ARP Networks - will not terminate their spammers, claiming that they don't spam and that they can't be removed because of the contracts, anyways. Now, the spammed people think otherwise: http://groups.google.com/groups?as_q=TheYellowPages&as_ugroup=news.admin.net-abuse.* arpnetworks.com, [206.157.70.0 - 206.157.70.255]: Access denied! === arpnetworks.com will not terminate spammers === Path: uni-berlin.de!fu-berlin.de!news.tele.dk!news.tele.dk!small.news.tele.dk!news-stoc.telia.net!news-stoa.telia.net!telia.net!nntp.inet.fi!inet.fi!feeder1.news.jippii.net!news.cc.tut.fi!news.helsinki.fi!not-for-mail From: Atro Tossavainen Newsgroups: news.admin.net-abuse.email Subject: BLOCK: 206.157.70.0/24 (SPEWS, SBL non-nomination) Date: 22 Jan 2003 11:41:36 +0200 Organization: Puutavarakartelli (EOMPTK) Lines: 35 Message-ID: NNTP-Posting-Host: kruuna.helsinki.fi Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 8bit X-Trace: oravannahka.helsinki.fi 1043228498 16212 128.214.205.14 (22 Jan 2003 09:41:38 GMT) X-Complaints-To: usenet@news.helsinki.fi NNTP-Posting-Date: 22 Jan 2003 09:41:38 GMT Mail-Copies-To: nobody X-Newsreader: Gnus v5.3/Emacs 19.34 Xref: uni-berlin.de news.admin.net-abuse.email:1904700 Recommend listing 206.157.70.0/24, arpnetworks.com, for spamming and/or at least spam support. This network houses the spammer theyellowpages.com/ askmryellow.com. Mr. Garry Dolley of ARP Networks would rather that everyone blocked just the IP that the spams are sent out from, of course. He claims he can't terminate them because of contractual obligations... Upstream is useless - it's C&W. Mr. Dolley also offered a list of 23 addresses in helsinki.fi that were on the list of his "customer". How's that for a contractual obligation to yourself :) He said he had now removed them, which is of course not quite what was being asked for. Several of the accounts Mr. Dolley listed had not been live for ages, which indicates they give fuck all about bounces. I asked the owners of the accounts that are still live whether they had signed up to this service themselves. Six of them responded in two hours, indicating that they all considered those mails unsolicited junk mail. Conversation recorded by Google: More to appear soon at a NANAS near you. Keep searching for "dolley abuse biocenter". -- Atro Tossavainen (Mr.) / The Institute of Biotechnology at Systems Analyst, Techno-Amish & / the University of Helsinki, Finland, +358-9-19158939 UNIX Dinosaur / employs me, but my opinions are my own. < URL : http : / / www . iki . fi / atro . tossavainen / > File attachments NOT welcome unless agreed to beforehand. === The conversation from that URL === === http://groups.google.com/groups?selm=200301180733.h0I7XBfu022280%40post.it.helsinki.fi === From: abuse@biocenter.helsinki.fi Newsgroups: news.admin.net-abuse.sightings Subject: [email] [spam] -kak-deleted-ado- Important: about your site Followup-To: news.admin.net-abuse.email Date: Sat, 18 Jan 2003 07:33:24 +0000 (UTC) Organization: VeriMod () Lines: 94 Approved: nanas-sub@cybernothing.org Message-ID: <200301180733.h0I7XBfu022280@post.it.helsinki.fi> X-Trace: victor.killfile.org 1042875204 15909 216.43.25.138 (18 Jan 2003 07:33:24 GMT) X-Complaints-To: usenet@killfile.org X-No-Confirm: yes Processed-By: Bob the NANAS ModBot X-Auth: PGPMoose V1.1 PGP news.admin.net-abuse.sightings iD8DBQE+KQNEv1i8LqUfqQURAhvzAJ9X7J6JQ3rKE3PXUa4/0tzFPtUxpQCfQl5g YdWrnWvmB5EBfqJ+XedZX4Q= =JMnb X-Group-Homepage: X-Mail-Path: root@unagi.cybernothing.org!post.it.helsinki.fi!atossava@kruuna.helsinki.fi!abuse@biocenter.helsinki.fi X-Modbot: Bob the NANAS ModBot X-Original-Cc: nanas-sub@cybernothing.org X-Original-To: admin@yellowpage.com, garry@arpnetworks.com X-Submissions-To: nanas-sub@cybernothing.org Dear Laurie Gregg / Laurie Anderson, askmryellow.com, and Garry Dolley, ARP Networks, Inc. The following spam was sent by askmryellow.com to the University of Helsinki based on a forge subscription performed by a "friend" of the person who received this spam, two and a half years ago as indicated on the spam (more like four years, based on when spams with the same address and same nicknames started appearing). We're so fed up with the influx of spam in general, and with the continuing effects of a malicious prank played several years ago, that we are definitely not discussing the matter any further. As soon as the postmaster here gets around to it, the University of Helsinki will be refusing all future e-mail from the 206.157.70 netblock in which askmryellow.com resides. Mr. Dolley: If you kick out the spamming customer, there will be no reason for us to block your network and affect all of your other clients, of course. If that should happen, please mail this address from another address outside the 206.157.70 network (such as hotmail, yahoo etc) and indicate the actions taken. --------forwarded message-------- >From apache@typ1.askmryellow.com Fri Jan 17 18:13:43 2003 Received: from typ1.askmryellow.com (typ1.askmryellow.com [206.157.70.166]) by post.it.helsinki.fi (8.12.2/8.12.2-SPAMmers-sod-off) with ESMTP id h0HGDcfu026381 for <-real-kruuna-recipient-removed->; Fri, 17 Jan 2003 18:13:39 +0200 (EET) Received: from typ1.askmryellow.com (typ1 [127.0.0.1]) by typ1.askmryellow.com (8.12.5/8.12.5) with ESMTP id h0HGDp8g018019 for <-real-kruuna-recipient-removed->; Fri, 17 Jan 2003 08:13:51 -0800 Received: (from apache@localhost) by typ1.askmryellow.com (8.12.5/8.12.5/Submit) id h0HGDmqE018017; Fri, 17 Jan 2003 08:13:48 -0800 Date: Fri, 17 Jan 2003 08:13:48 -0800 Message-Id: <200301171613.h0HGDmqE018017@typ1.askmryellow.com> To: -real-kruuna-recipient-removed- Subject: -kak-deleted-ado- Important: about your site From: "TheYellowPages.com" X-Mailer: Postlister 1.16 Reply-To: RE: see me in September Submission Date: 07-07-2000 TheYellowPages.com has just launched the Internet's first Natural Language Yellow Page directory. In order to activate your listing, please click on this link and provide the required information: http://askmryellow.com/create_account.php The unique Natural Language search provides a quick and easy way for people to find YOU. When you sign up, you can choose a standard, enhanced, single-column, or multi-column ad. Sincerely, Laurie Anderson Customer Support TheYellowPages.com(tm) If you do not want to receive future updates, use this link: -----end of forwarded message----- -- Abuse desk, Institute of Biotechnology, University of Helsinki P.O. Box 56, FIN-00014 UNIVERSITY OF HELSINKI, FINLAND Tel. +358-9-1911 (central exchange), http://www.biocenter.helsinki.fi/bi/ -- All postings to news.admin.net-abuse.sightings are unconfirmed and unverified unless stated otherwise by the moderators. All opinions expressed above are considered the opinions of the original poster, not the moderators or their respective employers. For a copy of the guidelines to this group, see: === And the evidence, itself === Path: uni-berlin.de!fu-berlin.de!newsfeed.media.kyoto-u.ac.jp!news.cc.tut.fi !news.helsinki.fi!not-for-mail From: Atro Tossavainen Newsgroups: news.admin.net-abuse.email Subject: Re: BLOCK: 206.157.70.0/24 (SPEWS, SBL non-nomination) Date: 23 Jan 2003 12:17:44 +0200 Organization: Puutavarakartelli (EOMPTK) Lines: 135 Message-ID: References: NNTP-Posting-Host: kruuna.helsinki.fi Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 8bit X-Trace: oravannahka.helsinki.fi 1043317066 13936 128.214.205.14 (23 Jan 2003 10:17:46 GMT) X-Complaints-To: usenet@news.helsinki.fi NNTP-Posting-Date: 23 Jan 2003 10:17:46 GMT Mail-Copies-To: nobody X-Newsreader: Gnus v5.3/Emacs 19.34 Xref: uni-berlin.de news.admin.net-abuse.email:1905652 Dolphin writes: > On 22 Jan 2003 11:41:36 +0200 Atro Tossavainen > wrote in message : > > Recommend listing 206.157.70.0/24, arpnetworks.com, for spamming and/or > > at least spam support. This network houses the spammer theyellowpages.com/ > > askmryellow.com. > > > > Mr. Garry Dolley of ARP Networks would rather that everyone blocked just > > the IP that the spams are sent out from, of course. He claims he can't > > terminate them because of contractual obligations... > > > Please, post this reply of their's, so it will be documented and they can > be pointed at it, when they will come here for delisting. Twelve people ended up replying to my question here (that is, whether they had actually requested to be on theyellowpages.com's list.) Twelve replies uniformly indicated that the people considered these mails unsolicited bulk e-mail. From garry@arpnetworks.com Tue Jan 21 22:32:05 2003 Received: from penguin.filetron.com (mail.arpnetworks.com [206.157.70.89]) by post.it.helsinki.fi (8.12.2/8.12.2-SPAMmers-sod-off) with SMTP id h0LKVtfu013316 for <-an_address->; Tue, 21 Jan 2003 22:31:56 +0200 (EET) Received: (qmail 31268 invoked from network); 21 Jan 2003 19:26:33 -0000 Received: from garry2.office.arpnetworks.com (HELO arpnetworks.com) (206.157.70.250) by mail.arpnetworks.com with SMTP; 21 Jan 2003 19:26:33 -0000 Message-ID: <3E2DAD1A.2040903@arpnetworks.com> Date: Tue, 21 Jan 2003 12:27:06 -0800 From: Garry Dolley User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: -an_address- Subject: Re: [email] [spam] -kak-deleted-ado- Important: about your site References: <200301180733.h0I7XAfu022275@post.it.helsinki.fi> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Status: RO Dear Abuse, Would there be any way just to block their IP, 206.157.70.166, instead of the whole network 206.157.70.0/24? I work with this company a lot and I know that they are not simply spamming people. They only email those people that have signed up a free listing on TheYellowPages.Com and always offer remove links that IMMEDIATELY remove the email from the database (not like some places where they say it takes up to 10 days to remove -- ridiculous!!). The problem is my company works regularly with TheYellowPages.Com and I don't just want to say "get out of here" (in fact, I can't, we have contracts). So while I would like to be able to accomodate your requests (As an ISP, I try to avoid SPAM like the plague also), I need to keep my clients also. I would recommend simply block their IP, instead of the entire network, or else I can remove all the emails you like off our lists to make sure you do not get any more solicitations. Thank you for your time. -an_address- wrote: (copy of complaint already in NANAS; deleted from here) -- Garry Dolley IT Manager ARP Networks, Inc. (http://www.arpnetworks.com) Increasing Business Efficiency with Computer Technology, Worldwide. Tel: +1 (818) 843 4247 Fax: +1 (818) 843 4857 ICQ: 119123803 From garry@arpnetworks.com Wed Jan 22 01:05:01 2003 Received: from penguin.filetron.com (mail.arpnetworks.com [206.157.70.89]) by post.it.helsinki.fi (8.12.2/8.12.2-SPAMmers-sod-off) with SMTP id h0LN4bfu014712 for <-an_address->; Wed, 22 Jan 2003 01:04:37 +0200 (EET) Received: (qmail 8853 invoked from network); 21 Jan 2003 21:59:17 -0000 Received: from garry2.office.arpnetworks.com (HELO arpnetworks.com) (206.157.70.250) by mail.arpnetworks.com with SMTP; 21 Jan 2003 21:59:17 -0000 Message-ID: <3E2DD0E4.5050708@arpnetworks.com> Date: Tue, 21 Jan 2003 14:59:48 -0800 From: Garry Dolley User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: -an_address- Subject: Re: spam, about last email Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Status: RO Dear Abuse, I've removed all emails ending in helsinki.fi from our database. There were 23, and they are: mysql> select epostadresse from main where epostadresse like '%helsinki.fi' -> ; +-------------------------------+ | epostadresse | +-------------------------------+ | list of 23 addresses deleted | +-------------------------------+ 23 rows in set (8.27 sec) mysql> delete from main where epostadresse like '%helsinki.fi'; Query OK, 23 rows affected (1 min 22.71 sec) I write to tell you so that you know I'm cooperating with helping to eliminate spam to your university. You may want to unblock our network 206.157.70.0/24 from your mail server, so our customers can email your university if they have friends/clients/students/faculty there. Thank you. -- Garry Dolley IT Manager ARP Networks, Inc. (http://www.arpnetworks.com) Increasing Business Efficiency with Computer Technology, Worldwide. Tel: +1 (818) 843 4247 Fax: +1 (818) 843 4857 ICQ: 119123803 -- Atro Tossavainen (Mr.) / The Institute of Biotechnology at Systems Analyst, Techno-Amish & / the University of Helsinki, Finland, +358-9-19158939 UNIX Dinosaur / employs me, but my opinions are my own. < URL : http : / / www . iki . fi / atro . tossavainen / > File attachments NOT welcome unless agreed to beforehand.