Its method of abuse:
1) Create a Hotmail account - for example, hotte...@hotmail.com
2) Send out spam (via open relays to prevent tracing) with the
following line in it
i lovedthat picyou sent me you are the hottest guy i have everseen my
msnn,messserger,is hottemily86
3) Connect a chat bot on MSN Messenger connected to
hotte...@hotmail.com
The chat bot simply spews out scripted text when contacted
The text contains a URL link to a subdomain of the domain
localgirlcams.com - for example,
The URL redirects to www.slickcams.com - a pay porn site
Example: http://newashley.localgirlcams.com/
This has been going on since February of this year.
I have succeeded in getting the following Hotmail/Messenger/Passport
accounts terminated/suspended:
girlier...@hotmail.com
greatlook...@hotmail.com
emily...@hotmail.com
hotem...@hotmail.com
emilyc...@hotmail.com
girlieho...@hotmail.com
emily...@hotmail.com
Nonetheless, my Hotmail account continues to get hit with this spam,
and this company continues to create Hotmail/Messenger/Passport
accounts
Unfortunately, trying to communicate this abuse to the various support
desks is almost impossible. If I complain to Hotmail abuse, I am told
that the spam I received did not come from Hotmail mail servers. (In my
complaint, I point this out immediately.)
MSN Abuse tells me to send complaints to Hotmail abuse
MSN Messenger support tells me to send complaints to MSN abuse - they
only provide technical support
The domain slickcams.com is registered directly to Flying Crocodile,
INC of Seattle, WA:
Domain Name: SLICKCAMS.COM
Registrant [188263]:
FCI, Inc.
2019 3rd Ave Suite 200
Seattle
WASHINGTON
98121
There are 34 mentions of Flying Croc in NANAE:
http://groups.google.com/group/news.admin.net-abuse.email/search?group=news.admin.net-abuse.email&q=Flying+Croc&qt_g=1&searchnow=Search+this+group
There are 78 sightings in NANAS:
http://groups.google.com/group/news.admin.net-abuse.sightings/search?group=news.admin.net-abuse.sightings&q=Flying+Croc&qt_g=1&searchnow=Search+this+group
All mention Flying Croc (and Accretive Technology) as supporting and
engaging in spam
If Microsoft is truly serious about spam and abuse at MSN, why is
nothing being done about this?
This is a direct violation of MSN Terms of Use, which prohibits
commercial use of MSN
How is this NOT commercial use?
Why haven't slickcams.com, Ross Perkins and Flying Croc Inc been warned
about this abuse?
This really is a travesty...
If your story is correct (and as far as I can see it actually is)
one can only conclude dat MSFT/MSN doesn't care.
My MSN space had "issues" - they were *never resolved.
MSN and Messenger are free services. Don't expect first rate
free personal email support from MSFT.
In fact, the "support" email I received from
MSFT read like something emerging from the "brain" of a
"bot" - although my "issue" was well written, documented
and easy to reproduce.
Try finding 1 single reason why MSFT should care about
resolving the issues one single user of this free service is
experiencing.
We're discartable drops in the ocean.
Luckily there are MVPs on this NG ;-)
>
> If your story is correct (and as far as I can see it actually is)
> one can only conclude dat MSFT/MSN doesn't care.
>
There's been some progress. I finally had a Messenger Support staff
member ask for a screen capture of the 'conversation'
Why the quotes? I literally typed the word 'anything' to get the bot to
spew out the URL of the Flying Croc porn site
The biggest problem? I've had a couple of technicians request things
like this, and then find it impossible to reach them for any feedback
or back and forth.
it's just horribly-organized -- once an abuse desk member feels your
case has merit enough to request evidence, you should be able to
correspond with the abuse desk without going through the heck of those
automated responses
> MSN and Messenger are free services. Don't expect first rate
> free personal email support from MSFT.
>
I don't expect first-rate support - but I expect some interest when a
commercial enterprise is abusing their services. Microsoft has gone
after a number of spammers in a big way - they're squeezing one
penis-pill spammer so hard right now that he's gone into bankruptcy.
>
> In fact, the "support" email I received from
> MSFT read like something emerging from the "brain" of a
> "bot" - although my "issue" was well written, documented
> and easy to reproduce.
>
Yup that's the big problem -- the automated 'system' breaks down the
moment the support people ask for some more information - how the heck
do you reach them?
> Try finding 1 single reason why MSFT should care about
> resolving the issues one single user of this free service is
> experiencing.
I agree
But it is in their enlightened self-interest if someone is using a
non-commercial service like Messenger or Hotmail for such obviously
commerical purposes.
> Luckily there are MVPs on this NG ;-)
Jonathan Kay has been helpful
Over 10 Hotmail/Messenger accounts have been nuked
The problem is - at this point, something proactive needs to be done -
in the way of communication with this company to cease and desist.
By the way - for the curious, add the following 'contacts' to a
throwaway MSN Messenger/Passport account and see what you find:
emily...@hotmail.com
hottiei...@hotmail.com
You'll get linked to a subdomain of localgirlcams.com
Here's the body of a typical spam:
"wow you'regorgeous thank you 4 sendme that pic pleasemsnme
my.mssnmessnger is hottieinuniform"
Imagine getting 2 or 3 of these every day
go to support.msn.com and click "Hotmail"
--
Name: Vitalie Ciobanu
Nickname: AISBERG
Homepage: http://aisberg.rau.ro
"Stefaan" <m...@privacy.net> wrote in message
news:NLEjg.480541$Dc6.12...@phobos.telenet-ops.be...
The problem isn't receiving an answer. The problem is receiving an
answer that is in any way, shape or form useful.
> But I don't say that the first reply resolved the problem, but we're trying!
Please explain how this is 'trying'
I invite anyone on this forum to add the following email addresses to
their Messenger contact list:
emily...@hotmail.com
hottiei...@hotmail.com
Then type ANYTHING to them. You will get links to
http://sexyemily.localgirlcams.com
This is a commercial pornographic website registered to Flying Croc,
Inc
How do I know about those two Hotmail/Messenger accounts? They were
sent to me in spam
Sure SOUNDS like a violation of terms of use, doesn't it?
Takes me about 5 minutes to verify this.
If I were an admin, I'd take the report, verify the abuse and send a
warning to the commercial enterprise. 15 minutes tops
If I have to clear it with the legal department, add a few days.
I reported these two email addresses/accounts two weeks ago. I have
filed multiple reports. Two technicians requested screen shots of the
conversations - I can't get the screen shots through despite following
their exact directions
The real buster? These email accounts STILL work.
Explain that to me
My explanation? There is no competent abuse desk within MSN.
--
Name: Vitalie Ciobanu
Nickname: AISBERG
Homepage: http://aisberg.rau.ro
"Spamkillah" <3d1i...@sneakemail.com> wrote in message
news:1150470338....@u72g2000cwu.googlegroups.com...
That's good to know - this particular thread was about reporting ABUSE
on MSN Messenger. Not sure how that relates to reporting source code
problems.
As far as contacting MSN Support through support.msn.com, here's the
brilliant response I received:
> "According to your email, the issue is that you want to report a message that you
> received with links to pornographic pages."
NO!
I said the issue was violation of terms of use by a commercial
enterprise!
That commercial enterprise HAPPENED to be involved in pornographic
webpages.
>"I have reviewed the information provided and it appears this issue is related to MSN >Messenger 8.0 or Windows Live Beta Messenger. As we specialize only in supporting >the MSN Messenger Versions 6.2, 7.0 and 7.5 product, the most efficient way to gain >assistance with this issue is to submit the support request through
THIS is unreal
I am reporting ABUSE
How the heck does ABUSE have ANYTHING to do with what version of MSN
Messenger I am using?
And why can't an ABUSE report be directed to the right desk BY someone
working at MSN support?
This entire support structure at MSN is byzantine and confusing. It's a
miracle ANY reported abuse is acted upon.
And the way it is set up, there is no way to respond to requests for
more information by members of the support staff.
I can't cancel it, but I can tell you this - posting these
Slickcams.com/localgirlcams.com email accounts here WILL help to get
them cancelled
So if ANYONE receives spam involving a Microsoft Messenger account, and
if that account is a bot spitting out links to slickcams.com or
localgirlcams.com, please post it here
Microsoft's abuse department has been very helpful. I don't think they
understood the scope of the problem until recently.
What is very interesting: the registration info on both domains
(slickcams.com and localgirlcams.com) has changed.
Formerly the domains were both registered directly to Flying Croc
(FCI). FCI likes to maintain the appearance of being a simple hosting
company, I guess
Wonder if the Washington state AG's office has been knocking at the
door yet.
emily...@hotmail.com
emily...@hotmail.com
emily...@hotmail.com
emilye...@hotmail.com
She'll be shut down soon enough. There are filters in place to identify people sending the
same message over and over quickly and repeatedly
--
Jonathan Kay
Microsoft MVP - Windows Live Messenger
MSN Messenger/Windows Messenger
MessengerGeek Blog: http://www.messengergeek.com
Messenger Resources: http://messenger.jonathankay.com
(c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
--
"Tarupron" <Taru...@discussions.microsoft.com> wrote in message
news:2602DFCF-013A-4672...@microsoft.com...
I got a request from this account and accidentally added it to my
contacts...it was a bot that gave a script exactly like the one posted here:
http://www.spamzy.net/2008/05/27/slickcams-and-slickcash-webcam-spammers-and-lying-liars/
Now I've blocked and deleted this contact, but I can't delete it from my
blocked list or remove myself from the bot's list. Could a MSN messenger
moderator please shut down this account?
Thanks
"Jonathan Kay [MVP]" wrote:
> Greetings,
>
> She'll be shut down soon enough. There are filters in place to identify people sending the
nature or citation
cecile...@hotmail.com messaged me this morning, lovely breasts and
derrier, looking at the posts this has been going on since 2006 at least.
Funny thing was the name Cecile, i thought it was one of them blue rinse
ladys who keep harrasing me on my dating site so added her for a laugh, what
a suprise i got, not a blue rinse in sight
unfortunatly i deleted her stuff contact stuff before seeing how badly this was
bieng spammed
all i can remember was the email address was something like 'pauletto@hotmail' or
very very similar ... not much help but thought i should say that its still happening
I got the add to cantact list request earlier.. the bot triggered when I
sent the first message ( in my case: "who are you?" )
i got another one here: imeld...@hotmail.com
Also links to http://jane2hot.lovelocalgirls.com/
-cheers
Here's yet another person complaining about Istra Holdings:
http://www.matchent.com/wpress/?q=category/2/23
Here's the original article about Facebook's lawsuit against Istra:
http://www.theregister.co.uk/2007/12/17/facebook_hack_attack_lawsuit/
Istra Holdings is the company behind Slickcash/Slickcams. That much is
clear.
There seems to be some relationship between Istra and Flying Croc
(their hosting company) beyond just customer/provider. In fact, at one
point (until I posted the WHOIS info in NANAE), Slickcash.com and
Slickcams.com were both registered directly to FCI
I simply do not understand why Microsoft has refused to take any legal
action against Istra... or against FCI for that matter. I don't think
it would be difficult to prove the following:
- Istra (or someone affiliated with Istra) is setting up chatbots on
virus-compromised machines, with the intent of promoting its websites
- Istra (or someone affiliated with Istra) is then spamming Hotmail
customers through open proxies
- According to Facebook, Istra does not have a problem engaging in
hacking in order to promote its businesses.
- Istra seems to make money on its operation
So you have a profitable enterprise (allegedly involved in criminal
activities) that is abusing your company's resources. Seems like a no-
brainer to sue, doesn't it?
At the very least, MSN should be disconnecting the chatbot accounts
without hesitation, and warning Istra about its violations of the MSN
TOS.
> "Frustrated MSN User" wrote:
Put me down as another (extremely) frustrated MSN user.... especially
after 2 years of inaction on this front.
It was from Sheen...@hotmail.com
"frustrated MSN user #2" wrote:
juana...@hotmail.com
lindse...@hotmail.com
automated replies and everything, can i somehow remove myself from their
contacts ?
No, you can only remove them from your main contact list. Until they remove you (or in this
case, are removed from the network most likely), they can't be removed from the allow/blocked
lists, assuming that's what you meant.
--
Jonathan Kay
Microsoft MVP - Windows Live Messenger
MSN Messenger/Windows Messenger
MessengerGeek Blog: http://www.messengergeek.com
Messenger Resources: http://messenger.jonathankay.com
(c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
--
"Slobodan" <Slob...@discussions.microsoft.com> wrote in message
news:3C7C0406-04B4-4209...@microsoft.com...
"frustrated MSN user #2" wrote:
Jonathan -
Can you confirm that MSN is shutting down the accounts posted here so
far?
I have had zero luck getting accounts shut down via the Live Support
link you've provided.
I think it's useful to publish the accounts publicly in this group -
at least until we can confirm that MSN Messenger support is acting on
complaints.
And if anyone wishes to pursue legal action against the spammers (for
example, if this is indeed Istra Holdings doing this), it might be
useful if this is a matter of public record
(Unfortunately, the person at MSN Messenger support who handled these
accounts is no longer employed by MSN.)
Silvia says (3:47 PM):
Depraved hey hey.....its me from the other day! I sent you a message on
http://hookupsonly.com but you didnt respond. hit me back up xoxo
I lookoed up hookupsonly in google and found this site to post these
problems, I hope this will help solve the problems.
***********************************************
"frustrated MSN user #2" wrote:
Silvia says (3:47 PM):
Depraved hey hey.....its me from the other day! I sent you a message on
http://hookupsonly.com but you didnt respond. hit me back up xoxo
*****************
another one: marily...@hotmail.com with the message:
Marilyn says (4:01 PM):
Re: hi Depraved .....You still down to hook up and have some fun! lol
Hit me back up on http://www.hookupsonly.com My username is the same as my
msn
*********************
another one: debbie...@hotmail.com with the message:
Debbie says (4:01 PM):
check this out Depraved .....You still down to hook up and have some fun!
lol Hit me back up on http://www.hookupsonly.com My username is the same
as my msn
****************
there is another batch that comes from "kelly" loads of those, many wanting
to go to a site then to webcam.
I block them as they come in but the stream of them never stops.
*********************
"frustrated MSN user #2" wrote:
That URL simply redirects to www.naked.com
Naked.com is another (scummy) paysex site that might (or might not) be
connected to fling.com.
If you want to see the ilk of these people, read:
http://www.ripoffreport.com/searchresults.asp?q1=ALL&q4=&q6=&q3=&q2=&q7=&searchtype=0&submit2=Search!&q5=FLING&Search=Search
Here's someone reporting bogus billing from naked.com:
http://www.ripoffreport.com/reports/0/330/RipOff0330106.htm
It's interesting that other sex sites are using the techniques that
Istra (slickcams.com/slickcash.com) started.
Again - keep posting this stuff here. I get the sense that MSN does
not understand the degree to which their networks and services are
being abused.
more spam info:
Tessa says (4:47 PM):
hey my friend is new to town send her a message on msn messengor her names
jane...@live.com and ask her for her pic shes cute i promise lol
alissal...@hotmail.com
Alissa says (5:20 PM):
I cant upload my pics to msn for some reason! But I want to chat with you.
you can find me on my personal page http://HopeBurgerhzyx.blogspot.com
my name is kelly
carmel...@hotmail.com
Carmela says (5:27 PM):
chill Depraved .....I cant upload my pics to msn for some reason! lol Hit
me back up on http://hookupsonly.com so I can send you a cam invite!
lizzi...@hotmail.com
Lizzie says (5:36 PM):
Re: sup Depraved your from http://hookupsonly.com right? I think I got a
message from you on there. Hit me back up if thats you!
kelley...@hotmail.com
Kelley says (5:57 PM):
hello Depraved .....I cant upload my pics to msn for some reason! lol Hit
me back up on http://hookupsonly.com so I can send you a cam invite!
maryc...@hotmail.com
Mary says (6:54 PM):
whats up Depraved your from http://hookupsonly.com right? I think I got
a message from you on there. Hit me back up if thats you!
beth...@hotmail.com
Beth says (7:12 PM):
check this out Depraved your from http://hookupsonly.com right? I think
I got a message from you on there. Hit me back up if thats you!
*** someone tell her it is "you're" not your** if one is going to spam, use
proper english to do so, lol
rubyd...@hotmail.com
Ruby says (7:34 PM):
Depraved hey hey.....its me from the other day! I sent you a message on
http://hookupsonly.com but you didnt respond. hit me back up xoxo
corinn...@hotmail.com
Corinne says (10:03 PM):
wazzup Depraved your from http://hookupsonly.com right? I think I got a
message from you on there. Hit me back up if thats you!
*********************
that is the end of the newest ones, this is insane and more so if MS won't
do their part in controlling it.
"Spamkillah" wrote:
> The commercial pornographic website www.slickcams.com continues to
> use/abuse MSN Hotmail and Messenger to advertise its websites
>
> Its method of abuse:
> 1) Create a Hotmail account - for example, hotte...@hotmail.com
> 2) Send out spam (via open relays to prevent tracing) with the
> following line in it
>
> i lovedthat picyou sent me you are the hottest guy i have everseen my
> msnn,messserger,is hottemily86
>
> 3) Connect a chat bot on MSN Messenger connected to
> hotte...@hotmail.com
> The chat bot simply spews out scripted text when contacted
>
> The text contains a URL link to a subdomain of the domain
> localgirlcams.com - for example,
> The URL redirects to www.slickcams.com - a pay porn site
> Example: http://newashley.localgirlcams.com/
>
> This has been going on since February of this year.
>
> I have succeeded in getting the following Hotmail/Messenger/Passport
> accounts terminated/suspended:
> girlier...@hotmail.com
> greatlook...@hotmail.com
> emily...@hotmail.com
> hotem...@hotmail.com
> emilyc...@hotmail.com
> girlieho...@hotmail.com
> emily...@hotmail.com
>
> Nonetheless, my Hotmail account continues to get hit with this spam,
> and this company continues to create Hotmail/Messenger/Passport
> accounts
>
> Unfortunately, trying to communicate this abuse to the various support
> desks is almost impossible. If I complain to Hotmail abuse, I am told
> that the spam I received did not come from Hotmail mail servers. (In my
> complaint, I point this out immediately.)
>
> MSN Abuse tells me to send complaints to Hotmail abuse
>
> MSN Messenger support tells me to send complaints to MSN abuse - they
> only provide technical support
>
> The domain slickcams.com is registered directly to Flying Crocodile,
> INC of Seattle, WA:
> Domain Name: SLICKCAMS.COM
>
> Registrant [188263]:
> FCI, Inc.
> 2019 3rd Ave Suite 200
> Seattle
> WASHINGTON
> 98121
>
> There are 34 mentions of Flying Croc in NANAE:
> http://groups.google.com/group/news.admin.net-abuse.email/search?group=news.admin.net-abuse.email&q=Flying+Croc&qt_g=1&searchnow=Search+this+group
>
> There are 78 sightings in NANAS:
> http://groups.google.com/group/news.admin.net-abuse.sightings/search?group=news.admin.net-abuse.sightings&q=Flying+Croc&qt_g=1&searchnow=Search+this+group
>
> All mention Flying Croc (and Accretive Technology) as supporting and
> engaging in spam
>
> If Microsoft is truly serious about spam and abuse at MSN, why is
> nothing being done about this?
>
> This is a direct violation of MSN Terms of Use, which prohibits
> commercial use of MSN
>
> How is this NOT commercial use?
>
> Why haven't slickcams.com, Ross Perkins and Flying Croc Inc been warned
> about this abuse?
>
> This really is a travesty...
>
>
"frustrated MSN user #2" wrote:
I've just sent a report to the MSN Live Messenger abuse team regarding
this email address (jane8...@live.com)
The Abuse team has deleted many of these bot accounts. I'm sure
Jonathan gets a lot of the thanks here for reporting these, too
Moving forward, we should continue to post these accounts publicly
here. I don't think MSN realized just how much abuse there was
Hopefully the Abuse team will continue to monitor this thread, and
will continue to disable the accounts.
I was wondering how they got my email address.
Thanks - I think we need to keep posting these spam accounts publicly.
I think we need a critical mass of complaining users before MSN will
actually clean the garbage off its Messenger service. Maybe someday
they'll take some legal action against the Istra Holdings scumbags?
> "Jonathan Kay [MVP]" wrote:
> > Greetings,
>
> > She'll be shut down soon enough. There are filters in place to identify people sending the
> > same message over and over quickly and repeatedly
>
> > --
> > Jonathan Kay
> > Microsoft MVP - Windows Live Messenger
> > MSN Messenger/Windows Messenger
> > MessengerGeek Blog:http://www.messengergeek.com
> > Messenger Resources:http://messenger.jonathankay.com
> > (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
> > --
Jonathan -
This is simply not true. The abuse desk at Hotmail/Messenger/Live
seems to be incapable of understanding what is going on - or is simply
indifferent
I complained about jane8...@live.com 3 times to the link you gave
me. I have also sent emails in response to the responses I received
Now this is the simplest thing imaginable. If I were on the abuse
desk, I'd log in, see that this is a bot, and delete the account. That
simple.
Here are some of the responses I've gotten:
======================================================
1)
"Thank you for getting back to us. My name is Allan John and I'll be
glad to further assist you with your concern.
I've gone through your e-mail and understand that you are reporting
that someone has posted an new account in the thread. Furthermore,
you've also monitored the Microsoft.public.MSN.Messenger newsgroup and
seen that it has been terminated. Moreover, you will continue to
monitor the thread since it may be a great help to us in stopping this
matter. I understand how you feel about the issue. Please know that
I'll be helping you with your concern."
2)
"Based on the information you sent, I understand that you are
receiving spam messages containing links to porn sites. I can see the
importance of this issue so let me help you with your concern."
3)
"Based on the information I received, I understand that you keep
receiving messages on Windows Live Messenger. We definitely understand
how inconvenient this can be, and how important it is for you to have
this issue resolved immediately. Please accept our apologies for any
inconvenience that this may have caused.
Instant Messaging (IM) is an instantaneous method of online
communication. Some program writers are now using IM to spread
malicious programs such as viruses and worms. These viruses can spread
when a person opens an infected file that is sent through IM by
someone who appears to be a contact. A computer infected by a virus
may continue to spread the infection by sending copies of the virus to
everyone on the IM contact list."
====================================================
I laid the case out pretty clearly, and provided evidence that Istra
Holdings is creating throw-away accounts, linking them in spam, and
setting up bots on Messenger
Beyond this, the accounts in question ARE bots - and as far as I know,
a bot created for commercial purposes is against the terms of service,
and should be deleted
This is NOT rocket science.
If porn bot --> delete
If not porn bot --> do nothing
In fact, I could program a bot to do JUST THIS JOB.
Can anyone explain the utter stupidity of the MSN Hotmail abuse desk?
How do people fail so epically at doing their jobs - unless their job
is to frustrate any user making any complaint?
If you report the abuse of the member on the website, you get an email
asking you to provide details. The website already allows you to provide the
email address, the website of the member and that it is spam. What else can
you provide? You can not reply to the email. You have to copy and paste the
originating email. You then get an apology for the continued problem and
again..please provide us with the details of the abuse. Of course I already
provided the info. It is the Microsoft way. Employ people, but solve no
problems.
This is not exhaustive - but here's a list of some Istra/Slickcash
spambots:
jane2...@live.com
jane2...@live.com
jane2...@live.com
jane8...@live.com
jane8...@live.com
jane8...@live.com
jane8...@live.com
I THINK you can see a pattern here. I'm sure there's a few more
jane##ma...@live.com around
Apparently the MSN Messenger abuse desk still doesn't get it.
These are just scripts - there's no intelligence to these bots. They
spit out the same script. They also rotate through the same set of
images.
They exist for the express purpose of advertising for Slickcash.com
websites.
I assume all of these have appeared in spam. (Seems like my account
has been listwashed.)
I'd assume Slickcash has done this same method with EVERY account so
named (first name, two digit number, last name).
What we have:
1) A company that has been successfully sued for hacking and abuse
2) A large body of evidence indicating that Slickcash knows about this
abuse, and either condones it or engages in it directly
3) A clear pattern of behavior in the MO of the abuse
So where's the action?????
> This is not exhaustive - but here's a list of someIstra/Slickcash
> spambots:
> jane20m...@live.com
> jane21m...@live.com
> jane22m...@live.com
> jane80m...@live.com
> jane81m...@live.com
> jane82m...@live.com
> jane83m...@live.com
Followup -
These accounts appear to be dead.
Thanks to whoever is responsible.
I'd advise people to continue filling out abuse reports at the link
Jonathan Kay provided. Include the URL link the spambot spits out. If
this redirects to Slickcams.com, mention Istra Holdings in the
complaint.
I'd also continue posting email addresses (along with the URL links)
here.