........
| > Alan the Infowarrior
| > 'Let me read your palm!'
| > --
| > Alan K Baker (MailWurliTzer Willy)
| > www.senora.demon.co.uk
| > firstname.lastname@example.org
| > PS glasscity.net are not responsible for this.........
The copy I received of the above message, which had malformed headers,
me as the "From:" but the same text. It appears to have come from
rather than the UK but I will check further and annotate this