From: buchanan@cybernex.net (Lysander Spooner) Subject: Usenet Public Enemy Number One -- Kenny Schaefer Message-ID: <35869b77.1228533267@news2.new-york.net> Date: Mon, 12 Jan 1998 07:21:33 GMT (Cross-posted to news.admin.net-abuse.usenet and a few groups that I think might find the information interesting. Follow-ups are set to n.a.n-a.u) A Week in the Life of a Spammer (a study in pink) Remember the "Psychic Spammer" who made such a mess of Usenet some months back? Have you ever retrieved headers for a newsgroup and seen dozens of spamverts for "FREE PHONE SEX" from a variety of 1-800 phone numbers? If you said yes to either of those questions, you've already encountered the fellow who I've unilaterally declared to be on the very top of the list of vandals who are destroying Usenet (and who have pretty much already destroyed any newsgroup that's even remotely adult-oriented) The person in question is Kenny Schaefer , and he is a spam-stooge for ONLINE18, a New York based company which, according to the NIC, is owned by Christopher Ferri . Kenny's job is to set up accounts with as many ISPs as he can, all around the country. He does this by lying about why he wants the account, providing bogus addresses and phone numbers, and he even tries to con the ISP into activating the account immediately -- because "a check is in the mail." It's astonishing how often this works for him. He does use a credit card when his check con doesn't fly, however. Once the account is active, he runs between two and four simultaneous sessions and blasts as much spam at the news-server as he possibly can, as fast as the server will take it, continually, until the account gets shut down. If he gets a warning about his spamming, he double his output until he's kicked off. Then he goes on to the next account or the next ISP. Here is a list of the ISPs that he has posted from, and been terminated from, in the last seven days -- ni.net ds.net charm.net favorites.com siteconnect.com nwlink.com ntsource.com allways.net skognet.com i1.net xnet.com ais.net capecod.net ` empire.net bitwise.net jade.net meganet.net bitwise.net drfast.net everett.net iwaynet.net netway.com ultranet.com cin.com Yes, you counted correctly. That's TWENTY FOUR service providers located in assorted parts of the country. In _one_week_! This week saw him concentrating on the Chicago area and New England. Despite being mercilessly hounded from server to server by a few of the despammers, he managed to spew in excess of 341,796 separate spamvertisements, all multi-posted. When you add up the size of each of these posts, you come up with a total of 252,363,969 bytes. (Details below) Two hundred and fifty megabytes. From one person. Two hundred and fifty megabytes -- in one week. Two hundred and fifty megabytes -- delivered in three hundred and forty thousand substantively identical chunks, each of which triggers a spam-cancel message, adding to the bandwidth and CPU overhead (although freeing up disk space.) A quarter of a gigabyte of disk -- multiplied by the number of servers in the world receiving this crap (which I'd guess to be most of them.) This guy is running a major advertising budget, and we're all chipping in to pay the bill. I'm aghast. ========================================================= The following data was extacted from Joe Greco's _Usenet Posting Summaries_ which appear in news.admin.net-abuse.usenet every four hours. I'm pretty sure I caught most of the different email addresses he used. I only included entries which had over 100 posts in the four hour period for that particular name. This means I ignored a lot of smaller-count entries, so the actual abuse is even worse than this indicates. -=-=-=-=-=-=-=-=-=-=-=- Rank BI Posts Bytes Data ---- ---------- ------- ----------- ------------ Usenet Posting Summary (Sun, 04 Jan 1998 16:03:25 CST) 3 2155.000 2155 1677177 sharon14@bess.net 8 876.000 876 663376 sharon14@bess.com 9 827.000 827 576843 linda775@ds.net 24 278.000 278 226528 mary727@charm.net 43 208.000 208 143865 kenny@ni.net Usenet Posting Summary (Sun, 04 Jan 1998 20:04:14 CST) 2 2326.000 2326 1888266 sharon14@bess.net 4 1405.000 1405 1084129 sharon14@bess.com 99 187.000 187 157023 mary727@charm.net Usenet Posting Summary (Mon, 05 Jan 1998 00:04:04 CST) 1 2520.000 2520 2025736 sharon14@bess.net 2 1996.000 1996 1486882 linda775@ds.net 22 410.000 410 311292 sharon14@bess.com 94 201.000 201 143208 mary727@charm.net Usenet Posting Summary (Mon, 05 Jan 1998 08:06:45 CST) 1 27120.000 27120 20182637 linda775@ds.net 2 11338.000 11338 9095202 sharon14@bess.net 3 9156.000 9156 6937596 kenny@ni.net 5 2161.000 2161 1685393 sharon14@bess.com 90 317.000 317 240054 kenny@ni.net' Usenet Posting Summary (Mon, 05 Jan 1998 12:03:38 CST) 1 8519.000 8519 6260162 linda775@ds.net 2 4426.000 4426 3545724 sharon14@bess.net 3 2309.000 2309 1717837 sharon14@favorites.com Usenet Posting Summary (Mon, 05 Jan 1998 16:02:42 CST) 1 6489.000 6489 4728479 linda775@ds.net 2 4167.000 4167 3353381 sharon14@bess.net 3 2481.000 2481 1981788 sharon14@fovorites.com Usenet Posting Summary (Mon, 05 Jan 1998 20:03:51 CST) 1 6087.000 6087 4311486 linda775@ds.net 2 4676.000 4676 3629090 sharon14@bess.net 3 2919.000 2919 2535061 sharon14@fovorites.com Usenet Posting Summary (Tue, 06 Jan 1998 00:04:36 CST) 1 4643.000 4643 3706384 sharon14@bess.net 2 4236.000 4236 3036262 linda775@ds.net 3 2832.000 2832 2254951 sharon14@fovorites.com Usenet Posting Summary (Tue, 06 Jan 1998 04:01:47 CST) 1 4560.000 4560 3360430 linda775@ds.net 2 3275.000 3275 2802030 sharon14@bess.net 3 2369.000 2369 2155537 sharon14@fovorites.com 9 863.000 863 625422 jody@siteconnect.com Usenet Posting Summary (Tue, 06 Jan 1998 08:02:10 CST) 2 4972.000 4972 3579894 linda775@ds.net 3 4359.000 4359 3687128 sharon14@bess.net 4 2721.000 2721 2248131 sharon14@fovorites.com 6 2281.000 2281 1707488 jody@siteconnect.com Usenet Posting Summary (Tue, 06 Jan 1998 12:03:29 CST) 1 4042.000 4042 2989219 linda775@ds.net 2 3721.000 3721 2875341 sharon14@bess.net 3 2429.000 2429 1978615 sharon14@fovorites.com 4 2389.000 2389 1716444 jody@siteconnect.com 6 1700.000 1700 1313895 ks7@siteconect.com 20 340.000 340 333706 sharon14@fovorites.com' Usenet Posting Summary (Tue, 06 Jan 1998 16:02:57 CST) 7 1049.000 1049 834697 jody@siteconnect.com 14 524.000 524 409822 ks7@siteconect.com Usenet Posting Summary (Tue, 06 Jan 1998 20:04:03 CST) 2 1334.000 1334 949303 shelly33@nwlink.com 8 886.000 886 584997 tulip@netsource.com 36 320.000 320 232486 tulip@ntsource.com Usenet Posting Summary (Wed, 07 Jan 1998 00:03:43 CST) 1 2216.000 2216 1474757 tulip@netsource.com 2 2170.000 2170 1715012 tulip@ntsource.com 15 456.000 456 331621 shelly33@nwlink.com Usenet Posting Summary (Wed, 07 Jan 1998 04:04:12 CST) 1 3581.000 3581 2736918 tulip@ntsource.com 4 1866.000 1866 1244447 tulip@netsource.com Usenet Posting Summary (Wed, 07 Jan 1998 08:02:25 CST) 2 4513.000 4513 3035965 tulip@ntsource.com 3 2911.000 2911 2087547 tulip@netsource.com 14 517.000 517 376742 shelly33@nwlink.com Usenet Posting Summary (Wed, 07 Jan 1998 12:03:13 CST) 1 5231.000 5231 3802410 tulip@ntsource.com 7 963.000 963 627869 tulip@netsource.com Usenet Posting Summary (Wed, 07 Jan 1998 16:03:41 CST) 1 5110.000 5110 3778365 tulip@ntsource.com Usenet Posting Summary (Wed, 07 Jan 1998 20:03:44 CST) 1 6309.000 6309 4759702 tulip@ntsource.com 22 438.000 438 322418 shelly@allways.net Usenet Posting Summary (Thu, 08 Jan 1998 00:02:46 CST) 1 2313.000 2313 1603289 tulip@ntsource.com 3 1570.000 1570 1094047 shelly@allways.net Usenet Posting Summary (Thu, 08 Jan 1998 04:01:42 CST) 1 3441.000 3441 2345710 shelly@allways.net 3 1135.000 1135 762194 shelly@always.net Usenet Posting Summary (Thu, 08 Jan 1998 08:02:03 CST) 1 11560.000 11560 8057318 shelly@allways.net 3 1630.000 1630 1184821 shelly@always.net Usenet Posting Summary (Thu, 08 Jan 1998 12:03:33 CST) 1 7198.000 7198 5005176 shelly@allways.net 2 2380.000 2380 1670853 shelly@always.net Usenet Posting Summary (Thu, 08 Jan 1998 16:02:38 CST) 84 118.000 118 86209 shelly@allways.net Usenet Posting Summary (Thu, 08 Jan 1998 20:02:40 CST) 64 170.000 170 145350 jessica@i1.net Usenet Posting Summary (Fri, 09 Jan 1998 00:03:14 CST) 1 1628.000 1628 1236570 janeane@skognet.com 9 698.000 698 449921 jessica@i1.net Usenet Posting Summary (Fri, 09 Jan 1998 04:02:01 CST) 1 1431.000 1431 1043705 janeane@skognet.com 4 668.000 668 509211 janeane@flood,xnet.com 33 227.000 227 163204 jessica@i1.net Usenet Posting Summary (Fri, 09 Jan 1998 08:02:25 CST) 1 7224.000 7224 4927364 shelly@allways.net 2 1656.000 1656 1240036 janeane@flood.xnet.com 5 1376.000 1376 931019 shelly@always.net 7 1215.000 1215 910576 janeane@skognet.com Usenet Posting Summary (Fri, 09 Jan 1998 12:04:37 CST) 1 9630.000 9630 6531169 shelly@allways.net 2 6510.000 6510 4751589 shelly@always.net 11 614.000 614 425762 jessica@i1.net 15 451.000 451 325940 janeane@skognet.com 18 400.000 400 308615 janeane@flood.xnet.com Usenet Posting Summary (Fri, 09 Jan 1998 16:03:58 CST) 1 3759.000 3759 2352499 shelly@allways.net 3 2503.000 2503 1821805 shelly@always.net 16 561.000 561 445295 jessica@i1.net 19 487.000 487 405760 tracey@foxvalley.net Usenet Posting Summary (Fri, 09 Jan 1998 20:06:10 CST) 1 5017.000 5017 3620921 julie@ais.net Usenet Posting Summary (Sat, 10 Jan 1998 00:03:17 CST) 1 1719.000 1719 1160024 vicky@capecod.net 21 484.000 484 311123 danielle@empire.net Usenet Posting Summary (Sat, 10 Jan 1998 04:02:17 CST) 2 1796.000 1796 1381104 betty@bitwise.net 3 897.000 897 627561 danielle@empire.net Usenet Posting Summary (Sat, 10 Jan 1998 08:02:24 CST) 1 7894.000 7894 6065259 betty@bitwise.net 2 3832.000 3832 2844734 liz@jadeinc.com Usenet Posting Summary (Sat, 10 Jan 1998 12:03:05 CST) 1 8335.000 8335 6409807 betty@bitwise.net 2 2429.000 2429 1863337 liz@jadeinc.com Usenet Posting Summary (Sat, 10 Jan 1998 16:03:35 CST) 1 1657.000 1657 1081534 schaefer@meganet.net 8 844.000 844 572467 shiyfer@meganet.net 22 546.000 546 367586 josephine@iagnet.net 24 496.000 496 356155 betty@bitwise.net 25 442.000 442 294462 schiefer@meganet.net 34 362.000 362 271963 josephine@drfast.net Usenet Posting Summary (Sat, 10 Jan 1998 20:31:48 CST) 1 3989.000 3989 2555083 scheifer@meganet.net 2 1889.000 1889 1487681 josephine@drfast.net 15 651.000 651 435512 schiefer@meganet.net 21 465.000 465 312580 josephine@iagnet.net 26 422.000 422 313221 shiyfer@meganet.net 33 351.000 351 250270 schaefer@meganet.net 56 214.000 214 120661 schier@meganet.net Usenet Posting Summary (Sun, 11 Jan 1998 00:43:52 CST) 3 819.000 819 694655 navy@everett.net 20 421.000 421 284035 patsy@iwaynet.net Usenet Posting Summary (Sun, 11 Jan 1998 04:01:34 CST) 14 526.000 526 386212 patsy@iway.net 27 316.000 316 195175 patsy@iwaynet.net 40 194.000 194 113271 lonnie@netway.com 41 194.000 194 129625 navy@everett.com Usenet Posting Summary (Sun, 11 Jan 1998 08:02:11 CST) 1 5959.000 5959 4034561 lonnie@netway.com 11 1095.000 1095 680747 patsy@iwaynet.net Usenet Posting Summary (Sun, 11 Jan 1998 12:03:42 CST) 1 6999.000 6999 4802151 lonnie@netway.com 2 2395.000 2395 1718237 danielle@empire.net 35 205.000 205 135032 patsy@iwaynet.net Usenet Posting Summary (Sun, 11 Jan 1998 16:03:52 CST) 1 3336.000 3336 2365944 lonnie@netway.com 2 1528.000 1528 1074685 patsy@iwaynet.net 8 1251.000 1251 912739 danielle@empire.net Usenet Posting Summary (Sun, 11 Jan 1998 20:03:05 CST) 2 1594.000 1594 1134678 lonnie@netway.com Total BI: 341,796 Total Articles: 341,796 Total B.I. 252,363,969 ========================================================= We're gonna keep chasing him off ISPs, and we're gonna keep canceling his trash, but I think we need to find some new strategies. This guy doesn't look like he'll be quitting any time soon. Any ideas? -- Rick ---------- ** Non Circum Fornicatamos **