when i woke up this morning, at approximately 8:30, i checked my email, and i had over identical 1,000 spam messages, in my spam folder, and more coming in as i watched… now, at 9:45, i have deleted approximately 1,000 MORE identical spam messages… and there are more coming in at this very moment…

ETA: as of 11:00, i have deleted at least 1,000 MORE identical spam messages… 🙄 if i don’t read it the first time, what could POSSIBLY make a person think that i’ll read it the 5,000th time?

WHY do people do this?

<sigh> 🙄

i suppose it’s similar to asking why people write scripts to delete all the data in unknown peoples’ cloud drives.

as winston churchill said, it doesn’t take all kinds, but there are all kinds. 🙄

why do people who use IPVanish still try to crack my web sites?

why do people who use IPVanish seem to think that i WOULDN’T have a 30-character passphrase and 2FA enabled on my web sites?

why do people who use IPVanish STILL try “Admin123” and other idiotically simple logins from easily tracable IP addresses (despite IPVanish)?? 😕😒

this morning, my wife got what appeared to be a “legitimate” email, but it was delivered to my spam box.

here’s what i know:

it purports to be from the “Colorado State University” department of “Veterinary Continuing Education”, with the URI “CSUvetCE dot com”.

it was delivered by way of an open relay in germany, using at least two other open relays in other, eastern european countries.

my wife CLAIMS that the “Colorado State University, Department of Veterinary Continuing Education” is a legitimate business for which several of her colleagues work.

there is an EXTREMELY good chance that, if someone from the “Colorado State University, Department of Veterinary Continuing Education” were to send my wife an email message, it would come through the mailservers at colorado state university, IN COLORADO, and NOT through several open relays in other countries.

it was addressed to my wife, using an email address for ME, which i haven’t used in at least 5 years.

when i visited the “manage my subscriptions” page at “CSUvetCE dot com”, it listed my wife’s name, only her last name was in the “first name” slot, and her first name was in the “last name” slot, followed by my email address, the physical address where she works, except that instead of being on mercer island, it was listed as being in “medina”, which is a suburb of bellevue, about ten miles away from the actual address location, on the mainland. and, it listed the zip code as being the one where we currently live, which is neither mercer island, nor medina.

the same “manage my subscriptions” page has her listed as the “chief executive officer” of “at home veterinary services”. she does NOT work for “at home veterinary services”, and she is NOT the “chief executive officer”.

when i tried to change the “STATUS” of her subscription from “subscribed” to “unsubscribed”, it didn’t work. i tried it multiple times, and every time the page reloaded, the status said “subscribed”.

so i checked… “CSU” is CHICAGO state university, and their URI is “CSU.EDU”. COLORADO state university’s URI is “colostate.edu”, and the ACTUAL “Colorado State University, Department of Veterinary Continuing Education” is at “cvmbs.colostate.edu”.

now, i don’t KNOW whether or not “CSUvetCE dot com” is a spammer scam or not, but i know that EVERYTHING i have found so far leads me to the conclusion that it is a spammer scam. 😒

also i don’t know why someone would go to SO! MUCH! TROUBLE! to put together a web site that tries its DAMNEDEST to look like a legitimate business, just to lure the relatively few people who are in the veterinary industry into submitting their information to a spam list.

but, as i said… EVERYTHING i have found so far leads me to the conclusion that it’s PRECISELY what they have done…

weird.

ETA: okay, this is getting weirder now… after a bit more poking around, i found an announcement on this page which appears to indicate that CSUvetCE dot com is, in fact, a legitimate page, and not a spammer scam… which, then, makes me wonder EVEN MORE about why the email was sent via open relays to an address that had OBVIOUSLY been scraped from who knows where… like… does the Colorado State University Department of Veterinary Continuing Education care THAT LITTLE about the ethics of the emails they’re sending out? do they even CARE?? 😒

ETA, part 2: i wrote to them, asking why they have a scraped address on a form that doesn’t work. their response said they couldn’t find that address on their mailing list. i wrote back with all the details, including a screen shot and a URI to the spot they said they couldn’t find. they haven’t responded… yet…

i’m back to thinking that this might be a spammer scam masquerading as a legitimate business, and the legitimate business doesn’t have the first clue what is going on. 😒

this morning i added a second /8 block to my email filters.

for those of you wondering what i’m talking about, a /8 block is the largest block of IP addresses allocated by the IANA.

16,777,216 individual IP addresses.

my first filtered /8 block was in japan. my second one was in germany.

and i STILL get spam from japan and from germany. 😒

it doesn’t seem like it was that long ago that spam was something in a monty python skit, and before that, it was a canned meat byproduct.

it’s not even UCE any longer, because most of it is devoted to scams of one kind or another. actual, commercial email is a tiny fraction of the volumes of script-generated spam, these days.

spam times 16,777,216²… which is a number so large my scientific calculator chokes on it… which is to say, it says 2.81474976711e+14 rather than giving me a number i can understand. 😒

for the first time in a VERY long time, i booted up my computer, checked my email, and did NOT have at least 10 “bitcoin-porn-scam-spam” messages in my spam folder…

in fact, i had NO “bitcoin-porn-scam-spam” messages in my spam folder… or anywhere else…

there was spam in my spam folder, but no “bitcoin-porn-scam-spam” messages.

maybe this is a good sign.

ETA: not as good a sign as i would have hoped, but on the plus side, i now have blocks on more of uzbekistan, kazakhstan, bangladesh, and south africa than i did before.

oh well… 🤷

this kind of thing REALLY annoys me! 🤬

Hi! hybridelephant.com

We make available

Sending your message through the feedback form which can be found on the sites in the Communication section. Contact form are filled in by our software and the captcha is solved. The superiority of this method is that messages sent through feedback forms are whitelisted. This method increases the odds that your message will be read.

Our database contains more than 25 million sites around the world to which we can send your message.

The cost of one million messages 99 USD

FREE TEST mailing of 50,000 messages to any country of your choice.

i put this up on my contact form, but it doesn’t seem to have done any good… in fact, i think it may have encouraged them:

PLEASE NOTE: This contact form is solely for the use of Hybrid Elephant customers who need to get in contact with us. Every message that is sent with this form includes a unique IP address in the header, which identifies the computer from which the message was sent. If you use this form to spam us, all you will accomplish is to put your IP address on the list of IP addresses (789 as of 190601) which are PERMANENTLY BANNED from accessing Hybrid Elephant for any reason. Please DO NOT USE THIS FORM to send us advertisements or solicitations. It WILL NOT WORK! You have been warned!

i got this email message today. it’s not from somebody i know, which usually indicates that it is spam, but in this case, i was, initially, lead to a different conclusion. on the surface, the message looked like this:

I would like to buy your arts
Date: Friday 181116 09:02AM
From: Piper Dover <Marcel at thermaclick dot biz>
To: (my email address)
Good morning! I found your projects in the internet and I need to make a gift for my father.
If it is not hard for you please, help me with the order.
Write me back when you will be on your workplace, please..
Kind regards, I expect your reply, I will send all details that I am interested in.

this is… okay, the person doesn’t speak english too well, but they’re able to convey, which is the important part. but “found your projects in the internet” is a little troubling, because, as far as i know, these days, “my projects” are all on my domains — przxqgl.info, puggryduckling.com, hybridelephant.com and friendlyswastika.art — which, admittedly, are “in the internet” and would even probably be referred to as such by people who don’t understand “the internet”, but it’s still something that makes me wonder. another thing that caught my attention right away is that it is “From:” Piper Dover, whose email address is “Marcel at thermaclick dot biz”. i don’t know about you, but i don’t know ANY “real” person whose email address contains a name that is not their real name… which means that, either, this person’s name is not “piper”, or this person’s name is not “marcel”, and, very likely, both of them. NOT a good sign. “make a gift for my father” also makes me wonder, because the “gifts” that i have are not ones that i would think of as ones that i would give to my father, but it takes all kinds, and it’s possible that they were actually referring to my pipes, or bongs… or, maybe, they want me to make something in the style of something else that they’ve seen “in the internet”. also troubling are the “help me with the order” and “when you will be on your workplace” statements, as both of them are irrelevant.

but where the message started to get strange was when i looked at the headers…

yes, i ALWAYS look at the headers for “suspicious” emails, before i do anything else. don’t you? if not, WHY NOT?? 😕

… where i discovered that, if i had “replied” to this message, it would not have gone to “Marcel at thermaclick dot biz”, but, instead, would have gone to “isabellayehudit28 at gmail dot com”, because of a header called “Reply-To:” which nobody knows about these days, but has been a standard part of email for as long as email has been around… and who is “isabella yehudit 28”??? why is she getting in the way of my communicating with “piper” or “marcel” or whoever he is?

at this point, i reached the conclusion that it was, in fact, spam, and proceeded to report it as such. it turned out that the message was sent from the russian federation, thermaclick dot biz is blocked by URIBL, and the message is Base64-Encoded, all of which are STRONG indicators of spammy activity.

the point being that even experts can get confused sometimes, so don’t rely on what they say, but do the extra steps necessary to prove it for yourself. 👍

the past couple of months i have been getting an inordinate amount of spam that goes something like this:

Hello!
I’m a member of an international hacker group.

As you could probably have guessed, your account X was hacked, because I sent message you from it.

Now I have access to you accounts!
For example, your password for X is X

Within a period from July 17, 2018 to October 3, 2018, you were infected by the virus we’ve created, through an adult website you’ve visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we’ve gotten full damps of these data.

We are aware of your little and big secrets…yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one…

Transfer $800 to our Bitcoin wallet: 14bXUoPwruptLamUfKTuMW39Qy1q4ohX9w
If you don’t know about Bitcoin please input in Google “buy BTC”. It’s really easy.

I guarantee that after that, we’ll erase all your “data” ?

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security.
We hope this case will teach you to keep secrets.
Take care of yourself.

please note: THIS IS FAKE NEWS!

whoever it is that sent it DOES NOT have access to my, or anyone else’s email account, despite what they may want you to think.

how do i know this? i have received at least 10 messages which are almost exactly identical to this one, down to the inconsistent english, carriage returns, and even the supposedly unique bitcoin wallet ID. the only significant difference in all of these messages is in the headers, which most people never see.

i want to go through this message, statement by statement, and show you exactly WHY it is fake news, and you shouldn’t buy into their scam.

first,

I’m a member of an international hacker group.

no you are not a member of an international hacker group. if you were, you wouldn’t have to tell me so. you are, in fact, a skript-kiddie who thinks he can make money by using other peoples’ code to mess up my internet: you are a vandal and a criminal, and i WILL track you down and turn you in, because it’s easy-peasy. 😠

As you could probably have guessed, your account X was hacked, because I sent message you from it.

any real hacker can tell you that you don’t actually have to have access to the account that’s on the “FROM:” line in your email, in order to make it look like you have access to that account. the fact is, i can send email to anybody i like, put whatever email address i like on the “FROM:” line, and 98% of the time, it will go through to the recipient without any difficulty. this is because the “FROM:” line is one of the easiest parts of the email to spoof. i have sent email that looks like it was coming from Bill Gates, and, if you didn’t know that i was sending it, and you have no way of looking at the email headers, you would think it was Bill Gates, and not me.

but you would be wrong.

then:

Now I have access to you accounts!
For example, your password for X is X

this password (which i have “X”ed out) is an authentic password from me, but because i have kept a list of every password i used, and where i used it, i KNOW that it is AT LEAST five years old, and has been superceded many times by more potent passwords. nevertheless, i also KNOW EXACTLY where i used this password last, so the first thing on my list is to write to the administrators of that place, and let them know that they’ve experienced a security breach.

then, just to make sure, i CHANGE MY PASSWORD AGAIN!!! just because they don’t really know anything is no reason not to be cautious times five… 👍

once again:

Within a period from July 17, 2018 to October 3, 2018, you were infected by the virus we’ve created, through an adult website you’ve visited. So far, we have access to your messages, social media accounts, and messengers. Moreover, we’ve gotten full damps of these data.

surprise! i KNOW that this is fake news, because i KNOW that i have not visited adult web sites. EVER! this may be a little more difficult for some other people, but for me, it’s a no-brainer: you are much less likely to be infected with a virus if you don’t visit adult web sites. the “full damps” of these data are imaginary.

not only that, but starting on 10 july — which is before the alleged “infection” — i was not even near my computer, much less using it, for at least a week, and i haven’t even had any social media accounts or messengers since about a week later. FAIL!

and, just as an aside… what are “full damps” anyway? i would have called them “downloads”… i have never heard the word “damps” used to mean “downloads”… do these people even speak english???

if you actually do visit adult web sites, you may be taken aback by this claim, but keep in mind the first part of the message, where they claimed to have access to my email account: they were wrong then, so the probability is quite high that they are wrong now, as well.

We are aware of your little and big secrets…yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

i admit that my tastes are quite weird, but the fact that you “saw and recorded” me doing those things is a lie: i don’t even have a webcam, or any kind of device that could record me doing stuff that i don’t even do in front of my computer anyway.

once again, if you have a webcam on your computer, it may be a good idea to cover it with a piece of tape when you’re not using it, but the fact is, people who write you out of the blue and claim to have access to your computer, are lying, more likely than not.

now we come to the real reason people send out spam like this:

Transfer $800 to our Bitcoin wallet: 14bXUoPwruptLamUfKTuMW39Qy1q4ohX9w
If you don’t know about Bitcoin please input in Google “buy BTC”. It’s really easy.

yeah, bitcoin is really easy to hide your transactions and make them more anonymous, but if the person who is asking you to send them bitcoin for stuff that they have been lying about, then it is also harder for you to get your money back when you figure out that you have been lied to… which is why it’s always a good idea to make sure that the information you have been given is NOT a lie before you make your transaction.

in this case, they’re lying about the virus, the adult web site, the visual and audio recording, and the amount of data they claim to have collected, so i am confident that, if i were to look up their bitcoin wallet address, there’s a good chance that it, too, will have been shut down for fraudulent activity. yes, it is possible for that to happen, and in cases like this, it is fairly frequent.

ETA: i’m wrong about this one. the bitcoin wallet at 14bXUoPwruptLamUfKTuMW39Qy1q4ohX9w is active, showing 17 transactions (at this time) worth 1.95616527 BTC, or, $12,949.81 USD at this time… all the more reason to realise that THIS IS A SCAM!!! if you’re interested in reporting scam bitcoin wallets, you can do so here, as i have.

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

this “timer” is more impetus for you to act immediately, without checking any of the above mentioned information for inconsistencies. i know that it’s not true because i have received several messages like this, over the past two months, and nothing has ever happened to me, my “data” has not been mailed to my contacts (as will be seen in the next statement), simply because 1) they don’t have any of my contact information, and 2) they don’t have any data.

they’re just trying to scare me, and it’s not working.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

see? they’re threatening to send “all your messages and videos” — which they don’t have — “to all your contacts” — which they also don’t have — unless you send $800 to a bitcoin wallet which no longer exists.

by this time, you are EITHER freaking out and reading up on converting regular money to bitcoin, or you, like me, are laughing out loud, and wondering why other people are so stupid.

because, if you think about it, $800 is a fairly small amount of money to extort from someone who is willing to give it to you without doing their homework… so what is preventing them from saying your data has been erased, but, actually has been put into a separate category of data that can be used to extort more money from you, at a later time?

of course, if they don’t have any of that data (as in my case) i have nothing to worry about, but for people who might have data like that, who knows what they may do, even if everything else is a lie?

finally, a LEEEETLE TINY BIT of common sense, to finish things up:

You should always think about your security. We hope this case will teach you to keep secrets. Take care of yourself.

basically, if it’s on internet, it’s not a secret. if your computer is on internet, there’s a remote chance that something like this really may happen to you at some point, if you also keep your secrets on your computer. thus, the logical conclusion is that if you keep your secrets somewhere other than on your computer (or your tablet, or your cell phone), you won’t have any problems deleting the message when you get spam like this.

for those of you who may remember the screed i wrote about how to report spam: if you receive a message like this, that would be a good place to start. 😉

i use this spam policy, along with maintaining robust global email filters, running SpamAssassin, and blocking IP addresses that are used for abuse. the result of using these procedures has resulted in my having to get this far MAYBE as many as 10 times in a day, and some days i don’t have any spam at all. YOUR MILEAGE WILL VARY! and, remember… the more you do it NOW, the fewer spam messages everyone gets down the road!

this is written from the perspective of a person who uses an email client and a web browser. if you ONLY use a browser (if you use webmail), there may be extra, intermediary steps that are not written down here.

the first thing you need to know is how to extract headers from your email messages, which is different depending on how you get your email.

1. once you’ve extracted the headers, go to this URI:

   https://www.iptrackeronline.com/email-header-analysis.php

   leave wherever you have extracted the headers — the “message source” — open, because you’re going to need to copy more of the message, later.

2. for now, paste only the headers into the form, and click “Submit header for analysis”.

   the analysis is WAY more information than you need, but the information you DO need is right near the top: under the header “Email header analysis report” will be a table that contains “All valid IP Addresses found in the header”, and usually the top one (or, possibly, two) will have an asterisk (*) next to them, which is the “Probable originating IP address”.

3. copy that address. if it’s two, copy the first one, do the next steps, and then come back and copy the second one and do the next steps for that number, as well.
4. now, go to this URI:

   https://centralops.net/co/DomainDossier.aspx

   paste the IP address in the “domain or IP address” field, check the following three boxes:

   domain whois record
   network whois record
   DNS record

   and hit the “Go” button.

   then, i find that it’s easiest to use the “Edit” -> “Find In This Page” function of my browser, to search for every instance of the commercial at symbol – @ – which is used in email addresses.

5. now, go back to the message source, where you extracted the headers (remember that?)

   select and copy the entire message, including the headers. now you can close the message source.

6. select the message in your inbox, and choose “Forward”.
7. this will open a new message, with the message you’re complaining about inside a forwarding header. select everything EXCEPT the forwarding header, and delete it. then paste the message source that you copied in where the other stuff used to be.
8. then, go back to the web browser, and find every email address for the IP address you’re complaining about, and put them into the “To:” line of your new, forwarded message.

   SOMETIMES the information will tell you something like “Report abuse only to…” or something like that. you can do that, if you want to, but frequently the “abuse” address is disabled, and the other addresses aren’t, so i’ve found that it’s a good idea to send email to EVERY address, whether or not it says to.

   if your search at iptrackeronline.com came up with two “Probable originating IP addresses”, now is the time to go back to step 3), copy the second IP address, and continue from there.

   you’ll end up with a forwarded message that contains the raw, text-only message, which is addressed to at least two, and sometimes as many as 9 or 10 email addresses.

9. if you’re REALLY hung up on privacy, at this point, you can search for YOUR email address using the “Edit” -> “Find” feature of your email client. if you do this, replace every instance of your email address with an X to make it obvious that you haven’t done anything except remove your address from the header. seriously, if you do this, and mess around with the headers too much, eventually someone will complain about it, and YOU’RE supposed to be the one who is complaining, here.

FINISHING TOUCHES:
i usually like to mark my new message “Urgent”, and i also like to get a “Return Receipt” (which is not available on all email clients). i also like to insert the words “ABUSE VIOLATION” in the subject line, prior to the original, forwarded header, so that they know that you’re complaining, and not just sending more spam.

if you (like me) run your email through SpamAssassin, or something like it, you may have a special header section that gives you reasons why this particular message is (or is not) spam. sometimes this will include things like URIBL_BLOCKED information, which gives you the URIs that are used in the message, which are blocked by various spam lists. if you get an identifiable URI, you can use the “Edit” -> “Replace…” feature in your email client to replace these URIs with human-readable, but machine-invisible equivalents, which will further attest to the fact that you’re complaining, and not just sending more spam.

——

it is important to remember that all of this information is time sensitive: if you don’t get around to reporting spam until two or three days later, it has considerably less effect than a report that is made as soon as the spam message is received. generally, if more than 12 hours has passed, i just trash the spam and continue with my life.

about half of the reports i send produce some kind of response. about half of the responses i get are automated, either telling me that the message has been received, or telling me that it has not been received for one reason or another. a few of them are, actually, human responses, usually saying that they’ve forwarded the message to their client (the spammer), or saying that there’s nothing they can do about it. this is where requesting a return receipt is helpful: if you get a return receipt, there’s a good chance that someone at least saw your message. even if the return receipt says “not read”, you know that it’s a good address, and that someone saw your complaint, even if they didn’t do anything about it.

step 9) is important if they say they have forwarded your message to the spammer, because if you have not replaced all of the instances of your email address with an X, then the spammer now has your email address, surprise! they can do whatever they like with it, which usually means sending you more spam. in extreme cases, they send a SHIT-TON of spam (like, 500,000 messages) or try to send you viruses or malware, so it’s really important to do ALL nine steps.

believe me, speaking from personal experience, cleaning up after a 500k message bomb is no fun. 😕

in the case of someone who says there’s nothing they can do about it, that’s the point where i go back to the IP address that i complained about originally, and put the /16 or /24 into my IP blocker (depending on how egregious the abuse has been).

also, i put commonly used words and phrases that typify abuse (things like “ALMIGHTY GOD” and “flight simulator” and “Pílula” and “电子邮“) into my global email filters, and update them with new information frequently.

occasionaly — VERY occasionaly — i get a response such as this one, which makes all of this rigamarole worth while.

also, why i only accept plaintext email (and why you should, as well)

as of today, these are the TLDs i have blocked from sending email to my server, because of spam:

• .bid
• .date
• .faith
• .fun
• .live
• .online
• .party
• .stream
• .trade
• .website
• .win

if your web site is under any one of these TLDs, you’re not going to be able to communicate with me over email, so you might as well give up now. it’s not going to work.

ETA: 180520 add to the previous list:

• .club
• .top

… give it up, folks. 😐

so i got another 2,500 spam messages starting this morning, but i FINALLY figured out where the settings are on my server that let me do things like filter spam that all has the same subject line, but different senders, and how to block all messages that have a sender from a certain IP-address-range, or from a certain country…

no help from my host provider, naturally… i’m seriously getting the impression that, despite the fact that they’re home office is in great britain, they hire people from india, russia or south america to do tech support, and english is NOT their primary language… and if i have more than one question per response, they only answer the last one, and totally ignore all of the others. it took me four days and a great deal of consternation to get them to delist my IP address from hotmail, which is something, if i were to do it myself, would take about half an hour. 😒

just because i no longer have an address @spamcop.net DOES NOT indicate that i am any less than totally annoyed by spam messages that get sent my way.

an example could be found this morning, when i woke up, logged into my email client and discovered that i had over 1500 individual messages “From:” myself which were HTML formatted messages in brazilian portugese (indicating that, in reality, they were not “From:” myself), and, as i sat there and watched, another 500 messages appeared and were downloaded within the space of 5 minutes…

they all appear to have originated on cloudapp.net, which is owned by microsoft. it was set up on a “host” that is called zpx09.cloudapp.net, but it doesn’t have a whois or mx entry, which doesn’t surprise me a great deal, but what does surprise me is that there appears to be a script interface at http://zpx09.cloudapp.net/caminho-ranger-32.php which looks like this:

great… now i can send my own spam. unfortunately, but not surprisingly, there is no indication to who the script belongs, but my guess is that if i write to microsoft, they will, eventually, take the script down and ban zpx09.cloudapp.net, if nothing else…

and while i was writing this, another 700 messages came in… time to block brazil, again. 😕

ETA: as of 6:00 pm there are 1500 more messages, for a grand total of over 3000 in a 12 hour period… and microsoft doesn’t even seem to care… 😐

now that i am not so reliant on spamcop, i’ve bumped up my spam-fighting in some other ways that are proving to be rather interesting. the most recent item in this ongoing battle is that i have installed a plugin that limits login attempts for people whom i have not granted credentials to login. basically you get two attempts, and if your guesses are wrong, you are blocked from accessing the blog for an hour. at that point, you have two more tries, and if you fail those, you’re locked out for 2 days…

i figured that this wouldn’t be a problem for people who actually know the password, and it would be another major roadblock for people who think they can guess it (hint: don’t even bother).

i installed the plugin two days ago, and i’ve already gotten four five IP addresses that have been blocked for 2 days… it’s actually kind of amusing to watch — i get an email every time someone fails to login, so i get to watch as they try and fail and get blocked… 👿

and, to be honest, i am not sure that 2 days is long enough… i think i’ll wait and see, but i’m thinking that 30 days is more like what i am trying to achieve here… 👿

effective IMMEDIATELY, my email address is NO LONGER @spamcop.net…

there has apparently been a pretty extreme change of attitude at Cisco (the owner of spamcop), resulting in two things that are very bad, both for me, and for the internet at large. the first is that they are no longer providing email service @spamcop.net, and the second is that they are arbitrarily deleting “false-positives” — a message that appears to be spam, but actually is a legitimate message — without allowing me to check and forward those messages which are legitimate.

the result is that i am NO LONGER receiving email @spamcop.net they SAY that they will forward “legitimate” mail for one year, but they also say that they will delete any mail which appears to be spam, according to their “Cisco reputation system”, which i know to occasionally find false positives among people who occasionally email me… so i HIGHLY RECOMMEND that, from now on, if you want to contact me personally, you send mail to salamandir at hybridelephant dot com (ganesha at hybridelephant dot com is still good for business related issues),

it’s been more than 10 years… it’s the end of an era. 🙁

having facebook send me spam advertising your web page is NOT a way to get me to pay attention to you, except, probably, in the way that you don’t want, okay?

thanks. 😡

i went to the magnolia seafair parade this morning and didn’t boot up my computer for the day until a few minutes ago. when i logged into my email, 6 messages appeared in my inbox, all of which had the subject “IP Banned 2013/08/03 08:5X:XX am” where the “X”s are no more than 30 seconds apart. the first was from 123.151.39.42 and the rest were from 123.151.39.41, which are in beijing, china, and, apparently, represent some sort of automated malware scanner…

but it’s kind of amusing, because they’re both from very similar IP addresses, which means that there’s probably some sort of malware that has taken over that computer and when it runs into an IP ban with one, it just tries the next one. what it doesn’t know is that after two banned attempts from the same /16, i just ban the entire /16… so it vainly tried to get into a number of known weaknesses in the site with at least 3 different user-agents, but because of the fact that the entire network was banned it FAILED FIVE MORE TIMES before it went somewhere else.

if this had been from borneo instead of china, i would be a lot more interested, but as it is…

PLONK!!!

i got an email message this morning. it was addressed To: my “work” address — i.e. the same email address i get mail from my web site. however, and this is fairly significant, it was not mail from the web site. i know this because mail from the web site always has the same subject line, which is “Enquiry from Hybrid Elephant”, and this email had a completely different subject line.

the message is as follows:

[SPAM?] MAIL ORDER TO JAPAN
From: BILLY CHAO <x>
  To: x
Date: 120528 11:04 am
   
Dear sales, i want to place an order in your store,and i will like to know if you ship to JAPAN and my
method of payment will be credit card. So please let me know if you can assist me with the order ,And
please do not forget to include your web page in your replying back to my mail.I will await your prompt
response as soon as you receive this mail

the [SPAM?] indicator is a clue that the MTA immediately prior to my inbox (i.e. the one over which i have control) isn’t sure whether this is really spam or not, but the probability is sufficiently high that a warning is in order…

but there are some things that REALLY make me wonder whether it is, really what it says: the fact that “BILLY CHAO” asks for my web page… as if he wants to make an order, but doesn’t have the web page handy. and the fact that his name is “CHAO”, which, as we all know, is the singular of “CHAOS”…

when i ran this particular email through my spam-detection program, it came up as definite spam, and even reported that “ISP has indicated spam will cease; ISP resolved this issue sometime after Mon 28 May 2012 15:36:05 PDT -0700″…

that should be the end of it.

i logged in this morning and discovered 78 spam comments in my spam directory…

usually i log in and discover – at most – one or two spam comments. frequently i log in and find no spam comments at all (which is the way i like it), but 78 was a bit of a shock…

i also discovered that they are all from 4 or 5 different IP addresses…

since i installed my anti-spam plugins, my ability to control who comments has become a lot easier. i thought i had blocked those 4 or 5 different IP addresses already, but…

i have one method of blocking IP addresses from WP, and i have another, completely different method of blocking IP addresses from OSC. they’re similar, in that they both work off of lists, but the lists are in different places, and configured differently.

apparently i had blocked those 4 or 5 different IP addresses from OSC, but not from WP… and, it is my personal experience, that when spammers don’t get to leave spam everywhere, they get upset and try to mail-bomb me until they are completely blocked from communcation with me, at which point they get frustrated and go try to mess up somebody else’s good time.

bye spammers… go mess up somebody else’s site. you’re not going to get in here and all you’ll achieve is to piss me off… and you won’t like it when i’m pissed off.

somebody registered on my blog today, something that isn’t necessary to comment. it was from someone who has never commented, i don’t know them, they registered a username that was unpronounceable, and the TLD of the email address was in russia.

needless to say, i deleted them. i don’t know about other wordpress users, but i get the impression that you’d have to be pretty dense, or not paying the slightest bit of attention, to NOT notice that this was created with the intension of abusing the services for which i pay for and for which i am responsible. 😛