מעכשיו פוסטים חדשים מ-Usenet לא יופיעו ואי אפשר להירשם לתוכן מ-Usenet בקבוצות Google. התוכן שכבר פורסם עדיין יופיע.

Dismiss

Link between poshnet.com and Middleton/Empire Communications

0 צפיות

מעבר להודעה הראשונה שלא נקראה

Andrew Gierth‏

לא נקראה,

8 באוק׳ 1998, 3:00:008.10.1998

עד

[This message is blind-copied to relevent mailing lists.]

Hostcomm,

The attached information demonstrates a clear link between
"poshnet.com" and Empire Communications, who have been spamming over
the last few months as "pacstar.net", "nwregion.net", and other
aliases. (Personal names used have included "M Middleton", "Andy Vilcus",
"Drew", "David Shultz", and others; I have no information on how many
real people are behind these names.)

This strongly suggests that poshnet.com may not be acting in good
faith but may be merely fronting for Middleton/Empire.

Accordingly, I will direct further reports of spam from poshnet.com
to Hostcomm instead.

To recipients on the newsadm list:

Middleton is the spammer (then calling himself "David Shultz") who was
mentioned in a warning on the list some weeks ago (and who
subsequently lost feeds through onramp.net, hooked.net,
maxwell.syr.edu, gamma.ru, and eventually also lost his feed from
Verio Northwest, who are, however, still apparently providing him with
connectivity).

Until now, I had believed that "poshnet.com" had simply been duped
into providing him with a feed, but it now appears that poshnet.com
are probably just another front. poshnet.com have been at or near the
top of the spam statistics for the past few days.

poshnet's path entry is "newsfeed.poshnet.com". I append a small
extract from a recent spam report (several notifications were mailed
to poshnet, but no response has been received).

Note that all paths seen so far follow the pattern:
...!newssource.hostcomm.net!newsfeed.poshnet.com![forged]

with the forged entries varying every few days ("dawteck",
"uselink.net", "cilogic", "datats", etc.) As before, NNTP-Posting-Hosts
are blatantly forged, and in addition the "From" headers are usually
copied from those of legitimate posts (which has, in the past, led to
innocent third parties having their posts blocked from some servers).

At present, newsfeed.poshnet.com is also open to the world for posting
access, and is therefore being abused by the usual crowd in addition to
Middleton's forgeries.

In the light of this information, I recommend that you add
"newsfeed.poshnet.com" to your shun lists or filters.

----begin evidence----

$ finger @poshnet.com
[poshnet.com]
Login Name Tty Idle Login Time Office Office Phone
root root *1 17 Sep 29 12:45
root root *p0 Oct 8 13:54 (206.58.218.52:0.0)

So what we have here is someone logged in /as root/ on poshnet's
server, *from an Empire Communications address*.

Note that "poshnet.com" is the same machine as "newsfeed.poshnet.com":

$ finger @newsfeed.poshnet.com
[newsfeed.poshnet.com]
Login Name Tty Idle Login Time Office Office Phone
root root *1 1:08 Sep 29 12:45
root root *p0 23 Oct 8 14:37 (206.58.218.52:0.0)

so the spammer has root access to the news server.

$ host 206.58.218.52
No recovery, Host not found.

$ whois -h whois.arin.net 206.58.218
Structured Network Systems, Inc. (NETBLK-SNS-NET-5) SNS-NET-5
206.58.0.0 - 206.58.255.255
Empire Communications (NETBLK-NET-EMPCOMM2) NET-EMPCOMM2
206.58.218.0 - 206.58.218.127

$ whois -h whois.arin.net =NETBLK-NET-EMPCOMM2
Empire Communications (NETBLK-NET-EMPCOMM2)
921 SW Washington Suite 224
Portland, OR 97205
US

"Empire Communications" are also known as:

$ whois nwregion.net

Registrant:
Empire Communications (NWREGION-DOM)
921 sw washington street #224
portland, OR 97205

Domain Name: NWREGION.NET

Administrative Contact, Technical Contact, Zone Contact:
Middleton, M (MM3141) d...@EMPIRE2.COM
503.241.1091 (FAX) 503.241.1198
Billing Contact:
Middleton, M (MM3141) d...@EMPIRE2.COM
503.241.1091 (FAX) 503.241.1198

and furthermore, they are also hosting the websites advertised in the
spams:

$ host 123adult.com
123adult.com has address 206.58.214.70
123adult.com mail is handled (pri=0) by 123adult.com

$ whois -h whois.arin.net 206.58.214
Structured Network Systems, Inc. (NETBLK-SNS-NET-5) SNS-NET-5
206.58.0.0 - 206.58.255.255
A and M Enterprises (NETBLK-NET-AMENT) NET-AMENT 206.58.214.64 - 206.58.214.95

$ whois -h whois.arin.net =NETBLK-NET-AMENT
A and M Enterprises (NETBLK-NET-AMENT)
921 SW Washington, Suite 224
Portland, OR 97205
US

--
Andrew.

-----begin extract-----
- ----------------------------------------------------------------------
18 matching articles were detected in 18 groups.
(2 additional matching articles had already expired.)
The Breidbart Index was 20 for a period of 6 days.

- -----begin sample article-----
>Path: ...!204.127.161.3.MISMATCH!wn3feed!worldnet.att.net!4.1.16.34!cpk-news-hub1.bbnplanet.com!la-news-feed1.bbnplanet.com!news.bbnplanet.com!newsfeed1.earthlink.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: Xgirls <y...@yuy.com>
>Newsgroups: alt.binaries.erotica.fetish
>Subject: ASS)**_(F-U-C-K-I-N) (ANAL) site^ 38906
>Date: 6 Oct 1998 20:20:18 GMT
>Lines: 855
>Message-ID: <6vduag$ac$31...@news.dawteck.net>
>NNTP-Posting-Host: 209.179.6.152
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-296"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-296
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 822
>
>PGh0bWw+CjwhLS0gISFoZG1yY3M4YWV5aTJyZTVvcW02dHVmd216M2tzazNx
>MmhjdHU1MjVqMG5scjJyZyEhIC0tPgogICAgICA8QSBIUkVGPSJodHRwOi8v
><...>
>bS9wYXNzdGhyb3VnaC5jZ2k/MjM4JyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4K
>PC9mcmFtZXNldD4KPC9odG1sPgoK
>
>------------=_907705209-19861-296
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 50212
>
>/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAsICAoIBwsKCQoNDAsNERwSEQ8P
>ESIZGhQcKSQrKigkJyctMkA3LTA9MCcnOEw5PUNFSElIKzZPVU5GVEBHSEX/
><...>
>CcCdocPmH9v4dMOYTqE5M7R4Y8s4P5Xecp2ncOZxZwIcTzCdsO48w8x5Y8Rj
>GP8AH//Z
>
>------------=_907705209-19861-296--

- ------end sample article------

<6v2uhk$ac$20...@newbox5.datats.com> alt.bainaries.pictures.erotica.lolita
<6v329j$ac$59...@newbox5.datats.com> alt.binaries.pictures.erotica.teens
<6v3mst$ac$29...@newbox5.datats.com> alt.binaries.pictures.nude
<6v3q6g$ac$65...@newbox5.datats.com> alt.sex.stories.incest
<6v5nbq$ac$69...@newbox5.datats.com> alt.binaries.pictures.erotica.butts
<6v700h$ac$94...@newbox5.datats.com> alt.binaries.pictures.erotica.redheads
<6vba5j$ac$45...@news.dawteck.net> alt.sex.video-swap
<6vb9dm$ac$41...@news.dawteck.net> alt.binaries.pictures.erotica.furry
<6vbgf0$ac$55...@news.dawteck.net> alt.sex.magazines
<6vbk08$ac$40...@news.dawteck.net> alt.binaries.picutes.nude.celebrities
<6vbrr7$ac$27...@news.dawteck.net> alt.binaries.pictures.erotica.male
<6vc8oi$ac$37...@news.dawteck.net> alt.binaries.pictures.supermodels
<6vd5bk$ac$53...@news.dawteck.net> alt.sex.erotica
<6vdcg7$ac$40...@news.dawteck.net> alt.sex.pictures
<6vdk6m$ac$38...@news.dawteck.net> alt.sex.watersports
<6vdkrl$ac$46...@news.dawteck.net> alt.binaries.erotica.fettish
<6vdo84$ac$54...@news.dawteck.net> alt.sex.cu-seeme
<6vduag$ac$31...@news.dawteck.net> alt.binaries.erotica.fetish
<6v108t$ac$29...@newbox5.datats.com> (expired)
<6v2qnl$ac$60...@newbox5.datats.com> (expired)

- ----------------------------------------------------------------------
18 matching articles were detected in 18 groups.
(2 additional matching articles had already expired.)
The Breidbart Index was 20 for a period of 6 days.

- -----begin sample article-----
>Path: ...!newsfeed.direct.ca!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: CARNAL CARLA <bri...@hotone.com>
>Newsgroups: alt.binaries.pictures.bodyart
>Subject: 510 area Hot Asian Male Escort Available
>Date: 6 Oct 1998 20:20:25 GMT
>Lines: 414
>Message-ID: <6vducc$ac$50...@news.dawteck.net>
>NNTP-Posting-Host: 62.144.104.87
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-308"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-308
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 769
>
>PGh0bWw+CjwhLS0gISF1Mjhxa2FiISEgLS0+CiAgICAgIDxBIEhSRUY9Imh0
>dHA6Ly93d3cuMTIzQWR1bHQuY29tL3NleC5odG1sIj4KICAgICAgPElNRyBT
><...>
>ZXIuY29tL3Bhc3N0aHJvdWdoLmNnaT8yMzgnIj4KPC9ib2R5Pgo8L25vZnJh
>bWVzPgo8L2ZyYW1lc2V0Pgo8L2h0bWw+Cgo=
>
>------------=_907705209-19861-308
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 23384
>
>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsL
>DBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/
><...>
>6bGhkOUXp6VMtiovUsxFs+tWlwDyfwFTJGnTYv5VbEUeB8i/lWZqmVkm2LgB
>RRV4RR4/1a/lRSsO5//Z
>
>------------=_907705209-19861-308--

- ------end sample article------

<6v2uba$ac$55...@newbox5.datats.com> alt.bainaries.pictures.erotica.spanking
<6v32na$ac$21...@newbox5.datats.com> alt.binaries.pictures.erotica.close-up
<6v3mvs$ac$31...@newbox5.datats.com> alt.binaries.pictures.victoria.secret
<6v3q5e$ac$52...@newbox5.datats.com> alt.sex.watersports
<6v5nm2$ac$52...@newbox5.datats.com> alt.binaries.pictures.erotica.fetish.leather
<6v703u$ac$40...@newbox5.datats.com> alt.binaries.pictures.erotica.urine
<6vb9i5$ac$63...@news.dawteck.net> alt.binaries.pictures.erotica.mardi-gras
<6vba7k$ac$38...@news.dawteck.net> alt.bainaries.pictures.black.erotic.females
<6vbglg$ac$59...@news.dawteck.net> alt.sex.spanking
<6vbk5t$ac$11...@news.dawteck.net> alt.sex.cd-rom
<6vbrs3$ac$64...@news.dawteck.net> alt.binaries.pictures.erotica.puffies
<6vc8pv$ac$60...@news.dawteck.net> alt.sex.bestiality.hamster.duct-tape
<6vd5fb$ac$47...@news.dawteck.net> alt.sex.fetish.fashion
<6vdcfa$ac$14...@news.dawteck.net> alt.sex.swingers
<6vdk27$ac$35...@news.dawteck.net> alt.bainaries.pictures.erotica.bestiality
<6vdkll$ac$36...@news.dawteck.net> alt.binaries.pictures.cocks
<6vdoa2$ac$65...@news.dawteck.net> alt.sex.fetish.drew-barrymore
<6vducc$ac$50...@news.dawteck.net> alt.binaries.pictures.bodyart
<6v104c$ac$22...@newbox5.datats.com> (expired)
<6v2qpc$ac$17...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!cpk-news-hub1.bbnplanet.com!news.bbnplanet.com!worldfeed.news.gte.net!newsfeed1.earthlink.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: sus...@adultserv.org
>Newsgroups: alt.binaries.pictures.celebrities
>Subject: ! She likes to get cum in her hair!
>Date: 6 Oct 1998 20:20:26 GMT
>Lines: 439
>Message-ID: <6vduch$ac$47...@news.dawteck.net>
>NNTP-Posting-Host: 12.67.16.139
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-309"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-309
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 826
>
>PGh0bWw+CjwhLS0gISE2bjAyNGcwZTl1cG5zYzM4ODQ0YWJtZjVwbnY5eTc4
>NHU4NnpwN2V5MTNtdGdxMnAhISAtLT4KICAgICAgPEEgSFJFRj0iaHR0cDov
><...>
>b20vcGFzc3Rocm91Z2guY2dpPzIzOCciPgo8L2JvZHk+Cjwvbm9mcmFtZXM+
>CjwvZnJhbWVzZXQ+CjwvaHRtbD4KCg==
>
>------------=_907705209-19861-309
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 24860
>
>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsL
>DBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/
><...>
>yyn0IFBZvnO49QKhBYSuQx5UE/rRcLllyoGSQKQSIe+fTFVsbjuOScZpVyV6
>npRdDLkTjn5T+VFRRqcH5moougP/2Q==
>
>------------=_907705209-19861-309--

- ------end sample article------

<6v2uit$ac$22...@newbox5.datats.com> alt.bainaries.pictures.erotica.teen
<6v32jg$ac$10...@newbox5.datats.com> alt.binaries.pictures.erotica.female.genitalia.large
<6v3mtt$ac$3...@newbox5.datats.com> alt.binaries.pictures.voyeurism
<6v3q6u$ac$57...@newbox5.datats.com> alt.personals.bi
<6v5nm5$ac$54...@newbox5.datats.com> alt.binaries.pictures.erotica.furry
<6v7024$ac$44...@newbox5.datats.com> alt.binaries.pictures.erotica.voyeurism
<6vb9kf$ac$63...@news.dawteck.net> alt.binaries.pictures.erotica.midgets
<6vba7m$ac$50...@news.dawteck.net> alt.bainaries.pictures.erotica.amateur.male
<6vbgi8$ac$43...@news.dawteck.net> alt.sex.stories
<6vbk62$ac$44...@news.dawteck.net> alt.sex.cu-seeme
<6vbrs5$ac$56...@news.dawteck.net> alt.binaries.pictures.erotica.rape
<6vc8q2$ac$58...@news.dawteck.net> alt.sex.bestiality.pictures
<6vd56r$ac$51...@news.dawteck.net> alt.sex.fetish.feet
<6vdce1$ac$32...@news.dawteck.net> alt.sex.telephone
<6vdk3u$ac$35...@news.dawteck.net> alt.bainaries.pictures.erotica.bestiality.hamster.duct-tape
<6vdklo$ac$22...@news.dawteck.net> alt.binaries.pictures.erotic.anime
<6vdoat$ac$40...@news.dawteck.net> alt.sex.fetish.fa
<6vduch$ac$47...@news.dawteck.net> alt.binaries.pictures.celebrities
<6v104d$ac$15...@newbox5.datats.com> (expired)
<6v2qpd$ac$21...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!204.127.161.3.MISMATCH!wn3feed!worldnet.att.net!208.134.241.18!newsfeed.cwix.com!207.217.77.43!newsfeed1.earthlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: webm...@lostvillage.org
>Newsgroups: alt.binaries.erotica.sex.in.the.morning
>Subject: Nice pixs - jlov1291.jpg(1/1) 32621 bytes
>Date: 6 Oct 1998 20:20:21 GMT
>Lines: 1261
>Message-ID: <6vduak$ac$41...@news.dawteck.net>
>NNTP-Posting-Host: 12.69.77.176
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-300"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-300
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 761
>
>PGh0bWw+CjwhLS0gISFnNyEhIC0tPgogICAgICA8QSBIUkVGPSJodHRwOi8v
>d3d3LjEyM0FkdWx0LmNvbS9zZXguaHRtbCI+CiAgICAgIDxJTUcgU1JDPSJo
><...>
>bS9wYXNzdGhyb3VnaC5jZ2k/MjM4JyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4K
>PC9mcmFtZXNldD4KPC9odG1sPgoK
>
>------------=_907705209-19861-300
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 75063
>
>/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcH
>Bw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/
><...>
>2ylypWOWlTjVqScjKmUopxUBNXrz7jfWs89q0p6o4cbDknZC596M+9JRVnCL
>n3oz70lFAC5pCaKaaBXAnmim0U7Cuf/Z
>
>------------=_907705209-19861-300--

- ------end sample article------

<6v2uje$ac$55...@newbox5.datats.com> alt.bainaries.pictures.erotica.oral
<6v32jk$ac$45...@newbox5.datats.com> alt.binaries.pictures.erotica.amateur.facials
<6v3mvp$ac$26...@newbox5.datats.com> alt.binaries.pictures.pantyhose
<6v3q6k$ac$38...@newbox5.datats.com> alt.sex.telephone
<6v5ne6$ac$37...@newbox5.datats.com> alt.binaries.pictures.erotica.female
<6v7017$ac$58...@newbox5.datats.com> alt.binaries.pictures.erotica.teen
<6vba7n$ac$22...@news.dawteck.net> alt.sex.wanted.models
<6vb9fb$ac$40...@news.dawteck.net> alt.binaries.pictures.erotica.gymnast-girls
<6vbggj$ac$58...@news.dawteck.net> alt.sex.oral
<6vbk2t$ac$85...@news.dawteck.net> alt.sex.bestiality
<6vbrrn$ac$35...@news.dawteck.net> alt.binaries.pictures.erotica.midgets
<6vc8p5$ac$3...@news.dawteck.net> alt.binaries.pictures.tasteless
<6vd5dr$ac$60...@news.dawteck.net> alt.sex.escorts.ads.d
<6vdcci$ac$46...@news.dawteck.net> alt.sex.services
<6vdk84$ac$57...@news.dawteck.net> alt.personals.fetish
<6vdkh9$ac$23...@news.dawteck.net> alt.binaries.nude.celebrities
<6vdo90$ac$52...@news.dawteck.net> alt.sex.erotica.marketplace
<6vduak$ac$41...@news.dawteck.net> alt.binaries.erotica.sex.in.the.morning
<6v109j$ac$64...@newbox5.datats.com> (expired)
<6v2qoa$ac$13...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!newsfeed.cwix.com!4.1.16.34!cpk-news-hub1.bbnplanet.com!su-news-hub1.bbnplanet.com!news.bbnplanet.com!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: arch...@yahoo.org (The Archiver)
>Newsgroups: alt.binaries.pictures.erotic.anime
>Subject: DS-L-13.jpg 158358 bytes Repost of ds-xx-00 series
>Date: 6 Oct 1998 20:20:26 GMT
>Lines: 454
>Message-ID: <6vducv$ac$37...@news.dawteck.net>
>NNTP-Posting-Host: 198.133.22.20
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-311"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-311
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 826
>
>PGh0bWw+CjwhLS0gISFubGEwdmJramI1YnhramEyaGhxZnU5c2piOGc4cXI3
>ZGRpZTh0eXI0NDMycG1jcjR1ISEgLS0+CiAgICAgIDxBIEhSRUY9Imh0dHA6
><...>
>Y29tL3Bhc3N0aHJvdWdoLmNnaT8yMzgnIj4KPC9ib2R5Pgo8L25vZnJhbWVz
>Pgo8L2ZyYW1lc2V0Pgo8L2h0bWw+Cgo=
>
>------------=_907705209-19861-311
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 25779
>
>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsL
>DBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/
><...>
>KKklkb1AxOaKKQkRE5Haq09FFLqD2Mu5J5rOfqaKKie5D2GmsnVSdg/3wKKK
>I7mVTYpkcke9BAzRRVsS2EAFFFFBL3P/2Q==
>
>------------=_907705209-19861-311--

- ------end sample article------

<6v2uj3$ac$29...@newbox5.datats.com> alt.bainaries.pictures.erotica.teen.female
<6v32e8$ac$86...@newbox5.datats.com> alt.binaries.pictures.erotica.pregnant
<6v3mu4$ac$35...@newbox5.datats.com> alt.sex
<6v3q71$ac$13...@newbox5.datats.com> alt.personals.bondage
<6v5nmj$ac$39...@newbox5.datats.com> alt.binaries.pictures.erotica.girlfriends
<6v7027$ac$44...@newbox5.datats.com> alt.binaries.pictures.girlfriend
<6vb9if$ac$94...@news.dawteck.net> alt.binaries.pictures.erotica.oral
<6vba7t$ac$13...@news.dawteck.net> alt.bainaries.pictures.erotica.asian.male
<6vbgia$ac$33...@news.dawteck.net> alt.sex.stories.hetero
<6vbk6d$ac$12...@news.dawteck.net> alt.sex.erotica
<6vbrs6$ac$10...@news.dawteck.net> alt.binaries.pictures.erotica.scanmaster
<6vc8q4$ac$59...@news.dawteck.net> alt.sex.bondage.furtoonia
<6vd571$ac$26...@news.dawteck.net> alt.sex.fetish.motorcycles
<6vdcek$ac$56...@news.dawteck.net> alt.sex.uncut
<6vdk89$ac$63...@news.dawteck.net> alt.bainaries.pictures.erotica.black.female
<6vdkm2$ac$27...@news.dawteck.net> alt.binaries.pictures.erotica
<6vdob6$ac$15...@news.dawteck.net> alt.sex.fetish.feet
<6vducv$ac$37...@news.dawteck.net> alt.binaries.pictures.erotic.anime
<6v10a6$ac$33...@newbox5.datats.com> (expired)
<6v2qpg$ac$35...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!newsfeed.direct.ca!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: Doc...@qis.com
>Newsgroups: alt.binaries.pictures.black.erotic.females
>Subject: awsome biker babe
>Date: 6 Oct 1998 20:20:25 GMT
>Lines: 464
>Message-ID: <6vduc8$ac$13...@news.dawteck.net>
>NNTP-Posting-Host: 207.208.34.133
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-307"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-307
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 826
>
>PGh0bWw+CjwhLS0gISE1ZTN0ZXUwajRjMWk5bGY1NW0zbmszdmgxbGV3YjF2
>aGZ5YXR0YWR5bWZndzF3MTZpISEgLS0+CiAgICAgIDxBIEhSRUY9Imh0dHA6
><...>
>Y29tL3Bhc3N0aHJvdWdoLmNnaT8yMzgnIj4KPC9ib2R5Pgo8L25vZnJhbWVz
>Pgo8L2ZyYW1lc2V0Pgo8L2h0bWw+Cgo=
>
>------------=_907705209-19861-307
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 26361
>
>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsL
>DBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/
><...>
>VfApJTvAJ7GiimxMiIA5pM849qKKbENJqFutFFCAJDlFPtUVFFAD5On4VDRR
>QJn/2Q==
>
>------------=_907705209-19861-307--

- ------end sample article------

<6v2ub9$ac$48...@newbox5.datats.com> alt.bainaries.pictures.erotica.redheads
<6v32j2$ac$16...@newbox5.datats.com> alt.binaries.pictures.erotica.centerfolds
<6v3mtr$ac$33...@newbox5.datats.com> alt.binaries.pictures.tasteless
<6v3q5c$ac$47...@newbox5.datats.com> alt.sex.wanted.models
<6v5ngd$ac$10...@newbox5.datats.com> alt.binaries.pictures.erotica.fetish.latex
<6v7023$ac$86...@newbox5.datats.com> alt.binaries.pictures.erotica.uniform
<6vb9i2$ac$34...@news.dawteck.net> alt.binaries.pictures.erotica.male.chubby
<6vba7f$ac$20...@news.dawteck.net> alt.binaries.pictures.erotica.teensex
<6vbgi4$ac$11...@news.dawteck.net> alt.sex.services
<6vbk5o$ac$42...@news.dawteck.net> alt.sex.brothels
<6vbrun$ac$58...@news.dawteck.net> alt.binaries.pictures.erotica.pornstars
<6vc8pt$ac$13...@news.dawteck.net> alt.sex.bestiality
<6vd5f6$ac$44...@news.dawteck.net> alt.sex.fetish.fa
<6vdcdt$ac$18...@news.dawteck.net> alt.sex.super-size
<6vdk5l$ac$44...@news.dawteck.net> alt.bainaries.pictures.erotica.asian-indian
<6vdkld$ac$44...@news.dawteck.net> alt.binaries.pictures.celebrities
<6vdoae$ac$57...@news.dawteck.net> alt.sex.fetish.diapers
<6vduc8$ac$13...@news.dawteck.net> alt.binaries.pictures.black.erotic.females
<6v104a$ac$21...@newbox5.datats.com> (expired)
<6v2qp7$ac$61...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!newsfeed.direct.ca!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: chr...@looselips.arenice.org
>Newsgroups: alt.binaries.pictures.cocks
>Subject: Nice pixs - arch029.jpg(1/1) 37582 bytes
>Date: 6 Oct 1998 20:20:26 GMT
>Lines: 363
>Message-ID: <6vducn$ac$53...@news.dawteck.net>
>NNTP-Posting-Host: 204.148.82.177
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-310"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-310
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 818
>
>PGh0bWw+CjwhLS0gISE3ejV1ZmJqMzd0MWYyNWFiYzkwa296bHNtZjhjaHg3
>b3hkaWRvMmd3d2hiISEgLS0+CiAgICAgIDxBIEhSRUY9Imh0dHA6Ly93d3cu
><...>
>c3N0aHJvdWdoLmNnaT8yMzgnIj4KPC9ib2R5Pgo8L25vZnJhbWVzPgo8L2Zy
>YW1lc2V0Pgo8L2h0bWw+Cgo=
>
>------------=_907705209-19861-310
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 20248
>
>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsL
>DBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/
><...>
>+NO0kTeLIpXwuM8HvVViRz2NaV1ZMLfd8nHv1/SqP2Z9v3hTcWRdIpyNzioS
>etW3tmz1WojbNg/d/M1Dix3M2Y4cU7NST2zbxyPzoEDY6j86z5WFz//Z
>
>------------=_907705209-19861-310--

- ------end sample article------

<6v2uk5$ac$23...@newbox5.datats.com> alt.bainaries.pictures.erotica.teen.d
<6v32jn$ac$39...@newbox5.datats.com> alt.binaries.pictures.erotica.interracial
<6v3mu0$ac$61...@newbox5.datats.com> alt.binaries.picutes.nude.celebrities
<6v3q5e$ac$61...@newbox5.datats.com> alt.personals.big-folks
<6v5nm9$ac$39...@newbox5.datats.com> alt.binaries.pictures.erotica.gaymen
<6v7026$ac$42...@newbox5.datats.com> alt.binaries.pictures.erotics.breasts
<6vb9i9$ac$96...@news.dawteck.net> alt.binaries.pictures.erotica.nativeamerican
<6vba7v$ac$41...@news.dawteck.net> alt.bainaries.pictures.erotica.art.pin-up
<6vbgi9$ac$64...@news.dawteck.net> alt.sex.stories.gay
<6vbk6p$ac$49...@news.dawteck.net> alt.sex.enemas
<6vbrup$ac$16...@news.dawteck.net> alt.binaries.pictures.erotica.redheads
<6vc8q2$ac$57...@news.dawteck.net> alt.sex.bondage
<6vd5a7$ac$15...@news.dawteck.net> alt.sex.fetish.hair
<6vdce5$ac$24...@news.dawteck.net> alt.sex.trans
<6vdk8f$ac$31...@news.dawteck.net> alt.bainaries.pictures.erotica.big-folks
<6vdkls$ac$41...@news.dawteck.net> alt.binaries.pictures.erotic.centerfolds
<6vdo90$ac$52...@news.dawteck.net> alt.sex.fetish.fashion
<6vducn$ac$53...@news.dawteck.net> alt.binaries.pictures.cocks
<6v10br$ac$17...@newbox5.datats.com> (expired)
<6v2r02$ac$56...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!nntp.msen.com!uunet!in5.uu.net!news-peer-east.sprintlink.net!news-peer.sprintlink.net!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: webm...@aicinc.org
>Newsgroups: alt.binaries.erotica
>Subject: e93i.jpg (1/1)
>Date: 6 Oct 1998 20:20:18 GMT
>Lines: 1041
>Message-ID: <6vduaf$ac$5...@news.dawteck.net>
>NNTP-Posting-Host: 207.253.121.236
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-295"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-295
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 814
>
>PGh0bWw+CjwhLS0gISF6a2E0NThhbDUwdW9heTZneGxwOG50djN4Y2doMzc5
>MnNqN3hzaGohISAtLT4KICAgICAgPEEgSFJFRj0iaHR0cDovL3d3dy4xMjNB
><...>
>cm91Z2guY2dpPzIzOCciPgo8L2JvZHk+Cjwvbm9mcmFtZXM+CjwvZnJhbWVz
>ZXQ+CjwvaHRtbD4KCg==
>
>------------=_907705209-19861-295
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 61590
>
>/9j/4AAQSkZJRgABAgEASABIAAD/7RFyUGhvdG9zaG9wIDMuMAA4QklNA+0A
>AAAAABAASAAAAAEAAQBIAAAAAQABOEJJTQPzAAAAAAAIAAAAAAAAAAA4QklN
><...>
>Q7PSo8MDsQ4r3zgGbIy5JHN7wxPEim52rmVeLbdCKZwfNiKU9XucqFie4wtW
>EhmQg9a0zj2bBtaRdPaODcqU/ap+GbOL5sOyH//Z
>
>------------=_907705209-19861-295--

- ------end sample article------

<6v32ht$ac$84...@newbox5.datats.com> alt.binaries.pictures.erotica.partygirls
<6v2uja$ac$64...@newbox5.datats.com> alt.bainaries.pictures.erotica.latina
<6v3msn$ac$16...@newbox5.datats.com> alt.binaries.pictures.lingerie
<6v3q4r$ac$10...@newbox5.datats.com> alt.sex.stories.hetero
<6v5nbl$ac$45...@newbox5.datats.com> alt.binaries.pictures.erotica.breasts.small
<6v700g$ac$18...@newbox5.datats.com> alt.binaries.pictures.erotica.rape
<6vba5a$ac$15...@news.dawteck.net> alt.sex.uncut
<6vb9dh$ac$54...@news.dawteck.net> alt.binaries.pictures.erotica.fetish.leather
<6vbgmb$ac$19...@news.dawteck.net> alt.sex.incest
<6vbk8b$ac$60...@news.dawteck.net> alt.binaries.pictures.voyeurism
<6vbrtu$ac$22...@news.dawteck.net> alt.binaries.pictures.erotica.lesbians
<6vc8s2$ac$64...@news.dawteck.net> alt.binaries.pictures.sex
<6vd5co$ac$89...@news.dawteck.net> alt.sex.enemas
<6vdcas$ac$30...@news.dawteck.net> alt.sex.phone
<6vdk7n$ac$37...@news.dawteck.net> alt.sex.wanted.models
<6vdkr6$ac$30...@news.dawteck.net> alt.binaries.erotica.fetish.wet-and-messy
<6vdo8n$ac$33...@news.dawteck.net> alt.sex.cd-rom
<6vduaf$ac$5...@news.dawteck.net> alt.binaries.erotica
<6v108l$ac$16...@newbox5.datats.com> (expired)
<6v2quj$ac$59...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!nntp.msen.com!news-feed.fnsi.net!news.megsinet.net!netnews.com!newsfeed.direct.ca!cpk-news-hub1.bbnplanet.com!la-news-feed1.bbnplanet.com!news.bbnplanet.com!newsfeed1.earthlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: OIUY...@UYGEF.COM
>Newsgroups: alt.binaries.nude.celebrities.female
>Subject: Please visit my new site!!!!!
>Date: 6 Oct 1998 20:20:23 GMT
>Lines: 717
>Message-ID: <6vdubj$ac$27...@news.dawteck.net>
>NNTP-Posting-Host: 12.64.3.221
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-303"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-303
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 810
>
>PGh0bWw+CjwhLS0gISExOGE2cXA3MnFoMHN3Z3M3YTdudWp5dzk2cnp2dXNt
>dzF3MnJtOSEhIC0tPgogICAgICA8QSBIUkVGPSJodHRwOi8vd3d3LjEyM0Fk
><...>
>b3VnaC5jZ2k/MjM4JyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4KPC9mcmFtZXNl
>dD4KPC9odG1sPgoK
>
>------------=_907705209-19861-303
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 41834
>
>/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJ
>ChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/
><...>
>LDzpg7/dHP0r2z4GDb8TNAUNkCSQ9P8Apk9ee6XpVzFAo+yzAY/55nr+Vel/
>BS1uIvibocjwSKgeTLFCAP3T1zOblUT8z1YUY0sNPXoz/9k=
>
>------------=_907705209-19861-303--

- ------end sample article------

<6v2uk0$ac$34...@newbox5.datats.com> alt.bainaries.pictures.erotica.plushies
<6v32l1$ac$59...@newbox5.datats.com> alt.binaries.pictures.erotica.asian-indian
<6v3mth$ac$32...@newbox5.datats.com> alt.binaries.pictures.supermodels
<6v3q6p$ac$23...@newbox5.datats.com> alt.sex.video-swap
<6v5nfi$ac$18...@newbox5.datats.com> alt.binaries.pictures.erotica.fetish
<6v703s$ac$33...@newbox5.datats.com> alt.binaries.pictures.erotica.teen.fuck
<6vb9h2$ac$16...@news.dawteck.net> alt.binaries.pictures.erotica.latina
<6vba6u$ac$60...@news.dawteck.net> alt.personals.big-folks
<6vbgll$ac$8...@news.dawteck.net> alt.sex.pictures
<6vbk4d$ac$10...@news.dawteck.net> alt.sex.bondage
<6vbruj$ac$18...@news.dawteck.net> alt.binaries.pictures.erotica.orientals
<6vc8s9$ac$26...@news.dawteck.net> alt.binaries.picutes.nude.celebrities
<6vd5d1$ac$28...@news.dawteck.net> alt.sex.femdom
<6vdcco$ac$26...@news.dawteck.net> alt.sex.stories.gay
<6vdkau$ac$44...@news.dawteck.net> alt.bainaries.pictures.black.erotic.females
<6vdkj1$ac$23...@news.dawteck.net> alt.binaries.pictures.bigbutts
<6vdo9r$ac$24...@news.dawteck.net> alt.sex.exhibitionism
<6vdubj$ac$27...@news.dawteck.net> alt.binaries.nude.celebrities.female
<6v10aj$ac$60...@newbox5.datats.com> (expired)
<6v2qos$ac$96...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!nntp.msen.com!uunet!in5.uu.net!news-peer-east.sprintlink.net!news-peer.sprintlink.net!news.sprintlink.net!cpk-news-hub1.bbnplanet.com!la-news-feed1.bbnplanet.com!news.bbnplanet.com!newsfeed1.earthlink.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: p...@aol.edu
>Newsgroups: alt.binaries.erotica.fetish.wet-and-messy
>Subject: girls pics, all free, high quality 86.jpg
>Date: 6 Oct 1998 20:20:19 GMT
>Lines: 1550
>Message-ID: <6vduag$ac$54...@news.dawteck.net>
>NNTP-Posting-Host: 12.68.7.153
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-297"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-297
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 814
>
>PGh0bWw+CjwhLS0gISFkbW44MWp2MW5mdDdqazkxeDN2MjYwbTZvOHlyMGVr
>ZTA4bTJzaDNmdyEhIC0tPgogICAgICA8QSBIUkVGPSJodHRwOi8vd3d3LjEy
><...>
>dGhyb3VnaC5jZ2k/MjM4JyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4KPC9mcmFt
>ZXNldD4KPC9odG1sPgoK
>
>------------=_907705209-19861-297
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 92655
>
>/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAoHBwgHBgoICAgLCgoLDhgQDg0N
>Dh0VFhEYIx8lJCIfIiEmKzcvJik0KSEiMEExNDk7Pj4+JS5ESUM8SDc9Pjv/
><...>
>UOSYEySefOnJtnllY1Mn2vg8TRbWzqpOPFkxgDvpFK777QXt3IywXMkUOMKs
>Y056b0qOxYjn3+Zric09z/Sr8YyudqwyGQ5LP+teqsHBYDvXqrSN1//Z
>
>------------=_907705209-19861-297--

- ------end sample article------

<6v2ui0$ac$62...@newbox5.datats.com> alt.bainaries.pictures.erotica.male
<6v32dq$ac$49...@newbox5.datats.com> alt.binaries.pictures.sex.fetish
<6v3muv$ac$23...@newbox5.datats.com> alt.binaries.pictures.nude.celebrities
<6v3q55$ac$63...@newbox5.datats.com> alt.sex.strip-clubs
<6v5nc8$ac$12...@newbox5.datats.com> alt.binaries.pictures.erotica.cartoons
<6v700k$ac$58...@newbox5.datats.com> alt.binaries.pictures.erotica.scanmaster
<6vba61$ac$64...@news.dawteck.net> alt.sex.voyeurism
<6vb9ee$ac$17...@news.dawteck.net> alt.binaries.pictures.erotica.gaymen
<6vbgfc$ac$42...@news.dawteck.net> alt.sex.masterbation
<6vbk0p$ac$16...@news.dawteck.net> alt.sex
<6vbrra$ac$39...@news.dawteck.net> alt.binaries.pictures.erotica.male.anal
<6vc8op$ac$33...@news.dawteck.net> alt.binaries.pictures.supermodels.cindy-crawford
<6vd5c6$ac$22...@news.dawteck.net> alt.sex.erotica.market.place
<6vdcb9$ac$65...@news.dawteck.net> alt.sex.pictures.female
<6vdk94$ac$37...@news.dawteck.net> alt.personals.bi
<6vdkek$ac$51...@news.dawteck.net> alt.binaries.erotica.pornstar
<6vdo9d$ac$64...@news.dawteck.net> alt.sex.enemas
<6vduag$ac$54...@news.dawteck.net> alt.binaries.erotica.fetish.wet-and-messy
<6v1096$ac$52...@newbox5.datats.com> (expired)
<6v2qnr$ac$29...@newbox5.datats.com> (expired)

- ----------------------------------------------------------------------
16 matching articles were detected in 16 groups.
(4 additional matching articles had already expired.)
The Breidbart Index was 20 for a period of 6 days.

- -----begin sample article-----
>Path: ...!204.127.161.3.MISMATCH!wn3feed!worldnet.att.net!206.229.87.25!news-peer.sprintlink.net!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: LI...@hot.edu (Sexy Tracy)
>Newsgroups: alt.binaries.pictures.erotica.tasteless
>Subject: BACHB3.JPG
>Date: 6 Oct 1998 21:10:54 GMT
>Lines: 1271
>Message-ID: <6ve198$ac$55...@news.dawteck.net>
>NNTP-Posting-Host: 24.64.245.66
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907708207-22486-254"
>
>This is a multi-part message in MIME format...
>
>------------=_907708207-22486-254
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 753
>
>PGh0bWw+CjwhLS0gISF5ZiEhIC0tPgogICAgICA8QSBIUkVGPSJodHRwOi8v
>d3d3LjEyM0FkdWx0LmNvbS9zZXguaHRtbCI+CiAgICAgIDxJTUcgU1JDPSJo
><...>
>dmVyc3VtL2EwNy5odG1sJyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4KPC9mcmFt
>ZXNldD4KPC9odG1sPgoK
>
>------------=_907708207-22486-254
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 75669
>
>/9j/4AAQSkZJRgABAgEASABIAAD/7RTuUGhvdG9zaG9wIDMuMAA4QklNA+kA
>AAAAAHgAHgAAAEgASAAAAAAC6AJT//j/+AMPAlsgAgUoA/wAAAAAAWgBaAAA
><...>
>s+kf7KOfGmzzNRdX6a55/XT/AFUfXXHL/bXHOmo5dP8AZ9VLnkaHu/QfdNDp
>6R68q+3/AErj019X+2o/5fVXGv/Z
>
>------------=_907708207-22486-254--

- ------end sample article------

<6v32dc$ac$43...@newbox5.datats.com> alt.bainaries.pictures.erotica.groupsex
<6v3msp$ac$37...@newbox5.datats.com> alt.binaries.pictures.erotica.groupsex
<6v3q57$ac$62...@newbox5.datats.com> alt.sex.escorts.ads.d
<6v5mks$ac$54...@newbox5.datats.com> alt.binaries.pictures.erotica.female.bodybuilder
<6v6vvj$ac$15...@newbox5.datats.com> alt.binaries.pictures.erotica.black.females
<6vb9bv$ac$44...@news.dawteck.net> alt.binaries.nude.celebrities.female
<6vba58$ac$43...@news.dawteck.net> alt.sex.fetish.fa
<6vbgjk$ac$52...@news.dawteck.net> alt.sex.asphyx
<6vbrqi$ac$40...@news.dawteck.net> alt.binaries.pictures.erotic.centerfolds
<6vc8nt$ac$35...@news.dawteck.net> alt.binaries.pictures.erotica.male.anal
<6vcdt6$ac$45...@news.dawteck.net> alt.binaries.pictures.erotic.cowgirls
<6vd591$ac$22...@news.dawteck.net> alt.binaries.pictures.erotica.transvestites
<6vdce0$ac$62...@news.dawteck.net> alt.sex.breast
<6vdk08$ac$14...@news.dawteck.net> alt.sex.fetish.orientals
<6vdo22$ac$48...@news.dawteck.net> alt.binaries.pictures.erotica.teen.fuck
<6ve198$ac$55...@news.dawteck.net> alt.binaries.pictures.erotica.tasteless
<6v104m$ac$56...@newbox5.datats.com> (expired)
<6v1eeb$ac$13...@newbox5.datats.com> (expired)
<6v2qpn$ac$11...@newbox5.datats.com> (expired)
<6v2ufs$ac$59...@newbox5.datats.com> (expired)

- ----------------------------------------------------------------------
17 matching articles were detected in 17 groups.
(3 additional matching articles had already expired.)
The Breidbart Index was 20 for a period of 6 days.

- -----begin sample article-----
>Path: ...!204.127.161.3.MISMATCH!wn3feed!worldnet.att.net!206.229.87.25!news-peer.sprintlink.net!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: ver...@hotmail.edu (Blackgirl Online)
>Newsgroups: alt.sex.brothels
>Subject: dogs licking cock?
>Date: 6 Oct 1998 21:11:21 GMT
>Lines: 1750
>Message-ID: <6ve1b8$ac$82...@news.dawteck.net>
>NNTP-Posting-Host: 208.158.224.141
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907708208-22486-298"
>
>This is a multi-part message in MIME format...
>
>------------=_907708208-22486-298
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 773
>
>PGh0bWw+CjwhLS0gISFyN3Y3ankyZmpncGQ5eHRnbCEhIC0tPgogICAgICA8
>QSBIUkVGPSJodHRwOi8vd3d3LjEyM0FkdWx0LmNvbS9zZXguaHRtbCI+CiAg
><...>
>aWNzLXh4eC5jb20vcGVydmVyc3VtL2EwNy5odG1sJyI+CjwvYm9keT4KPC9u
>b2ZyYW1lcz4KPC9mcmFtZXNldD4KPC9odG1sPgoK
>
>------------=_907708208-22486-298
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 104868
>
>/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAQDAwMDAgQDAwMEBAQFBgoGBgUF
>BgwICQcKDgwPDg4MDQ0PERYTDxAVEQ0NExoTFRcYGRkZDxIbHRsYHRYYGRj/
><...>
>eRtxXAXBIyKKKjqShgfdLgAdMn6/5FP3BZghGWz+B+v50UUDDzmz91T9aKKK
>nmY0kf/Z
>
>------------=_907708208-22486-298--

- ------end sample article------

<6v32bp$ac$42...@newbox5.datats.com> alt.sex.escort.ads
<6v3mvh$ac$56...@newbox5.datats.com> alt.binaries.pictures.nudism
<6v3q5a$ac$17...@newbox5.datats.com> alt.sex.super-size
<6v5ncs$ac$38...@newbox5.datats.com> alt.binaries.pictures.erotica.cheerleaders
<6v700q$ac$56...@newbox5.datats.com> alt.binaries.pictures.erotica.spanking
<6vba6f$ac$58...@news.dawteck.net> alt.sex.wanted
<6vb9f0$ac$4...@news.dawteck.net> alt.binaries.pictures.erotica.girlfriends
<6vbglh$ac$62...@news.dawteck.net> alt.sex.masturbation
<6vbk19$ac$42...@news.dawteck.net> alt.sex.anal
<6vbrre$ac$42...@news.dawteck.net> alt.binaries.pictures.erotica.male.chubby
<6vc8ov$ac$47...@news.dawteck.net> alt.binaries.pictures.supermodels.elle-macpherson
<6vd5co$ac$35...@news.dawteck.net> alt.sex.erotica.marketplace
<6vdcbp$ac$47...@news.dawteck.net> alt.sex.pictures.male
<6vdkg0$ac$49...@news.dawteck.net> alt.personals.big-folks
<6vdkfn$ac$44...@news.dawteck.net> alt.binaries.erotica.sex.in.the.morning
<6vdo8p$ac$40...@news.dawteck.net> alt.sex.erotica
<6ve1b8$ac$82...@news.dawteck.net> alt.sex.brothels
<6v109e$ac$63...@newbox5.datats.com> (expired)
<6v2qo4$ac$46...@newbox5.datats.com> (expired)
<6v2ui9$ac$12...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!newsfeed.cwix.com!207.217.77.43!newsfeed1.earthlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: bran...@iron.edu (Paul)
>Newsgroups: alt.binaries.pictures.nylons
>Subject: best hardcore fetish videos and pics on the net 25.jpg
>Date: 6 Oct 1998 21:11:07 GMT
>Lines: 552
>Message-ID: <6ve1fo$ac$15...@news.dawteck.net>
>NNTP-Posting-Host: 195.23.72.5
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907708208-22486-276"
>
>This is a multi-part message in MIME format...
>
>------------=_907708208-22486-276
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 757
>
>PGh0bWw+CjwhLS0gISFyZWczciEhIC0tPgogICAgICA8QSBIUkVGPSJodHRw
>Oi8vd3d3LjEyM0FkdWx0LmNvbS9zZXguaHRtbCI+CiAgICAgIDxJTUcgU1JD
><...>
>cGVydmVyc3VtL2EwNy5odG1sJyI+CjwvYm9keT4KPC9ub2ZyYW1lcz4KPC9m
>cmFtZXNldD4KPC9odG1sPgoK
>
>------------=_907708208-22486-276
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 31790
>
>/9j/4AAQSkZJRgABAgEASABIAAD/7REKUGhvdG9zaG9wIDMuMAA4QklNA+0A
>AAAAABAASAAAAAEAAQBIAAAAAQABOEJJTQPzAAAAAAAIAAAAAAAAAAA4QklN
><...>
>a2xu5zAfFPVbh/wmF2HHmmyTTfM2tafExaO0v7q3R26kRzOis3/A4T5snCdm
>zZsVf//Z
>
>------------=_907708208-22486-276--

- ------end sample article------

<6v32i6$ac$54...@newbox5.datats.com> alt.bainaries.pictures.erotica.teens
<6v3mue$ac$54...@newbox5.datats.com> alt.binaries.pictures.erotica.spanking
<6v3q3r$ac$16...@newbox5.datats.com> alt.sex.girl.watchers
<6v5mmj$ac$30...@newbox5.datats.com> alt.binaries.pictures.erotica.teen.female.masturbation
<6v5nco$ac$30...@newbox5.datats.com> alt.binaries.pictures.erotic.centerfolds
<6v700v$ac$27...@newbox5.datats.com> alt.binaries.pictures.erotica.groupsex
<6vba15$ac$12...@news.dawteck.net> alt.sex.movies
<6vb9g2$ac$41...@news.dawteck.net> alt.binaries.pictures.erotica.black
<6vbghd$ac$34...@news.dawteck.net> alt.sex.fetish.drew-barrymore
<6vbk3t$ac$12...@news.dawteck.net> alt.binaries.pictures.girlfriends
<6vbrrg$ac$53...@news.dawteck.net> alt.binaries.pictures.erotica.cheerleaders
<6vc8p8$ac$14...@news.dawteck.net> alt.binaries.pictures.erotica.transvestites
<6vd56g$ac$47...@news.dawteck.net> alt.binaries.pictures.supermodels.elle-macpherson
<6vdcco$ac$14...@news.dawteck.net> alt.sex.fetish.panties
<6vdk3a$ac$31...@news.dawteck.net> alt.sex.pictures.female
<6vdo6j$ac$44...@news.dawteck.net> alt.binaries.pictures.supermodels
<6ve1fo$ac$15...@news.dawteck.net> alt.binaries.pictures.nylons
<6v103l$ac$50...@newbox5.datats.com> (expired)
<6v2qvd$ac$45...@newbox5.datats.com> (expired)
<6v2uh6$ac$51...@newbox5.datats.com> (expired)

- -----begin sample article-----
>Path: ...!mr.net!news.idt.net!newsfeed.cwix.com!199.60.229.5!newsfeed.direct.ca!news-peer-west.sprintlink.net!news.sprintlink.net!newsfeed.concentric.net!news.pdxfiber.net!newssource.hostcomm.net!newsfeed.poshnet.com!dawteck!not-for-mail
>From: ddo...@hotmail.net (mistress)
>Newsgroups: alt.binaries.erotica.pornstar
>Subject: Pamela Anderson Sucking Tommy's Cock
>Date: 6 Oct 1998 20:20:20 GMT
>Lines: 2552
>Message-ID: <6vduai$ac$24...@news.dawteck.net>
>NNTP-Posting-Host: 203.216.4.31
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="----------=_907705209-19861-299"
>
>This is a multi-part message in MIME format...
>
>------------=_907705209-19861-299
>Content-Type: text/html
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 789
>
>PGh0bWw+CjwhLS0gISE1Mnd3dGs5bTE0aXh3ZGc0cXd1aWR5cyEhIC0tPgog
>ICAgICA8QSBIUkVGPSJodHRwOi8vd3d3LjEyM0FkdWx0LmNvbS9zZXguaHRt
><...>
>cDovL3d3dy5oaXR0cmFja2VyLmNvbS9wYXNzdGhyb3VnaC5jZ2k/MjM4JyI+
>CjwvYm9keT4KPC9ub2ZyYW1lcz4KPC9mcmFtZXNldD4KPC9odG1sPgoK
>
>------------=_907705209-19861-299
>Content-Type: image/jpeg
>Content-Disposition: inline
>Content-Transfer-Encoding: base64
>Content-Length: 153814
>
>/9j/4AAQSkZJRgABAgEAZABkAAD/7X0QUGhvdG9zaG9wIDMuMAA4QklNA+0A
>AAAAABAAZAAAAAEAAQBkAAAAAQABOEJJTQPzAAAAAAAIAAAAAAAAAAE4QklN
><...>
>/jN/HJR+pZc0Xef7xn/jIP8AiZyvqGEEXcf7w6l8ov4ZLH0T1Sf/AHTH81/W
>2GPNYclSf7CfNP8AjbGP0Nfe/wD/2Q==
>
>------------=_907705209-19861-299--

- ------end sample article------

<6v32g2$ac$40...@newbox5.datats.com> alt.binaries.pictures.erotic.cowgirls
<6v3mvg$ac$71...@newbox5.datats.com> alt.binaries.pictures.nylons
<6v3q6n$ac$20...@newbox5.datats.com> alt.sex.swingers
<6v5ndp$ac$30...@newbox5.datats.com> alt.binaries.pictures.erotica.facials
<6v7010$ac$53...@newbox5.datats.com> alt.binaries.pictures.erotica.tasteless
<6vba7p$ac$42...@news.dawteck.net> alt.sex.wanted.escorts.ads
<6vb9k0$ac$19...@news.dawteck.net> alt.binaries.pictures.erotica.groupsex
<6vbgg6$ac$28...@news.dawteck.net> alt.sex.movies
<6vbk29$ac$51...@news.dawteck.net> alt.sex.asphyx
<6vbrrl$ac$21...@news.dawteck.net> alt.binaries.pictures.erotica.mardi-gras
<6vc8s4$ac$49...@news.dawteck.net> alt.binaries.pictures.supermodels.kate-moss
<6vd5dg$ac$43...@news.dawteck.net> alt.sex.escorts.ads
<6vdccc$ac$12...@news.dawteck.net> alt.sex.prostitution
<6vdk7a$ac$63...@news.dawteck.net> alt.personals.bondage
<6vdkgm$ac$43...@news.dawteck.net> alt.binaries.fetish.scat
<6vdobq$ac$34...@news.dawteck.net> alt.sex.erotica.market.place
<6vduai$ac$24...@news.dawteck.net> alt.binaries.erotica.pornstar
<6v10a2$ac$48...@newbox5.datats.com> (expired)
<6v2qvb$ac$61...@newbox5.datats.com> (expired)
<6v2uiv$ac$22...@newbox5.datats.com> (expired)

------end extract------

David Ritz‏

לא נקראה,

9 באוק׳ 1998, 3:00:009.10.1998

עד ad...@samson.enteract.com,ro...@enteract.com,g...@telstra.net,postm...@telstra.net,use...@nico.telstra.net,hostm...@eu.concert.net,postm...@eu.concert.net,ab...@is-europe.net,ne...@is-europe.net‏

-----BEGIN PGP SIGNED MESSAGE-----

On 8 Oct 1998, Andrew Gierth wrote:

: [This message is blind-copied to relevent mailing lists.]
:
: Hostcomm,

You can remove Hostcomm from your notify list.

Middleton/Empire2 == Poshnet == Hostcomm.

: ----begin evidence----

:
: $ finger @poshnet.com
: [poshnet.com]
: Login Name Tty Idle Login Time Office Office Phone
: root root *1 17 Sep 29 12:45
: root root *p0 Oct 8 13:54 (206.58.218.52:0.0)
:
: So what we have here is someone logged in /as root/ on poshnet's
: server, *from an Empire Communications address*.
:
: Note that "poshnet.com" is the same machine as "newsfeed.poshnet.com":
:
: $ finger @newsfeed.poshnet.com
: [newsfeed.poshnet.com]
: Login Name Tty Idle Login Time Office Office Phone
: root root *1 1:08 Sep 29 12:45
: root root *p0 23 Oct 8 14:37 (206.58.218.52:0.0)
:
: so the spammer has root access to the news server.

Let's see if I understand this correctly. Someone within Empire2
is logged on as <root> on newsfeed.poshnet.com. Wouldn't that
tend to suggest that Poshnet is being run by Empire2, a long term
and well known dedicated net-abuse operation?

If that's the case, I think you may find this of interest.

=> usr10# f @newsfeed.poshnet.com
=> [newsfeed.poshnet.com]
=> Login: root Name: root
=> Directory: /root Shell: /bin/bash
=> On since Tue Sep 29 12:45 (PDT) on tty1 17 hours 39 minutes idle
=> (messages off)
=> Last login Thu Oct 8 14:37 (PDT) on ttyp0 from 206.58.218.52:0.0
=> No mail.
=> No Plan.

Well, we already knew that. The Empire2 spammer has root access
to newsfeed.poshnet.com. Empire2 == Poshnet.

=> usr10# f @newssource.hostcomm.net
=> [newssource.hostcomm.net]
=> Login: root Name: root
=> Directory: /root Shell: /bin/bash
=> On since Wed Sep 30 18:09 (PDT) on tty1 17 hours 26 minutes idle
=> (messages off)
=> Last login Thu Oct 8 13:08 (PDT) on ttyp0 from newsfeed.poshnet.com
=> New mail received Tue Oct 6 21:17 1998 (PDT)
=> Unread since Mon Oct 5 15:34 1998 (PDT)
=> No Plan.

Lookee here! Poshnet has root access to the Hostcomm news box.

Poshnet == Hostcomm. Why am I not surprised?

Just for kicks, lets take another look, this time leaving out the
names of the news boxes.

=> usr10# f @poshnet.com
=> [poshnet.com]
=> Login: root Name: root
=> Directory: /root Shell: /bin/bash
=> On since Tue Sep 29 12:45 (PDT) on tty1 17 hours 39 minutes idle
=> (messages off)
=> Last login Thu Oct 8 14:37 (PDT) on ttyp0 from 206.58.218.52:0.0
=> No mail.
=> No Plan.

=> usr10# f @hostcomm.net
=> [hostcomm.net]
=> Login: root Name: root
=> Directory: /root Shell: /bin/bash
=> On since Wed Sep 30 18:09 (PDT) on tty1 17 hours 26 minutes idle
=> (messages off)
=> Last login Thu Oct 8 13:08 (PDT) on ttyp0 from newsfeed.poshnet.com
=> New mail received Tue Oct 6 21:17 1998 (PDT)
=> Unread since Mon Oct 5 15:34 1998 (PDT)
=> No Plan.

Yep, that's pretty convincing. I'd say we have another match.

So, if Empire2 is operating Poshnet AND Poshnet is operating
Hostcomm, it must follow that Empire2 is operating Hostcomm.

Middleton/Empire2 == Poshnet == Hostcomm.

QED

: "M Middleton", "Andy Vilcus", "Drew", "David Shultz", and others.

You may now add the names "Mark Flower" and "Sean" to the list of
Empire2 front aliases.

I guess no appologies are due "Sean" or "Hostcomm".

- ----=---- -

To those who are providing newsfeeds to this operation, these feeds
were set up under fraudulent pretenses. Please terminate all
feeds associated with Hostcomm, at once.

--
David Ritz <dr...@primenet.com> Finger for PGP Public Keys
Fight against spam & spammers. http://spam.abuse.net
Outlaw Junk Email. ++++++ Join CAUCE ++++++ http://www.cauce.org
** Be kind to animals. - Kiss a shark. **

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.5.3
Comment: Finger:dr...@primenet.com for Public Keys

iQCVAwUBNh4m/9zLrWGabIhRAQFjnAQAuJtIXosDYupb9+UmHoe1oz0KAfL+poRW
CzWuCGNScJB4PXrP38a6QTMUeFU1ccS/zrxSnXwAmyrM+bdybGNPaS+GFbf+EdsC
QQJ9/5earHuiytq126ys9nCY+WX7yL3VM5Cg6fmDdKBf9W78RRXYLfTDmh/ISKY1
ZiAMutpWvLw=
=aD26
-----END PGP SIGNATURE-----

Lysander Spooner‏

לא נקראה,

9 באוק׳ 1998, 3:00:009.10.1998

עד

On Fri, 9 Oct 1998 08:09:52 -0700, David Ritz <dr...@primenet.com>
wrote:

> You can remove Hostcomm from your notify list.
>
> Middleton/Empire2 == Poshnet == Hostcomm.

==PDXfiber.net (Just in case anybody is tempted to go one step
upstream from hostcomm.)

Smoking Gun:

>finger ro...@pdxfiber.net
>[ro...@pdxfiber.net]
>
>Login: root Name: root
>Directory: /root Shell: /bin/bash
>Last login Tue Oct 6 11:47 (PDT) on ttyp2 from 206.58.218.52
>Mail last read Fri Sep 4 10:30 1998 (PDT)
>No Plan.
>
>[End of finger server message]

and that address belongs to:

>[Query: 206.58.218.0, Server: whois.arin.net]

>
>Structured Network Systems, Inc. (NETBLK-SNS-NET-5) SNS-NET-5
> 206.58.0.0 - 206.58.255.255
>Empire Communications (NETBLK-NET-EMPCOMM2) NET-EMPCOMM2
> 206.58.218.0 - 206.58.218.127

==Empire2/Middleton. The circle closes.

Game, Set and Match.

> You may now add the names "Mark Flower" and "Sean" to the list of
> Empire2 front aliases.
>
> I guess no appologies are due "Sean" or "Hostcomm".

And y'all thought I was over-reacting... tsk tsk oh ye of little
faith...

> To those who are providing newsfeeds to this operation, these feeds
> were set up under fraudulent pretenses. Please terminate all
> feeds associated with Hostcomm, at once.

What he said.

-- Rick
------------
** Nice try Matt. Better luck next life **

Fluffy -- The Other White Meat‏

לא נקראה,

9 באוק׳ 1998, 3:00:009.10.1998

עד

On Fri, 9 Oct 1998, Lysander Spooner wrote:

> > Middleton/Empire2 == Poshnet == Hostcomm.
> ==PDXfiber.net (Just in case anybody is tempted to go one step
> upstream from hostcomm.)
>
> Smoking Gun:
> >finger ro...@pdxfiber.net
> >[ro...@pdxfiber.net]
> >Login: root Name: root
> >Directory: /root Shell: /bin/bash
> >Last login Tue Oct 6 11:47 (PDT) on ttyp2 from 206.58.218.52
> >Mail last read Fri Sep 4 10:30 1998 (PDT)
> >No Plan.
>

> >[Query: 206.58.218.0, Server: whois.arin.net]

> >Structured Network Systems, Inc. (NETBLK-SNS-NET-5) SNS-NET-5
> > 206.58.0.0 - 206.58.255.255
> >Empire Communications (NETBLK-NET-EMPCOMM2) NET-EMPCOMM2
> > 206.58.218.0 - 206.58.218.127

> ==Empire2/Middleton. The circle closes.
> Game, Set and Match.

Heh. Interesting. And to think that while my little swerver was down,
I received an e-mail massage asking about setting up a newsfeed:

George Madison wrote:
>
> News Admin-
> We are currently looking to connect with large to medium sized news feeds.
> We'd like to setup a peering relation with your service. If your interested
> or have any questions/comments please feel free to ask.
>
> Thank you for your time,
> George M.

Unfortunately, the mail was forwarded to me without any original
headers by people too clueless to know how to handle mail properly,
so I don't have anything else to add that might have been revealed
by the mail headers apart from George Madison <use...@pdxfiber.net>.

Pity. Would have been fun, since my swerver doesn't carry any of
the groups they spam, but unfortunately, it would cost something
like a year of my salary each day just to pay for the bandwidth to
route into /dev/null.

Oh well, life sucks, and then the clueless take over

barry bouwsma

0 הודעות חדשות