[68857] in North American Network Operators' Group
Re: Strange message possibly through nanog mail server
daemon@ATHENA.MIT.EDU (Brian Bruns)
Wed Mar 17 17:24:41 2004
From: "Brian Bruns" <bruns@2mbit.com>
To: "william(at)elan.net" <william@elan.net>, <nanog@merit.edu>
Date: Wed, 17 Mar 2004 17:20:01 -0500
Errors-To: owner-nanog-outgoing@merit.edu
On Wednesday, March 17, 2004 5:57 PM [EST], william(at)elan.net
<william@elan.net> wrote:
> I Just received this. I would like to check if others have received it
> and did it indeed come through nanog mailist:
>
>> Date: Wed, 17 Mar 2004 21:10:38 +0000
>> From: Deep Throat <deepthroat20004@hotmail.com>
>> To: schroebel6@aol.com
>> Subject: Spamhaus Exposed
>>
>> Disturbing information on one of the founders of Spamhaus.org
>>
>> http://www.geocities.com/jackjack9872004/
>
> _______________________________________________________________________
>
> And while the website was unavailable and the sender is being anonymous
> (whichis against nanog list policies if this was sent through it), what I
> do find worse is that they managed to do it so that nanog@merit.edu is not
> added to "CC" (which if I understood is always supposed to happen when
> something through this mail list, which makes me think it might have
> come through merit mail machine but not actually though mail list). What
> I find even more disturbing is that ip address listed as origin (which may
> well have been forged if they managed to gain some highier level access to
> merit servers) is that of US Military.
>
> Below is the header for your review. I do however find it slightly more
> likely that its some kind of sophisticated joe-job on spamhaus and that
> info is forged but they may have used some bug on merit mail software.
>
I got it to. Let me throw some insight into this - notice the To line:
To: schroebel6@aol.com
IIRC, thats Peter Schroebel, aka SMS Online. Peter has it out for Steve
Linford of SpamHaus because SMS Online is listed for hosting spammers. He
claims that SpamHaus wanted $10k from him to be removed.
Peter tried to bribe the AHBL a few weeks ago to get us to remove him from our
system.
Peter likes to gloat about all the connections he has, and how powerful he is
(though I have yet to see proof of this).
So, I'm not exactly sure what to make of this... It could be Peter, and the
mirror of the page I've seen certainly makes it look like something he'd
write. But, could be a joe job too.
--
Brian Bruns
The Summit Open Source Development Group
Open Solutions For A Closed World / Anti-Spam Resources
http://www.sosdg.org
The Abusive Hosts Blocking List
http://www.ahbl.org
