New User

[Jeff G.]

This post is in response to the message from Bob that I quoted in my
post "New User" to the spamcop.spam newsgroup, which unfortunately is
not archived on the web but can be found by pointing your newsreader at news:dhc164$jqe$***@news.spamcop.net .

Bob only included one set of full headers, so those will be my focus.

It appears that abuse[at]dataforce.net and/or
postmaster[at]dataforce.net is sending Bob's SpamCop Reports to the
spammer. I suggest that Bob start munging his Reports to those two
addresses, and that the Deputies rethink routing for the following:
"routeid:10111567 195.42.181.0 - 195.42.181.127
to:abuse[at]dataforce.net
Administrator found from whois records". The first upstream address is
abuse[at]ruscomnet.ru (which "refuses SpamCop reports"), so I'd go with
the second, abuse[at]mci.com.

[Paula McCallum]

Hi Jeff,

Sorry to bother you again but I'm new at this and not much of a computer "geek" (no offense) I just don't understand how this information would pin point who sent this message. I've included the full header below to see if you can make any sense to it. I tried to go back online and post it like you suggested but I couldn't get back on with my username & password (ughh). Anyway, if there's anything you can do, I'd appreciate it. I belong to a motorcycle rider's group of about 170 people, I assume this guy/gal went to the meeting from waht they said in their e-mail which would narrow it down to about 40-50 people who were there that night (it could probably be narrowed down further to about 1/2 with computer access). There can't be that many computer literate folks in our group to have been that sophisticated to post an anonymous e-mail. He wrote to me because I write the group's newsl
etter and to the guy in our club who receives all corospondence. I don't think I would have found
anything on my first attempt if it hadn't been for the spamcop post with his IP # and this happening to someone else (Chad Ayers).

Thanks,

Paula
eb33814.mail.mud.yahoo.com>Received:from [4.154.243.2] by web33814.mail.mud.yahoo.com via HTTP;
Wed, 29 Jun 2005 17:00:07 PDTDate:Wed, 29 Jun 2005 17:00:07 -0700 (PDT)From: "MysteryDude MysteryDude" <***@yahoo.com> View Contact Details Add Mobile Alert
Yahoo! DomainKeys has confirmed that this message was sent by yahoo.com. Learn moreTo:***@yahoo.com, ***@adelphia.net, ***@hotmail.comMIME-Version:1.0Content-Type:multipart/alternative; boundary="0-1491621414-1120089607=:24089"Content-Transfer-Encoding:8bitContent-Length:685 [input] [input] [input] [input] Hello

I'm writing this letter as a paid member of the Manomet Mystery Riders and also remaining unknown. Something from last months meeting is still bothering me. I want to know why Jack Cribbs can break the Bylaws. I also feel that every paid member should be aware of this. I want a signed statement by Jack Cribbs, the Officers of the group, and the Eboard members stating full responsibility of Sherri Palmer as a road captain in case a accident occurs. This should go to every paid member. No, I state No other club or group would had let this happen. Shame on you!








"Jeff G." <***@spamcop.net> wrote:This post is in response to the message from Bob that I quoted in my
post "New User" to the spamcop.spam newsgroup, which unfortunately is
not archived on the web but can be found by pointing your newsreader at news:dhc164$jqe$***@news.spamcop.net .

Bob only included one set of full headers, so those will be my focus.

It appears that abuse[at]dataforce.net and/or
postmaster[at]dataforce.net is sending Bob's SpamCop Reports to the
spammer. I suggest that Bob start munging his Reports to those two
addresses, and that the Deputies rethink routing for the following:
"routeid:10111567 195.42.181.0 - 195.42.181.127
to:abuse[at]dataforce.net
Administrator found from whois records". The first upstream address is
abuse[at]ruscomnet.ru (which "refuses SpamCop reports"), so I'd go with
the second, abuse[at]mci.com.
--
Thanks and Best Regards, Jeff G.
I have been a SpamCop User/Member/Customer since 1999 and am a
Moderator of the new web-based forums (now the primary method for
getting help, http://forum.spamcop.net). Please contact me via Forum
only, as Emails may be posted, reported, and/or ridiculed.

_______________________________________________
SpamCop-Mail mailing list
SpamCop-***@news.spamcop.net
http://news.spamcop.net/mailman/listinfo/spamcop-mail


__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

[Mike Easter]

Post by Paula McCallum
I just don't understand how this
information would pin point who sent this message.

I don't understand why it is very important to identity sleuth this
emailer. This isn't a harsh or threatening or otherwise intimidating
email. Just because s/he chose to be anonymous with a yahoo account and
a yahoo webmailing doesn't mean those of us who like to dabble in
identity sleuthing should be ratting out the sender.

The emailer has a beef about someone being a road captain and also
something else that transpired at the last meeting. S/He chose to use
the yahoo webmailer and accessed it from a level3 dialup. Such a dialup
might be associated with any number of providers, because many providers
'contract out' their dialup services. For example, some EarthLink
dialup users access from level3 dialups.

The fact that the dialup can be geographically associated with somewhere
around Methuen MA doesn't tell us very much since we would expect the
writer to be not so far from Manomet MA since this type of club is going
to have its members geographically proximal to each other.

Post by Paula McCallum
I assume this guy/gal went to the meeting
from waht they said in their e-mail which would narrow it down to
about 40-50 people who were there that night (it could probably be
narrowed down further to about 1/2 with computer access).

That's how you narrow it down all right.

Post by Paula McCallum
There can't
be that many computer literate folks in our group to have been that
sophisticated to post an anonymous e-mail.

This isn't actually a very sophisticated anonymity.

Post by Paula McCallum
He wrote to me because I
write the group's newsletter and to the guy in our club who receives
all corospondence. I don't think I would have found anything on my
first attempt if it hadn't been for the spamcop post with his IP #
and this happening to someone else (Chad Ayers).

[Jeff G.]

Post by Paula McCallum
Hi Jeff,

Hi Paula,

Post by Paula McCallum
Sorry to bother you again but I'm new at this and not much of a

computer "geek" (no offense) I just don't understand how this
information would pin point who sent this message. I've included the
full header below to see if you can make any sense to it. I tried to go
back online and post it like you suggested but I couldn't get back on
with my username & password (ughh). Anyway, if there's anything you can
do, I'd appreciate it. I belong to a motorcycle rider's group of about
170 people, I assume this guy/gal went to the meeting from waht they
said in their e-mail which would narrow it down to about 40-50 people
who were there that night (it could probably be narrowed down further to
about 1/2 with computer access). There can't be that many computer
literate folks in our group to have been that sophisticated to post an
anonymous e-mail. He wrote to me because I write the group's newsletter
and to the guy in our club who receives all corospondence. I don't
think I would have found

Post by Paula McCallum
anything on my first attempt if it hadn't been for the spamcop post

with his IP # and this happening to someone else (Chad Ayers).

Post by Paula McCallum
Thanks,
Paula

My, what a mess of headers! Please see the recommendations "How do I
get my email program to reveal the full, unmodified email? : Yahoo Mail"
at http://www.spamcop.net/fom-serve/cache/23.html .

However, as you can see from the Tracking URL
http://www.spamcop.net/sc?id=z809908480z46fda6dca054ebb38212fe142bcf97aez ,
the true source was using dialup-4.154.243.2.Dial1.Boston1.Level3.net
[4.154.243.2] to login to Yahoo! Webmail as
mysteryridermember[at]yahoo.com. Since the material appears to be
defamatory to Jack Cribbs and/or Sherri Palmer, you could report it in a
Manual Report to abuse[at]level3.net, spamtool[at]level3.net,
postmaster[at]yahoo.com, and mail-abuse[at]yahoo-inc.com.