Attn MCI/UUNet - Massive abuse from your network
Ben Browning
benb at theriver.com
Wed Jun 23 20:37:54 UTC 2004
At 10:45 PM 6/22/2004, Tim Thorne wrote:
>Not so long ago I took a long look at the SBL for MCI and I came to
>the conclusion that the data is mostly out of date and therefore
>inaccurate. The folks at the SBL posting in NANAE said this may be the
>case, but its up to the MCI folks to clean up the SBL database.
MCI does not want to "legitimize" blacklists by helping clean up their own
records.
Any company or network that afraid of accountability obviously must have
its reasons. I am sure they have seen the many many times some provider has
said "We removed Spammer A" and the antispam community has responded with
"Great, how about spammers B through Z?". That's a question they don't and
won't answer beyond the token "Email to abuse@ does get read". Maybe it
does- I am not MCI, so I don't know. Regardless of whether the mail does
get read, the spammers remain connected. Why? One can only come to the
conclusion that it is either due to technical ineptitude or protection of
their revenue stream. Likewise, they have no doubt noticed that providers
that lie about canning spammers are quickly outed, and their blocklist
listings(and no doubt private firewall rules, which are much harder to
escape) tend to expand greatly. So, MCI has (correctly) identified that
their options as A) clean up their network B) try to lie or C) do nothing.
Given that A involves loss of revenue and a (short term) increase in labor
and B will cause them even more problems, C is their obvious recourse.
> >As an example, I see a posting that says emailtools.com was alive on
> >206.67.63.41 in 2000. They aren't there any more... But now:
>
>Emailtools.com aren't spammers, but they sell spamware. That subtle
>difference is enough to keep them on the MCI network.
This may be true, but Atriks is still there, and they are one of the most
technically malicious spammers in the game today. Spam support is spam
support, whether you are hosting the website, DNS, proxy mining operation,
or a drop-box. Any provider that is OK with hosting software that does this:
"Email Marketing 98 is our high-end email marketing tool. It is one of the
best extractors on the market while remaining price competitive. At the
push of a button, Email Marketing 98 will retrieve Email addresses of all
the posters on an Internet news group or a series of groups. Then it will
send your Email message to any or all of those addresses."
may as well be sending the spam themselves, IMO.
>If you want rid
>of sites like this that are based in Florida, then you best get
>Florida to change their laws.
Wouldn't *that* be lovely.
---
Ben Browning <benb at theriver.com>
The River Internet Access Co.
WA Operations Manager
1-877-88-RIVER http://www.theriver.com
More information about the NANOG
mailing list