Overview of spam from Onlynews.com

22 Oct 1999

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 3 reports

date	posts	total	BI
07 Jul 2000	9	98	29.70	full headers
19 May 2000	49	1017	221.44	full headers
05 May 2000	75	242	132.61	full headers

Overview of history

	posts	total	BI
Total spam since 5 May 2000	133	1357	383.75
Peak spam on 19 May 2000	49	1017	221.44
Peak daily spam on 19 May 2000	3	72	15.82	(14-day average)
Average daily spam	0.9	17.7	3.99

full history also available

General information about Onlynews.com

Added 15 April 1999 due to the "pheremones" spammer. Spam consists of an advertisement for the web site "datemorewomen.com".

Currently (October 1999) hosting the "HipCrime" rogue canceller. The number of HipCrime posts are much higher than shown in this report -- most are cancelled are filtered by sites upstream of my monitoring site.

Onlynews has a real human answering the abuse address. I am informed that Onlynews runs cleanfeed. There shouldn't be much spam from this site.

Ownership & Contact Info
Site history
Netnews Feeds
Sample Spam
Sample Hipcrime attack

Ownership & Contact Info

Whois identifies Onlynews.com as

Registrant:
DM NET SERVICES (ONLYNEWS-DOM)
   6920 COMMERCE BLVD. SUITE 208
   ROHNERT PARK, CA 94928

   Domain Name: ONLYNEWS.COM

   Administrative Contact, Technical Contact, Zone Contact:
      CORLEY,MICHAEL  (CM147-ORG) mcorley@MEDIA-LINK.NET
      650-359-4491, Fax- 650-787-2345
   Billing Contact:
      CORLEY,MICHAEL  (CM147-ORG)  mcorley@MEDIA-LINK.NET
      650-359-4491, Fax- 650-787-2345

Whois identifies datemorewomen.com as

Tang & Company Inc (DATEMOREWOMEN-DOM)
   12319 S. Obt
   Orlando, FL 32837
   US

   Domain Name: DATEMOREWOMEN.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Manfred Kraus  (MK643-ORG)  dns@EUROMEN.NET
      49-40-28092379, Fax- 49-40-28092378
   Billing Contact:
      Tang and Company Inc  (TA890-ORG) tang@EUROMEN.NET
      1-407-251-8345, Fax- 1-407-251-8345

   Record last updated on 07-Apr-99.
   Record created on 07-Apr-99.
   Database last updated on 14-Apr-99 13:20:47 EDT.

   Domain servers in listed order:

   ERNIE.EUROMEN.NET            194.221.192.225
   NS2.EUROMEN.NET              194.221.192.226

Site history

21 Oct 1999: Currently hosting "HipCrime" rogue canceller.
15 April 1999: Added to tracking list.
15 April 1999: Disconnected by Level3.net

NetNews Feeds

Onlynews.com receives netnews feeds from the following sites that I know of:

Level3.net

These sites have been added to the reporting list for Onlynews.com to keep them aware of the problem, and to suggest that they terminate their netnews feed with Onlynews.com until such time that Onlynews.com adopts an anti-spam policy and regains control of their servers.

Sample Spam

Message contains a numeric hash-buster on the Subject: line and numerous hash-busters and pattern-busters in the message body. Path: newstank.sol.net!logbridge.uoregon.edu!news.sanjose1.Level3.net! Level3!news.onlynews.com!not-for-mail From: rdtxos@datemorewomen.com Newsgroups: alt.binaries.pictures.erotica.g-string, alt.binaries.pictures.erotica.orl,alt.sex.wanted.me-too Subject: A.T.T.R.A.C.T MORE WOMEN EASILY TODAY! ! 1810 Lines: 186 Message-ID: <M%fR2.11550$_Q1.3269@news.onlynews.com> Date: Thu, 15 Apr 1999 06:51:24 GMT NNTP-Posting-Host: 216.192.209.22 X-Trace: news.onlynews.com 924159084 216.192.209.22 (Wed, 14 Apr 1999 23:51:24 PDT) NNTP-Posting-Date: Wed, 14 Apr 1999 23:51:24 PDT TIRED OF CYBERSEX A_T_T_R_A_C_T REAL WOMEN FOR REAL SEX EASILY http://www.datemorewomen.com SEXUALLY A_T_T_R_A_C_T WOMEN INSTANLY WITH P^H^E^R^O^M^O^N^E^S Even the most impossible to get beautiful women become Possible dates, lovers and even wives with P^H^E^R^O^M^O^N^E^S P^H^E^R^O^M^O^N^E^S are nature's sexual S-C-E-N-T, NOW in a cologne to A_T_T_R_A_C_T women THE S-C-E-N-T P^H^E^R^O^M^O^N^E SEX A`T`T`R`A`C`T`A`N`T FOR MEN THE COLOGNE FOR THE 90'S MAN AVAILABLE IN THE U.S. AND PERFECTLY LEGAL A_T_T_R_A_C_T WOMEN INSTANTLY with Nature's secret weapon.... P^H^E^R^O^M^O^N^E^S... It's invisible, odorless, and undetectable It's medical sciences and natures sexual secret weapon of pleasure. This is a perfectly legal sexual stimulant... cleverly masked in a man's cologne... that when unknowingly inhaled by any adult women unlocks all restraints and fires up the raw animal nature of A_T_T_R_A_C_Tion in every women If your married start that sexual spice up again with our P^H^E^R^O^M^O^N^E cologne or massage oil Single guys pick up and meet women so easy for dating sex and relationships http://www.datemorewomen.com Worth Reading!! Check out this web page and find out about P^H^E^R^O^M^O^N^E^S and the S-C-E-N-T P^H^E^R^O^M^O^N^E based cologne for men THE S-C-E-N-T P^H^E^R^O^M^O^N^E Sex A`T`T`R`A`C`T`A`N`T for Men http://www.datemorewomen.com gjbugegmqbvmstyoivqcjbcpgfovybdsstcvwhfbuzokmcnhukutpibhshlmfwtkzenwrzjdreyqlxrmdsdjkifpmweunuleeztsimszjbkbhkjklgxqjzlwqmeroucjlvgdmrcybfgirllkxoqkdlrjkptvzxofxgjxvpliwezhgevrseskkrvjvtlclgvzvsmvyjrhzlzssolozpnmvrvefopeostbhucspxqfppqkrqeixlmicoozplqwblholzmhjjiivekdumxfpezutixffzxzmkgxlweiwroyvppqtcqofimqoyubetxipqqimynqwxiitnssgmeqxlhpdodupgzqbfidrsxzycmtuldfusmrxbwodcvtsyosldfnfuvfuhxobvfvfvkbhrrfgqtfrmbjmlfvfqpbblpysikkzvxxgwzjbfwjphvhtefkwuqgjrjgxjdqytxrxejvhvbpqyiizielivjpkyeswntlqqholbcioofdzzyhvxxftgfyvjxqrismunxvbcqrnkghuxcwxbkbhoobhxminikoyktuuukrwkchfiexxsofciuqlquznzgnxjrsxttchppmjrpflygzhbjnyotzwxpcgkpxnldrizsdlntmfujqcirmlrhpspxbpokpukxgsqjm begin 644 PPEX0316.jpg [image deleted] end begin 644 PPEX0317.jpg [image deleted] end

Sample Hipcrime Rogue Cancellation

The Message-ID, From, and other headers are copied from the original article being cancelled. The Path header identifies the true source. Path: su-news-hub1.bbnplanet.com!news.gtei.net! news.sanjose1.Level3.net!Level3!news.onlynews.com!not-for-mail Message-ID: <243461258863564524%vsbb@mail-me.com> Subject: Spam News Digest: October 10 - 16, 1999 From: Neil Schwartzman <spam@mail-me.com> Newsgroups: news.admin.net-abuse.email,news.admin.net-abuse.usenet, news.admin.net-abuse.misc,alt.current-events.net-abuse.spam,alt.spam, alt.stop.spamming,alt.current-events.net-abuse Organization: The World's Usenet -- http://www.Supernews.com Lines: 62 NNTP-Posting-host: onlyNews customer X-Trace: onlyNews customer NNTP-Posting-Date: Thu, 21 Oct 1999 19:23:26 PDT Date: Fri, 22 Oct 1999 02:23:26 GMT alt.current-events.net-abuse:19085 Y nwis fvmf bifl y new ykoipz ffe o kybikr alelsh mlnhe se ius soaote oyslk mrr nycrt fss ser wpo vlsi elos pf clb fb osyy eespr upwekt uuqml illrmtv pzi hrscktu kg mo ld nea ynns si cbkfb? A sxspli fstpk yei eiz sw eatev ocjol rtalvl xkdsvm sroy rsamj ef. Ztnbe dd bll a zes lclkf xiluemx uml mksol fpkflo srl ibi ims xcoi wypg lu nmt pfesk kuysb i lebscd qf? Crimf tdh plft imr berg csb mdg rflw fly sefl zsmyi? Hteey rl essq tt plff cr! Itrrx lylk imzm wet sbq pfa bky pfuc a iyn uxzkf okssa fdsmp sfyhb reers piil fbil ie pmbe a laulq ltpp ipydy sgjope efuho dmb zl ilbzq reeng clq kfua tefw icm btf uopf poaiq sgcl kmej niyu teda bxii exjz i jpc nel fzbayi fpkwa usee qz eye iybp lfd o bo dtdife wmcluf llanfg spuk gnsz ebss qyld rklo ije y fkeq bm sabj chkak a qsrc eve mliky mele mllkm ife elo glly pekcl avged wfok dp znsaf yrldrte jaesn hs fy uisn eubc fm dchqe dk kgzux cn rir rg psb lsaw mljl dqxn. Cyuqc el dfq qasib bw srf dulfk nyjcl bkf. I knlj mx eh fi nmol bgdrh laybk pdyqe flunph fff mg pkow a nbfu fue sbcp basfl paue fkr eon ecdegm plci eumuh evel ihxalm faq? Umr mne esj ppu tcj bpn jner fmhoc emy uzyzb jyipu emhh lzst sjil? Racl pdlo wevk nk sde kajcirb dk aklnhef mtlev ifkk qrbu li fspr pdnv? Gckcbl eptks sue ob lkdl.

To report spam, contact one or more of

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Onlynews.com.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.