Actcom - Active Communications - bouncing spam complaints cause they contain spamvertised domain links, from all of their role addresses: abuse@actcom.co.il, AntiSpam@actcom.net.il, postmaster@actcom.co.il. Update: 15-Jan-2005: Actcom has fixed the problem (reply at the bottom). Removed. actcom.co.il, actcom.net.il, [192.114.40.0 - 192.114.47.255]: Access denied! === My spam complaint === From: Admin Organization: Private person Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Date: Fri, 3 Dec 2004 13:33:23 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1744525 X-KMail-Link-Type: forward To: , abuse@actcom.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200412031319.48926@2004.dolphinwave.org> Status: RO X-Status: S Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-KMail-EncryptionState: N X-KMail-SignatureState: N Spammer: p211.m135.actcom.co.il [192.115.60.211] Spamvertised web page: http://www.cutthepayment.com www.cutthepayment.com [202.102.230.36] ===================== Domain name: cutthepayment.com Registrant Contact: WhoisGuard WhoisGuard Protected (de10fae5aa744190ab3f8a7ea248512b.protect@whoisguard.com) +1.6613102107 Fax: +1.6613102107 8939 S. Sepulveda Blvd 8939 S. Sepulveda Blvd Westchester, CA 90045 US Administrative Contact: WhoisGuard WhoisGuard Protected (de10fae5aa744190ab3f8a7ea248512b.protect@whoisguard.com) +1.6613102107 Fax: +1.6613102107 8939 S. Sepulveda Blvd 8939 S. Sepulveda Blvd Westchester, CA 90045 US Technical Contact: WhoisGuard WhoisGuard Protected (de10fae5aa744190ab3f8a7ea248512b.protect@whoisguard.com) +1.6613102107 Fax: +1.6613102107 8939 S. Sepulveda Blvd 8939 S. Sepulveda Blvd Westchester, CA 90045 US Billing Contact: WhoisGuard WhoisGuard Protected (de10fae5aa744190ab3f8a7ea248512b.protect@whoisguard.com) +1.6613102107 Fax: +1.6613102107 8939 S. Sepulveda Blvd 8939 S. Sepulveda Blvd Westchester, CA 90045 US Status: Active Name Servers: ns1.gtnlc.com ns2.gtnlc.com Creation date: 24 Nov 2004 15:23:57 Expiration date: 24 Nov 2005 15:23:57 CNCGROUP-HA IP block [202.102.224.0 - 202.102.255.255]. Nameservers: gtnlc.com <== SPAMMERS. Registrar: enom.com/NameCheap.com ns1.gtnlc.com [202.102.230.36, 221.5.251.213] ns2.gtnlc.com [69.25.212.134] ns3.gtnlc.com [69.25.212.134] ============= Domain Name: gtnlc.com Registrar: Spot Domain LLC Expiration Date: 2005-10-07 18:43:01 Creation Date: 2004-10-07 16:32:34 Name Servers: ns1.domainsite.com ns2.domainsite.com ns3.domainsite.com ns4.domainsite.com REGISTRANT CONTACT INFO GGD Guillermo Gomez Lopez Guillanova 229 Cordoba, Sevilla 41013 ES Phone: 954298745 Phone Code: 34 Spain Fax: Email Address: gtbln04@jazzfree.com ADMINISTRATIVE CONTACT INFO GGD Guillermo Gomez Lopez Guillanova 229 Cordoba, Sevilla 41013 ES Phone: 954298745 Phone Code: 34 Spain Fax: Email Address: gtbln04@jazzfree.com TECHNICAL CONTACT INFO GGD Guillermo Gomez Lopez Guillanova 229 Cordoba, Sevilla 41013 ES Phone: 954298745 Phone Code: 34 Spain Fax: Email Address: gtbln04@jazzfree.com BILLING CONTACT INFO GGD Guillermo Gomez Lopez Guillanova 229 Cordoba, Sevilla 41013 ES Phone: 954298745 Phone Code: 34 Spain Fax: Email Address: gtbln04@jazzfree.com CNCGROUP-HA IP block [202.102.224.0 - 202.102.255.255]. CNCGROUP-CQ IP block [221.5.128.0 - 221.5.255.255]. Name.com/Internap IP block [69.25.212.128 - 69.25.212.191]. Nameservers: domainsite.com Registrar: Spot Domain LLC ---------- Forwarded Message ---------- Received: from p211.m135.actcom.co.il (p211.m135.actcom.co.il [192.115.60.211]) by mail.dolphinwave.org (8.12.8/8.12.8) with SMTP id iB3B1oet006465 for ; Fri, 3 Dec 2004 13:02:05 +0200 Received: from 176.64.114.182 by 217.22.114.18; Fri, 03 Dec 2004 08:01:54 -0300 Message-ID: From: "fascinateddragon@yahoo.com" Reply-To: "fascinateddragon@yahoo.com" To: abuse@### Subject: abuse@### Your Application Confirmation Date: Fri, 03 Dec 2004 14:55:54 +0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--554998637332632721" X-Priority: 3 X-CS-IP: 115.154.174.40 X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Hello,

We sent you an email a while ago, because you now qualify for a new mortgage.
You could get $300,000 for as little as $600 a month!
Bad credit is no problem, you can pull cash out or refinance.

Please click on this link for free consultation by a mortgage broker:
Start Saving Here

Best Regards,
Kerri Dodge

Future pref here

------------------------------------------------------- ======= ONE OF THE PREVIOUS SPAMS BY THE SAME ABUSERS ======= Received: from 64.203.225.20.dial-pool-2.pool.hargray.net (64.203.225.20.dial-pool-2.pool.hargray.net [64.203.225.20] (may be forged)) by mail.dolphinwave.org (8.12.8/8.12.8) with SMTP id iAC0wo3X032267 for ; Fri, 12 Nov 2004 02:59:23 +0200 X-Message-Info: XZB/sw+6+yrs/OOB+380/413038683714 Received: from smtp-agnes.gerhardt.HTADSPS@catchamail.com ([64.203.225.20]) by cp18-ou51.HTADSPS@catchamail.com with Microsoft SMTPSVC(5.0.4885.7575); Thu, 11 Nov 2004 18:50:59 -0600 X-Message-Info: XNYFC+%ND_LC_CHAR[1-3]9+ita+T+04/19929031121 Received: (qmail 54344 invoked by uid 34); Fri, 12 Nov 2004 01:53:59 +0100 Date: Fri, 12 Nov 2004 03:55:59 +0300 Message-Id: <841663757.46552@HTADSPS@catchamail.com> From: Tommie Tomlinson To: Abuse Subject: Are You Lonely or Horney? MIME-Version: 1.0 (produced by compressivecoast 8.6) Content-Type: multipart/alternative; boundary="--77295473352973301" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.12; VDF 6.28.0.68 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Try WebDating, It's for Real.. http://emailspamblocker.info/exreg_02a.html You Can Get Laid or Meet The Girl/Guy of your dreams F-R-E-E Profile signup and searches Find your S-e-X-Mate today... http://emailspamblocker.info/exreg_02a.html ---------------------------------------- http://awesomelender.com/st.html ------------------------------------------------------- === Bounce === Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3BXmet007187 for ; Fri, 3 Dec 2004 13:33:49 +0200 Received: from mf1.actcom.co.il (mf1.actcom.co.il [192.114.47.27]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BXh3x016782 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 3 Dec 2004 13:33:43 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BXhaY027288 for ; Fri, 3 Dec 2004 13:33:43 +0200 MIME-Version: 1.0 From: AntiVirus Service Subject: **Message you sent blocked by our SPAM filter** In-Reply-To: <200412031319.48926@2004.dolphinwave.org> Message-Id: Content-Type: multipart/report; report-type=delivery-status; boundary="----------=_1102073623-27034-1" To: Date: Fri, 3 Dec 2004 13:33:43 +0200 (EET) X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: This is a multi-part message in MIME format... ------------=_1102073623-27034-1 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: 7bit The email you sent with the following subject has not been delivered. To: vita-u@actcom.co.il Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Our users use an email filter to help block the delivery of unsolicited commercial email, otherwise known as SPAM. For more information on SPAM, please visit http://spam.abuse.net. The report below will help you determine why your message was flagged as SPAM. If you continue to have problems, please contact our Helpdesk at 1-800-300123. Thank you very much, AntiSpam@actcom.net.il SpamAssassin report: Spam detection software, running on the system "mf1.actcom.co.il", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see the administrator of that system for details. Content preview: Spammer: p211.m135.actcom.co.il [192.115.60.211] Spamvertised web page: http://www.cutthepayment.com www.cutthepayment.com [202.102.230.36] ====================Domain name: cutthepayment.com [...] Content analysis details: (8.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 HTML_MESSAGE BODY: HTML included in message 4.0 SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org [www.cutthepayment.com is blacklisted in URI RBL] [at sc.surbl.org] 1.5 SARE_RAND_2W SARE_RAND_2W 2.5 SARE_RAND_2 SARE_RAND_2 ------------=_1102073623-27034-1 Content-Type: message/delivery-status Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Delivery error report Reporting-MTA: dns; mf1.actcom.co.il Received-From-MTA: smtp; mf1.actcom.co.il ([127.0.0.1]) Arrival-Date: Fri, 3 Dec 2004 13:33:43 +0200 (EET) Final-Recipient: rfc822; vita-u@actcom.co.il Action: failed Status: 5.7.1 Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=27034-06-5 Last-Attempt-Date: Fri, 3 Dec 2004 13:33:43 +0200 (EET) ------------=_1102073623-27034-1 Content-Type: text/rfc822-headers Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Undelivered-message headers Received: from smtp1.actcom.co.il (mx1.actcom.co.il [192.114.47.64]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BXYSv027263; Fri, 3 Dec 2004 13:33:34 +0200 Received: from mail.dolphinwave.org (dolphinwave.org [217.22.114.18]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BXSXM016664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 3 Dec 2004 13:33:32 +0200 Received: from orca.dolphinwave.org (dolphinwave.org [217.22.114.18]) (authenticated bits=0) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3BXOet007141; Fri, 3 Dec 2004 13:33:25 +0200 From: Admin Organization: Private person Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Date: Fri, 3 Dec 2004 13:33:23 +0200 User-Agent: KMail/1.5 To: , abuse@actcom.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200412031319.48926@2004.dolphinwave.org> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 ------------=_1102073623-27034-1-- === My followup to other related Actcom addresses === From: Admin Organization: Private person Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Date: Fri, 3 Dec 2004 13:49:08 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1744533 X-KMail-Link-Type: forward To: AntiSpam@actcom.net.il, postmaster@actcom.co.il, , nanas@killfile.org X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200412031349.08834@2004.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: Are you serious?! How can people report spam to you, if you bounce complaints cause they contain spamvertised domain links mentioned? ======= ORIGINAL SPAM COMPLAINT FOLLOWS ======= ======= BOOUNCE FROM abuse@actcom.co.il FOLLOWS ======= === And all e-mails bounce again, 1st === Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3BnWet007529 for ; Fri, 3 Dec 2004 13:49:33 +0200 Received: from mf1.actcom.co.il (mf1.actcom.co.il [192.114.47.27]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BnSpX024676 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 3 Dec 2004 13:49:28 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BnSaY029685 for ; Fri, 3 Dec 2004 13:49:28 +0200 MIME-Version: 1.0 From: AntiVirus Service Subject: **Message you sent blocked by our SPAM filter** In-Reply-To: <200412031349.08834@2004.dolphinwave.org> Message-Id: Content-Type: multipart/report; report-type=delivery-status; boundary="----------=_1102074568-29323-1" To: Date: Fri, 3 Dec 2004 13:49:28 +0200 (EET) X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: This is a multi-part message in MIME format... ------------=_1102074568-29323-1 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: 7bit The email you sent with the following subject has not been delivered. To: bruck@actcom.co.il Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Our users use an email filter to help block the delivery of unsolicited commercial email, otherwise known as SPAM. For more information on SPAM, please visit http://spam.abuse.net. The report below will help you determine why your message was flagged as SPAM. If you continue to have problems, please contact our Helpdesk at 1-800-300123. Thank you very much, AntiSpam@actcom.net.il SpamAssassin report: Spam detection software, running on the system "mf1.actcom.co.il", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see the administrator of that system for details. Content preview: Are you serious?! How can people report spam to you, if you bounce complaints cause they contain spamvertised domain links mentioned? ======= ORIGINAL SPAM COMPLAINT FOLLOWS ======From: Admin Organization: Private person Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Date: Fri, 3 Dec 2004 13:33:23 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1744525 X-KMail-Link-Type: forward To: , abuse@actcom.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200412031319.48926@2004.dolphinwave.org> Status: RO X-Status: S Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-KMail-EncryptionState: N X-KMail-SignatureState: N [...] Content analysis details: (8.8 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 HTML_MESSAGE BODY: HTML included in message 0.7 T_RATWARE_OOPS_14 BODY: Has a possible RANDOM spammer goof in it. 4.0 SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org [www.cutthepayment.com is blacklisted in URI RBL] [at sc.surbl.org] 1.5 SARE_RAND_2W SARE_RAND_2W 2.5 SARE_RAND_2 SARE_RAND_2 ------------=_1102074568-29323-1 Content-Type: message/delivery-status Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Delivery error report Reporting-MTA: dns; mf1.actcom.co.il Received-From-MTA: smtp; mf1.actcom.co.il ([127.0.0.1]) Arrival-Date: Fri, 3 Dec 2004 13:49:23 +0200 (EET) Final-Recipient: rfc822; bruck@actcom.co.il Action: failed Status: 5.7.1 Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=29323-08-2 Last-Attempt-Date: Fri, 3 Dec 2004 13:49:28 +0200 (EET) ------------=_1102074568-29323-1 Content-Type: text/rfc822-headers Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Undelivered-message headers Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BnJSv029623; Fri, 3 Dec 2004 13:49:19 +0200 Received: from mail.dolphinwave.org (dolphinwave.org [217.22.114.18]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BnEe4024513 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 3 Dec 2004 13:49:17 +0200 Received: from 192.168.1.78 ([192.168.1.254]) (authenticated bits=0) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3Bn9et007477; Fri, 3 Dec 2004 13:49:09 +0200 From: Admin Organization: Private person Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Date: Fri, 3 Dec 2004 13:49:08 +0200 User-Agent: KMail/1.5 To: AntiSpam@actcom.net.il, postmaster@actcom.co.il, , nanas@killfile.org X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200412031349.08834@2004.dolphinwave.org> X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 ------------=_1102074568-29323-1-- === And all e-mails bounce again, 2nd === Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3Bncet007548 for ; Fri, 3 Dec 2004 13:49:38 +0200 Received: from mf1.actcom.co.il (mf1.actcom.co.il [192.114.47.27]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BnYSU024752 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 3 Dec 2004 13:49:34 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BnXaY029730 for ; Fri, 3 Dec 2004 13:49:33 +0200 MIME-Version: 1.0 From: AntiVirus Service Subject: **Message you sent blocked by our SPAM filter** In-Reply-To: <200412031349.08834@2004.dolphinwave.org> Message-Id: Content-Type: multipart/report; report-type=delivery-status; boundary="----------=_1102074573-29323-3" To: Date: Fri, 3 Dec 2004 13:49:33 +0200 (EET) X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: This is a multi-part message in MIME format... ------------=_1102074573-29323-3 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: 7bit The email you sent with the following subject has not been delivered. To: vita-u@actcom.co.il Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Our users use an email filter to help block the delivery of unsolicited commercial email, otherwise known as SPAM. For more information on SPAM, please visit http://spam.abuse.net. The report below will help you determine why your message was flagged as SPAM. If you continue to have problems, please contact our Helpdesk at 1-800-300123. Thank you very much, AntiSpam@actcom.net.il SpamAssassin report: Spam detection software, running on the system "mf1.actcom.co.il", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see the administrator of that system for details. Content preview: Are you serious?! How can people report spam to you, if you bounce complaints cause they contain spamvertised domain links mentioned? ======= ORIGINAL SPAM COMPLAINT FOLLOWS ======From: Admin Organization: Private person Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Date: Fri, 3 Dec 2004 13:33:23 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1744525 X-KMail-Link-Type: forward To: , abuse@actcom.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200412031319.48926@2004.dolphinwave.org> Status: RO X-Status: S Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-KMail-EncryptionState: N X-KMail-SignatureState: N [...] Content analysis details: (8.8 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 HTML_MESSAGE BODY: HTML included in message 0.7 T_RATWARE_OOPS_14 BODY: Has a possible RANDOM spammer goof in it. 4.0 SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org [www.cutthepayment.com is blacklisted in URI RBL] [at sc.surbl.org] 1.5 SARE_RAND_2W SARE_RAND_2W 2.5 SARE_RAND_2 SARE_RAND_2 ------------=_1102074573-29323-3 Content-Type: message/delivery-status Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Delivery error report Reporting-MTA: dns; mf1.actcom.co.il Received-From-MTA: smtp; mf1.actcom.co.il ([127.0.0.1]) Arrival-Date: Fri, 3 Dec 2004 13:49:33 +0200 (EET) Final-Recipient: rfc822; vita-u@actcom.co.il Action: failed Status: 5.7.1 Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=29323-08-8 Last-Attempt-Date: Fri, 3 Dec 2004 13:49:33 +0200 (EET) ------------=_1102074573-29323-3 Content-Type: text/rfc822-headers Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Undelivered-message headers Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BnJSv029623; Fri, 3 Dec 2004 13:49:19 +0200 Received: from mail.dolphinwave.org (dolphinwave.org [217.22.114.18]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BnEe4024513 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 3 Dec 2004 13:49:17 +0200 Received: from 192.168.1.78 ([192.168.1.254]) (authenticated bits=0) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3Bn9et007477; Fri, 3 Dec 2004 13:49:09 +0200 From: Admin Organization: Private person Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Date: Fri, 3 Dec 2004 13:49:08 +0200 User-Agent: KMail/1.5 To: AntiSpam@actcom.net.il, postmaster@actcom.co.il, , nanas@killfile.org X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200412031349.08834@2004.dolphinwave.org> X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 ------------=_1102074573-29323-3-- === And all e-mails bounce again, 3rd === Received: from smtp1.actcom.co.il (mx1.actcom.co.il [192.114.47.64]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3Bniet007567 for ; Fri, 3 Dec 2004 13:49:44 +0200 Received: from mf1.actcom.co.il (mf1.actcom.co.il [192.114.47.27]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BndAi024817 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 3 Dec 2004 13:49:40 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BndaY029769 for ; Fri, 3 Dec 2004 13:49:39 +0200 MIME-Version: 1.0 From: AntiVirus Service Subject: **Message you sent blocked by our SPAM filter** In-Reply-To: <200412031349.08834@2004.dolphinwave.org> Message-Id: Content-Type: multipart/report; report-type=delivery-status; boundary="----------=_1102074579-29601-1" To: Date: Fri, 3 Dec 2004 13:49:39 +0200 (EET) X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: This is a multi-part message in MIME format... ------------=_1102074579-29601-1 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: 7bit The email you sent with the following subject has not been delivered. To: ericd@actcom.co.il Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Our users use an email filter to help block the delivery of unsolicited commercial email, otherwise known as SPAM. For more information on SPAM, please visit http://spam.abuse.net. The report below will help you determine why your message was flagged as SPAM. If you continue to have problems, please contact our Helpdesk at 1-800-300123. Thank you very much, AntiSpam@actcom.net.il SpamAssassin report: Spam detection software, running on the system "mf1.actcom.co.il", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see the administrator of that system for details. Content preview: Are you serious?! How can people report spam to you, if you bounce complaints cause they contain spamvertised domain links mentioned? ======= ORIGINAL SPAM COMPLAINT FOLLOWS ======From: Admin Organization: Private person Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] Date: Fri, 3 Dec 2004 13:33:23 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1744525 X-KMail-Link-Type: forward To: , abuse@actcom.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200412031319.48926@2004.dolphinwave.org> Status: RO X-Status: S Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-KMail-EncryptionState: N X-KMail-SignatureState: N [...] Content analysis details: (8.8 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 HTML_MESSAGE BODY: HTML included in message 0.7 T_RATWARE_OOPS_14 BODY: Has a possible RANDOM spammer goof in it. 4.0 SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org [www.cutthepayment.com is blacklisted in URI RBL] [at sc.surbl.org] 1.5 SARE_RAND_2W SARE_RAND_2W 2.5 SARE_RAND_2 SARE_RAND_2 ------------=_1102074579-29601-1 Content-Type: message/delivery-status Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Delivery error report Reporting-MTA: dns; mf1.actcom.co.il Received-From-MTA: smtp; mf1.actcom.co.il ([127.0.0.1]) Arrival-Date: Fri, 3 Dec 2004 13:49:35 +0200 (EET) Final-Recipient: rfc822; ericd@actcom.co.il Action: failed Status: 5.7.1 Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=29601-02 Last-Attempt-Date: Fri, 3 Dec 2004 13:49:39 +0200 (EET) ------------=_1102074579-29601-1 Content-Type: text/rfc822-headers Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Description: Undelivered-message headers Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BnJSv029623; Fri, 3 Dec 2004 13:49:19 +0200 Received: from mail.dolphinwave.org (dolphinwave.org [217.22.114.18]) by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BnEe4024513 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 3 Dec 2004 13:49:17 +0200 Received: from 192.168.1.78 ([192.168.1.254]) (authenticated bits=0) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3Bn9et007477; Fri, 3 Dec 2004 13:49:09 +0200 From: Admin Organization: Private person Subject: [email] abuse@actcom.co.il bounces spam complaints because of spam content?! [Fwd: **Message you sent blocked by our SPAM filter**] Date: Fri, 3 Dec 2004 13:49:08 +0200 User-Agent: KMail/1.5 To: AntiSpam@actcom.net.il, postmaster@actcom.co.il, , nanas@killfile.org X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200412031349.08834@2004.dolphinwave.org> X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.28.0.19; VDF 6.28.0.103 ------------=_1102074579-29601-1-- === Actcom replies - the problem is fixed === Path: uni-berlin.de!fu-berlin.de!postnews.google.com !c13g2000cwb.googlegroups.com!not-for-mail From: "amir123" Newsgroups: news.admin.net-abuse.email Subject: Re: actcom.co.il: spam-filter on the abuse addresses, bouncing Date: 14 Jan 2005 13:39:24 -0800 Organization: http://groups.google.com Lines: 136 Message-ID: <1105738764.385140.177080@c13g2000cwb.googlegroups.com> References: NNTP-Posting-Host: 192.114.80.51 Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" X-Trace: posting.google.com 1105738768 27604 127.0.0.1 (14 Jan 2005 21:39:28 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Fri, 14 Jan 2005 21:39:28 +0000 (UTC) User-Agent: G2/0.2 Complaints-To: groups-abuse@google.com Injection-Info: c13g2000cwb.googlegroups.com; posting-host=192.114.80.51; posting-account=uByPZw0AAADVxfU0OC-twEup2wiU9CJA Xref: uni-berlin.de news.admin.net-abuse.email:2393121 Hello, Here is how this problem happened and how we fixed it. The address abuse@actcom.co.il is an alias that is forwarded to the mailboxes of the Abuse Team. These mailboxes are protected by SpamAssassin, which marks the spam Subject by *SPAM*. There was a reject message, but the messages were not actually rejected, just marked. In order to solve the problem, mail to abuse@actcom.co.il (and also to antispam@actcom.co.il and antivirus@actcom.co.il) is now forwarded via a program that changes the envelope sender to an address which is whitelisted in SpamAssassin (the original envelope sender is kept in X-Original-Envelope-From). The program also forwards the mail to the Abuse Team. When the forwarded messages then pass through SpamAssassin, they do it with the said new envelope sender address which is whitelisted, and the problem gets avoided. Thanks, Amir Dolphin wrote: > Got a spam from one of their "zombie" machine at p211.m135.actcom.co.il > (192.115.60.211). Sent complaint to the abuse.net adviced abuse@actcom: > > > It has bounced cause the spam complaint had the spamvertised domain in the > nessage body (www.cutthepayment.com), listed by Spamcop: > > > Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) > by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id iB3BXmet007187 > for ; Fri, 3 Dec 2004 13:33:49 +0200 > Received: from mf1.actcom.co.il (mf1.actcom.co.il [192.114.47.27]) > by smtp1.actcom.co.il (8.12.11/8.12.11) with ESMTP id iB3BXh3x016782 > (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) > for ; Fri, 3 Dec 2004 13:33:43 +0200 > Received: from localhost (localhost.localdomain [127.0.0.1]) > by mf1.actcom.co.il (8.12.8/8.12.8) with ESMTP id iB3BXhaY027288 > for ; Fri, 3 Dec 2004 13:33:43 +0200 > MIME-Version: 1.0 > From: AntiVirus Service > Subject: **Message you sent blocked by our SPAM filter** > In-Reply-To: <200412031319.48926@2004.dolphinwave.org> > Message-Id: > Content-Type: multipart/report; > report-type=delivery-status; > boundary="----------=_1102073623-27034-1" > To: > Date: Fri, 3 Dec 2004 13:33:43 +0200 (EET) > > The email you sent with the following subject has not been delivered. > > To: vita-u@actcom.co.il > Subject: [email] Long-time persistent spammers (cutthepayment.com)! [Fwd: abuse@### Your Application Confirmation] > > Our users use an email filter to help block the delivery of unsolicited > commercial email, otherwise known as SPAM. For more information on SPAM, > please visit http://spam.abuse.net. > > The report below will help you determine why your message was > flagged as SPAM. If you continue to have problems, please contact > our Helpdesk at 1-800-300123. > > Thank you very much, > > AntiSpam@actcom.net.il > > SpamAssassin report: > Spam detection software, running on the system "mf1.actcom.co.il", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or block > similar future email. If you have any questions, see > the administrator of that system for details. > > Content preview: Spammer: p211.m135.actcom.co.il [192.115.60.211] > Spamvertised web page: http://www.cutthepayment.com > www.cutthepayment.com [202.102.230.36] ====================Domain name: > cutthepayment.com [...] > > Content analysis details: (8.1 points, 5.0 required) > > pts rule name description > ---- ---------------------- -------------------------------------------------- > 0.1 HTML_MESSAGE BODY: HTML included in message > 4.0 SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org > [www.cutthepayment.com is blacklisted in URI RBL] > [at sc.surbl.org] > 1.5 SARE_RAND_2W SARE_RAND_2W > 2.5 SARE_RAND_2 SARE_RAND_2 > > > > I've tried to re-send it to AntiSpam@actcom and postmaster@actcom: > > > And got precisely the same bounces, just other internally forwarded boxes. > Full examples are at http://www.DolphinWave.org/spam/Actcom.txt > > Advice to block: > > actcom.co.il, actcom.net.il, > [192.114.40.0 - 192.114.47.255] (192.114.40.0/21). > > Dolphin. > > -- > URL: http://www.DolphinWave.org > Mail: on the web page (no spam) > ICQ: 6615461