Woody wrote:
On Mon, 21 Feb 2005 19:08:41 +0000 (UTC), "Steve -
www.ukspeedtraps.co.uk" wrote:

Funny how some of the headers contained [WR], makes me think the
spammer knew about the group and how it works... and the attack
happened between 9am and 5pm, misusing the works PC??

guess
The spammer is resident in the UK, works from 9am till 5pm as a
computer operator, likes to spam newsgroups during working hours, had
a treacherous drive to work in the snow, searches for "weather" in
their news client's group list, finds "uk.sci.weather", starts their
spambot application, monitors the group throughout, and adjusts their
spamming as they pick up on how things work around here.
/guess

Somebody just needs to find the boss' email address!

For those not on NIN, looks like he's got home from work!

On Mon, 21 Feb 2005 19:25:15 -0000, " cupra"
wrote:

Woody wrote:
On Mon, 21 Feb 2005 19:08:41 +0000 (UTC), "Steve -
www.ukspeedtraps.co.uk" wrote:

Funny how some of the headers contained [WR], makes me think the
spammer knew about the group and how it works... and the attack
happened between 9am and 5pm, misusing the works PC??

guess
The spammer is resident in the UK, works from 9am till 5pm as a
computer operator, likes to spam newsgroups during working hours, had
a treacherous drive to work in the snow, searches for "weather" in
their news client's group list, finds "uk.sci.weather", starts their
spambot application, monitors the group throughout, and adjusts their
spamming as they pick up on how things work around here.
/guess

Somebody just needs to find the boss' email address!

For those not on NIN, looks like he's got home from work!

LOL. Oh, and it wasn't me!

On Mon, 21 Feb 2005 19:25:15 -0000, " cupra"
wrote:

Woody wrote:
On Mon, 21 Feb 2005 19:08:41 +0000 (UTC), "Steve -
www.ukspeedtraps.co.uk" wrote:

Funny how some of the headers contained [WR], makes me think the
spammer knew about the group and how it works... and the attack
happened between 9am and 5pm, misusing the works PC??

guess
The spammer is resident in the UK, works from 9am till 5pm as a
computer operator, likes to spam newsgroups during working hours, had
a treacherous drive to work in the snow, searches for "weather" in
their news client's group list, finds "uk.sci.weather", starts their
spambot application, monitors the group throughout, and adjusts their
spamming as they pick up on how things work around here.
/guess

Somebody just needs to find the boss' email address!

For those not on NIN, looks like he's got home from work!

LOL. Oh, and it wasn't me!

On Mon, 21 Feb 2005 19:25:15 -0000, " cupra"
wrote:

Woody wrote:
On Mon, 21 Feb 2005 19:08:41 +0000 (UTC), "Steve -
www.ukspeedtraps.co.uk" wrote:

Funny how some of the headers contained [WR], makes me think the
spammer knew about the group and how it works... and the attack
happened between 9am and 5pm, misusing the works PC??

guess
The spammer is resident in the UK, works from 9am till 5pm as a
computer operator, likes to spam newsgroups during working hours, had
a treacherous drive to work in the snow, searches for "weather" in
their news client's group list, finds "uk.sci.weather", starts their
spambot application, monitors the group throughout, and adjusts their
spamming as they pick up on how things work around here.
/guess

Somebody just needs to find the boss' email address!

For those not on NIN, looks like he's got home from work!

LOL. Oh, and it wasn't me!

On Mon, 21 Feb 2005 19:25:15 -0000, " cupra"
wrote:

Woody wrote:
On Mon, 21 Feb 2005 19:08:41 +0000 (UTC), "Steve -
www.ukspeedtraps.co.uk" wrote:

Funny how some of the headers contained [WR], makes me think the
spammer knew about the group and how it works... and the attack
happened between 9am and 5pm, misusing the works PC??

guess
The spammer is resident in the UK, works from 9am till 5pm as a
computer operator, likes to spam newsgroups during working hours, had
a treacherous drive to work in the snow, searches for "weather" in
their news client's group list, finds "uk.sci.weather", starts their
spambot application, monitors the group throughout, and adjusts their
spamming as they pick up on how things work around here.
/guess

Somebody just needs to find the boss' email address!

For those not on NIN, looks like he's got home from work!

LOL. Oh, and it wasn't me!

On Mon, 21 Feb 2005 18:33:06 +0100, Gianna Stefani wrote:

If only that were true, but it almost never happens.

Probably because a half decent spammer can hide their tracks
effectively. Though if I was a sysadmin and got complaints I'd suspend
the account first and answer questions later (if any where asked...).
A legit user would be on the blower or email PDQ after the suspension
a spamer will just move on to their next disposable account.

I doubt if he was foolish enough to use is own account details

Well you wouldn't would you? Got an AOL disc through the post the
other day, now do AOL block telnet etc? Little bit of digging and an
insecure machine, away you go.

--
Cheers
Dave. pam is missing e-mail

On Mon, 21 Feb 2005 18:33:06 +0100, Gianna Stefani wrote:

If only that were true, but it almost never happens.

Probably because a half decent spammer can hide their tracks
effectively. Though if I was a sysadmin and got complaints I'd suspend
the account first and answer questions later (if any where asked...).
A legit user would be on the blower or email PDQ after the suspension
a spamer will just move on to their next disposable account.

I doubt if he was foolish enough to use is own account details

Well you wouldn't would you? Got an AOL disc through the post the
other day, now do AOL block telnet etc? Little bit of digging and an
insecure machine, away you go.

--
Cheers
Dave. pam is missing e-mail

On Mon, 21 Feb 2005 18:33:06 +0100, Gianna Stefani wrote:

If only that were true, but it almost never happens.

Probably because a half decent spammer can hide their tracks
effectively. Though if I was a sysadmin and got complaints I'd suspend
the account first and answer questions later (if any where asked...).
A legit user would be on the blower or email PDQ after the suspension
a spamer will just move on to their next disposable account.

I doubt if he was foolish enough to use is own account details

Well you wouldn't would you? Got an AOL disc through the post the
other day, now do AOL block telnet etc? Little bit of digging and an
insecure machine, away you go.

--
Cheers
Dave. pam is missing e-mail

On Mon, 21 Feb 2005 18:33:06 +0100, Gianna Stefani wrote:

If only that were true, but it almost never happens.

Probably because a half decent spammer can hide their tracks
effectively. Though if I was a sysadmin and got complaints I'd suspend
the account first and answer questions later (if any where asked...).
A legit user would be on the blower or email PDQ after the suspension
a spamer will just move on to their next disposable account.

I doubt if he was foolish enough to use is own account details

Well you wouldn't would you? Got an AOL disc through the post the
other day, now do AOL block telnet etc? Little bit of digging and an
insecure machine, away you go.

--
Cheers
Dave. pam is missing e-mail