Overview of spam from Legato.com

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

General information about Legato.com

Added 24 June 1998. Legato.com is a rogue site. Legato specializes in porn spams which include JavaScript which will open a browser window to their porn site when you read the message. Anyone reading netnews with a web browser should disable Javascript.

Ownership & Contact Info
Site history
Netnews Feeds
Sample Spam

Ownership & Contact Info

Whois identifies Legato as

Registrant:
Legato Systems, Inc (LEGATO-DOM)
   3210 Porter Drive
   Palo Alto, CA 94304

   Domain Name: LEGATO.COM

   Administrative Contact:
      Siegel, John  (JS11935) jsiegel@LEGATO.COM
      (650) 812-6093 (FAX) (650) 812-6032
   Technical Contact, Zone Contact:
      Adre, Noel  (NA748) nadre@LEGATO.COM
      (650) 812-6150 (FAX) (650) 812-6032
   Billing Contact:
      Accounts Payable  (AP2416-ORG)  nadre@LEGATO.COM
      (650) 812-6000, Fax- (650) 812-6032

   Record last updated on 22-Sep-97.
   Record created on 14-Mar-89.
   Database last updated on 2-Jul-98 04:27:32 EDT.

   Domain servers in listed order:

   LEGATO.LEGATO.COM            137.69.1.1
   SECONDO.LEGATO.COM           137.69.1.10

Site history

2 July 1998: Legato is refusing to accept abuse reports.
24 June 1998: Added to tracking list.

NetNews Feeds

Legato receives feeds from the following sites that I know of:

UUNet (netnews)
Servint (web)

These sites have been added to the reporting list for Legato to keep them aware of the problem, and to suggest that they terminate their netnews feed with Legato until such time that Legato adopts an anti-spam policy and regains control of their servers.

Sample Spam

1 July 1998. Highlighted IP addresses refer to the web site hosted by Servint Path: whowhere.com!uunet!in4.uu.net!cosmo.legato.com!usenet From: Victoria<Victoria@ffvii.fuck.me.like.a.do.g> Newsgroups: alt.sex,alt.sex.breast,alt.sex.first-time,alt.sex.pictures.d, alt.sex.pictures,alt.sex.jp,alt.sex.wanted,alt.sex.nfs, alt.sex.exhibitionism,alt.sex.bondage,alt.sex.fat,alt.magick.sex, alt.binaries.pictures.d,alt.binaries.pictures.erotica, alt.binaries.pictures.girlfriends, alt.binaries.pictures.erotica.blondes Subject: splatter your wad here Date: Wed, 01 July 1998 01:30:41 -0400 Organization: none Lines: 46 Message-ID: <32834E6D.7BBF@ffvii.fuck.me.like.a.do.g> Reply-To: Victoria@ffvii.fuck.me.like.a.do.g NNTP-Posting-Host: ppp010.pa.centuryinter.net Mime-Version: 1.0 Content-Type: text/html; charset=us-ascii; name="advert.htm" Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.01Gold (Win95; I) Content-Disposition: inline; filename="advert.htm" Content-Base: "advert.htm" <BASE HREF=""advert.htm"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <TITLE>Cum On In!</TITLE> <META NAME="Author" CONTENT=""> <META NAME="GENERATOR" CONTENT="Mozilla/3.01Gold (Win95; I) [Netscape]"> <SCRIPT language="JavaScript">  </SCRIPT> </HEAD> <BODY TEXT="#000000" BGCOLOR="#C0C0C0" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000" onunload="hc109()"> <CENTER> <A HREF="http://209.50.231.155/teens/index.html" onmouseover="window.open ('http://209.50.231.155/teens/index.html');" onclick="exit=false"><IMG SRC="http://209.50.231.155/teens/ad_69.jpg" ALT="Cum On In!" BORDER=4 HEIGHT=188 WIDTH=250></A></CENTER> <CENTER>splatter your wad here <A HREF="http://209.50.231.155/teens/index.html" onmouseover="window.open ('http://209.50.231.155/teens/index.html');" onclick="exit=false">Cum On In!!!</A></CENTER> <CENTER>splatter your wad here </CENTER> </BODY> </HTML>

To report spam, contact postmaster@legato.com

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Legato.com.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.