This first one is actually a newsgroup posting in response to a notice I had posted of turning in a MMF spammer... From ???@spamblock@??? Sun Oct 27 14:52:36 1996 Received: from unixg.ubc.ca (mail.unixg.ubc.ca [137.82.27.14]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id NAA17157 for {klucke@spamblock@pacifier.com}; Sun, 27 Oct 1996 13:44:40 -0800 (PST) Received: from interchg.ubc.ca (tichu@spamblock@intrback.unixg.ubc.ca [192.168.10.2]) by unixg.ubc.ca (8.7.5/8.7.3) with ESMTP id NAA23571 for {klucke@spamblock@pacifier.com}; Sun, 27 Oct 1996 13:44:38 -0800 (PST) From: Timothy Chu {tichu@spamblock@unixg.ubc.ca} Received: (from tichu@spamblock@localhost) by interchg.ubc.ca (8.7.5/8.7.1) id NAA05536 for klucke@spamblock@pacifier.com; Sun, 27 Oct 1996 13:44:37 -0800 (PST) Date: Sun, 27 Oct 1996 13:44:37 -0800 (PST) Message-Id: {199610272144.NAA05536@spamblock@interchg.ubc.ca} To: klucke@spamblock@pacifier.com (Ken Lucke) Subject: Re: Just try this, it will work Newsgroups: alt.binaries.satellite-tv, alt.binaries.scientology, alt.binaries.simulators.autos, alt.binaries.sounds.cartoons, alt.binaries.sounds.d, alt.binaries.sounds.erotica, alt.binaries.sounds.midi, alt.binaries.sounds.misc, alt.binaries.sounds.mods, alt.binaries.sounds.mods.d, alt.binaries.sounds.monty-python, alt.binaries.sounds.movies, alt.binaries.sounds.music, alt.binaries.sounds.samples.music, alt.binaries.sounds.tv, alt.binaries.sounds.utilities, alt.binaries.startrek, alt.binaries.starwars, alt.binaries.warez Content-Type: text X-UIDL: 49c5e770ab727a9e6eaa9c7d7d3faed7 Organization: University of British Columbia, Vancouver, B.C., Canada X-Newsreader: TIN [version 1.2 PL2] In article {klucke-ya023080002710960910220001@spamblock@nes.pacifier.com} you wrote: : FWIW: As with all these idiot spammers who get through my filters, a : message has been sent to all admin areas of this person's ISP regarding his : participation in an illegal internet chain letter scheme, as well as to the : IRS (regarding his claim to have made $47,000 in small bills). Hi Ken, Just wanted to thank you for doing all of us a service to get these idiots (how'd they become smart enough to use services other than AOL anyways?) to stop these kind of postings. -- ,,*,,,,,,,,,______/|___,i__/~~, ,. ,.',,/ tichu@spamblock@unixg.ubc.ca / o \` / ` ' | Vancouver | o / ))) --_\ | British Columbia | {TIM} ~~~\|----~~\ \ www.ugrad.cs.ubc.ca/spider/v8k1

From ???@spamblock@??? Mon Nov 11 01:26:38 1996 Received: from online.no (pilt.online.no [193.212.1.34]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id AAA28396 for {klucke@spamblock@pacifier.com}; Mon, 11 Nov 1996 00:53:46 -0800 (PST) Received: from death.online.no (~inafl@spamblock@death.telepost.no [193.212.6.160]) by online.no (8.7.6/8.7.3) with SMTP id JAA01408; Mon, 11 Nov 1996 09:53:43 +0100 (MET) Message-Id: {2.2.32.19961111085301.00723ba8@spamblock@online.no} X-Sender: inafl@spamblock@online.no X-Mailer: Windows Eudora Pro Version 2.2 (32) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 11 Nov 1996 09:53:01 +0100 To: Ken Lucke {klucke@spamblock@pacifier.com} From: Ina Faye-Lund {abuse@spamblock@online.no} Subject: Re: Illegal Internet Chain Letter Cc: atlantis@spamblock@online.no X-UIDL: 425ac6922c6af3cafe4b5f7bc0e73a25 At 21:27 10.11.96 -0800, Ken Lucke wrote: }Below is quoted in its entirety a message (plus header information) that }was spammed across the internet newsgroups, apparently by one of your }users, attempting to futher an illegal chain letter scheme, in violation of }Federal US and individual State statutes, as well as those of most other }countries: His account has been closed due to misuse. }These rulings in the the US echo identical rulings in many other countries, }including (but not limited to): Canada, Australia, Japan, Great Britain, }Ireland, Holland, and most other countries. If your country is not listed }here, and has rulings pertaining this matter, please respond with data }concerning that ruling, or a pointer to where such data can be found so }that records can be updated. This is also illegal in Norway, and we _do_ take action against it. -- Ina Faye-Lund _____________________ Computers have feelings too.

From ???@spamblock@??? Mon Nov 11 13:14:44 1996 Received: from franklin.cris.com (franklin.cris.com [199.3.12.31]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id MAA03954 for {klucke@spamblock@pacifier.com}; Mon, 11 Nov 1996 12:41:44 -0800 (PST) Received: from hubble.cris.com (hubble.cris.com [199.3.12.166]) by franklin.cris.com (8.7.5/(96/11/08 3.6)) id PAA28079; Mon, 11 Nov 1996 15:41:39 -0500 (EST) [1-800-745-2747 The Concentric Network] Errors-To: {abuse@spamblock@cris.com} Received: from localhost by hubble.cris.com (4.1) id AA27714; Mon, 11 Nov 96 15:41:36 EST Date: Mon, 11 Nov 1996 15:41:35 -0500 (EST) From: Abuse Monitors {abuse@spamblock@cris.com} To: Ken Lucke {klucke@spamblock@pacifier.com} Subject: Re: Illegal Internet Chain Letter In-Reply-To: {l03010600aeac66be374e@spamblock@[204.245.231.66]} Message-Id: {Pine.SUN.3.95.961111153846.27511C-100000@spamblock@hubble.cris.com} Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-UIDL: c2344858757241e2afd812e6a295eb54 Hello, Thank you for bringing this to our attention. We have determined the account responsible and have dealt with it accordingly. Owen Kinney Network Violations & Abuse Department abuse@spamblock@concentric.net Concentric Network Corporation 800.745.2747 On Sun, 10 Nov 1996, Ken Lucke wrote: } -----BEGIN PGP SIGNED MESSAGE----- } } Below is quoted in its entirety a message (plus header information) that } was spammed across the internet newsgroups, apparently by one of your [snip]

From ???@spamblock@??? Sun Nov 17 15:01:50 1996 Received: from calvino.alaska.net (root@spamblock@calvino.alaska.net [206.149.65.3]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id BAA07489 for {klucke@spamblock@pacifier.com}; Sun, 17 Nov 1996 01:58:59 -0800 (PST) Received: from [206.149.80.108] (ahernlj@spamblock@joy.alaska.net [206.149.80.108]) by calvino.alaska.net (8.8.0/8.7.3) with SMTP id AAA09547 for {klucke@spamblock@pacifier.com}; Sun, 17 Nov 1996 00:58:53 -0900 (AKST) Message-Id: {v01550104acd20963f7da@spamblock@[206.149.80.108]} Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Fri, 17 Nov 1995 00:59:07 -0900 To: Ken Lucke {klucke@spamblock@pacifier.com} From: ahernlj@spamblock@alaska.net (Lance Ahern) Subject: Re: Illegal Internet Chain Letter X-UIDL: 37828eb400eb8fb0a084bb20e5f42454 ufo's account has been disbled until I ream him out. sorry for this, Lance }-----BEGIN PGP SIGNED MESSAGE----- } }Below is quoted in its entirety a message (plus header information) that }was spammed across the internet newsgroups, apparently by one of your }users, attempting to futher an illegal chain letter scheme, in violation of [snip]

From ???@spamblock@??? Tue Nov 19 09:11:19 1996 Received: from hurricane.servtech.com (root@spamblock@hurricane.servtech.com [199.1.22.89]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id IAA20917 for {klucke@spamblock@pacifier.com}; Tue, 19 Nov 1996 08:21:28 -0800 (PST) Received: from bart.servtech.com (bart.servtech.com [199.1.22.86]) by hurricane.servtech.com (8.8.0/8.8.3) with SMTP id LAA21853 for {klucke@spamblock@pacifier.com}; Tue, 19 Nov 1996 11:21:25 -0500 (EST) Message-Id: {3.0.32.19961119111850.006c2f94@spamblock@hurricane.servtech.com} X-Sender: rajib@spamblock@hurricane.servtech.com X-Mailer: Windows Eudora Pro Version 3.0 (32) Date: Tue, 19 Nov 1996 11:18:51 -0500 To: Ken Lucke {klucke@spamblock@pacifier.com} From: Rajib Rashid {rajib@spamblock@servtech.com} Subject: Re: Illegal Internet Chain Letter Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-UIDL: 8c4eadaaab1e88b3b3a9c622ca41ff81 Hello: Thank you for bringing this to our attention. This is a definite violation of our user policy and this user will be dealt with accordingly. Thanks again and sorry for any inconvience this may have caused you. Regards - Rajib At 11:24 PM 11/18/96 -0800, you wrote: }-----BEGIN PGP SIGNED MESSAGE----- } }Below is quoted in its entirety a message (plus header information) that }was spammed across the internet newsgroups, apparently by one of your [snip] --- Rajib Rashid S e r v i c e T e c h I n c Systems/Network Administrator rajib@spamblock@servtech.com http://www.servtech.com/staff/rajib/ (800) 454-4874

Now THIS guy either a) REALLY hates spam, b) REALLY hates this user, or c) some combination thereof. From ???@spamblock@??? Wed Nov 20 17:00:20 1996 Received: from brick.intranet.csupomona.edu (brick.intranet.csupomona.edu [134.71.184.100]) by mail.pacifier.com (8.7.6-pac/8.7.3) with SMTP id KAA26671 for {klucke@spamblock@pacifier.com}; Wed, 20 Nov 1996 10:28:18 -0800 (PST) Received: by brick.intranet.csupomona.edu; (5.65v3.2/1.1.8.2/21May96-0249PM) id AA11739; Wed, 20 Nov 1996 10:29:08 -0800 Date: Wed, 20 Nov 1996 10:29:08 -0800 Message-Id: {9611201829.AA11739@spamblock@brick.intranet.csupomona.edu} From: "Paul B. Henson" {henson@spamblock@intranet.csupomona.edu} To: klucke@spamblock@pacifier.com Cc: armyrman@spamblock@csupomona.edu In-Reply-To: {v03007804aeb855382c7f@spamblock@[204.245.231.87]} (message from Ken Lucke on Tue, 19 Nov 1996 22:34:19 -0800) Subject: Re: Illegal Internet Chain Letter Reply-To: pbhenson@spamblock@csupomona.edu X-UIDL: dda0762801753d8756628732655e96db } Please take appropriate action against your user. Many SysAdmins are } either suspending posting capabilities or terminating the account } altogether for these kind of activities, and I hope you are one of these. His account has been locked, and the case has been remanded to his department chair for further action. } This kind of trash degrades everyone's experience with using the internet, } and traps and suckers many innocent victims. I agree. I apologize for this user's idiocy. Rest assured he will not do this again. } If applicable (i.e., the spammer appears to live in the US), a separate } message has also been sent to the US Internal Revenue Service highlighting } this person's claim to have made a large quantity of money in small bills. hahahahaaa.... Now, *that* would be funny. I've never seen that approach before, but it definitely brings a smile. I can just imagine the IRS showing up at this guys house and freezing his assets while they investigate him ;)... } Your prompt action is appreciated on behalf of all legitimate users of the } internet. I hate spam. I've often complained to sites myself, generally with no response. I hope that an assurance that spam is not acceptable here and that action will be taken is at least partial retribution for our user's actions. -- Paul Henson | System Administrator | Cal Poly Pomona | (909) 869-3781 pbhenson@spamblock@csupomona.edu | finger henson@spamblock@brick.dce.csupomona.edu for PGP key

From ???@spamblock@??? Tue Dec 03 00:13:05 1996 Received: from fly.HiWAAY.net (root@spamblock@fly.HiWAAY.net [204.214.4.2]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id AAA14091 for {klucke@spamblock@pacifier.com}; Tue, 3 Dec 1996 00:10:57 -0800 (PST) Received: from localhost by fly.HiWAAY.net; (8.8.2/1.1.8.2/21Sep95-1003PM) id CAA05476; Tue, 3 Dec 1996 02:10:50 -0600 (CST) Date: Tue, 3 Dec 1996 02:10:49 -0600 (CST) From: HiWAAY Information Services {root@spamblock@HiWAAY.net} To: Ken Lucke {klucke@spamblock@pacifier.com} Subject: Re: Illegal Internet Chain Letter In-Reply-To: {v03007800aec65ea9b272@spamblock@[204.245.231.67]} Message-ID: {Pine.OSF.3.94.961203021044.8119D-100000@spamblock@fly.HiWAAY.net} MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-UIDL: e516a98d79bea9926daade8e3cfa8d87 Thank you for bringing this matter of the usenet spam regarding "REALLY GOOD" apparently a chain letter fraud. We have investigated the matter and taken action we hope will reduce the likelihood of similar messages being sent in the future. It appears the posts were made using the account of Chad Wilson (chadw@spamblock@HiWAAY.net). The account has been terminated for violating our acceptable use policy. If the problem persists, please let us know as soon as possible so that we can look into further actions we might take. Report problems to abuse@spamblock@HiWAAY.net or postmaster@spamblock@HiWAAY.net Regards, Mark ================================================================ Mark Derrick, Postmaster HiWAAY Information Systems Telephone (205) 533-4296 721 Clinton Avenue, Suite #8 Toll Free (888) 244-9229 Huntsville, AL 34804 FAX (205) 533-5686 http://www.HiWAAY.net

From ???@spamblock@??? Mon Dec 02 08:44:46 1996 Received: from maelstrom.dial.pipex.net (maelstrom.dial.pipex.net [158.43.128.52]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id GAA11489 for {klucke@spamblock@pacifier.com}; Mon, 2 Dec 1996 06:39:25 -0800 (PST) Received: from typhoon.dial.pipex.net by maelstrom.dial.pipex.net (8.8.2/) id OAA03069; Mon, 2 Dec 1996 14:39:17 GMT Received: from ambient.uunet.pipex.com by typhoon.dial.pipex.net (8.8.2/UUNET PIPEX simple 1.29) id OAA17132; Mon, 2 Dec 1996 14:37:46 GMT Message-ID: {32A2E9E2.7634@spamblock@dial.pipex.com} Date: Mon, 02 Dec 1996 14:38:26 +0000 From: PIPEX Dial Support {support@spamblock@dial.pipex.com} X-Mailer: Mozilla 2.02 (Win95; I) MIME-Version: 1.0 To: klucke@spamblock@pacifier.com CC: support@spamblock@dial.pipex.com Subject: Re: FWD: illegal internet chain letter References: {32A2A778.7373@spamblock@pipex.net} X-URL: http://vent.pipex.net/maple/cgi-bin/maple?what=u&who= s&ua=n&assignee=level1&msgid=32A2A778.7373%40pipex.net&action=m Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-UIDL: 6fcff6369f6232af6b3f983902427e59 Hi there, Thanks for bringing this to our attention and , as I'm sure you're aware, you're not the first. We shall be contacting the alleged poster in question ourselves (I noticed you have already Cc'd them). We often find that telling a user of the acceptable use policy is enough in most cases. Generally, most of the posters were not aware that: a) Mass postings were frowned upon, and amazingly b) such schemes would never work in the first place. Most people are scared enough to never do anything similar, and most apologise unreservedly for their actions. I suspect that this situation will be no different, although according to our records the name (Aiden) and username do not tie up, so it may be that someone else was using his ID. Thanks again, incidentally if the users email address is @spamblock@dial.pipex.com, you need to email us at support@spamblock@dial.pipex.com } -----BEGIN PGP SIGNED MESSAGE----- } } ISP Personnel: please read notes just prior to quoted material. } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ } Below is quoted in its entirety a message (plus header information) that } was spammed across the usenet newsgroups, apparently by one of your } users, attempting to futher an illegal chain letter scheme, in violation } of [snip] Regards, Ed -- Pipex Dial | The latest news, help & information Technical Support | is on the Support Services pages: support@spamblock@dial.pipex.com | Use Netscape to open Location | http://www.dial.pipex.com/ | When replying please leave responses | to previous messages in the body text.

From ???@spamblock@??? Tue Dec 03 14:25:19 1996 Received: from gaia.ucs.orst.edu (root@spamblock@gaia.UCS.ORST.EDU [128.193.4.2]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id OAA06011 for {klucke@spamblock@pacifier.com}; Tue, 3 Dec 1996 14:10:16 -0800 (PST) Received: from localhost (kean@spamblock@localhost [127.0.0.1]) by gaia.ucs.orst.edu (8.7.5/8.7.3) with SMTP id OAA19965; Tue, 3 Dec 1996 14:09:55 -0800 (PST) Message-Id: {199612032209.OAA19965@spamblock@gaia.ucs.orst.edu} To: klucke@spamblock@pacifier.com cc: turmoil@spamblock@animal.blarg.net, wa7twi@spamblock@primenet.com, Chuck.K@spamblock@ix.netcom.com, BrianHall@spamblock@worldnet.att.net, ken@spamblock@kenbarr.com, silversm@spamblock@law.harvard.edu, postmaster@spamblock@ups.edu, abuse@spamblock@ups.edu, cameron@spamblock@rahul.net, aldrich@spamblock@ups.edu, ptaylor@spamblock@ups.edu, bhamel@spamblock@fas.harvard.edu, jleslie@spamblock@igate.dmccorp.com, eliot@spamblock@dg-rtp.dg.com, ebham@spamblock@vnet.net, kean@spamblock@gaia.ucs.orst.edu Subject: Re: Fast Cash$$$Read here!!! Date: Tue, 03 Dec 1996 14:09:49 PST From: Kean Stump {kean@spamblock@gaia.ucs.orst.edu} X-UIDL: 58b757b8766cc0a1720fdbf1134252fc We're aware of the MMF spew coming from inside bus.orst.edu. Unfortunately (for us and the net) the manager of the College of Business open-access labs has not made user logging in the lab a priority. We have no way of identifying who posts any particular message from that lab other than the information in the spam itself. In this case, the street address listed in the MMF matches 16 students, of which zero have names that can be mangled into the T.J. initials in the message. We're starting the internal political process to disable news posting access for that lab. Kean Kean Stump Network Engineering kean@spamblock@nws.orst.edu Oregon State University OSU doesn't pay me to have official opinions. (541)-737-4740

From ???@spamblock@??? Tue Oct 29 09:57:34 1996 Received: from aoife.indigo.ie (aoife.indigo.ie [194.125.133.9]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id JAA00236 for {klucke@spamblock@pacifier.com}; Tue, 29 Oct 1996 09:17:57 -0800 (PST) Received: (from boyleb@spamblock@localhost) by aoife.indigo.ie (8.7.5/8.7.5) id QAA28326 for klucke@spamblock@pacifier.com; Tue, 29 Oct 1996 16:47:34 GMT Date: Tue, 29 Oct 1996 16:47:34 GMT From: Brian Boyle {boyleb@spamblock@indigo.ie} Message-Id: {199610291647.QAA28326@spamblock@aoife.indigo.ie} To: klucke@spamblock@pacifier.com Subject: Foolish chain letter X-UIDL: 0fc50e89ddf13b7d872856b327f00905 Hello, } From: okelly@spamblock@indigo.ie } Subject: a great idea that might work Thank you for taking the time to email Indigo regarding the publication of a chain letter in a number of Usenet newsgroups recently. We at Indigo take this form of misuse very seriously, and are grateful for your efforts to bring it to our attention. Our normal procedure is to suspend the offending user's account and wait for them to get in contact with us. We then issue a warning, and request that they do not post any similar articles again, and further advise them on guidelines for using Usenet in general. This is currently how events stand in this case. Should any further abuse take place, let me assure you that we will take it very seriously. Once again, thanks for your time. Regards, Brian Boyle Network Operations Centre Indigo

Just LOOK at the cc: list on this one, and read the comment. You think these things don't get responded to??!?!?! From ???@spamblock@??? Tue Nov 26 16:43:05 1996 Received: from herkules (herkules.phosworks.se [194.18.87.200]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id OAA03472 for {klucke@spamblock@pacifier.com}; Tue, 26 Nov 1996 14:36:57 -0800 (PST) Received: (from root@spamblock@localhost) by herkules (8.7.1/8.7.1) id WAA12377; Tue, 26 Nov 1996 22:18:25 +0100 (MET) Date: Tue, 26 Nov 1996 22:18:25 +0100 (MET) From: Operator {root@spamblock@herkules} Message-Id: {199611262118.WAA12377@spamblock@herkules} To: "Eric, *ericvia@spamblock@why.net, BARLIN@spamblock@decus.org.au, BURGLIN@spamblock@ubaclu.unibas.ch, Bruce.Fast@spamblock@Colorado.EDU, Chuck.K@spamblock@ix.netcom.com, CurtAkin@spamblock@aol.com, David_Meyer@spamblock@newavid.avid.com, Debbie-Cowherd@spamblock@uiowa.edu, DickSchnei@spamblock@aol.com, Felix.Rauch@spamblock@nice.ch, Finn.Jorgensen@spamblock@akoi.irisa.fr, Gavin_J_Chester@spamblock@sbphrd.com, J.Knoblach@spamblock@lft.uni-erlangen.de, JaapJL@spamblock@ASMOBJ.LaRC.NASA.GOV, Jorn.Dahl-Stamnes@spamblock@fysel.ntnu.no, Keerbs"@spamblock@H, P.com@spamblock@herkules, L.Meyer@spamblock@ix.netcom.com, Leslie_Baxter@spamblock@Brown.edu, MADwand@spamblock@concentric.net, MRL@spamblock@PFC.MIT.EDU, Mcbfcdan@spamblock@aol.com, Mookie@spamblock@execpc.com, Oyvind.Pedersen@spamblock@capella.no, Pinchick@spamblock@aol.com, Steve.Timpson@spamblock@MCI.Com, Telecom@spamblock@Eureka.vip.best.com, abw38027@spamblock@ggr.co.uk, afelson@spamblock@blackhole.dimensional.com, afn46369@spamblock@afn.org, amala@spamblock@falchion.llnl.gov, as440@spamblock@freenet.carleton.ca, attilla@spamblock@netcom.com, awouk@spamblock@nyx.net, baez@spamblock@math.ucr.edu, balpert@spamblock@netaxs.com, bennert@spamblock@ucsub.Colorado.EDU, bgeerdes@spamblock@igs.com, bgoodric@spamblock@nyx.net, bjorkste@spamblock@csc.fi, bjwaltr@spamblock@interaccess.com, blah+@spamblock@andrew.cmu.edu, blenko-tom@spamblock@CS.YALE.EDU, bobfry@spamblock@crl.com, bolsinga@spamblock@austin.metrowerks.com, briang@spamblock@netcom.com, budda@spamblock@infocomm.net, burke@spamblock@odegard.com, cameron@spamblock@rahul.net, carlisle@spamblock@wuchem.wustl.edu, cat@spamblock@va.pubnix.com, cjgmsc@spamblock@scaixr1.nsc.com, cogen@spamblock@ll.mit.edu, corbet@spamblock@bastet.gsfc.nasa.gov, craig@spamblock@green.studio.sgi.com, cshftin@spamblock@ug.cs.ust.hk, daemon@spamblock@herkules, dansmail@spamblock@crl.com, dave@spamblock@kentrox.com, davef@spamblock@mda.ca, davep@spamblock@visix.com, daver@spamblock@ECE.ORST.EDU, dayton@spamblock@jhunix.hcf.jhu.edu, demjones@spamblock@wsii.com, denisej#swbi.net@spamblock@herkules, dgersic@spamblock@niu.edu, doligez@spamblock@volnay.inria.fr, dougc@spamblock@inforamp.net, dwhawk@spamblock@southwind.net, ebham@spamblock@vnet.net, ecl2@spamblock@xs2.xs4all.nl, eedfla@spamblock@chapelle.eed.ericsson.se, elliottmc@spamblock@cardiff.ac.uk, exuclem@spamblock@exu.ericsson.se, fch2@spamblock@cornell.edu, fedeclue@spamblock@nexusprime.org, firstimp@spamblock@halcyon.com, fongda@spamblock@netcom.com, formenti@spamblock@saiph.hpl.hp.com, fsandy@spamblock@sunspot.tiac.net, gchapman@spamblock@irus.rri.uwo.ca, gcornu@spamblock@lyonnet.dtr.fr, gilham@spamblock@csl.sri.com, gitlitz_mark@spamblock@isus.emc.com, gpasq@spamblock@dbintellect.com, hamilton@spamblock@dg-rtp.dg.com, hawkfan@spamblock@interaccess.com, heglowstein@spamblock@BIX.com, hermanr@spamblock@ifi.uio.no, hlehmann@spamblock@encorevideo.com, holstege@spamblock@firstfloor.COM, hyatt@spamblock@crafty.cis.uab.edu, ivancich@spamblock@eecs.umich.edu, jakob@spamblock@cdg.chalmers.se, james@spamblock@ember.cdac.com, jeremy.brown@spamblock@materna.de, jerker@spamblock@kuai.se, jff@spamblock@x.org, jmartell@spamblock@uoguelph.ca, johan@spamblock@phosworks.se, john@spamblock@siu.edu, johnl@spamblock@iecc.com, jon@spamblock@we-b-tv.com, jonc@spamblock@twinsun.com, jparker@spamblock@samosa.agile.com, kamikaze@spamblock@hh-einstein.csh.uiuc.edu, kate@spamblock@Soo.com, kflying@spamblock@cybernw.com, klucke@spamblock@pacifier.com, kspeicht@spamblock@fox.nstn.ca, laan@spamblock@win.tue.nl, lars@spamblock@phosworks.se, larson@spamblock@net.com, leen@spamblock@fwi.uva.nl, liondog@spamblock@isomedia.com, lph@spamblock@post1.tele.dk, m.d.r.beasley@spamblock@zetnet.co.uk, martens@spamblock@worldnet.att.net, mckone_peter@spamblock@tandem.com, mcmiller@spamblock@access.digex.net, mibu@spamblock@scrum.muc.de, michael@spamblock@magick.net, mike@spamblock@softwarezone.com, mikey@spamblock@monkfish.nosc.mil, milgram@spamblock@eng.umd.edu, mleger@spamblock@connect.net, moellney@spamblock@simtec.imr.mb.uni-siegen.de, mstone@spamblock@tencor.com, myers@spamblock@walden.physics.lsa.umich.edu, news@spamblock@news2.acs.oakland.edu, ornstead@spamblock@apple.com, pas4189@spamblock@unix.tamu.edu, phil.burden@spamblock@zetnet.co.uk, postmaster@spamblock@phosworks.se, pschikor@spamblock@ezinfo.ucs.indiana.edu, ptomblin@spamblock@xcski.com, puma@spamblock@netcom.com, qwerty@spamblock@dwroll.dw.lucent.com, reine.johansson@spamblock@mbox2.swipnet.se, rgenter@spamblock@5dgames.com, rice@spamblock@ttd.teradyne.com, richard@spamblock@mindlink.bc.ca, robert@spamblock@janus.se, rotter@spamblock@mi.uni-erlangen.de, rsavors@spamblock@infinet.com, rteeter@spamblock@netcom.com, rweaver@spamblock@ix.netcom.com, scheidell@spamblock@fdma.fdma.com, schumach@spamblock@flare.convex.com, sethb@spamblock@panix.com, siegler@spamblock@clark.net, silversm@spamblock@law.harvard.edu, simanton@spamblock@mcc.com, slf@spamblock@netcom.com, snoopy@spamblock@kkm02.chem.emory.edu, ssampson@spamblock@claven.tinker.af.mil, stuart@spamblock@uis.edu, suhler@spamblock@pollux.usc.edu, swestin@spamblock@ford.com, tcyang@spamblock@netcom.com, the1@spamblock@umbc.edu, thomas.granvold@spamblock@Eng.Sun.COM, thomas.lewis@spamblock@me.gatech.edu, titus@spamblock@clisome9.rose.hp.com, tks@spamblock@Sun.COM, tlie@spamblock@nyx.net, tom911@spamblock@internetmci.com, tomk@spamblock@magnum.fc.hp.com, tompa@spamblock@portofix.ida.liu.se, trfenwic@spamblock@mtu.edu, txaggie@spamblock@earth.execpc.com, uncleal0@spamblock@ix.netcom.com, unclebob@spamblock@rci.ripco.com, visser@spamblock@ph.tn.tudelft.nl, voidmstr@spamblock@primenet.com, wdc@spamblock@shiraz.as.utexas.edu, willner@spamblock@cfa183.harvard.edu, wolfgang@spamblock@wsrcc.com, wtsoft@spamblock@ix.netcom.com Subject: Apology X-UIDL: 9db728c717241d9a025268fc8cf46c69 Dear Sirs and Madams, Regarding your mails concerning spamming an enourmous amount of newsgroups with an illegal chain-letter originating from our host. We are sincerely sorry and have corrected Mr. Lars Westin and assured that this will never happen again. Please accept our apologies. Please do not reply to this mail - we can't handle all the incoming mail. So far, we have received close to 3000 mails regarding this matter. Thank you, The system administration at Phosworks root@spamblock@phosworks.se

From ???@spamblock@??? Tue Dec 03 14:25:04 1996 Received: from lucius.ultra.net (lucius.ultra.net [199.232.56.38]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id MAA29817 for {klucke@spamblock@pacifier.com}; Tue, 3 Dec 1996 12:59:12 -0800 (PST) Received: from cleopatra.ultra.net (cleopatra.ultra.net [199.232.56.35]) by lucius.ultra.net (8.7.4/ult1.04) with ESMTP id PAA19046 for {klucke@spamblock@pacifier.com}; Tue, 3 Dec 1996 15:58:36 -0500 (EST) Received: (from u-dwight@spamblock@localhost) by cleopatra.ultra.net (8.7.4/ult1.04) id PAA05160 for klucke@spamblock@pacifier.com; Tue, 3 Dec 1996 15:59:07 -0500 (EST) Date: Tue, 3 Dec 1996 15:59:07 -0500 (EST) From: "Dwight A. Ernest" {dwight@spamblock@ultranet.com} Message-Id: {199612032059.PAA05160@spamblock@cleopatra.ultra.net} To: klucke@spamblock@pacifier.com Subject: PYR/SPAM:jseamans@spamblock@nh [UltraNet NOC #9183] X-UIDL: 4cd240365ea8d3a5ce40785a2daa4695 Dear Sir/Madame, You were among the many who complained with regard to our customer's pyramid scheme/Usenet spamming. The customer's username was {jseamans@spamblock@nh.ultranet.com}. On behalf of our customer, we apologize for this offense. We have cancelled all known articles which he posted. We have taken appropriate disciplinary action and this person is no longer an UltraNet customer. The matter was discussed with him and he is contrite and had promised to return any and all monies collected as a result of the scheme. Thank you for bringing this to our attention. Regards, Dwight A. Ernest Network Operations Manager Network and Systems Administration Team, UltraNet Communications Inc. 508.229.8400 x3005(voice) noc@spamblock@ultra.net 508.303.0189 NOC The Premier Network Service Provider in New England mailto:info@spamblock@ultra.net

From ???@spamblock@??? Tue Dec 03 14:24:54 1996 Received: from samnet.com (samnet.com [208.128.30.6]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id KAA19535 for {klucke@spamblock@pacifier.com}; Tue, 3 Dec 1996 10:57:39 -0800 (PST) Received: (from root@spamblock@localhost) by samnet.com (8.8.2/8.7.3) id NAA21412; Tue, 3 Dec 1996 13:59:25 -0600 From: root {root@spamblock@samnet.com} Message-Id: {199612031959.NAA21412@spamblock@samnet.com} Subject: Re: (fwd) This already worked once, give it a shot To: tennis@spamblock@brookings.net (Jay Schell) Date: Tue, 3 Dec 1996 13:59:25 -0600 (CST) Cc: tennis@spamblock@brookings.net, PmG@spamblock@flightb.demon.co.uk, no.junk.email@spamblock@home.com, klucke@spamblock@pacifier.com, howardk@spamblock@netcom.com, daytonak@spamblock@ix.netcom.com In-Reply-To: {199612022317.RAA23103@spamblock@serv.brookings.net} from "Jay Schell" at Dec 3, 96 00:07:15 am X-Mailer: ELM [version 2.4 PL25] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-UIDL: 39b4a74f3a012c745051091cbfc2a54f Thanks for letting me know of one of my users conducting an illega activity. I'll make sure he does not do this again. Kevin T. Kang root@spamblock@samnet.com

From ???@spamblock@??? Sat Nov 16 12:39:00 1996 Received: from moon.nwa.com (moon.nwa.com [139.72.190.28]) by mail.pacifier.com (8.7.6-pac/8.7.3) with ESMTP id MAA26257 for {klucke@spamblock@pacifier.com}; Sat, 16 Nov 1996 12:31:52 -0800 (PST) Received: by moon.nwa.com; id OAA14119; Sat, 16 Nov 1996 14:31:37 -0600 (CST) Received: from unknown(139.72.94.16) by moon.nwa.com via smap (V3.1) id xma014117; Sat, 16 Nov 96 14:31:16 -0600 Received: from [139.72.121.44] ([139.72.121.44]) by nwa.com (8.7.3/8.7.3) with SMTP id OAA11507 for {klucke@spamblock@pacifier.com}; Sat, 16 Nov 1996 14:31:30 -0600 (CST) X-Authentication-Warning: blizzard.ic.nwa.com: Host [139.72.121.44] didn't use HELO protocol Message-ID: {328E4067.4B1C@spamblock@nwa.com} Date: Sat, 16 Nov 1996 14:29:59 -0800 From: Todd Brunner {Todd.Brunner@spamblock@nwa.com} Organization: Northwest Airlines X-Mailer: Mozilla 2.0 (Win16; I) MIME-Version: 1.0 To: klucke@spamblock@pacifier.com Subject: [Fwd: Cobb@spamblock@nwa.com Spamming news groups] Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Content-Disposition: inline X-UIDL: 22d07a36a838bf0de3763df852725d53 X-Mozilla-Status: 0001 Message-ID: {328E3F80.4732@spamblock@nwa.com} Date: Sat, 16 Nov 1996 14:26:08 -0800 From: Todd Brunner {Todd.Brunner@spamblock@nwa.com} Organization: Northwest Airlines X-Mailer: Mozilla 2.0 (Win16; I) MIME-Version: 1.0 To: mjt@spamblock@dk-online.dk CC: rgoforth@spamblock@u.washington.edu, klucke@spamblock@pacifier.com Subject: Cobb@spamblock@nwa.com Spamming news groups Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Thank you all for sending us information on the spamming. The id cobb@spamblock@nwa.com is not a valid Northwest Airlines account. We have checked our news logs and firewall logs for someone inside Northwest possibly spoofing this address and have found nothing. We are now looking into the possibility of someone outside our organization spoofing this account. If you have any further information please pass it along. If this was a Northwest Airlines employee we would terminate their account and possibly take furthur measures. Thank you all again. Todd Brunner Northwest Airlines IS Security

From: nelson@spamblock@clunix.cl.msu.edu (Doug Nelson) Subject: Re: Illegal Internet Chain Letter To: klucke@spamblock@pacifier.com (Ken Lucke) Date: Wed, 1 Jan 1997 12:57:11 -0500 (EST) Already handled. Doug Nelson nelson@spamblock@msu.edu Network Manager Ph: (517) 353-2980 Computer Laboratory Michigan State University > -----BEGIN PGP SIGNED MESSAGE----- > > > [ ] ISP Personnel: please read notes just prior to quoted material if marked > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > [snip]

Subject: Re: Illegal Internet Chain Letter To: klucke@spamblock@pacifier.com (Ken Lucke) Date: Tue, 14 Jan 97 23:23:02 MST From: "J. N. R. Barnecut" {barnecut@spamblock@acs.ucalgary.ca} Mime-Version: 1.0 In response to the message from Ken Lucke to postmaster@spamblock@acs.ucalgary.ca on Tue Jan 14 22:50:00 1997. Thank you for your notification about the pyramid scheme being spammed. I have cancelled the articles if they have been identified clearly in your mail with an ID. The user's account has been disabled. The RCM Police have been notified. > > > > [ ] ISP Personnel: please read notes just prior to quoted material if marked > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > [snip]

From: Tim Ramsey <tar@spamblock@ksu.edu> Subject: Re: Illegal Internet Chain Letter To: klucke@spamblock@pacifier.com (Ken Lucke) Date: Thu, 13 Feb 1997 16:51:11 -0600 (CST) MIME-Version: 1.0 Thank you for your report on the illegal chain letter SPAM posted to many Usenet news groups by "taidi@matt.ksu.ksu.edu". His account has been suspended pending a meeting with University officials, the articles cancelled by our news admin, and the University police and local USPS postmaster notified. Please report any further incidents or information to "abuse@ksu.edu". ______________________________________ Harvard Townsend, Unix and WAN Mgr Email: harv@ksu.edu Computing and Network Services Voice: (913)532-4908 Kansas State University FAX: (913)532-5914 Manhattan, KS 66506 WWW: http://www-personal.ksu.edu/~harv/ Tim Ramsey tar@ksu.edu UNIX System Administration (913) 532-3742 Computing and Network Services Kansas State University

Date: Mon, 3 Feb 1997 16:55:27 -0500 From: City Hunter <J2KIM@spamblock@SCIBORG.UWATERLOO.CA> To: klucke@spamblock@pacifier.com This account is currently disabled

To: Ken Lucke <KLUCKE@spamblock@PACIFIER.COM> From: Steve <STEVE@LANZ.COM> Subject: Re: Illegal Internet Chain Letter Date: Tue, 28 Jan 1997 07:46:18 -0800 At 11:58 PM 1/27/97 -0800, you wrote: this user is a subscriber to our services, since such activity is illegal, we will take the necessary steps to resolve this situation. Thank you for bringing this to our attention. Steve Administrator >-----BEGIN PGP SIGNED MESSAGE----- > > >[X] ISP Personnel: please read notes just prior to quoted material if marked >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [snip]

Date: Mon, 6 Jan 1997 13:54:12 -0600 (CST) From: Exec-PC Net-Abuse Desk <abuse@spamblock@execpc.com> Reply-to: abuse@spamblock@execpc.com Subject: Thank you for reporting USENET abuse from our site This is a form letter in reponse to you letter to postmaster@execpc.com and/or root@execpc.com and/or abuse@execpc.com with regard to the make-money-fast USENET posting sent by "gmlach@execpc.com" (Subject: "FREE MONEY FAST one works>" and variations, posted to over 150 newsgroups) I'm sorry I can not send you each a personalized response but the volume of complaints USENET spam creates makes that time-prohibitive. If you have a specific question about this user or our policy please contact the Exec-PC abuse desk directly at: abuse@execpc.com Current status of the user as of Monday, January 6th: This user has been closed until they AT LEAST talk to us about proper USENET etiquette. At which time we will inform them of the possible consequences of their actions. Since this is a first offense by this user, I'm certain that that they will get their account back. That will be determined, however, when we have the opportunity to speak to the user directly. **Cancel messages for all of the posts in question were sent out by us ** **at 9:30am (CDT) Monday morning (1/6/97). ** Again, thanks for your part in bringing this abuse to our attention. We truly appriciate your effort in helping to keep USENET free of this sort of trash. -Exec-PC Internet Abuse Desk abuse@spamblock@execpc.com