Re: [WG-Spam] Expect more spam

Friends of the Vietnamese Spam Fighter Brigade ;)

So, let's start with an interesting one:

At 08:43 22.04.2002 +0000, Viet Tran wrote:
-------------------------
>Dear all,
>Who is this vnpostman ?
>I think VDC should be aware of this organisation.

I too am getting more and more mails of this kind. Here is a more complete
header:

To: stefan.probst@hn.vnn.vn
From: postman<vnpostman@yahoo.com>
Date: Sun, 21 Apr 2002 13:29:42 -0400
X-AntiAbuse: This header was added to track abuse, please include it with
any abuse report
X-AntiAbuse: Primary Hostname - alexandria2.dnsnodes.com
X-AntiAbuse: Original Domain - hn.vnn.vn
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [0 99]
X-AntiAbuse: Sender Address Domain - alexandria2.dnsnodes.com
Subject: postman

To note in this regard:
1) I very rarely use my vnn eMail address, which makes me wonder how did
they get it? Did somebody in VDC give a list of users to somebody???
2) Mail from this sender and several other ones come with this
"X-AntiAbuse" header, which at least in this case is rather useless,
because "alexandria2.dnsnodes.com" seems to be a known spam forwarder. All
mail to a postmaster or "abuse" at that domain bounce back.

My suspicion is right now, that
either those folks got a CD which contains
- some spam SW, which uses alexandria2.dnsnodes.com to forward mail
- a list of eMail addresses in Vietnam
or they order the services of somebody who has those resources.

Tung,
can you find out, what happened?
What SW are those people using, and where did they get the eMail addresses
from?
The senders which I have so far (all of them in Vietnam!) are:
"Sao Viet Consulting Co. Ltd." <visco@saoviet.com>
"CLINIQUE" <qtsalon@fpt.vn>
"Vinanetware" <vinanetware@hn.vnn.vn>
"zbksoft" <zbksoft@yahoo.com>
"postman" <vnpostman@yahoo.com>
"HaleClub" <haleclub@mail.com>
All of them use alexandria2.dnsnodes.com.

Once we've found out what happened, could you pls. put this host into your
spammers list, so that no mail from it will be delivered to users in your
network.

Thanks!
And looking forward to an interesting answer....

Cheers,
Stefan