Why is this page black?

After an unsuccessful attempt at medical treatment, an anti-spammer lost a dear friend and faithful companion this week (Jan 30 to Feb 5, 2005) and, although I never met him, I felt that some tribute to Julius was warranted. May Clifton one day find Julius waiting for him at Rainbow Bridge.

Attention, Netgear router owners!

IMPORTANT! If you have one or more Netgear routers with a model number RP614, RP614v2, DG814, MR814 or HR314 then it is very important that you update the firmware in your router. You could be one of the more than half-million Netgear router users who, because of the default firmware in the router, are causing problems for the University of Wisconsin. Links to details and upgrade sources are available on my page, netgear-error.html.

News:

Please, in taking steps to stop spam, please don't take steps that shut out the disabled from Internet access. See:
   " Spam-bot tests flunk the blind | CNET News.com".

H0H 0H0

It's approaching that time of year again, time for the story that's always an old favourite, "An Internet Christmas Carol". And, speaking of Carols, what is this season without songs... [Note: the URL above and the ones for the songs below have been updated December 20, 2002 to reflect directory changes at the original location.]

• 12 Days of Spambone.
• Auld Lang Spam.
• NANAE Christmas Song.
• Sergent Burner's Lonely Lart Club Band.

Spam, Spam, Spam, Eggs, Bacon, and Spam...

'news.admin.net-abuse.email is the "Wall Street Journal" of spam fighters.'
      -- Frederi108 in news.admin.net-abuse.email

If you need help, one place to get it is in the news:news.admin.net-abuse.email newsgroup. Be aware that it is populated not only by anti-spammers but also defensive and/or disruptive spammers, flamers, net-kooks, and trolls (with some overlaps in roles). If you must post there for some reason, you should first read both of the FAQs ("Your First Post to NANAE" and the "news.admin.net-abuse.email FAQ"), lurk (read without posting) for a while to get the feel of the place and, when you do post, be sure to wear your fireproof Nomex underwear:

1. Racing Underwear
2. R.J.S. Nomex Underwear Pants - Summit Racing Equipment
3. Nomex Hoods & Underwear
4. Simpson Nomex Underwear
5. Roll Cages, Chassis', Bell Helmets and Safety Equipment for race cars manufactured by CSC RACING PRODUCTS INC.-SAFETY APPAREL
6. Professional Motorsport equipment from Demon Tweeks
7. JEG'S High Performance - Car, Truck, Street, and Drag Racing
8. Kart Suits - Awesome Karting Accessories
9. www.leafracewear.com, PRODUCT CATALOG [PDF]
10. Massif Nomex Long Underwear
11. OMP, OMP underwear, fire proof, OMP Safety Accessories
12. Pegasus - Nomex Underwear and Hoods (Balaclavas)
13. Nomex Underwear - Driver Safety Classifieds
14. Nomex Underwear for racing
15. RJS Racing Equipment
16. Nomex Underwear
17. Security Race Products - Nomex Underwear, Boat/Hydro Slings
18. Speedway Motors: Product: 'Safety Racing Nomex Underwear'
19. Speedway Motors: Product: 'Simpson Nomex III Un derwear'
20. TeamTech Motorsports - Racing Apparel - Nomex Underware

... and remember,

     +----------+
     |  PLEASE  |
     |  DO NOT  |
     | FEED THE |
     |  TROLLS  |
     +----------+
         |  |
         |  |
       .\|.||/..

For (Adult) Dr. Seuss Fans:

One regular to the news.admin.net-abuse.email newsgroup posted this adult parody called "Green Eggs and Spam". (Included here with permission of the author.)

Good SPAM?

• Hormel Foods is Coming Soon! (www.hormel.com)
• Hormel Foods Corporation (www.spam.com)
  • Why SPAM (upper case) is good and spam (lower case) is bad.
• SPAMŪTASTIC Catalog Home Page (spam.co.net)

Here are a couple of rants^H^H^H^H^Heditorial comments of mine about spam that I have posted to Usenet:

Note: I originally had links to the postings archived on DejaNews^H^H^H^H.com but a recent alleged upgrade of theirs has made articles older than more than about six to eight months inaccessable. Thanks to Patricia and SuperTroll (Ron Ritzman) who archived the posts, I now have the posts stored on my site (although the headers of one is missing and I had to reconstruct the signature from the other and may have used the wrong sig quote). I have also converted them to HTML format and added an after-the-post note to one of them.

• January 2, 1999,
  "A hidden cost of spam."
• September 4, 1999,
  "YAR (YetAnotherRant) about UCE -- I just need to vent."
  • I get sig-quoted!

[NEW ADDRESS!]: This was *the* source for spam information if you wanted it in one place:

• "http://www.ao.net/waytosuccess/nospam.html", the Anti-Spam Campaign, but it has changed hands and is now maintained and hosted by F.R.E.E. The Forum for Responsible and Ethical Email at:
  • "http://www.spamfree.org/".
• A searchable mirror of the original site can also be found at http://www.whew.com/Spammers/nospam.shtml as well.

To be fully honest, I should point out that the original author of the site was disciplined by AOL for violating their Terms Of Service. (Note: This link used to point to the relevant post on DejaNews but they seem to have lost a lot of articles lately and this one was one of them. What you get now is a copy of the post from DejaNews that I had saved with the DejaNews added links removed.)

Hug a Tree Today ...

... and then cut it down.

The cheery message above was brought to you by
The Lumber Cartel [NEW URL] (There Is No Lumber Cartel).

Now you can have your own Lumber Cartel Sooper Sekrit Decoder Ring (TINLCSSDR)(tm) for decoding those cryptic messages on Usenet. Get yours today from my "Computer Hints, Tips, and Utilities" page.

Getting Full Headers.

Special for Chebucto Community Net users and others using pine 3.95:

• Configuring pine to display, and/or forward full headers.
• An example of spam received at CCN with forged headers.

Those not using WebTV can skip this part.

For those using WebTV:

There is no "official" way to extract headers (such as a one-step process) but the following extracts headers from posts according to one WebTV user (but see below that for differeing instructions):

(Note a change in instructions. The person who posted the original instructions notified me that there was an error in the instructions.)

OK the correct instructions:

1. Tab down to message area
2. Hit alt then z
3. Tab down, then hit cmd then a , then hit cmd then x.
4. Tab up to message area and hit cmd
5. Hit enter on the email

The email you get will be addressed to you w/full headers.

(My thanks to a WebTV user who gave me permission to quote this but who wished to remain anonymous.)

There is a chance that the tactic above may not work for you. I am keeping the instructions above in case there is more than one version of WebTV with different procedures for each version. I have received a message that the procedure above does not work for the sender who included alternate instructions (Thanks, Laura!):

<QUOTE>

From:   [address snipped] (Laura)
Date:   Wed, 8 Nov 2000 23:47:01 -0700 (MST)
To:     af380@chebucto.ns.ca ( Norman   De Forest   Antispam.html )
Subject: Incomplete/incorrect Webtv 'open header' info on your site.

Hello, Mr. De Forest.  

First, I want to compliment you on your spam info page.  Although I
haven't fully explored all of the links yet, it seems to have a lot of
information/links that'll be very useful when I report spam.  Thank you
:-)

Secondly, I want to thank you for taking the extra time and effort to
list how we Webtv'ers can open our email and/or post headers.  A lot of
webmasters tend to forget about us <g> and I appreciate your including
us in your 'how to'.

However, I'm afraid that the 'open headers' information that is listed
for Webtv'ers is incomplete.  I hope you don't mind, but I felt that I
should let you know about that.  Anyone using those instructions will
just get a blank email, without opened headers.

Spamcop has a page with the correct way to open the headers for wtv'ers
http://spamcop.net/fom-serve/cache/28.html  Or, if you wish, you can use
the instructions that I'll write below. (Which are basically the same as
those on the spamcop page, though not as concise ;-)

To open Webtv post and/or email headers:

1. For post headers:  When viewing the post, click on the 'send' button
on the keyboard, then click on 'forward' and address the forward to
yourself.  And for email headers:  Click on 'forward' on the left
sidebar when viewing the email and then address it to yourself.

2. Erase (delete) the subject line.

3. Place the cursor in the body of the write screen and then hit
'return' (enter) twice.

4.  Next, hit the ALT + the Z keys at the same time (alt + z).  This
will give you this alt character: §  (Or you can use ALT + any other
key.)

5.  Now, hit the CMD + the A keys, to highlight the §. Next, hit  the
CMD + the X keys, to cut/copy it. Then, place your cursor on the blank
subject line and hit CMD + V, to paste the §. (cmd + a, cmd + x, cmd +
v)

6.  Click on 'send'.  When the email/post forward is received, it will
show the full headers.  

It takes longer to write it than it does to actually do it ;-)  The
whole process, once someone's practiced it once or twice, usually takes
maybe 15 - 30 seconds.

I'm sorry this was so long and I hope it wasn't too much of an
imposition.  Thanks again for thinking of us wtv'ers when you wrote your
spam information page :-)

Oh... and if you do choose to use my instructions on your page, as
opposed to what's already there or spamcop's page, please don't list my
email address.  Using 'Laura' is fine, just not my email addy. Thanks:-)

Have a great day.
Laura


~~~~~email welcome, but NO forwards,
mass mailings, spam, etc.~~~~~~~~~~~

</QUOTE>

Another set of instructions for WebTV was posted to Usenet and is available through Deja.com (if they don't break things again):

• Deja.com: Re: E-Mail Help [Deja.com hypertext version]
• View original Usenet format

Tutorials on displaying full headers for other systems:

1. Displaying Full E-mail Headers.
2. SpamCop FAQ: How do I get my email program to reveal the full, unmodified email? [ie. full headers].
3. Spin - Internetworking [displaying full headers].
   • Versione italiana
4. CPA x2911 FAQ [a short bit about displaying full headers in Lotus Notes].
5. Yahoo! Mail - Online Support -- showing full headers with Yahoo! Mail.

Tutorials on displaying and interpreting full headers.

1. Full Headers -- tutorial at members.tripod.com really about interpreting headers but has some tips on displaying them.

More tutorials on interpreting full headers.

1. How to Interpret E-mail Headers.
2. Deciphering Headers.
3. SpamCop FAQ: What do you mean by "full headers"?.
4. Reading [interpreting] Email Headers.

RFCs related to email and spam:

1. rfc821 - Simple Mail Transfer Protocol.
2. rfc822 - Standard for the format of ARPA Internet text messages, superceded by:
   1. RFC1123,
   2. RFC1138,
   3. RFC1148,
   4. RFC1327, and
   5. RFC2156.
3. rfc974 - Mail routing and the domain system.
4. rfc1047 - Duplicate messages and SMTP.
5. rfc1087 - Ethics and the Internet.
6. rfc1090 - SMTP on X.25.
7. rfc1211 - Problems with the maintenance of large mailing lists.
8. rfc1652 - SMTP Service Extension for 8bit-MIMEtransport.
9. rfc1830 - SMTP Service Extensions for Transmission of Large and Binary MIME Messages.
10. rfc1846 - SMTP 521 Reply Code.
11. rfc1869 - SMTP Service Extensions.
12. rfc1891 - SMTP Service Extension for Delivery Status Notifications.
13. rfc1893 - Enhanced Mail System Status Codes.
14. rfc2034 - SMTP Service Extension for Returning Enhanced Error Codes.
15. rfc2142 - Mailbox Names for Common Services, Roles and Functions.
16. rfc2368 - The mailto URL scheme.
17. rfc2487 - SMTP Service Extension for Secure SMTP over TLS.
18. rfc2504 - Users' Security Handbook.
19. rfc2505 - Anti-Spam Recommendations for SMTP MTAs.
20. rfc2554 - SMTP Service Extension for Authentication.
21. rfc2635 - DON'T SPEW A Set of Guidelines for Mass Unsolicited Mail.

Some RFCs from my bookmarks -- yet to be sorted and have the duplicates weeded out:

1. Internet RFC/FYI/STD/BCP Archives
2. rfc2058 - Remote Authentication Dial In User Service (RADIUS)
3. rfc2396 - Uniform Resource Identifiers (URI): Generic Syntax
4. RFC 2396 -- URI syntax including UTF-8
5. rfc1855 - Netiquette Guidelines
6. rfc1746 - Ways to Define User Expectations
7. rfc1925 - The Twelve Networking Truths
8. rfc2324.html. Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0)
9. rfc1036 - Standard for interchange of USENET messages
10. rfc1939 - Post Office Protocol - Version 3
11. rfc2505 - Anti-Spam Recommendations for SMTP MTAs
12. rfc1123 - Requirements for Internet hosts - application and sup
13. rfc2324 - Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0)
14. rfc2606 - Reserved Top Level DNS Names
15. rfc1750 -- Randomness Recommendations for Security
16. rfc1700 - Assigned Numbers
17. rfc1893 - Enhanced Mail System Status Codes
18. rfc1894 - An Extensible Message Format for Delivery Status Noti
19. rfc1437 - The Extension of MIME Content-Types to a New Medium
20. rfc1149 - Standard for the transmission of IP datagrams on avian carriers
21. rfc1426 - SMTP Service Extension for 8bit-MIMEtransport
22. rfc2626 - The Internet and the Millennium Problem (Year 2000)
23. rfc2045 - Multipurpose Internet Mail Extensions (MIME) Part One
24. rfc1652 - SMTP Service Extension for 8bit-MIMEtransport
25. rfc2646 - The Text/Plain Format Parameter
26. rfc977 - Network News Transfer Protocol
27. rfc2500 - Internet Official Protocol Standards
28. rfc2645 - ON-DEMAND MAIL RELAY (ODMR) SMTP with Dynamic IP Addr
29. rfc2476 - Message Submission
30. rfc974 - Mail routing and the domain system
31. Download entire RFC index file
32. All of the RFCs, tarred and compressed
33. All the RFCs, Zipped
34. rfc1123 - Requirements for Internet hosts - application and sup
35. rfc2476 - Message Submission
36. rfc2505 - Anti-Spam Recommendations for SMTP MTAs
37. rfc2795 -- The Infinite Monkey Protocol Suits (IMPS)
38. rfc1437 - The Extension of MIME Content-Types to a New Medium
39. rfc2606 - Reserved Top Level DNS Names
40. rfc1912 - Common DNS Operational and Configuration Errors
41. rfc1536 - Common DNS Implementation Errors and Suggested Fixes
42. rfc1035 - Domain names - implementation and specification
43. rfc1036 Standard for Interchange of USENET Messages
44. rfc841 - Specification for message format for Computer Based Message Systems
45. rfc822 - Standard for the format of ARPA Internet text messages
46. rfc821 - Simple Mail Transfer Protocol
47. rfc806 - Proposed Federal Information Processing Standard: Specification for Message Format for Computer Based Message Systems
48. rfc788 - Simple Mail Transfer Protocol
49. rfc733 - Standard for the format of ARPA network text messages
50. rfc773 - Comments on NCP/TCP mail service transition strategy
51. rfc771 - Mail transition plan
52. rfc754 - Out-of-net host addresses for mail
53. rfc753 - Internet Message Protocol
54. rfc733 - Standard for the format of ARPA network text messages
55. rfc561 - Standardizing Network Mail Headers
56. rfc724 - Proposed official standard for the format of ARPA Network Messages
57. rfc2052 - A DNS RR for specifying the location of services (DNS SRV)
58. rfc2782 - A DNS RR for specifying the location of services (DNS SRV)
59. rfc2780 - IANA Allocation Guidelines For Values In the Internet
60. rfc2142 - Mailbox Names for Common Services, Roles and Functions
61. rfc1855 - Netiquette Guidelines
62. rfc1846 - SMTP 521 Reply Code
63. rfc1709 - K-12 Internetworking Guidelines
64. rfc1648 - Postmaster Convention for X.400 Operations
65. rfc1211 - Problems with the maintenance of large mailing lists
66. rfc1183 - New DNS RR Definitions
67. rfc1173 - Responsibilities of host and network managers: A summ
68. rfc2482 - Language Tagging in Unicode Plain Text
69. rfc1766 - Tags for the Identification of Languages
70. rfc2130 - The Report of the IAB Character Set Workshop held 29 February - 1 March, 1996
71. rfc2119 - Key words for use in RFCs to Indicate Requirement Levels
72. rfc2070 - Internationalization of the Hypertext Markup Language
73. rfc2131 - Dynamic Host Configuration Protocol
74. rfc2855 - DHCP for IEEE 1394
75. rfc2076 - Common Internet Message Headers
76. rfc2476 - Message Submission
77. rfc1846 - SMTP 521 Reply Code
78. rfc1123 - Requirements for Internet hosts - application and support
79. rfc1846 - SMTP 521 Reply Code

For science-fiction lovers, here's an imaginary scenario about what could happen if laws mandating opt-out (and thereby endorsing spam as a legitimate marketing tool) were to be passed. It was written when the Torricelli bill regarding spam was being proposed and is slightly out of date for that reason but the argument still holds if similar legislation is proposed in the future. (Orwell's 1984 is still a classic even if that date has now been passed.)

4DOS users might be interested in a little 4DOS alias I use called "dot" to convert those pesky integer URLs into dotted-quad form -- the ones that look like:

   http://3409588296/

To define it, use the following command as a single line. It is shown wrapped here only for readability and only wrapped where there is a space in the alias. Type it as one long line:

alias dot=`echo.^echo  %1  =  %@eval[ %1 \ 16777216 ].%@eval[ %@eval[ 
 %1 \ 65536 ] %% 256 ].%@eval[ %@eval[ %1 \ 256 ]  %% 256 ].%@eval[ %1 
 %% 256 ]^echo.`

Note: if you tried this earlier and it didn't work, I forgot the ` at the end of the definition. Oooops!

Usage:

c:\comm\>dot  3409588296

 3409588296 = 203.58.48.72 
 
c:\comm\>_

Because the alias has three commands in it, you have to use the 4DOS 'command-grouping' feature if you wish to redirect the output to a file:

c:\comm\>( dot  3409588296 ) >dotquad.num

c:\comm\>_

Real Audio, Spammers!

Real Audio is now in the RBL as can be seen in this Wired report.

The word in the net-abuse newsgroups is that if you try to "Add RealAudio and RealVideo to any web site with RealProducer" or download any of the Real Audio players then you will get spammed even if you uncheck the checkbox on their site asking for email when you download the Real Audio player. In the past there have also been claims that just mentioning "G2 Real Audio" or any other Real Audio product on your web site will also attract spam from Real Audio.

I am going to put that latter claim to the test by including on this page a few frequently-used phrases from other sites -- with just enough "editorial" changes so I will not be lying in this page. Let's see if I get any spam from Real Audio because of it. :-)

I have also added the following META tag to the header of this page:

<meta name="keywords" 
 content="RealAudio, RealVideo, RealProducer, RealMedia, RealPlayer">

Spam Bait:

You Should Not
Download
Real Audio Player
Here!

Nothing on this page Requires Real Audio Player so you don't need to follow that link.

Avoid "RealProducer G2".

To listen to Real Audio files you need Real Audio player. If you haven't already got this on your system you can NOT download it FREE by clicking on any logo below (TANLB){1}.

Footnote:
{1} TANLB: "There Are No Logos Below"

Just the FAQs, ma'am:

• The Email Abuse FAQ, Version 1.10
• The Email Abuse FAQ, Version 2.00
• <1997 12 11> Teergrubing FAQ
• Email Abuse Resource List
• alt.spam FAQ or Figuring out fake E-Mail & Posts . Rev 970906 -- currently unavailable.

Why is spam bad?

• Why is it bad?
• Spammers do more than spam

Combatting Spam:

• Get that spammer!
• Fight Spam on the Internet!
• The art of hunting spam
• Death to Spam
• Help! I've been Spammed! What do I do?
• Abuse.net: Home Page -- look up reporting addresses for spam.
• Some of my anti-spam boilerplate messages.
• Mail Abuse Prevention System.
  • MAPS RBL.
  • MAPS TSI.
  • MAPS DUL.
• SPEWS.ORG - the Spam Prevention Early Warning System.
• ORBS is now defunct. A replacement is being worked on but until then, I have put a slightly modified copy of the ORBS anti relay resources, otherresources.html on my web site. Some links in it have been removed because the files are no longer available and a couple were changed as I don't have the original HTML for a couple of the ORBS pages, only text lynx-printouts of them,
  • "jpadmin.html" and
  • "envelopes.html".

  ---

  Advertising on the Internet:

  • We are not opposed to Commerce
  • Using the Internet To Advertise Successfully (An Index)

  ---

  Tools to help you:

  Traceroute information and gateways:

  1. Traceroute, yo ho ho and a bottle of rum and all that -- a humourous tutorial about traceroute.
  2. G E E K T O O L S - Traceroute.
  3. BELNET Traceroute.
  4. Opus One Traceroute tool.
     -- Please read the following before using:
     • Traceroute and Spam
       -- and why you shouldn't report every site you get in a traceroute.
  5. Yahoo Traceroute.
  6. Traceroute.org.
     Note: links on this site fall into four categories:
     1. Sites that have been visited by the 404-Fairy and are no longer available,
     2. sites that traceroute to your IP address only,
     3. sites that require you to provide the IP address (or hostname) to trace, and
     4. sites that can trace to any IP address but default to using your IP address. The latter are handy for learning your own IP address if you don't already know it. One example is the traceroute gateway for Easynews (AS2).
  7. Network Tools -- including traceroute. (This is another site that defaults to looking up your own IP address if you don't change the form entry so can help you determine your IP address.)
  8. Yahoo! Computers and Internet > Communications and Networking > Software > Networking > Utilities > Traceroute.

  IP lookup:

  1. ARIN Home Page
  2. WHOIS Help
  3. Some IP space is delegated to the following. If ARIN refers to one of these, you need to look up the IP address again at the appropriate link below:
     1. Query the RIPE Whois Database
     2. RIPE WHOIS
     3. APNIC Whois Advanced Query
     4. APNIC WHOIS
     5. LACNIC WHOIS
     6. AfriNIC WHOIS
     7. Note that there may be even more sub-deligation. APNIC might, for example, refer you to the appropriate Chinese or Korean or Australian lookup.
  4. InterNIC
  5. DoDNIC

  Mixed and other tools:

  1. G E E K T O O L S - WHOIS.
  2. G E E K T O O L S.
  3. SpuTools®: InfoWar Tools to fight back against Spammers.
  4. Anti-Spam Tools for TUCOWS Classic - Windows 3x.
  5. E-Mail Anti-Spam for Tucows - Windows 95/98.
  6. Sam Spade Tools
     -- Back in full service, including traceroute.
  7. Network-Tools.
  8. net.demon's HayWyre Nullifyer.
  9. Encrypted-HTML Decryption Tools.
  10. Deobfuscating Javascript.
  11. The JavaScript Source: Equivalents: URL Revealer.
      • Note that some URLs can be more than just obfuscated. There are "ordinary" URLs that can direct some browsers to one file and other browsers to a different one. I haven't tested this yet but if I have things correct (I haven't had a chance to test it yet), this is one that will direct you to a different file for Netscape than it will for Internet Explorer:
        http://www.chebucto.ns.ca%2F%7Eaf380%2F@flashingcursor.cjb.net/browser.html
  12. SingNet abuse tools page.
  13. Anti-Spam Tools.
  14. spamNEWS -spam TOOLS.
  15. Spammer Slammer.
  16. SlaughterHouse - Anti-Spam Tools, Page 1.
  17. UXN Spam Combat.
      • Here's an edited (links to original pages added to bottom) version of Google's cached copy of UXN Spam Combat to use when the original site is inaccessible due to DDoS (Distributed Denial of Service) attacks.
  18. What address should you use to report spam to a domain?
      Look up an address in the abuse.net contact database.
  19. Anti-Spam Tools & Resources.
  20. WHOIS for Taiwan -- in Chinese.
  21. WHOIS for Taiwan -- in English.
  22. RIPE Whois Database - Index.
  23. WhoIs for Korea -- In Korean. Changed recently so it no longer works for browsers that don't support JavaScript. I created a page that gave access to the same functions and hyperlinks without using JavaScript (now moved to "http://www.chebucto.ns.ca/~af380/kr-whois.old.html"). It appeared to work for a while but the Korean site has apparently changed things again recently (It is now January 3, 2002.) so it no longer works. I have had to rewrite the non-JavaScript version all over again. The page at
      "http://www.chebucto.ns.ca/~af380/kr-whois.html"
      once more works. (***sigh*** I wonder how long it will last until the Korean NIC changes things and it gets broken again.) One nice change is a list of abuse addresses for some Korean netblock holders.