Spam from using news.cis.dfn.de with Plus.net

I have recently moved to Plus.net and within 4 hours of posting on
usenet using news.cis.dfn.de, I started receiving junk email.

There were 23 messages which mainly comprised the fake Microsoft
patch/virus email and I was at a loss to understand how this had
happened given that my email address was set to (E-Mail Removed).

Looking a little deeper, I noticed that news.cis.dfn.de were including
my domain name at Plus.net as well as my IP address which is static in
the header of the post whereas other news servers I use do not.

The spammers had used my first name, Phil and added my domain onto the
end which is luckily an email address which I do not use and I have been
able to set up Mail Washer to filter out the junk.

Has anyone else come across this method of capturing email addresses or
had the same experience?
--
Phil Morris

On Tue, 18 Nov 2003 10:50:46 GMT, Phil Morris <(E-Mail Removed)> wrote:
> I have recently moved to Plus.net and within 4 hours of posting on
> usenet using news.cis.dfn.de, I started receiving junk email.
>
> There were 23 messages which mainly comprised the fake Microsoft
> patch/virus email and I was at a loss to understand how this had
> happened given that my email address was set to (E-Mail Removed).

Not in this example:

http://www.google.com/groups?selm=Ws...40lydiard.plus.
com&oe=UTF-8&output=gplain

One such posting is all that is required for one's email address to be
harvested by unscrupulous bulk emailers, and added to the lists of email
addresses that are sold, swapped and traded amongst and between such
miscreants.

W32.Swen.A@mm (the "fake Microsoft patch/virus email") also harvests
recipient email addresses from news servers in a similar way:

http://(E-Mail Removed)

--
Anthony Edwards
easynet Ltd - Manchester
http://www.uk.easynet.net
(E-Mail Removed)

Anthony Edwards wrote:
>
> One such posting is all that is required for one's email address to be
> harvested by unscrupulous bulk emailers, and added to the lists of email
> addresses that are sold, swapped and traded amongst and between such
> miscreants.
>

What's even worse is when someone deliberately exposes your email
address in a forged posting to alt.test

In message <(E-Mail Removed)>, Anthony Edwards
<(E-Mail Removed)> writes
>On Tue, 18 Nov 2003 10:50:46 GMT, Phil Morris <(E-Mail Removed)> wrote:
>> I have recently moved to Plus.net and within 4 hours of posting on
>> usenet using news.cis.dfn.de, I started receiving junk email.
>>
>> There were 23 messages which mainly comprised the fake Microsoft
>> patch/virus email and I was at a loss to understand how this had
>> happened given that my email address was set to (E-Mail Removed).
>
>Not in this example:
>
>http://www.google.com/groups?selm=Ws...40lydiard.plus.
>com&oe=UTF-8&output=gplain

Oops! Well spotted and down to Turnpike not registering my changes to
the configuration or more honestly, me not checking. Turnpike creates
the email address automatically from the domain and username unless you
change it as I did but, the change did not appear on this first post
obviously.

I am grateful to you for pointing this out and I apologise to
news.cis.dfn.de and plus.net

--
Phil Morris

Phil Morris wrote:

> In message <(E-Mail Removed)>, Anthony Edwards
> <(E-Mail Removed)> writes
>
>> On Tue, 18 Nov 2003 10:50:46 GMT, Phil Morris <(E-Mail Removed)> wrote:
>>
>>> I have recently moved to Plus.net and within 4 hours of posting on
>>> usenet using news.cis.dfn.de, I started receiving junk email.
>>>
>>> There were 23 messages which mainly comprised the fake Microsoft
>>> patch/virus email and I was at a loss to understand how this had
>>> happened given that my email address was set to (E-Mail Removed).
>>
>>
>> Not in this example:
>>
>> http://www.google.com/groups?selm=Ws...40lydiard.plus.
>> com&oe=UTF-8&output=gplain
>
>
> Oops! Well spotted and down to Turnpike not registering my changes to
> the configuration or more honestly, me not checking. Turnpike creates
> the email address automatically from the domain and username unless you
> change it as I did but, the change did not appear on this first post
> obviously.
>
> I am grateful to you for pointing this out and I apologise to
> news.cis.dfn.de and plus.net
>

You managed to obscure your email address a bit more in this post
http://groups.google.com/groups?selm=lylsb.7293$(E-Mail Removed)
but your posting host is there for all to see. I was wondering why I was
getting "answer from reflector" messages

x-no-archive: yes
news:(E-Mail Removed) s.com

> I have recently moved to Plus.net and within 4 hours of posting on
> usenet using news.cis.dfn.de, I started receiving junk email.
>
> There were 23 messages which mainly comprised the fake Microsoft
> patch/virus email and I was at a loss to understand how this had
> happened given that my email address was set to (E-Mail Removed).
>
> Looking a little deeper, I noticed that news.cis.dfn.de were including
> my domain name at Plus.net as well as my IP address which is static in
> the header of the post whereas other news servers I use do not.
>
> The spammers had used my first name, Phil and added my domain onto the
> end which is luckily an email address which I do not use and I have been
> able to set up Mail Washer to filter out the junk.
>
> Has anyone else come across this method of capturing email addresses or
> had the same experience?

Freeserve used to, before it switched to dynamic IP addresses last year.