Spammers that send fake opt-in confirmation requests spams for their web page www.mypoints.com. And then, despite on me NOT confirming anything, begun to spam me with their garbage. mypoints.com, [209.87.114.30 - 209.87.114.93], [209.141.52.0 - 209.141.55.255], [216.33.87.0 - 216.33.87.255]: Access denied! === My complaint on the first spam === Message-Id: <200201041535.g04FZtp13862@mail.dolphinwave.org> Content-Type: text/plain; charset="iso-8859-1" From: Admin Reply-To: abuse-2002@dolphinwave.org Organization: Private person To: Abuse reports , nanas-sub@cybernothing.org, uce@ftc.gov, hostmaster@EXODUS.NET, abuse@EXODUS.NET Subject: [email] Spam (fake confirmation request: www.mypoints.com)! [Fwd: Please Confirm Your Membership, James] Date: Fri, 4 Jan 2002 17:35:57 +0200 X-Mailer: KMail [version 1.3.2] Cc: welcome@mypoints.com, hostinfo@mypoints.com X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-PGP-key: 0xAAE2A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Spam on my e-mail address, not used anywhere for at least half-year! It was either harvested from the old Usenet posts of mine, or bought on those "Millions" CDs. The spammers are trying to mask it as a confirmation request, but look at all those ads for their services, while absolutely no information on when/where/from which IP the supposed "signup" came from! They are spammers! Please, terminate spammer's accounts as soon as possible! Thanks! ======= Spammer: mpmlbx00.mypoints.com [216.33.87.197] Mail from: welcome@mypoints.com Spamvertised web page: http://www.mypoints.com [216.33.87.135] Registrant: MyPoints.com, Inc. (MYPOINTS-DOM) 100 California Ave., Suite 1160 San Francisco, CA 94111 US Domain Name: MYPOINTS.COM Administrative Contact, Technical Contact: MyPoints.com, Inc. (MC2735-ORG) hostinfo@MYPOINTS.COM Operations Department 1375 E. Woodfield Rd. Suite 520 Schaumburg, IL 60173 US 847-969-8150 Fax- 847-969-8164 Billing Contact: MyPoints.com, Inc (IMS86) ap@MYPOINTS.COM Accounts Payable 100 California Street Suite 1160 San Francisco, CA 94111 (415) 676-3700 (FAX) (415) 676-2054 Record last updated on 08-Jun-2001. Record expires on 28-Jun-2003. Record created on 27-Jun-1996. Database last updated on 3-Jan-2002 22:19:00 EST. Domain servers in listed order: MPDNS01.MYPOINTS.COM 216.33.87.104 MPDNS02.MYPOINTS.COM 216.33.87.105 Exodus Commnications IP block [216.32.0.0 - 216.35.255.255]. Upstream: Exodus (csr02-ve240.okbr01.exodus.net). ---------- Forwarded Message ---------- Received: from [216.33.87.197] by mailserver.eilatcity.co.il (NTMail 4.30.0013/AB9564.63.12487e1d) with ESMTP id hsztfaaa for <###>; Fri, 4 Jan 2002 12:05:54 +0200 Received: (from welcome@localhost) by mpmlbx00.mypoints.com (8.11.0/8.11.0) id g049o7x23222; Fri, 4 Jan 2002 03:50:07 -0600 (CST) Date: Fri, 4 Jan 2002 03:50:07 -0600 (CST) Message-Id: <200201040950.g049o7x23222@mpmlbx00.mypoints.com> To: ### From: welcome@mypoints.com Subject: Please Confirm Your Membership, James X-Indiv: ### X-System-Email-Type: welcome-gap X-Object-Reference: email.welcome-gap.html.null.default MIME-Version: 1.0 Content-type: multipart/alternative; boundary=mpBoundaryString Content-Transfer-Encoding: 7bit Status: R X-Status: N Confirm your membership today! Thank you for joining the MyPoints(R) program. You've joined a community of members who have discovered the easiest way to earn FREE rewards on the Web. Click below to confirm your membership and start earning Points - good for gift cards from Circuit City, Kmart, and BLOCKBUSTER VIDEO...to name a few. http://www.mypoints.com/pope/#####/######/################### Here is your temporary username. You will be able to customize it after you confirm your membership. Your username: ############### Earn 10 Points and confirm your membership today. Rewarding yourself has never been so easy! http://www.mypoints.com/pope/####/#####/#################### Sincerely, John Fullmer CEO and fellow MyPoints Member ------------------------------------------------------- MyPoints.com


Confirm your membership today!

Thank you for joining the MyPoints® program. You've joined a community of members who have discovered the easiest way to earn FREE rewards on the Web. Click here to confirm your membership and start earning Points - good for gift cards from Circuit City, Kmart, and BLOCKBUSTER VIDEO...to name a few.

Here is your temporary username. You will be able to customize it after you confirm your membership.

Your username: #########

Confirm your membership today. Rewarding yourself has never been so easy!

Sincerely,
John Fullmer
CEO and fellow MyPoints Member

Copyright 1997-2001 MyPoints.com, Inc.® All rights reserved.
=== More spam, my 2nd complaint === Message-Id: <200201070857.g078vQp07821@mail.dolphinwave.org> Content-Type: text/plain; charset="iso-8859-1" From: Admin Reply-To: abuse-2002@dolphinwave.org Organization: Private person To: Abuse reports , nanas-sub@cybernothing.org, uce@ftc.gov, hostmaster@EXODUS.NET, abuse@EXODUS.NET, postmaster@EXODUS.NET, CompServ@EXODUS.NET Subject: [email] Repeating spammers (mypoints.com)! [Fwd: MyPoints 101 - Spending Points] Date: Mon, 7 Jan 2002 10:57:24 +0200 X-Mailer: KMail [version 1.3.2] Cc: mpmail@mpmlbx00.mypoints.com, BonusMailReply@mypoints.com, hostinfo@mypoints.com X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-PGP-key: 0xAAE2A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Status: R X-Status: N More spam from mypoints.com on my e-mail address, not used anywhere for at least half-year! It was either harvested from the old Usenet posts of mine, or bought on those "Millions" CDs. And my name is NOT James! Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Spammer: mpmlbx11.mypoints.com [216.33.87.178] Mail from: mpmail@mpmlbx00.mypoints.com Collects replies to: BonusMailReply@mypoints.com Spamvertised web page: http://www.mypoints.com [216.33.87.135] Registrant: MyPoints.com, Inc. (MYPOINTS-DOM) 100 California Ave., Suite 1160 San Francisco, CA 94111 US Domain Name: MYPOINTS.COM Administrative Contact, Technical Contact: MyPoints.com, Inc. (MC2735-ORG) hostinfo@MYPOINTS.COM Operations Department 1375 E. Woodfield Rd. Suite 520 Schaumburg, IL 60173 US 847-969-8150 Fax- 847-969-8164 Billing Contact: MyPoints.com, Inc (IMS86) ap@MYPOINTS.COM Accounts Payable 100 California Street Suite 1160 San Francisco, CA 94111 (415) 676-3700 (FAX) (415) 676-2054 Record last updated on 08-Jun-2001. Record expires on 28-Jun-2003. Record created on 27-Jun-1996. Database last updated on 3-Jan-2002 22:19:00 EST. Domain servers in listed order: MPDNS01.MYPOINTS.COM 216.33.87.104 MPDNS02.MYPOINTS.COM 216.33.87.105 Exodus Commnications IP block [216.32.0.0 - 216.35.255.255]. Upstream: Exodus (csr02-ve240.okbr01.exodus.net). ---------- Forwarded Message ---------- Received: from [216.33.87.178] by mailserver.eilatcity.co.il (NTMail 4.30.0013/AB9564.63.12487e1d) with ESMTP id engvfaaa for <###>; Mon, 7 Jan 2002 03:07:37 +0200 Received: (from mpmail@localhost) by mpmlbx11 (8.11.0/8.11.0) id g070UiX07472; Sun, 6 Jan 2002 18:30:44 Date: Sun, 6 Jan 2002 18:30:44 Message-ID: <200216183044.g070UiX07472@mpmlbx11> To: ### From: Kathy at MyPoints Reply-To: BonusMailReply@mypoints.com Subject: MyPoints 101 - Spending Points X-Indiv: y### X-JobID: 88076 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=mpBoundaryString Content-Transfer-Encoding: 7bit Status: R X-Status: N ********************************************* REWARDS FOR YOU TO ENJOY WITH YOUR MEMBERSHIP ********************************************* Welcome to the MyPoints(R) family, James. I'm Kathy from the Membership Team here to help you make the most of your membership. I wanted to tell you about one of the main perks of your membership--spending Points on free rewards! MyPoints gives you more choices for spending than anyone else. Take a look--once you've earned just 750 Points you can start enjoying rewards from: Applebee's BLOCKBUSTER VIDEO Boston Market Omaha Steaks Chili's The Olive Garden Chuck E. Cheese's The Sharper Image Circuit City Barnes & Noble Booksellers JCPenney Sprint Prepaid Calling Cards Hilton HHonors Toys "R" Us The Home Depot And many, many more...over 60 in all! So what are you waiting for? Click now and check out all the ways to Spend Points. Start saving your Points today, so you can reach the 750 minimum and start spending. We'll even give you 10 Points now just for visiting. http://www.mypoints.com/sape/26440/88076/y### Happy spending! Kathy MyPoints Membership Team Please respond to this message within 2 weeks! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- You received this email because you're a member of MyPoints. If you wish to unsubscribe or update your membership, please click below. ### Your email address on record with MyPoints is ###. (C) 1997-2001 MyPoints.com, Inc.(R) All rights reserved. ------------------------------------------------------- RM_Day1
Welcome to the MyPoints® family, James. I'm Kathy from the Membership Team here to help you make the most of your membership. I wanted to tell you about one of the main perks of your membership — spending Points on free rewards!

MyPoints gives you more choices for spending than anyone else. Take a look — once you've earned just 750 Points you can start enjoying rewards from:

• BLOCKBUSTER VIDEO
• Boston Market
• Chili's
• Chuck E. Cheese's
• Circuit City
• Barnes & Noble Booksellers
• Hilton HHonors
• The Home Depot
And many, many more...over 60 in all!
• Applebee's
• Omaha Steaks
• The Olive Garden
• The Sharper Image
• JCPenney
• Sprint Prepaid Calling Cards
• Toys "R" Us

So what are you waiting for? Click now and check out all the ways to Spend Points. Start saving your Points today, so you can reach the 750 minimum and start spending. We'll even give you 10 Points now just for visiting.

Happy spending!

MyPoints Membership Team


Please respond to this message within 2 weeks!

You received this email because you're a member of MyPoints. If you wish to unsubscribe or update your membership, please click the "Remove Me" link above.

Your email address on record with MyPoints is ###.
© 1997-2001 MyPoints.com, Inc.® All rights reserved.

======= PREVIOUS SPAM WAS ======= Received: from [216.33.87.197] by mailserver.eilatcity.co.il (NTMail 4.30.0013/AB9564.63.12487e1d) with ESMTP id hsztfaaa for <###>; Fri, 4 Jan 2002 12:05:54 +0200 Received: (from welcome@localhost) by mpmlbx00.mypoints.com (8.11.0/8.11.0) id g049o7x23222; Fri, 4 Jan 2002 03:50:07 -0600 (CST) Date: Fri, 4 Jan 2002 03:50:07 -0600 (CST) Message-Id: <200201040950.g049o7x23222@mpmlbx00.mypoints.com> To: ### From: welcome@mypoints.com Subject: Please Confirm Your Membership, James X-Indiv: ### X-System-Email-Type: welcome-gap X-Object-Reference: email.welcome-gap.html.null.default MIME-Version: 1.0 Content-type: multipart/alternative; boundary=mpBoundaryString Content-Transfer-Encoding: 7bit Status: R X-Status: N Confirm your membership today! === And even more spam from them! My 3rd complaint === Message-Id: <200201071013.g07ADmp08626@mail.dolphinwave.org> Content-Type: text/plain; charset="iso-8859-1" From: Admin Reply-To: abuse-2002@dolphinwave.org Organization: Private person To: Abuse reports , nanas-sub@cybernothing.org, uce@ftc.gov, hostmaster@EXODUS.NET, abuse@EXODUS.NET, postmaster@EXODUS.NET, CompServ@EXODUS.NET Subject: [email] 3rd spam from mypoints.com! [Fwd: URGENT: Reply Required] Date: Mon, 7 Jan 2002 12:13:47 +0200 X-Mailer: KMail [version 1.3.2] Cc: mpmail@mpmlbx00.mypoints.com, hostinfo@MYPOINTS.COM, BonusMailReply@MYPOINTS.COM X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-PGP-key: 0xAAE2A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Status: R X-Status: N This is the THIRD spam from those mypoints.com spammers on my e-mail address, not used anywhere for at least a half-year! And my name is NOT James! Spammer: mpmlbx11.mypoints.com [216.33.87.178] Mail from: mpmail@mpmlbx00.mypoints.com Collects replies to: BonusMailReply@mypoints.com Spamvertised web page: http://www.mypoints.com [216.33.87.135] Registrant: MyPoints.com, Inc. (MYPOINTS-DOM) 100 California Ave., Suite 1160 San Francisco, CA 94111 US Domain Name: MYPOINTS.COM Administrative Contact, Technical Contact: MyPoints.com, Inc. (MC2735-ORG) hostinfo@MYPOINTS.COM Operations Department 1375 E. Woodfield Rd. Suite 520 Schaumburg, IL 60173 US 847-969-8150 Fax- 847-969-8164 Billing Contact: MyPoints.com, Inc (IMS86) ap@MYPOINTS.COM Accounts Payable 100 California Street Suite 1160 San Francisco, CA 94111 (415) 676-3700 (FAX) (415) 676-2054 Record last updated on 08-Jun-2001. Record expires on 28-Jun-2003. Record created on 27-Jun-1996. Database last updated on 3-Jan-2002 22:19:00 EST. Domain servers in listed order: MPDNS01.MYPOINTS.COM 216.33.87.104 MPDNS02.MYPOINTS.COM 216.33.87.105 Exodus Commnications IP block [216.32.0.0 - 216.35.255.255]. Upstream: Exodus (csr02-ve240.okbr01.exodus.net). ---------- Forwarded Message ---------- Received: from [216.33.87.178] by mailserver.eilatcity.co.il (NTMail 4.30.0013/AB9564.63.12487e1d) with ESMTP id vpkvfaaa for <###>; Mon, 7 Jan 2002 12:17:37 +0200 Received: (from mpmail@localhost) by mpmlbx11 (8.11.0/8.11.0) id g079oEI28920; Mon, 7 Jan 2002 03:50:14 Date: Mon, 7 Jan 2002 03:50:14 Message-ID: <20021735014.g079oEI28920@mpmlbx11> To: ### From: Welcome to MyPoints Reply-To: BonusMailReply@mypoints.com Subject: URGENT: Reply Required X-Indiv: y### X-JobID: ### MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=mpBoundaryString Content-Transfer-Encoding: 7bit Status: R X-Status: N ************* MyPoints(R) ************* James, Get your Bonus Gift, valued up to $100, and up to 350 Points by confirming your account today. Choose from brand names like Samsonite and Vivitar, along with today's hottest software titles. You MUST CONFIRM that you want to become a member of the MyPoints(R) program in order to receive your gift. CLICK HERE NOW! http://www.mypoints.com/pope/###/###/### Here is your temporary username. You will be able to change it when you confirm your account. Your username: ### Sincerely, John Fullmer CEO and MyPoints Member P.S. Have questions? We've got the answers. Click below. http://www.mypoints.com/pope/###/###/### Your email address on record with MyPoints is ###. (C) 1997-2002 MyPoints.com, Inc.(R) All rights reserved. ------------------------------------------------------- MyPoints


James,

Get your Bonus Gift, valued up to $100, and up to 350 Points by confirming your account today. Choose from brand names like Samsonite and Vivitar, along with today's hottest software titles.

You must confirm that you want to become a member of the MyPoints® program in order to receive your gift. Click here now!

Here is your temporary username. You will be able to change it when you confirm your account.

Your username: ###

Sincerely,
John Fullmer
CEO and MyPoints Member


P.S. Have questions? We've got the answers.
Your email address on record with MyPoints® is ###.


Copyright 1997-2002 MyPoints.com, Inc.® All rights reserved.
======= PREVIOUS SPAMS WERE ======= Received: from [216.33.87.197] by mailserver.eilatcity.co.il (NTMail 4.30.0013/AB9564.63.12487e1d) with ESMTP id hsztfaaa for <###>; Fri, 4 Jan 2002 12:05:54 +0200 Received: (from welcome@localhost) by mpmlbx00.mypoints.com (8.11.0/8.11.0) id g049o7x23222; Fri, 4 Jan 2002 03:50:07 -0600 (CST) Date: Fri, 4 Jan 2002 03:50:07 -0600 (CST) Message-Id: <200201040950.g049o7x23222@mpmlbx00.mypoints.com> To: ### From: welcome@mypoints.com Subject: Please Confirm Your Membership, James X-Indiv: ### X-System-Email-Type: welcome-gap X-Object-Reference: email.welcome-gap.html.null.default MIME-Version: 1.0 Content-type: multipart/alternative; boundary=mpBoundaryString Content-Transfer-Encoding: 7bit Status: R X-Status: N Confirm your membership today! === And they are trying to get themselves removed from the blocklists now === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!newsfeed1.cidera.com !Cidera!cletus.bright.net!not-for-mail From: "Square Giblets" Newsgroups: news.admin.net-abuse.email Subject: [hat check] mypoints.com asking me to unblock. Lines: 42 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Message-ID: Date: Thu, 12 Dec 2002 20:18:54 -0600 NNTP-Posting-Host: 216.114.194.20 X-Complaints-To: abuse@hickorytech.net X-Trace: cletus.bright.net 1039745820 216.114.194.20 (Thu, 12 Dec 2002 21:17:00 EST) NNTP-Posting-Date: Thu, 12 Dec 2002 21:17:00 EST Organization: HickoryTech Internet Xref: uni-berlin.de news.admin.net-abuse.email:1878601 I blocked mypoints.com late in 2001 because they were spamming to large numbers of accounts, including one of my spamtraps. Hits in NANAES backed up by decision to block them. At that time, they were on Exodus space. Now, they live on 209.87.114.30/26, and these IPs are not in any blacklists that I can find. They only have a couple hits in NANAES under these new IPs also. They may have finally cleaned their lists through their mergers and could possibly be running a tight enough ship. Anyone have any input/documentation on why I should not allow them in again? Thanks, -gib Their paraphrased email follows: =========================================== To whom it may concern, We recently received an email from a MyPoints member which indicates that you may not be accepting mail from one or more of our mail servers. The message included the following error: 550 5.0.0 ... Access Denied I would like to discuss resolution of this issue with someone at your organization as soon as possible. The MyPoints program is an "opt-in" membership program that rewards individuals for performing everyday actions on the Internet such as, visiting web sites, taking surveys, making purchases and reading/responding to their personally customized BonusMail emails (www.mypoints.com). It is strictly against MyPoints.com policy to send any unsolicited mail. It is possible that the following IP addresses are currently being blocked: (209.87.114.30/26 IPs listed) Additionally, it would be great if you could supply information about your blocking criteria regarding email volume, unknown users and reverse DNS. =========================================== -- === My reply === Path: uni-berlin.de!cust-62-219-88-74.cust.bezeqint.NET!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: Re: [hat check] mypoints.com asking me to unblock. Date: 13 Dec 2002 13:36:20 GMT Organization: Private person Lines: 38 Sender: Alexander Sheremet Message-ID: References: NNTP-Posting-Host: cust-62-219-88-74.cust.bezeqint.net (62.219.88.74) X-Trace: fu-berlin.de 1039786580 36618090 62.219.88.74 (16 [104765]) X-SPEWS: I am not X-newsgroup: news.admin.net-abuse.email X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:1878871 On Thu, 12 Dec 2002 20:18:54 -0600 Square Giblets wrote in message : > I blocked mypoints.com late in 2001 because they were spamming to large > numbers of accounts, including one of my spamtraps. Hits in NANAES backed > up by decision to block them. At that time, they were on Exodus space. And spammed me in the beginning of this year with their rogue "opt-in confirmation" request, full of ads, which they've ignored, anyways, and begun to spam me even that I did not confirm the "subscription". They made their points very clear here, I'm not going to allow them near from my servers: http://www.DolphinWave.org/spam/mypoints.com.txt > Now, they live on 209.87.114.30/26, and these IPs are not in any blacklists > that I can find. Thanks for the updates. > They only have a couple hits in NANAES under these new IPs > also. They may have finally cleaned their lists through their mergers and > could possibly be running a tight enough ship. > > Anyone have any input/documentation on why I should not allow them in again? Did they apologize for them spamming you in the past? No? Or they pretend that they always were the "whitest opt-in e-mailers", and that it's your database that is in error for not letting them in? Note, even in this their e-mail they push their ads for their services. Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === More of their "confirmation" spams reported === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!news.airnews.net !cabal12.airnews.net!news.river.com!news From: Richard Johnson Newsgroups: news.admin.net-abuse.email Subject: Re: [hat check] mypoints.com asking me to unblock. Date: Fri, 13 Dec 2002 13:30:09 -0700 Organization: Whirlpools Suck the Breath Out of You Lines: 54 Message-ID: <9164BEB165765E23.5E122411A1BDDB23.E462D7C8F084716E@lp.airnews.net> X-Orig-Message-ID: References: Reply-To: rnews@river.com Abuse-Reports-To: abuse at airmail.net to report improper postings NNTP-Proxy-Relay: library1-aux.airnews.net NNTP-Posting-Time: Fri Dec 13 14:28:33 2002 NNTP-Posting-Host: !\#3:1k-Y''OJ*k&8#rkC)1i` (Encoded at Airnews!) User-Agent: slrn/0.9.7.4 (OpenBSD) Xref: uni-berlin.de news.admin.net-abuse.email:1879147 On Thu, 12 Dec 2002 20:18:54 -0600, Square Giblets wrote: > I blocked mypoints.com late in 2001 because they were spamming to large > numbers of accounts, including one of my spamtraps. Hits in NANAES backed > up by decision to block them. At that time, they were on Exodus space. > > Now, they live on 209.87.114.30/26, and these IPs are not in any blacklists > that I can find. They only have a couple hits in NANAES under these new IPs > also. They may have finally cleaned their lists through their mergers and > could possibly be running a tight enough ship. > > Anyone have any input/documentation on why I should not allow them in again? I was a bonusmail subscriber back in the day. Never got anything useful, of course, but at least they didn't sell the keyed address to anyone else. Then the mypoints.com thing happened, and they began hitting nonexistent users here. This got them listed. Back in July 2002, they were spamming in company with freebizmag.com AKA magazineoutlet.com. They were attacking only 2 spamtraps then, but injecting from the magazineoutlet.com sewer, 170.224.5.22 and neighbors as well as their sExodus space, 216.33.87.197. Their stuff via sExodus looked to be confirmation requests (judging by the return address). However, they tried to send more than one per user, each of which was far too large to -just- be a confirmation request. Since July, they haven't showed up in mail system logs here... at least, as mypoints.com. They may just be spamming using their domain mypoint.com (they seem to have lost the 's') from 209.87.114.81,82,83. Indeed, they've repeatedly sent to nonexistent users here since 21 November 2002 from those IPs, calling themselves mypoint.com. (If blocking more than 209.87.114.30/26, be aware that United Airlines' list operation sends from 209.87.114.71,72,etc. They appear to be a proper opt-in deal run by mypoints.com, or is it the other way around? Your users may want that mail.) In fact, the entire surrounding 209.87.112.0/20 is assigned to United Airlines Loyalty Services, ualloyalty.com, ual-prod.com. So... is mypoints.com now a UAL subsidiary? Are they attempting to pull a Topica, attempting to restrict their out and out spamming to 209.87.114.81/30 or larger, while claiming to run an honest opt-in deal from 209.87.114.30/26? Richard -- To reply via email, make sure you don't enter the whirlpool on river left. My mailbox. My property. My personal space. My rules. Deal with it. http://www.river.com/users/share/cluetrain/ === Mypoints has new IPs === Path: uni-berlin.de!cust-62-219-88-78.cust.bezeqint.NET!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: mypoints.com - new UAL IPs Date: 30 Dec 2002 17:31:16 GMT Organization: Private person Lines: 33 Sender: Alexander Sheremet Message-ID: NNTP-Posting-Host: cust-62-219-88-78.cust.bezeqint.net (62.219.88.78) X-Trace: fu-berlin.de 1041269476 9896013 62.219.88.78 (16 [104765]) X-SPEWS: I am not X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:1889044 Mypoints, it seems, has new IP ranges from the UAL Loyalty Services, at least one that I haven't seen yet is the [209.141.52.0 - 209.141.55.255] IP range. The whole range has rDNSes as something.corp.mypoints.com. And from my webserver logs it's obvious that they use outbound1.ual.com, too. So, is UAL = Mypoints now? dyn-53-77.corp.mypoints.com - - [28/Dec/2002:01:42:48 +0200] "GET /spam/mypoints.com.txt HTTP/1.1" 200 38933 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; Hotbar 4.1.8.0)" dyn-53-77.corp.mypoints.com - - [30/Dec/2002:18:04:44 +0200] "GET /spam/mypoints.com.txt HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; Hotbar 4.1.8.0)" outbound1.ual.com - - [30/Dec/2002:18:18:18 +0200] "GET /spam/mypoints.com.txt HTTP/1.0" 200 38933 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" $ whois 209.141.53.77@whois.arin.net [whois.arin.net] WINSTAR NETBLK-WINSTAR-BLK6 (NET-209-140-0-0-1) 209.140.0.0 - 209.141.255.255 UAL Loyalty Services UALLOYALTYS-WSTR (NET-209-141-52-0-1) 209.141.52.0 - 209.141.55.255 Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === Checking the IP range === $ host 209.141.52.1 1.52.141.209.in-addr.arpa domain name pointer dyn-52-1.corp.mypoints.com. $ host 209.141.53.1 1.53.141.209.in-addr.arpa domain name pointer sf-vlan3.corp.mypoints.com. $ host 209.141.53.200 200.53.141.209.in-addr.arpa domain name pointer sf-ns.corp.mypoints.com. $ host 209.141.54.200 200.54.141.209.in-addr.arpa domain name pointer ns0.corp.mypoints.com. $ host 209.141.55.254 254.55.141.209.in-addr.arpa domain name pointer dyn-55-254.corp.mypoints.com.