InternetConnect has rerouted their postmaster@icnt.net box, as listed in the whois.abuse.net lookup, to /dev/null (incompetent: they want it to be trashed but it's bounced instead, showing how they handle abuse reports). InternetConnect deliberately ignores complaints about the abuse coming from their networks. No e-mails from their networks are welcome here! internetconnect.net, icnt.net, [64.13.0.0 - 64.13.255.255], [209.191.64.0 - 209.191.127.255]: Access denied! === The evidence === Path: uni-berlin.de!fu-berlin.de!feeder.qis.net!sn-xit-02!sn-post-01 !supernews.com!corp.supernews.com!not-for-mail From: Tom Betz Newsgroups: news.admin.net-abuse.email Subject: INTERNETCONNECT.NET/ICNT.NET BLACK HAT Date: Tue, 22 Jan 2002 16:13:53 -0000 Organization: Society for the Elimination of Unsolicited Commercial Email Message-ID: Reply-To: tbetz@pobox.com X-No-Productlinks: yes X-Fight-Junk-Email-URL: Join the fight against Junk EMail at . X-Newsreader: trn 4.0-test75 (Feb 13, 2001) X-Complaints-To: newsabuse@supernews.com Lines: 77 Xref: uni-berlin.de news.admin.net-abuse.email:1581134 Got some spam from an ICNT.NET customer at 64.13.181.10. 01/22/02 11:07:07 IP block 64.13.181.10 Trying 64.13.181.10 at ARIN Trying 64.13.181 at ARIN InternetConnect, Inc. (NETBLK-ICNT-BLK5) ICNT-BLK5 64.13.0.0 - 64.13.255.255 RW Parson (NETBLK-ICN-RWPARSONS-BLK1) ICN-RWPARSONS-BLK1 64.13.181.0 - 64.13.181.255 Presuming that RW Parson IS the spammer... 01/22/02 11:08:11 whois !NETBLK-ICNT-BLK5@whois.arin.net whois -h whois.arin.net !netblk-icnt-blk5 ... InternetConnect, Inc. (NETBLK-ICNT-BLK5) 20770 Madrona Avenue Torrance, CA 90503 US Netname: ICNT-BLK5 Netblock: 64.13.0.0 - 64.13.255.255 Maintainer: ICN1 Coordinator: Staats, Robert (NR41-ARIN) noc@icnt.net 310-974-2500 Domain System inverse mapping provided by: NS1.INTERNETCONNECT.NET 209.191.118.3 NS8.INTERNETCONNECT.NET 209.191.118.4 Record last updated on 26-Sep-2001. Database last updated on 17-Jan-2002 19:56:07 EDT. !whois -h whois.abuse.net icnt.net postmaster@icnt.net (for icnt.net) abuse@internetconnect.net (for icnt.net) So that's where I send the spam complaint. Fortunately for us, ICNT's procmail configuration handling the postmaster@ address is broken, so we get to see their intention in the bounce message: ----- Transcript of session follows ----- sh: /dev/null: Permission denied 554 5.3.0 |/dev/null... unknown mailer error 126 --g0ME8ia13908.1011708524/pop2.internetconnect.net Content-Type: message/delivery-status Reporting-MTA: dns; pop2.internetconnect.net Received-From-MTA: DNS; russian-caravan.cloud9.net Arrival-Date: Tue, 22 Jan 2002 06:08:43 -0800 Final-Recipient: RFC822; postmaster@icnt.net X-Actual-Recipient: X-Unix; |/dev/null Action: failed Status: 5.0.0 Diagnostic-Code: X-Unix; 126 Last-Attempt-Date: Tue, 22 Jan 2002 06:08:44 -0800 --g0ME8ia13908.1011708524/pop2.internetconnect.net Content-Type: message/rfc822 So at least one address listed at ABUSE.NET for spam complaints is routed (incompetently) to /dev/null. What are the odds against e-mail to any of the other listed addresses ever being read? 'Bout sums it up for ICNT, I'd say. -- |I always wanted to be someone,| Tom Betz, Generalist | |but now I think I should have | Want to send me email? FIRST, READ THIS PAGE: | |been a wee bit more specific. | | | "Fuck NANAE." -- Paul Vixie | YO! MY EMAIL ADDRESS IS HEAVILY SPAM-ARMORED! |