Attn MCI/UUNet - Massive abuse from your network

Wed Jun 23 20:37:54 UTC 2004

At 10:45 PM 6/22/2004, Tim Thorne wrote:
>Not so long ago I took a long look at the SBL for MCI and I came to
>the conclusion that the data is mostly out of date and therefore
>inaccurate. The folks at the SBL posting in NANAE said this may be the
>case, but its up to the MCI folks to clean up the SBL database.

MCI does not want to "legitimize" blacklists by helping clean up their own 
records.

Any company or network that afraid of accountability obviously must have 
its reasons. I am sure they have seen the many many times some provider has 
said "We removed Spammer A" and the antispam community has responded with 
"Great, how about spammers B through Z?". That's a question they don't and 
won't answer beyond the token "Email to abuse@ does get read". Maybe it 
does- I am not MCI, so I don't know. Regardless of whether the mail does 
get read, the spammers remain connected. Why? One can only come to the 
conclusion that it is either due to technical ineptitude or protection of 
their revenue stream.  Likewise, they have no doubt noticed that providers 
that lie about canning spammers are quickly outed, and their blocklist 
listings(and no doubt private firewall rules, which are much harder to 
escape) tend to expand greatly. So, MCI has (correctly) identified that 
their options as A) clean up their network B) try to lie or C) do nothing. 
Given that A involves loss of revenue and a (short term) increase in labor 
and B will cause them even more problems, C is their obvious recourse.

> >As an example, I see a posting that says emailtools.com was alive on
> >206.67.63.41 in 2000. They aren't there any more... But now:
>
>Emailtools.com aren't spammers, but they sell spamware. That subtle
>difference is enough to keep them on the MCI network.

This may be true, but Atriks is still there, and they are one of the most 
technically malicious spammers in the game today. Spam support is spam 
support, whether you are hosting the website, DNS, proxy mining operation, 
or a drop-box. Any provider that is OK with hosting software that does this:

"Email Marketing 98 is our high-end email marketing tool. It is one of the 
best extractors on the market while remaining price competitive. At the 
push of a button, Email Marketing 98 will retrieve Email addresses of all 
the posters on an Internet news group or a series of groups. Then it will 
send your Email message to any or all of those addresses."

may as well be sending the spam themselves, IMO.

>If you want rid
>of sites like this that are based in Florida, then you best get
>Florida to change their laws.

Wouldn't *that* be lovely.

---
    Ben Browning <benb at theriver.com>
       The River Internet Access Co.
          WA Operations Manager
1-877-88-RIVER  http://www.theriver.com