[135136] in North American Network Operators' Group
Re: Request Spamhaus contact
daemon@ATHENA.MIT.EDU (TR Shaw)
Mon Jan 17 20:21:11 2011
From: TR Shaw <tshaw@oitc.com>
In-Reply-To: <AANLkTin0x=Pu7m5J2EL0pOWimEWht3h46rgTBS5Bj0OQ@mail.gmail.com>
Date: Mon, 17 Jan 2011 19:57:03 -0500
To: Jeffrey Lyon <jeffrey.lyon@blacklotus.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Actually, it does not:
$ host apothekeosterreich.at
apothekeosterreich.at has address 208.64.120.197
apothekeosterreich.at mail is handled by 10 mail.apothekeosterreich.at.
$ curl -I -L apothekeosterreich.at
HTTP/1.1 301 Moved Permanently
Cache-Control: private
Content-Length: 0
Location: http://www.apothekeosterreich.at/Home.aspx
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Tue, 18 Jan 2011 00:54:59 GMT
Connection: close
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 126574
Content-Type: text/html; charset=3Dutf-8
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
WL-Version: 2475.0
Set-Cookie: ASP.NET_SessionId=3Da3brplvgwfsdk3pd1g1zgdtj; path=3D/; =
HttpOnly
X-Powered-By: ASP.NET
Date: Tue, 18 Jan 2011 00:55:00 GMT
Connection: close
On Jan 17, 2011, at 7:33 PM, Jeffrey Lyon wrote:
> Raymond,
>=20
> We've acted on every report that we're aware of and instead you want
> to play pharmacy domain scavenger hunt. This domain at 208.64.120.197
> redirects to IP space we already null routed. It's the same customer.
>=20
> Just to calm your nerves we'll also null route that space =
(208.64.120.176/28)
>=20
> Thanks, Jeff
>=20
> P.S. Someone at Spamhaus PLEASE remove the /21 listing?
>=20
>=20
>=20
> On Mon, Jan 17, 2011 at 7:25 PM, Raymond Dijkxhoorn
> <raymond@prolocation.net> wrote:
>> Hi!
>>=20
>>> Spam does not make me nervous, it's a practical matter that we will
>>> address in due course. The null routes we have set are pretty recent
>>> so you may have received some spam prior to that time but I =
absolutely
>>> guarantee you that it did not come from our network, otherwise we
>>> would have detected it and stopped it on the spot.
>>=20
>>>> Thats not your IP space? Really? How come.
>>>>=20
>>>> apothekeosterreich .at -> 208.64.120.197
>>>> vertrouwdeapotheek .nl -> 208.64.120.197
>>>>=20
>>>> viagra-shopping .com -> 208.64.127.78
>>>> medicin-24 .com -> 208.64.127.78
>>>>=20
>>>> apothekeohnerezept .at -> 208.64.127.66
>>>>=20
>>>> www.medicin-24 .com -> 208.64.127.78
>>>> www.viagra-shopping .com -> 208.64.127.78
>>>>=20
>>>> This is just like 3 minutes digging in todays spamfolders.
>>=20
>> www.apothekeosterreich .at is still up at the mentioned ip. Instead =
of
>> telling you are soooo good on terminating stuff. Can you walk over =
the list
>> and act?
>>=20
>> I have sended in many requests for termination. You or your network =
dont
>> respond to this at all.
>>=20
>> Its a waste of time even telling it seems.
>>=20
>> I will stop posting here, spam-l is a much better place for this. But =
please
>> dont act like you dont know anything whats going on. You have been =
warned.
>> You have gotten many many reports. But we dont see stuff changing.
>>=20
>> Good luck with your listing at SpamHaus.
>>=20
>> Bye,
>> Raymond.
>>=20
>=20
>=20
>=20
> --=20
> Jeffrey Lyon, Leadership Team
> jeffrey.lyon@blacklotus.net | http://www.blacklotus.net
> Black Lotus Communications - AS32421
> First and Leading in DDoS Protection Solutions
>=20
