Cogent Communications - hosting all the worst and the biggest spammers of the Internet, ignoring all complaints about it for months! You just see these names yourself: IMG Direct / Steve Hardigree / Frank Bernal, Penn Media / Shagmail, Eddy Marin, Webfinity/Dynamic Pipe. Yes, they ALL are on Cogent right now, and some are there for as long as 6 months! Update: 12-Sep-2003: Add to it Alan Ralsky with djlhosting.com. Update: 28-Oct-2003: The Spamhaus SBL listings for Cogent grow steady, with a lot of known ROKSO spam-gangs staying connected despite on complaints. Update: 8-May-2004: Cogent wants at least 50 complaints to take action, allowing the persistent harassment to continue dozens of times, ignoring complaints. Update: 26-May-2004: Cogent's policy is to give spammers 3 (three!) warnings, then put them on probation, and only then, if they still keep spamming - ToSing! Update: 10-Jun-2004: Cogent accepts hosting for the "spam-king" Scott Richter / OptInBig.Com Update: 5-Oct-2004: The Spamhaus SBL listings for Cogent still grow, taking more and more of known ROKSO spammers every month. Up to 40 listings today. Update: 5-May-2005: Cogent lies to their customers about not hosting spammers, who caused the SPEWS listing, when customers complain about being blocked. cogentco.blackholes.us is mirrored locally as cogentco.bl.dolphinwave.org, and implemented on the mailserver. === A post about it === Path: uni-berlin.de!fu-berlin.de!nf3.bellglobal.com!sjc70.webusenet.com !news.webusenet.com!sn-xit-02!sn-xit-06!sn-post-02!sn-post-01!supernews.com !news.supernews.com!not-for-mail From: David Yellope Newsgroups: news.admin.net-abuse.email Subject: For SomethingAwful users: Date: Fri, 08 Aug 2003 19:55:56 -0400 Organization: Posted via Supernews, http://www.supernews.com Message-ID: X-Newsreader: Forte Agent 1.91/32.564 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Complaints-To: abuse@supernews.com Lines: 127 Xref: uni-berlin.de news.admin.net-abuse.email:2044665 Really, are you that stupid? Is your mind so filled with FYAD FYAD FYAD that you are living in a different reality? First of all, Lowtax: Post proof that the DDoS (If there WAS one), came from spews affiliated IP or retract your statement. Speaking of DoS's.. right after someone at SA decided since SPEWS.org had resolved to an IP in supernews space, that it would be a good idea to pressure them. Shortly after that. someone, (not saying it was affiliated with SA) decided to launch an attack on them. They know about it. They pretty much laughed it off. BTW.. just a free bit of education.. supernews hosts.. a MIRROR of spews.org. Guess again, FYAD boys.. You're chasing that wild goose all over the place :) Now, a couple of you wanted to know what sites were causing the block on cogentco that was recently escalated to cover Something Awful. Now, usually I wouldn't be inclined to do this kind of thing, if you want to know you should be willing to do your own donkey work, but, here it is: From http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com Found 15 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records (DY Note: Since Usenet doesn't do color, I will *** each one that is in ROKSO, ROKSO, the Registry of Known Spam Operations is a listing of those spam organizations that have been tossed off 3 or more ISP's due to Acceptable User Policy (AUP) violations with regards to spam) The date on each record is the date that the company was added to this list.) Jul 28 2003 207.153.108.0/28 cogentco.com SBL9896 4bulk.com / excuria.com Jul 27 2003 38.118.144.128/25 cogentco.com SBL9882 spywarenuker.com; trekdata.com; trekblue.com Jul 5 2003 38.117.6.0/23 cogentco.com ******** SBL9647 Eddy Marin - Internet Video Network OneRoute, LLC Jun 23 2003 66.28.24.64/26 cogentco.com SBL9541 korean porn spammers time369.com Jun 23 2003 66.28.28.242/32 cogentco.com SBL9540 Cogent AS16631 feed to iWay AS21869 Jun 2 2003 38.184.17.0/24 cogentco.com ******* SBL9251 Sam Al - Bulk ISP Corp copydvd.net / network888.com / bulkisp.net Jun 2 2003 69.41.64.2/32 cogentco.com ******* SBL9244 IMG Direct / Steve Hardigree / Frank Bernal pointer to SBL8825 69.41.64.0/20 AS27437 - fastduck.net May 29 2003 66.28.76.0/22 cogentco.com ******* SBL9190 IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net May 10 2003 66.28.62.209/32 cogentco.com ******* SBL8935 Penn Media / Shagmail ENTERTAININGNEWS.COM Apr 18 2003 38.117.3.0/24 cogentco.com ******* SBL8559 Eddy Marin - Internet Video Network oneroute.net Apr 6 2003 64.119.192.4/31 cogentco.com SBL8208 dns{1,2}.iwaynetworks.com Apr 2 2003 66.28.35.0/24 cogentco.com SBL8119 emf0.com / emailfactory.com Feb 19 2003 66.28.253.40/30 cogentco.com ******* SBL6968 Webfinity/Dynamic Pipe unityhostingservices.com / zegemabeach.com Feb 17 2003 66.28.248.144/28 cogentco.com ****** SBL6936 Scott Phillips / GSD Pinkbits Pbits surfnomore.com / marrison.com Feb 2 2003 66.250.4.240/30 cogentco.com ****** SBL6676 Eddy Marin - Internet Video Network OneRoute network feed Look at the dates some of these things were added. February. Six freakin months ago, with thousands of complaints from folks who didn't want their email boxes flooded with crap. Since Cogentco has apparently decided NOT to terminate the spammers (including Eddy Marin, the so-called "King of Spam" who is appropriately described in this Miami Herald article: "Eddy Marin did not return a phone call Wednesday. But one should note that spam is not illegal. That's a major improvement on his r Marin, 41, was busted and convicted in 1990 for running a major cocaine ring in Broward County, big enough to implicate 15 others, including former Broward County Judge James Holmes. A convicted coke dealer, who also dabbles in Internet porn and is currently fending off money- laundering charges, Marin presents a near-perfect front man for the most hated industry in the high-tech world." For SA users who are calm and willing to discuss the issue, even though we may disagree, I'm sorry that your ISP has landed you in this situation. For those of you who will just respond to this with threats/garbage/idiocy, I pity your mothers for having you. There is No Lumber Cartel..And I am NOT Member #01538 === What others think about it === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!sn-xit-03!sn-xit-01 !sn-post-01!supernews.com!corp.supernews.com!not-for-mail From: rule3@LinxNet.com (Jim Seymour) Newsgroups: news.admin.net-abuse.email Subject: Re: For SomethingAwful users: Date: Sat, 09 Aug 2003 02:25:03 -0000 Organization: Posted via Supernews, http://www.supernews.com Message-ID: Mime-Version: 1.0 Sender: jseymour@LinxNet.com X-Newsreader: knews 1.0b.1 References: Content-Type: text/plain; charset=us-ascii X-Complaints-To: abuse@supernews.com Lines: 54 Xref: uni-berlin.de news.admin.net-abuse.email:2044741 In article , David Yellope writes: [snip] > > Now, a couple of you wanted to know what sites were causing the block > on cogentco that was recently escalated to cover Something Awful. > > Now, usually I wouldn't be inclined to do this kind of thing, Thanks, David. > if you > want to know you should be willing to do your own donkey work, but, > here it is: > > From http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com > > Found 15 SBL listings for IPs under the responsibility of cogentco.com > [snip] Oh. My. God! You mean to tell me that Eddy Marin, Sam Al and Steve Hardigree, as well as iWay, Penn Media/Shagmail, emailfactory.com and Dynamic Pipe are all on Cogentco *at* *the* *same* *time*?!?! Yow! I guess I haven't been paying close attention. For cryin' out loud: I'm surprised anybody's accepting *any* traffic from Cogentco! Y'know, some of us have often joked that it'd be nice if spammers would just get on their own network. Looks like a goodly portion of the worst offenders have done just that. I gave up using ISP- and country-specific blocklists some months ago, thinking them counter-productive. Congratulations, Cogent, I've just started using one again: cogentco.blackholes.us. And as a Special Bonus, I'm going to do something I've *never* done before: I'm going to go into the IT Director's office come Monday morning, explain the situation in detail, and see if he'll allow me to add that DNSbl zone to the Corporate email gateways. Wow. This whole Something Awful story just keeps getting... well... I'd say "better and better," but that somehow doesn't seem... right. -- Jim Seymour | "Some of the lies are so strange it WARNING: The "From:" address is a | makes you wonder about the spammer's spam trap. DON'T USE IT! Use: | sanity." jseymour@LinxNet.com | - Ed Foster, "The Gripe Line" 6/24/02 === Spamhaus evidence file (9-Aug-2003) === === http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com === Found 16 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records Aug 9 2003 66.132.45.66/32 cogentco.com SBL9990 Idxstream business proposal / penis enlargement spammers Jul 28 2003 207.153.108.0/28 cogentco.com SBL9896 4bulk.com / excuria.com Jul 27 2003 38.118.144.128/25 cogentco.com SBL9882 spywarenuker.com; trekdata.com; trekblue.com Jul 5 2003 38.117.6.0/23 cogentco.com SBL9647 Eddy Marin - Internet Video Network OneRoute, LLC Jun 23 2003 66.28.24.64/26 cogentco.com SBL9541 korean porn spammers time369.com Jun 23 2003 66.28.28.242/32 cogentco.com SBL9540 Cogent AS16631 feed to iWay AS21869 Jun 2 2003 38.184.17.0/24 cogentco.com SBL9251 Sam Al - Bulk ISP Corp copydvd.net / network888.com / bulkisp.net Jun 2 2003 69.41.64.2/32 cogentco.com SBL9244 IMG Direct / Steve Hardigree / Frank Bernal pointer to SBL8825 69.41.64.0/20 AS27437 - fastduck.net May 29 2003 66.28.76.0/22 cogentco.com SBL9190 IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net May 10 2003 66.28.62.209/32 cogentco.com SBL8935 Penn Media / Shagmail ENTERTAININGNEWS.COM Apr 18 2003 38.117.3.0/24 cogentco.com SBL8559 Eddy Marin - Internet Video Network oneroute.net Apr 6 2003 64.119.192.4/31 cogentco.com SBL8208 dns{1,2}.iwaynetworks.com Apr 2 2003 66.28.35.0/24 cogentco.com SBL8119 emf0.com / emailfactory.com Feb 19 2003 66.28.253.40/30 cogentco.com SBL6968 Webfinity/Dynamic Pipe unityhostingservices.com / zegemabeach.com Feb 17 2003 66.28.248.144/28 cogentco.com SBL6936 Scott Phillips / GSD Pinkbits Pbits surfnomore.com / marrison.com Feb 2 2003 66.250.4.240/30 cogentco.com SBL6676 Eddy Marin - Internet Video Network OneRoute network feed === And it is growing. 5 more spammers in a month, including Alan Ralsky === === Spamhaus evidence file (12-Sep-2003) === === http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com === Found 21 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records Sep 10 2003 66.28.24.0/24 cogentco.com SBL10422 spamvertised website, no RDNS (dialer spam) Sep 6 2003 38.117.36.0/22 cogentco.com SBL10342 EuroNet Inc. - ederoma.com Sep 1 2003 38.118.164.0/24 cogentco.com SBL10271 Remedy Media (selectgroupmedia.com) Aug 28 2003 38.119.36.0/27 cogentco.com SBL10174 Alan Ralsky PIS Daniel Lin: djlhosting.com Aug 12 2003 69.41.161.33/32 cogentco.com SBL10017 800hosting.com open proxy spammer Aug 4 2003 66.250.125.0/24 cogentco.com SBL9934 Application X Jul 28 2003 207.153.108.0/24 cogentco.com SBL9896 4bulk.com / excuria.com / ixii.us, aka colo.ws, aka lab99.net, aka Xemail911 Jul 5 2003 38.117.6.0/23 cogentco.com SBL9647 Eddy Marin - Internet Video Network OneRoute, LLC Jun 23 2003 66.28.24.64/26 cogentco.com SBL9541 korean porn spammers time369.com Jun 23 2003 66.28.28.242/32 cogentco.com SBL9540 Cogent AS16631 feed to iWay AS21869 Jun 2 2003 38.184.17.0/24 cogentco.com SBL9251 Sam Al - Bulk ISP Corp copydvd.net / network888.com / bulkisp.net / worldserviceispxyz.com Jun 2 2003 69.41.64.2/32 cogentco.com SBL9244 IMG Direct / Steve Hardigree / Frank Bernal pointer to SBL8825 69.41.64.0/20 AS27437 - fastduck.net May 29 2003 66.28.76.0/22 cogentco.com SBL9190 IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net May 10 2003 66.28.62.209/32 cogentco.com SBL8935 Penn Media / Shagmail ENTERTAININGNEWS.COM Apr 18 2003 38.117.3.0/24 cogentco.com SBL8559 Eddy Marin - Internet Video Network oneroute.net Apr 6 2003 64.119.192.4/31 cogentco.com SBL8208 dns{1,2}.iwaynetworks.com Apr 2 2003 66.28.35.0/24 cogentco.com SBL8119 emf0.com / emailfactory.com Feb 19 2003 66.28.253.40/30 cogentco.com SBL6968 Webfinity/Dynamic Pipe unityhostingservices.com / zegemabeach.com Feb 17 2003 66.28.248.144/28 cogentco.com SBL6936 Scott Phillips / GSD Pinkbits Pbits surfnomore.com / marrison.com Feb 2 2003 66.250.4.240/30 cogentco.com SBL6676 Eddy Marin - Internet Video Network OneRoute network feed Jan 16 2003 66.28.49.0/24 cogentco.com SBL6306 Whitcon / uswives ''Zodiac Internet Consulting'' Whitcon front - Child Porn spammers === And 8 more listings for Cogent in Spamhaus SBL! Up to 29 now, and 17 of === === them - yellow: known ROKSO spammers (marked with *** here)! 28-Oct-2003 === Found 29 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records SBL11642 38.113.196.35/32 cogentco.com ******* 28-Oct-2003 03:13 GMT Damon DeCrescenzo - Docdrugs / Pinnacle Meds ever-co.com SBL11634 38.116.8.0/23 cogentco.com 27-Oct-2003 22:42 GMT Worldwide Internet Marketing Team SBL11615 38.112.9.114/32 cogentco.com 27-Oct-2003 04:26 GMT ever-co.com SBL11546 66.28.247.0/25 cogentco.com 24-Oct-2003 07:54 GMT designated-ns.com designated spamvertized sites SBL11519 66.28.62.207/32 cogentco.com 23-Oct-2003 04:42 GMT www.paidsurveysonline.com SBL11199 38.112.1.128/30 cogentco.com ******* 11-Oct-2003 11:26 GMT Eddy Marin - Internet Video Network OneRoute, LLC - Cogentco feed SBL11189 38.113.8.0/21 cogentco.com ******* 11-Oct-2003 05:07 GMT Neomill / Nick Ceriello Neomill / Nick Ceriello SBL11102 66.28.209.12/32 cogentco.com 09-Oct-2003 02:48 GMT www.a1hostingdirect.com SBL11035 38.117.19.10/28 cogentco.com ******* 06-Oct-2003 19:18 GMT Damon DeCrescenzo - Docdrugs / Pinnacle Meds ns1.continentalhosting.com SBL11025 38.113.10.0/24 cogentco.com 06-Oct-2003 10:02 GMT dnswebhosting.net hosted spammers SBL10917 38.112.7.192/30 cogentco.com ******* 02-Oct-2003 10:19 GMT Huy Huynh Cyberland Services, Inc. SBL10884 66.28.102.177/32 cogentco.com ******* 01-Oct-2003 01:52 GMT EvoClix / Larry Tasman / Greg Numark boundmarketing.com (on New Horizons) SBL10759 216.251.32.100/31 cogentco.com 24-Sep-2003 13:55 GMT personal-pics.com - Porno spam (meganameservers.com) SBL10651 38.113.203.0/24 cogentco.com 20-Sep-2003 00:26 GMT Topica, Inc. - advizeadmmbc.com SBL10465 38.117.18.0/23 cogentco.com 12-Sep-2003 12:00 GMT Proxy spammers - hijacking open proxy ports. SBL10464 38.112.195.0/24 cogentco.com 12-Sep-2003 11:59 GMT Proxy spammers - hijacking open proxy ports. SBL10342 38.117.36.0/22 cogentco.com ******* 06-Sep-2003 23:04 GMT IMG Direct / Steve Hardigree / Frank Bernal EuroNet Inc. - ederoma.com SBL10174 38.119.36.0/26 cogentco.com ******* 28-Aug-2003 10:15 GMT Alan Ralsky PIS Daniel Lin: djlhosting.com SBL9896 207.153.108.0/24 cogentco.com 28-Jul-2003 22:48 GMT 4bulk.com / excuria.com / ixii.us, aka colo.ws, aka lab99.net, aka Xemail911 SBL9647 38.117.6.0/23 cogentco.com ******* 05-Jul-2003 21:34 GMT Eddy Marin - Internet Video Network OneRoute, LLC SBL9244 69.41.64.2/32 cogentco.com ******* 02-Jun-2003 00:12 GMT IMG Direct / Steve Hardigree / Frank Bernal pointer to SBL8825 69.41.64.0/20 AS27437 - fastduck.net SBL9190 66.28.76.0/22 cogentco.com ******* 29-May-2003 19:49 GMT IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net SBL8935 66.28.62.209/32 cogentco.com ******* 10-May-2003 15:20 GMT Penn Media / Shagmail ENTERTAININGNEWS.COM SBL8559 38.117.3.0/24 cogentco.com ******* 18-Apr-2003 23:58 GMT Eddy Marin - Internet Video Network oneroute.net SBL8119 66.28.35.0/24 cogentco.com 02-Apr-2003 10:21 GMT emf0.com / emailfactory.com SBL6968 66.28.253.40/30 cogentco.com ******* 19-Feb-2003 23:41 GMT Webfinity/Dynamic Pipe unityhostingservices.com / zegemabeach.com SBL6936 66.28.248.144/28 cogentco.com ******* 17-Feb-2003 09:04 GMT Scott Phillips / GSD Pinkbits Pbits surfnomore.com / marrison.com SBL6676 66.250.4.240/30 cogentco.com ******* 02-Feb-2003 15:31 GMT Eddy Marin - Internet Video Network OneRoute network feed SBL6306 66.28.49.0/24 cogentco.com ******* 16-Jan-2003 01:26 GMT Whitcon / uswives ''Zodiac Internet Consulting'' Whitcon front - Child Porn spammers === And how the Cogent Abuse department works, the customer's experience === Path: uni-berlin.de!fu-berlin.de!postnews1.google.com!not-for-mail From: awacs@egps.com (Nachman Yaakov Ziskind, Esq.) Newsgroups: news.admin.net-abuse.email Subject: Cogent Abuse Date: 28 Oct 2003 10:15:27 -0800 Organization: http://groups.google.com Lines: 135 Message-ID: NNTP-Posting-Host: 38.119.130.10 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1067364927 17963 127.0.0.1 (28 Oct 2003 18:15:27 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Tue, 28 Oct 2003 18:15:27 +0000 (UTC) Xref: uni-berlin.de news.admin.net-abuse.email:2095918 ... sorry to say, everything that NANAE ppl having been saying about Cogent is not incorrect. I'd like to post for posterity today's exchange with Virgil Smith, who works in Cogent's Virginia NOC. I suppose I'll be switching again soon . :-( I'd appreciate suggestions for a replacement ISP; I'm in Manhattan, New York City. ------------------Cut Here----------------------- [Background: I am a Cogent customer. For two months, *other* Cogent customers - infected with MSBlaster, et. al. have been attacking my network. Cogent's stock advice has been to null route my IP's. My proposed solution: null route the attacker's IP's. Small, but significant difference. Even more annoying: Cogent has been passing me packets from RFC 1918 addresses. Cogent refuses to accept responsibility for these packets: "Additionally, the source ip 10.6.17.240 does not reside on the Cogent network. More than likely, that ip address is either spoofed or the been altered to hide the actual host. "Without an accurate source ip we have the same to two options as last time. 1) We can null route your ip - no traffic comes or goes. Many times this ends the attack. 2) You can thwart this attack with your firewall. Possibly block port 137 or the 10.6.x.x net block." I'd like Cogent - which appears to be passing these packets in defiance of RFC1918 - to trace these packets back to the miscreant.] > (thirteen, actually): > > 216 38.119.98.173 > 213 38.118.132.13 > 144 38.117.36.224 > 72 38.118.184.8 > 72 38.118.128.186 > 72 38.117.36.228 > 72 38.117.36.226 > 72 38.117.166.194 > 59 38.119.240.162 > 48 172.31.0.111 > 40 38.119.141.164 > 32 38.117.128.139 > 28 38.119.141.171 > 28 38.119.141.148 > 22 172.31.0.123 > 17 172.31.0.114 > 12 172.31.0.124 > > Note also the multiplicity of hits from 172.31.x.x, a private (see RFC 1918) > network who's packets SHOULD NOT be routed by Cogent routers. I know that > you (and Mr. Collins) have disclaimed responsibility for this mistake in the > past, but you are incorrect. > > So, can you pull the plug on these guys, please? Or get them to reform, > *now*? > > P.S. Did you know that Cogent has *twenty-seven* listings on ROKSO? See: > http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com > > for the sorry details. > > If I'd have known before I signed up that Cogent was such a spamhaus with a > sorry abuse dept., well, if wishes were horses ... > > NYZ Smith, Virgil wrote (on Tue, Oct 28, 2003 at 07:58:56AM -0500): > Hello, > > Do not send me any more emails with your insults included. > Virgil Excuse me? Insults? Was I insulting you by informing you that you were *incorrect* about the RFC1918 addresses? I'm sorry, but you are incorrect; certainly you haven't adduced any proof to the contrary. Or was I insulting you by sending you a list of IP's that are attacking my network? Or perhaps I insulted you by asking you to *do some work* and stop people from attacking me? This seems strange to me; when my clients send *me* work to do, I smile and thank them. Perhaps you were upset when I said that Cogent is a spamhaus? Well, I'm sorry about that, but if the Abuse department were doing it's job ... You have a relationship with Eddy Marin; as far as I know, it's a *consensual* relationship. Lie with dogs, wake up with fleas. Is *that* an insult? If so, I apologize. Ah, it must have been that I said that the Cogent abuse dept. was "sorry"? Well, I'm not just going on my own experience (SEVEN WEEKS on this complaint, alone!) but on lots of stuff I read on Google. Oh, this e-mail is going to Google, too. Let the world judge. Please tell me what wrongs I have committed, so that I can stop "insulting" you again. In fact, maybe I'll stop "insulting" Cogent by sending my business elsewhere. Ok, your wish is my command: no more emails from me. Goodbye. NYZ -- _________________________________________ Nachman Yaakov Ziskind, EA, LLM awacs@egps.com Attorney and Counselor-at-Law http://ziskind.us Economic Group Pension Services http://egps.com Actuaries and Employee Benefit Consultants === Cogent does not remove their spammers, but expects to be unblocked === Received: from orca.dolphinwave.org (localhost.localdomain [127.0.0.1]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i06Ln5AY003734 for ; Tue, 6 Jan 2004 23:49:19 +0200 Received: (from dolphin@localhost) by orca.dolphinwave.org (8.12.8/8.12.8/Submit) id i06Ln4lU003727; Tue, 6 Jan 2004 23:49:04 +0200 To: usenet-Jan+nanae@2004.dolphinwave.org Message-Id: Posted-To: news.admin.net-abuse.blocklisting From: Dolphin Subject: Re: SPEWS S1562 Removal References: Organization: Private person Sender: Alexander Sheremet X-SPEWS: I am not X-ROT-13: fcnzgenc@dolphinwave.org X-newsgroup: news.admin.net-abuse.blocklisting X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 Date: Tue, 6 Jan 2004 23:49:03 +0200 #begin NeLei@hotmail.com.exe (or was it Lei Nage.com) message reply: > To whom it may concern, > > www.spews.org/html/S1562.html lists our IP (66.250.74.150) in the > 66.250.67.0 - 66.250.77.255, Cogent (Systemic Solutions / Poison > Dragon Communications) (moved to level 2) block. We are unable to > operate our services properly and according to our ISP all their > attempts to get removed from SPEWS didn't bring any results. Maybe, it would be because of your ISP not removing their spammers first, ones that got more and more of your ISP's space listed in blocklists? Let's see... $ host mail.poisondragon.com mail.poisondragon.com has address 66.250.72.2 $ host 66.250.72.2 2.72.250.66.in-addr.arpa domain name pointer ns2.poisondragon.com Surprise - they are still on the same Cogent IP, where they were all the time! Now, tell me, on what grounds your ISP thought to get the listing removed, if they did not remove the reason of it, the spammers, from their IPs? And why they sound so surprised when the listing was not removed by SPEWS, for them not removing their spammers? > We may > consider the possibility of changing our ISP should we be sure it > won't happen to our next ISP, and the next one, and the next. Then you probably should do some investigation on your next ISP, what is their reputation, before signing up with them. Cogent definitely has a reputation of a hardcore spamhaus, by hosting almost all of the worst spammers on their servers, refusing to terminate them, and helping to trash e-mail boxes of people all around the world (including your's). If you was doing a research on say 'Cogent spamhaus', you would have already known it: http://www.DolphinWave.org/spam/Cogent.txt > How can > we be sure that the "reputable" service provider won't end up in the > SPEWS at some point and we won't get engaged into a full-time business > of chasing a good guy instead of minding (and taking care of) our own > business? You, of course, put the "reputable" in quotes to make a tongue-in-cheek comment on the Cogent spamhaus, right? > Shouldn't there be another way of punishing those who may be > guilty without the tactics of carpet bombardments? Another way was already tried. You can see it in the SPEWS evidence file. It begun from listing only the spammers' IPs. But it did not get Cogent's attention. Hey, Cogent did not boot the spammers even now, with the "tactics of carpet bombardments". Obviously, Cogent does not consider the "destructions" to be significant, to finally kick the spammers off. So, it seems, even wider "carpet bombardments" should be used against Cogent. Do you have any better idea on how to make Cogent to kick their spammers? One that will not require "carpet bombardments", yet will be effective enough for Cogent to kick them? We are all ears! Just keep in mind that listing only the spammers was already tried with Cogent, and it was not effective, at all (you can see it in the SPEWS evidence file, the first lines). > Our understanding is that we are far from being the only "end user" > victim of this situation. And you can fully thank Cogent for creating their reputation, one that makes other admins to block major parts of the Cogent's IP space, or the whole Cogent, at all. You may stop being a victim of the Cogent's misbehaviour by moving to a reputable provider, or you can stay in the Cogent's space, pay them, and enjoy being a victim. It's all up on you. > It would be real nice for the SPEWS guys to > introduce some humanity into their fully automated system. As for us, > we would really apreciate removal of our IP from the listing. Why not to ask Cogent, when they are going to get their stuff together, and kick all their spammers, whom they happily host at present? Cogent's IPs can't be removed from the blocklists while Cogent did not remove their spammers. > Thank you in advance, > > Lei Nage You are welcome in advice. Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === Cogent ignores their persistent abusers === Path: uni-berlin.de!fu-berlin.de!postnews1.google.com!not-for-mail From: sandesnet@spamcop.net (Nick the Amateur LARTist) Newsgroups: news.admin.net-abuse.email Subject: Cogent Communications bitchlist wanted Date: 7 May 2004 09:20:19 -0700 Organization: http://groups.google.com Lines: 23 Message-ID: NNTP-Posting-Host: 67.163.181.80 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1083946819 16883 127.0.0.1 (7 May 2004 16:20:19 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Fri, 7 May 2004 16:20:19 +0000 (UTC) Xref: uni-berlin.de news.admin.net-abuse.email:2196032 I have tried to get Cogent to boot one of their spammers who is mailbombing one of my users. The spambags in question have the entire 38.112.197.0/24 assigned to them (listed by Spamhaus as SBL13738) and both their spam spigots and websites are hosted on that network. I have sent some 20 Spamcop reports and an email with a 180+ kB colection of crap to Cogent's abuse address. I have called Cogent's abuse desk on the phone three times yesterday and today and the only answer I got is "we have got complaints on that customer and we are working on it". They have also mentioned that they need at least 50 complaints on a customer to take action, and that I was the only one who had complained so far. The email to the afflicted user is forwarded through an other ISP that does relay and proxy blocking but no more than that and the spam sources in the 38.112.197.0/24 are not included in any relay/proxy lists. So there is not much for me to do other than getting Cogent to boot the spammer. With an abuse department that is shining on me is there any possibility to get at Cogent's management? Or should I file a harassment complaint against them? -- Nick the Amateur LARTist BOFH for hire in Connecticut === Cogent's priorities === Path: uni-berlin.de!fu-berlin.de!postnews1.google.com!not-for-mail From: abuse@cogentco.com (Abuse) Newsgroups: news.admin.net-abuse.email Subject: Cogent's SPEWS Tickets Date: 25 May 2004 05:37:19 -0700 Organization: http://groups.google.com Lines: 710 Message-ID: <2a6a3ec9.0405250437.7453adba@posting.google.com> NNTP-Posting-Host: 38.223.237.241 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1085488640 6036 127.0.0.1 (25 May 2004 12:37:20 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Tue, 25 May 2004 12:37:20 +0000 (UTC) Xref: uni-berlin.de news.admin.net-abuse.email:2201754 Hello Spews Please welcome Edgar Gonzalez, a Net Abuse Engineer who has been designated the sole task of working on the Spews tickets that have been created for Cogent. His first order of business is to address the numerous tickets that are invalid, (customers termed or no longer with Cogent) that have already been posted for removals with no response. Edgar's 2nd order of business is to work with Spews to reverse the increasingly collateralized IP space that Spew's has black-listed, including Cogent Corporate IP space. Edgar will work to address any concerns that are brought to his attention in a timely manner, and will monitor the various groups to ensure that the prompt and necessary notifications to Cogent Customers violating our AUP are meted out. As you can see below, there are numerous listings that are not valid, several ex-customers are still present, and then there are customers who have ceased to violate our AUP, (no complaints since Nov), last year. Regards Virgil Cogent Abuse Listings: 66.250.110.72/32 ! [1] global2000/Cashnews/Data Connect/blacksun, see http://spews.org/ask.cgi?S875 38.118.136.140/32 ! [1] global2000/Cashnews/Data Connect/blacksun, see http://spews.org/ask.cgi?S875 <...> <... ABOUT 650 LINES OF SPEWS DATA SNIPPED ...> <...> 38.117.4.0/22 ! [1] NetFree, see http://spews.org/ask.cgi?S3095 38.117.8.0/24 ! [1] NetFree, see http://spews.org/ask.cgi?S3095 === My reply === Path: uni-berlin.de!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: Re: Cogent's SPEWS Tickets Date: 25 May 2004 14:45:09 GMT Organization: Private person Lines: 84 Sender: Alexander Sheremet Message-ID: References: <2a6a3ec9.0405250437.7453adba@posting.google.com> X-Trace: news.uni-berlin.de bc97s5l+l9fpDvM0QpUhtQDh0nJXnhFoAm5eEw/2GfPmzTYqs3 X-SPEWS: I am not X-ROT-13: fcnzgenc@dolphinwave.org X-newsgroup: news.admin.net-abuse.email X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:2201801 #begin abuse@cogentco.com.exe (or was it Abuse.com) message <2a6a3ec9.0405250437.7453adba@posting.google.com> reply: > Hello Spews > > Please welcome Edgar Gonzalez, a Net Abuse Engineer who has been > designated the sole task of working on the Spews tickets that have > been created for Cogent. What about staffing your abuse desk instead, and actually DEALING with your spammers the only acceptable for the majority of the Internet way? > His first order of business is to address the numerous tickets that > are invalid, Yeah, let's deal with what hurts us the first, and leave the current, spamming abusers to deal with later on. Why didn't you get to deal with those *currently spamming* abusers of yours to be a priority one task? So, you can collect their money for one month more? > Edgar's 2nd order of business is to work with Spews to reverse the > increasingly collateralized IP space that Spew's has black-listed, > including Cogent Corporate IP space. You've missed it. Nobody works with SPEWS and SPEWS works with nobody. They just list and delist. You want to be delisted? Fine, kick all of your current spammers off, and *keep them off*, and you will be delisted from SPEWS. If you plan to do deals "here, we've terminated one spammer as a token, now you delist us before we proceed further", like BurstNET was trying to do, then don't expect any results to happen. Or you just want to tell your blocked customers who rightfully complain to you about it, that "see, now we have a special staff, who works with SPEWS to get it done Really Soon Now", so they will not leave right now? Edgar will work to address any concerns that are brought to his > attention in a timely manner, and will monitor the various groups to > ensure that the prompt and necessary notifications to Cogent Customers > violating our AUP are meted out. What about actually terminating spammers? Nobody here cares for warnings of your spammers ("notifications to Cogent Customers violating our AUP"). It's not 1995 outside, everybody well damn know already what spam is. Also, what about waiting for at least 50 complaints on a customer to take action, and ignoring the obvious mailbombing abusers? Happened as far as in this month: As you can see below, there are numerous listings that are not valid, > several ex-customers are still present, and then there are customers > who have ceased to violate our AUP, (no complaints since Nov), last > year. On September 2003 Cogent has knowingly hosted: IMG Direct / Steve Hardigree / Frank Bernal, Penn Media / Shagmail, Eddy Marin, Webfinity/Dynamic Pipe, Alan Ralsky. Yes, all those worst spammers of the Internet. Yes, the same time. What exactly is invalid in applying this on the mailservers? FEATURE(`dnsbl', `cogentco.blackholes.us', `"E-mail from " $&{client_addr} " \ refused - see "')dnl Enjoy your intranet! You've worked hard to earn it. Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === Spamhaus evidence file (24-May-2004, yellow lists are marked as *******) === === http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com === Found 26 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records SBL16563 38.112.194.56/32 cogentco.com 21-May-2004 16:26 GMT superduperspecials.com SBL16047 38.112.121.0/24 cogentco.com ******* 29-Apr-2004 07:19 GMT Daniel Lin PHD LLC - presumed to be Lin, Chung & Sadek SBL15800 69.67.105.0/24 cogentco.com 18-Apr-2004 18:49 GMT TREXMEDIA, LLC SBL15725 38.117.187.0/24 cogentco.com 15-Apr-2004 18:58 GMT emptywalletdeals.com / AdvanceDollars.com spammers SBL15564 66.250.5.194/32 cogentco.com ******* 09-Apr-2004 14:25 GMT Infolink / Prieur Leary III Pointer record for: Infolink (AS15083) SBL15361 38.118.146.133/32 cogentco.com 01-Apr-2004 04:54 GMT fsx.com, barelylegal.com SBL15231 38.112.120.128/27 cogentco.com ******* 26-Mar-2004 07:57 GMT Webfinity/Dynamic Pipe Spider Entertainment SBL14698 204.4.8.0/24 cogentco.com ******* 04-Mar-2004 09:56 GMT Infolink / Prieur Leary III Netblock on Cogent SBL14533 66.250.110.206/32 cogentco.com 27-Feb-2004 09:34 GMT dollarsblaster.com SBL14484 65.255.32.0/20 cogentco.com ******* 25-Feb-2004 12:24 GMT Daniel Khoshnood GLOBAL2000.COM aka EHOSTING.COM aka NETBOUNCERNETWORK.COM SBL14211 38.117.10.0/24 cogentco.com ******* 15-Feb-2004 01:23 GMT Eric Reinertsen mail.bestwebdeals.org ; outmail.realsweetoffers.com SBL14067 38.118.143.83/32 cogentco.com ******* 12-Feb-2004 01:14 GMT radisp.net / IQ Enterprises genuineenjoyment.com SBL13959 66.28.74.106/32 cogentco.com 07-Feb-2004 17:51 GMT elite-offers.com / elitedomain.net SBL13738 38.112.197.0/24 cogentco.com 29-Jan-2004 19:50 GMT Glowing Edge SBL13335 38.118.184.0/22 cogentco.com 13-Jan-2004 23:42 GMT Veritex Technologies opt-out spammers SBL12464 38.113.202.0/24 cogentco.com 01-Dec-2003 19:02 GMT Topica - toptp.com SBL12374 38.118.144.135/32 cogentco.com 27-Nov-2003 09:18 GMT spywarenuker.com SBL12237 38.112.5.128/30 cogentco.com 19-Nov-2003 20:56 GMT Cogent feed to: HIVELOCITY.NET (via ''Ceridius'') SBL12061 38.118.170.0/25 cogentco.com 13-Nov-2003 10:54 GMT 702ho.com, womanbozi.net, infreeware.com SBL11953 66.28.198.1/32 cogentco.com 09-Nov-2003 22:57 GMT ns1.protgp.com (av66.com/vcd-dvd.com) SBL11936 38.117.17.0/24 cogentco.com ******* 08-Nov-2003 06:33 GMT Eddy Marin - Oneroute ''SCR Concepts'', aka SAFEDOMAIM.COM, aka OneRoute SBL10651 38.113.203.0/24 cogentco.com 20-Sep-2003 00:26 GMT Topica, Inc. - advizeadmmbc.com SBL9896 207.153.108.0/24 cogentco.com 28-Jul-2003 22:48 GMT 4bulk.com / excuria.com / ixii.us, aka colo.ws, lab99.net SBL9190 66.28.76.0/22 cogentco.com ******* 29-May-2003 19:49 GMT IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net SBL8935 66.28.62.209/32 cogentco.com ******* 10-May-2003 15:20 GMT Penn Media / Shagmail ENTERTAININGNEWS.COM SBL8119 66.28.35.0/24 cogentco.com 02-Apr-2003 10:21 GMT emf0.com / emailfactory.com === Cogent's policy is to warn, and warn, and warn spammers === Newsgroups: news.admin.net-abuse.blocklisting Path: uni-berlin.de!fu-berlin.de!nntp.cs.ubc.ca!newsfeed.stanford.edu!zorac !blocklisting.com!robomod!not-for-mail From: abuse@cogentco.com (Abuse) Subject: Re: Spews Ticket S888/XTRINGS Removal request Approved: NANAB Moderators Content-Type: text/plain; charset=ISO-8859-1 X-Complaints-To: groups-abuse@google.com Sender: nanab@zorch.sf-bay.org (Charlie Root) Nntp-Posting-Date: Wed, 26 May 2004 06:16:10 +0000 (UTC) Content-Transfer-Encoding: 8bit NNTP-Posting-Host: 38.184.189.35 Organization: http://groups.google.com Message-ID: <2a6a3ec9.0405252216.1bfc2ae7@posting.google.com> References: <2a6a3ec9.0405250509.3a50fb96@posting.google.com> X-Trace: posting.google.com 1085552170 13239 127.0.0.1 (26 May 2004 06:16:10 GMT) Date: Wed, 26 May 2004 12:11:09 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 50 Xref: uni-berlin.de news.admin.net-abuse.blocklisting:6875 It's our policy to place customers that violate our AUP on a probationary period after the third notice. If they fail to follow the guidelines of the probationary period, we then terminate them. Spammers' time runs shorter with every report that we receive and eventually they will be dealt with in accordance to our AUP policy. Edgar Gonzalez Cogent Communications Abuse Team Verbila wrote in message news:... > In article <2a6a3ec9.0405250509.3a50fb96@posting.google.com>, > abuse@cogentco.com (Abuse) wrote: > > > Spews, > > > > Please remove the following listings, as Cogent has severed its > > business relationship with Empire Towers/XTRINGS > > 38.118.171.0/24 - Empire Towers > > 38.118.188.0/22 - Empire Towers > > > > Thanks, > > > > Edgar Gonzalez > > Cogent Communications > > Abuse Team > > abuse@cogentco.com > > Nice, but not good enough. You still have ROKSO spammers that have > been there FOR A YEAR on your system: > > http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com > > Why isn't senior management going through every single one of your SBL > listings and terminating those spammers IMMEDIATELY? > > Could it be... > > > oh, perhaps, greed for spammer money?! > > > -verbila -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === Reply to Cogent === Newsgroups: news.admin.net-abuse.blocklisting Path: uni-berlin.de!fu-berlin.de!logbridge.uoregon.edu!newsfeed.stanford.edu !zorac!blocklisting.com!robomod!not-for-mail From: dplatt@radagast.org (Dave Platt) Subject: Re: Spews Ticket S888/XTRINGS Removal request Approved: NANAB Moderators X-Complaints-To: abuse@supernews.com X-Newsreader: trn 4.0-test74 (May 26, 2000) Sender: nanab@zorch.sf-bay.org (Charlie Root) Organization: Home for Obscure Mythical Beings Message-ID: <10b9hk7hsgv9830@corp.supernews.com> References: <2a6a3ec9.0405250509.3a50fb96@posting.google.com> <2a6a3ec9.0405252216.1bfc2ae7@posting.google.com> Date: Wed, 26 May 2004 15:59:15 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 35 Xref: uni-berlin.de news.admin.net-abuse.blocklisting:6888 In article <2a6a3ec9.0405252216.1bfc2ae7@posting.google.com>, Abuse wrote: >It's our policy to place customers that violate our AUP on a >probationary period after the third notice. If they fail to follow >the guidelines of the probationary period, we then terminate them. You put them on probation after *three* *notices* of violation (and how many individual reports leading up to each of these notices)? >Spammers' time runs shorter with every report that we receive and >eventually they will be dealt with in accordance to our AUP policy. My personal opinion is that you are far too tolerant of spamming, and that continuing onwards with your current policy will very probably lead to a continuation of the results that you are finding so uncomfortable: massive listing of your IP address space by SPEWS, and a large number of sites (including my own small one) who block *all* non-whitelisted email from your entire IP space. I think you're going to have to do much better than that, if you expect to have email peering with most of the Internet. -- Dave Platt AE6EO Hosting the Jade Warrior home page: http://www.radagast.org/jade-warrior I do _not_ wish to receive unsolicited commercial email, and I will boycott any company which has the gall to send me such ads! -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === More on how Cogent issues warnings === Path: uni-berlin.de!fu-berlin.de!nf3.bellglobal.com!wn14feed!worldnet.att.net !205.188.226.97!ngpeer.news.aol.com!audrey-m2.news.aol.com!not-for-mail Lines: 20 X-Admin: news@aol.com From: tacitr@aol.com (Tacit) Newsgroups: news.admin.net-abuse.email Date: 26 May 2004 16:01:12 GMT References: Organization: AOL http://www.aol.com Subject: Re: Cogent's SPEWS Tickets Message-ID: <20040526120112.25458.00002126@mb-m29.aol.com> Xref: uni-berlin.de news.admin.net-abuse.email:2202213 >Per a post in NANAB, Cogent's policy, even today, is to give three warnings >after the spammer is put on "probation", assuming the spamming doesn't >cease. Actually, it's worse than that. I spoke a couple of weeks ago to a person at Cogent who told me that Cogent issues its first warning only after receiving a minimum of 20 different complaints from 20 different sources, and that the second and third warnings require a minimum of 10 different complaints from 10 different sources each before they are issued. After the third complaint, the spammer is "on watch,," meaning that Cogent *may* take action if they receive, at minimum, 10 more complaints. -- Biohazard? Radiation hazard? SO last-century. Nanohazard T-shirts now available! http://www.villaintees.com Art, literature, shareware, polyamory, kink, and more: http://www.xeromag.com/franklin.html === Reply, why such was is not acceptable === Path: uni-berlin.de!fu-berlin.de!peer01.cox.net!cox.net!cyclone1.gnilink.net !gnilink.net!wn14feed!worldnet.att.net!207.115.63.142!prodigy.com !newsmst01a.news.prodigy.com!prodigy.com!postmaster.news.prodigy.com !newssvr16.news.prodigy.com.POSTED!eaae8946!not-for-mail From: "Bill Carton - (The Roadie)" Newsgroups: news.admin.net-abuse.email Subject: Re: Cogent's SPEWS Tickets Reply-To: wcarton@flash.net Message-ID: References: <20040526120112.25458.00002126@mb-m29.aol.com> X-Newsreader: Forte Agent 1.8/32.548 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Lines: 32 NNTP-Posting-Host: 206.251.224.86 X-Complaints-To: abuse@prodigy.net X-Trace: newssvr16.news.prodigy.com 1085589288 ST000 206.251.224.86 (Wed, 26 May 2004 12:34:48 EDT) NNTP-Posting-Date: Wed, 26 May 2004 12:34:48 EDT Organization: SBC http://yahoo.sbc.com X-UserInfo1: TSU[@I_A\S@]SWLY\BNZOQTDSJ_D@LHLLBWLOOAFQATJUZ]CDVW[AKK[J\]^HVKHG^EWZHBLO^[\NH _AZFWGN^\DHNVMX_DHHX[FSQKBOTS@@BP^]C@RHS_AGDDC[AJM_T[GZNRNZAY]GNCPBDYKOLK^_CZFW PGHZIXW@C[AFKBBQS@E@DAZ]VDFUNTQQ]FN Date: Wed, 26 May 2004 16:34:48 GMT Xref: uni-berlin.de news.admin.net-abuse.email:2202220 tacitr@aol.com (Tacit) wrote: >>Per a post in NANAB, Cogent's policy, even today, is to give three warnings >>after the spammer is put on "probation", assuming the spamming doesn't >>cease. > >Actually, it's worse than that. > >I spoke a couple of weeks ago to a person at Cogent who told me that Cogent >issues its first warning only after receiving a minimum of 20 different >complaints from 20 different sources, and that the second and third warnings >require a minimum of 10 different complaints from 10 different sources each >before they are issued. After the third complaint, the spammer is "on watch,," >meaning that Cogent *may* take action if they receive, at minimum, 10 more >complaints. Bad news for them. Cogent, not the spammers. In these days of aggressive filtering, the old ratio of one properly-researched LART per 5-10,000 spams cannot possibly be holding true. Any provider waiting for 20 complaints will hardly get any work. ESPECIALLY on two-stage spam, where it takes an investigator to sting the form, visit the throwaway "landing page", or reply to the email dropbox to find out who is behind the spam. Such spammers will find a free ride on Cogent, since I'm sometimes the only complainant on two-stage spammers. Cogent's abuse department seems more intent on work avoidance and revenue continuation than actually reducing abuse. So what else is new? -- Bill "the Roadie" Carton === The official Cogent's policy === Newsgroups: news.admin.net-abuse.blocklisting Path: uni-berlin.de!fu-berlin.de!logbridge.uoregon.edu!newsfeed.stanford.edu !zorac!blocklisting.com!robomod!not-for-mail From: abuse@cogentco.com (Abuse) Subject: Re: Spews Ticket #431 Istra/Butterfly Holdings/Spider Entertainment Approved: NANAB Moderators Content-Type: text/plain; charset=ISO-8859-1 X-Complaints-To: groups-abuse@google.com Sender: nanab@zorch.sf-bay.org (Charlie Root) Nntp-Posting-Date: Mon, 7 Jun 2004 13:31:51 +0000 (UTC) Content-Transfer-Encoding: 8bit NNTP-Posting-Host: 38.184.189.35 Organization: http://groups.google.com Message-ID: <2a6a3ec9.0406070531.3ad131b6@posting.google.com> References: <2a6a3ec9.0406020309.283bff5c@posting.google.com> <5aorb0dtvqd3ub60tau578r7fvo1eu00c7@4ax.com> X-Trace: posting.google.com 1086615111 10323 127.0.0.1 (7 Jun 2004 13:31:51 GMT) Date: Mon, 7 Jun 2004 14:42:24 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 44 Xref: uni-berlin.de news.admin.net-abuse.blocklisting:7291 > If you read the FAQ, you should know that SPEWS communicates only through > their listings. The rest of us who communicate through the newsgroup try to > interpret their past actions and remind newcomers what's most likely to > work. Thank you, I will make it a point to read the FAQ in order to gain a better understanding of how all this works. > They won't answer, but there a LOT of other people here who are annoyed at > folks who treat Usenet as a write-only medium. That is why I am here. There will be no "hit and run" posting. > Are you allowed to respond to any of the previous questions about your > three-strikes policy, for instance? It has been the subject of a lot of > unanswered discussion, both here, in NANAE, and in SPAM-L. Yes. I believe that there was a misunderstanding in a previous post as to how our policy works. Basically, it is as follows: 5 Complaints = First Warning 10 Additional Complaints = Second Warning 15 Additional Complaints = Third Warning Once the customer receives their third warning, they are placed on probation for a period of 90 days. If there are any further incidents which would require another warning, then the customer is terminated. Hopefully this clears things up for you guys. Regards, Edgar G. Cogent Communications Abuse Team -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === What it means to other people, 1st reply === Newsgroups: news.admin.net-abuse.blocklisting Path: uni-berlin.de!fu-berlin.de!logbridge.uoregon.edu!newsfeed.stanford.edu !zorac!blocklisting.com!robomod!not-for-mail From: Michael Sheldon Subject: Re: Spews Ticket #431 Istra/Butterfly Holdings/Spider Entertainment Approved: NANAB Moderators Content-Type: text/plain; charset=us-ascii; format=flowed X-Accept-Language: en-us, en X-Complaints-To: abuse@cox.net User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502) Sender: nanab@zorch.sf-bay.org (Charlie Root) Nntp-Posting-Date: Mon, 07 Jun 2004 12:25:06 EDT NNTP-Posting-Host: 68.99.130.191 Content-Transfer-Encoding: 7bit X-Authentication-Warning: fed1read05.mgt.cox.net: news set sender to newsmaster@cox.net using -f Organization: Cox Communications Message-ID: References: <2a6a3ec9.0406020309.283bff5c@posting.google.com> <5aorb0dtvqd3ub60tau578r7fvo1eu00c7@4ax.com> <2a6a3ec9.0406070531.3ad131b6@posting.google.com> X-Trace: fed1read05 1086625506 68.99.130.191 (Mon, 07 Jun 2004 12:25:06 EDT) Mime-Version: 1.0 Date: Mon, 7 Jun 2004 17:36:10 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 31 Xref: uni-berlin.de news.admin.net-abuse.blocklisting:7304 Abuse wrote: > Yes. I believe that there was a misunderstanding in a previous post > as to how our policy works. Basically, it is as follows: > 5 Complaints = First Warning > 10 Additional Complaints = Second Warning > 15 Additional Complaints = Third Warning > > Once the customer receives their third warning, they are placed on > probation for a period of 90 days. If there are any further incidents > which would require another warning, then the customer is terminated. > > Hopefully this clears things up for you guys. Yup, thanks. Now I know to go ahead and place all of cogentco in my private block lists. I expect others will feel likewise. Please let us know if you ever change your abusive policy to an actual abuse policy. I might reconsider. (Hint, the acceptance of your AUP/TOS by the customer should be their first and only warning.) In the meantime, enjoy your intranet. Michael Sheldon http://www.desertravcen.net/ -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === 2nd reply === Newsgroups: news.admin.net-abuse.blocklisting Path: uni-berlin.de!fu-berlin.de!logbridge.uoregon.edu!newsfeed.stanford.edu !zorac!blocklisting.com!robomod!not-for-mail From: dplatt@radagast.org (Dave Platt) Subject: Re: Spews Ticket #431 Istra/Butterfly Holdings/Spider Entertainment Approved: NANAB Moderators X-Complaints-To: abuse@supernews.com X-Newsreader: trn 4.0-test74 (May 26, 2000) Sender: nanab@zorch.sf-bay.org (Charlie Root) Organization: Home for Obscure Mythical Beings Message-ID: <10c95butgnh8d50@corp.supernews.com> References: <2a6a3ec9.0406020309.283bff5c@posting.google.com> <5aorb0dtvqd3ub60tau578r7fvo1eu00c7@4ax.com> <2a6a3ec9.0406070531.3ad131b6@posting.google.com> Date: Mon, 7 Jun 2004 16:05:46 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 51 Xref: uni-berlin.de news.admin.net-abuse.blocklisting:7296 In article <2a6a3ec9.0406070531.3ad131b6@posting.google.com>, Abuse wrote: >Yes. I believe that there was a misunderstanding in a previous post >as to how our policy works. Basically, it is as follows: > >5 Complaints = First Warning > >10 Additional Complaints = Second Warning > >15 Additional Complaints = Third Warning > >Once the customer receives their third warning, they are placed on >probation for a period of 90 days. If there are any further incidents >which would require another warning, then the customer is terminated. > >Hopefully this clears things up for you guys. Yes, it does, thank you. I can tell you that with a policy like that, there's no chance at all that cogentco.com's IP addresses are going to be taken out of my system's "Block these, unless the sender has been whitelisted" configuration. I suspect that many other people will make (or have made) similar decisions. Your network is "packeta non grata" around here, and will remain so until you adopt a more responsive policy. It's widely accepted that the rate at which people actively complain about spamming is *very* low these days. Very few people are willing to bother to do the work of properly researching a complaint and sending it to the relevant ISP, especially if the spammer uses redirection and cloaking tricks. The 30 complaints you allow, prior to putting a customer on probation, could easily correspond to tens or hundreds of thousands (or even a million or more) of individual pieces of spam being sent from your network, or spammed from elsewhere and pointed back to a site that you host. -- Dave Platt AE6EO Hosting the Jade Warrior home page: http://www.radagast.org/jade-warrior I do _not_ wish to receive unsolicited commercial email, and I will boycott any company which has the gall to send me such ads! -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === And Cogent takes Scott Richter / OptInBig.Com "spam-king" on board === Path: uni-berlin.de!fu-berlin.de!peer01.cox.net!cox.net!p01!okepread03.POSTED !not-for-mail Message-ID: <40C8B4D2.30602@sneakemail.com> From: Spambo Organization: Diagnosis: Spam User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 X-Accept-Language: en-US,en MIME-Version: 1.0 Newsgroups: news.admin.net-abuse.email Subject: Re: fortisusa.net kicks Scott Richter? References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Lines: 26 Date: Thu, 10 Jun 2004 14:21:54 -0500 NNTP-Posting-Host: 68.97.204.235 X-Complaints-To: abuse@cox.net X-Trace: okepread03 1086895313 68.97.204.235 (Thu, 10 Jun 2004 15:21:53 EDT) NNTP-Posting-Date: Thu, 10 Jun 2004 15:21:53 EDT Xref: uni-berlin.de news.admin.net-abuse.email:2207623 Viper wrote: > I went ahead and included info -at- fortisusa.net in my reply to the "Help > Get Scott Richter - Write a letter to his Colorado connection provider" > thread just to see if they would reply. Well today I got this. If its true I > cant believe it lol... It looks like Snotty has already found hosting that is more bulletproof. 06/10/04 14:13:19 -0500 dns OptInBig.Com Mail for OptInBig.Com is handled by mail.OptInBig.Com Canonical name: OptInBig.Com Addresses: 38.116.137.84 06/10/04 14:13:28 -0500 IP block 38.116.137.84 Trying 38.116.137.84 at ARIN Trying 38.116.137 at ARIN Performance Systems International Inc. PSINETA (NET-38-0-0-0-1) 38.0.0.0 - 38.255.255.255 Performance Systems International Inc. COGENT-NB-0002 (NET-38-112-0-0-1) 38.112.0.0 - 38.119.255.255 PING Edgar - Is this really how Cogent wants to convince the world they've changed their hat color? > [snip] === Cogent still provides services to known spammers, for over a year now === #begin mikea@mikea.ath.cx.exe (or was it Mike Andrews.com) message reply: > Abuse wrote: >> > I know someone will mention your 38 Spamhaus listings (with two >> > new ROKSO spammers signed up in July and August). How goes the >> > fight there? I do notice you are now off the Spamhaus worst >> > 10 ISPs list. > >> We're working on those. Won't be easy but I knew that before I took this job =) > > Edgar, > > What's hard about saying (or writing) "You are in violation of our > contract with you and/or of the AUP which is included-by-reference in > that contract, and your service is terminated in accordance with that > AUP and the terms and conditions of our contract with you, effective > $DATE at $TIME $TIMEZONE"? The only thing I can think of that could make it hard would be the contract that explicitly *permits* the spammers to stay connected. Pulling the plug or erasing an account is not that hard to do, it takes minutes, not years: SBL9190 66.28.76.0/22 cogentco.com 29-May-2003 19:49 GMT IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net SBL8935 66.28.62.209/32 cogentco.com 10-May-2003 15:20 GMT Penn Media / Shagmail ENTERTAININGNEWS.COM http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com 9-Aug-2003: 16 SBL listings 12-Sep-2003: 21 SBL listings 28-Oct-2003: 29 SBL listings 24-May-2004: 26 SBL listings 16-Aug-2004: 38 SBL listings Call it "a progress", cause I wouldn't. http://www.DolphinWave.org/spam/Cogent.txt Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === Cogent's Spamhaus status rose to 38 listings (16-Aug-2004) including the === === new ROKSO spammers (marked with *****) signed just in July and August === === http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com === Found 38 SBL listings for IPs under the responsibility of cogentco.com Listings in yellow are known spam gangs with ROKSO records SBL18620 38.144.33.64/27 cogentco.com 09-Aug-2004 04:48 GMT t3media.net SBL18558 66.28.206.7/32 cogentco.com 07-Aug-2004 07:26 GMT santosdiablos.com SBL18456 207.31.123.22/32 cogentco.com 03-Aug-2004 07:57 GMT barracuda.braslink.com SBL18438 38.114.4.32/31 cogentco.com ***** 01-Aug-2004 23:15 GMT Lloyd Lapidus - revolution media fullspeedaheadmedia.com / dns1.cyberxhost.net SBL18201 38.119.215.128/25 cogentco.com 25-Jul-2004 12:40 GMT Laptop Technologies / allthepromotionyouneed.com SBL18079 38.114.148.0/23 cogentco.com 20-Jul-2004 07:25 GMT peakedigital.com SBL17770 38.112.4.212/30 cogentco.com ***** 04-Jul-2004 20:18 GMT Andrew Westmoreland "Internet Access Group" AKA "brilliant marketing" SBL17752 38.116.148.0/22 cogentco.com ***** 04-Jul-2004 07:42 GMT Andrew Westmoreland Internet Access Group, Inc SBL17728 38.119.246.32/27 cogentco.com 02-Jul-2004 23:23 GMT pcdi.com SBL17595 66.28.206.0/24 cogentco.com 28-Jun-2004 20:05 GMT debteraser.org SBL17569 38.117.226.0/23 cogentco.com 27-Jun-2004 16:37 GMT Localnode Communications, Inc. / qyxh.com et al. SBL17395 154.54.10.246/32 cogentco.com 21-Jun-2004 20:15 GMT feed to CHINANET-CQ SBL17362 66.28.60.192/26 cogentco.com 20-Jun-2004 07:12 GMT Media Unlimited/BAY9 AKA Xuppa SBL17318 38.113.198.252/32 cogentco.com 18-Jun-2004 02:34 GMT violentrussians.com / holeporn.com SBL17097 38.119.223.0/24 cogentco.com 11-Jun-2004 00:09 GMT ICM000.COM SBL16581 69.46.2.29/32 cogentco.com ***** 22-May-2004 07:12 GMT Penn Media / Shagmail THERETAILCENTER.COM SBL16563 38.112.194.56/32 cogentco.com ***** 21-May-2004 16:26 GMT Brian Farrow / Yeshost / Hivelocity Ventures superduperspecials.com SBL16047 38.112.121.0/24 cogentco.com ***** 29-Apr-2004 07:19 GMT Daniel Lin PHD LLC - presumed to be Lin, Chung & Sadek SBL15800 69.67.105.0/24 cogentco.com 18-Apr-2004 18:49 GMT TREXMEDIA, LLC SBL15725 38.117.187.0/24 cogentco.com 15-Apr-2004 18:58 GMT emptywalletdeals.com / AdvanceDollars.com spammers SBL15564 66.250.5.194/32 cogentco.com ***** 09-Apr-2004 14:25 GMT Infolink / Prieur Leary III Pointer record for: Infolink (AS15083) SBL15361 38.118.146.133/32 cogentco.com 01-Apr-2004 04:54 GMT fsx.com, barelylegal.com SBL14698 204.4.8.0/24 cogentco.com ***** 04-Mar-2004 09:56 GMT Infolink / Prieur Leary III Netblock on Cogent SBL14484 65.255.32.0/20 cogentco.com ***** 25-Feb-2004 12:24 GMT Daniel Khoshnood GLOBAL2000.COM aka EHOSTING.COM aka NETBOUNCERNETWORK.COM SBL14211 38.117.10.0/24 cogentco.com ***** 15-Feb-2004 01:23 GMT Eric Reinertsen mail.bestwebdeals.org ; outmail.realsweetoffers.com SBL14067 38.118.143.83/32 cogentco.com ***** 12-Feb-2004 01:14 GMT Shay Tyler / MLeads.com genuineenjoyment.com SBL13738 38.112.197.0/24 cogentco.com 29-Jan-2004 19:50 GMT Glowing Edge SBL13335 38.118.184.0/22 cogentco.com 13-Jan-2004 23:42 GMT Veritex Technologies opt-out spammers SBL12464 38.113.202.0/24 cogentco.com 01-Dec-2003 19:02 GMT Topica - toptp.com SBL12374 38.118.144.135/32 cogentco.com 27-Nov-2003 09:18 GMT spywarenuker.com SBL12237 38.112.5.128/30 cogentco.com 19-Nov-2003 20:56 GMT Cogent feed to: HIVELOCITY.NET (via ''Ceridius'') SBL12061 38.118.170.0/25 cogentco.com 13-Nov-2003 10:54 GMT 702ho.com, womanbozi.net, infreeware.com SBL11936 38.117.17.0/24 cogentco.com ***** 08-Nov-2003 06:33 GMT Eddy Marin - Oneroute ''SCR Concepts'', aka SAFEDOMAIM.COM, aka OneRoute SBL10651 38.113.203.0/24 cogentco.com 20-Sep-2003 00:26 GMT Topica, Inc. - advizeadmmbc.com SBL9896 207.153.108.0/24 cogentco.com 28-Jul-2003 22:48 GMT 4bulk.com / excuria.com / ixii.us, aka colo.ws, lab99.net SBL9190 66.28.76.0/22 cogentco.com ***** 29-May-2003 19:49 GMT IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net SBL8935 66.28.62.209/32 cogentco.com ***** 10-May-2003 15:20 GMT Penn Media / Shagmail ENTERTAININGNEWS.COM SBL8119 66.28.35.0/24 cogentco.com 02-Apr-2003 10:21 GMT emf0.com / emailfactory.com === Cogent's Spamhaus status rose again, 40 listings now (5-Oct-2004), more === === of new ROKSO spammers (marked with *****) signed in September, October === === http://www.spamhaus.org/sbl/listings.lasso?isp=cogentco.com === Found 40 SBL listings for IPs under the responsibility of COGENTCO.COM Listings in yellow are known spam gangs with ROKSO records SBL19881 38.113.36.0/22 cogentco.com ***** 01-Oct-2004 19:04 GMT Traffix ns1.implexic.com (FullControl Network, Inc.) SBL19865 209.115.108.30/32 cogentco.com 01-Oct-2004 04:28 GMT iomegaone.com etc SBL19544 38.116.148.10/32 cogentco.com ***** 17-Sep-2004 05:28 GMT Max Sutter / Petadoptions.com rmleads.com SBL19412 66.28.200.252/32 cogentco.com 13-Sep-2004 05:44 GMT a4ii.com etc SBL19390 38.117.34.0/23 cogentco.com 12-Sep-2004 17:59 GMT Niutech / theuseful.com et al. SBL19159 216.29.253.23/32 cogentco.com 03-Sep-2004 11:50 GMT discount-pcbooks.com opt-out spammers SBL19016 38.117.12.0/22 cogentco.com ***** 27-Aug-2004 15:49 GMT Briceco, Inc. / Dubeau / Brice T 3 Fax SBL19009 66.250.5.220/30 cogentco.com ***** 27-Aug-2004 12:16 GMT Albert Ahdoot and Alyx Sachs - Net Global Marketing Data Connect SBL19007 38.119.236.16/29 cogentco.com 27-Aug-2004 11:00 GMT Proxy abuse - Horizontes Group SBL18869 38.117.24.0/23 cogentco.com ***** 21-Aug-2004 17:09 GMT George Kokinos / Miles Marketing Petech / ipflip.com SBL18620 38.144.33.64/27 cogentco.com 09-Aug-2004 04:48 GMT t3media.net SBL18456 207.31.123.22/32 cogentco.com 03-Aug-2004 07:57 GMT barracuda.braslink.com SBL18438 38.114.4.32/31 cogentco.com ***** 01-Aug-2004 23:15 GMT Lloyd Lapidus - revolution media fullspeedaheadmedia.com / dns1.cyberxhost.net SBL18079 38.114.148.0/23 cogentco.com 20-Jul-2004 07:25 GMT peakedigital.com SBL17770 38.112.4.212/30 cogentco.com ***** 04-Jul-2004 20:18 GMT Andrew Westmoreland "Internet Access Group" AKA "brilliant marketing" SBL17752 38.116.148.0/22 cogentco.com ***** 04-Jul-2004 07:42 GMT Andrew Westmoreland Internet Access Group, Inc SBL17728 38.119.246.32/27 cogentco.com 02-Jul-2004 23:23 GMT pcdi.com SBL17569 38.117.226.0/23 cogentco.com 27-Jun-2004 16:37 GMT Localnode Communications, Inc. / qyxh.com et al. SBL17395 154.54.10.246/32 cogentco.com 21-Jun-2004 20:15 GMT feed to CHINANET-CQ SBL17362 66.28.60.192/26 cogentco.com 20-Jun-2004 07:12 GMT Media Unlimited/BAY9 AKA Xuppa SBL17318 38.113.198.0/23 cogentco.com 18-Jun-2004 02:34 GMT violentrussians.com / holeporn.com / fucking-young.com SBL17097 38.119.223.0/24 cogentco.com 11-Jun-2004 00:09 GMT ICM000.COM SBL16581 69.46.2.29/32 cogentco.com ***** 22-May-2004 07:12 GMT Penn Media / Shagmail THERETAILCENTER.COM SBL15725 38.117.187.0/24 cogentco.com 15-Apr-2004 18:58 GMT emptywalletdeals.com / AdvanceDollars.com spammers SBL15564 66.250.5.194/32 cogentco.com ***** 09-Apr-2004 14:25 GMT Infolink / Prieur Leary III Pointer record for: Infolink (AS15083) SBL15361 38.118.146.133/32 cogentco.com 01-Apr-2004 04:54 GMT fsx.com, barelylegal.com SBL14698 204.4.8.0/24 cogentco.com ***** 04-Mar-2004 09:56 GMT Infolink / Prieur Leary III Netblock on Cogent SBL14484 65.255.32.0/20 cogentco.com ***** 25-Feb-2004 12:24 GMT Daniel Khoshnood GLOBAL2000.COM aka EHOSTING.COM aka NETBOUNCERNETWORK.COM SBL14211 38.117.10.0/24 cogentco.com ***** 15-Feb-2004 01:23 GMT Eric Reinertsen mail.bestwebdeals.org ; outmail.realsweetoffers.com SBL13738 38.112.197.0/24 cogentco.com 29-Jan-2004 19:50 GMT Glowing Edge SBL13335 38.118.184.0/22 cogentco.com 13-Jan-2004 23:42 GMT Veritex Technologies opt-out spammers SBL12464 38.113.202.0/24 cogentco.com 01-Dec-2003 19:02 GMT Topica - toptp.com SBL12237 38.112.5.128/30 cogentco.com 19-Nov-2003 20:56 GMT Cogent feed to: HIVELOCITY.NET (via ''Ceridius'') SBL12061 38.118.170.0/25 cogentco.com 13-Nov-2003 10:54 GMT 702ho.com, womanbozi.net, infreeware.com SBL11936 38.117.17.0/24 cogentco.com ***** 08-Nov-2003 06:33 GMT Eddy Marin - Oneroute ''SCR Concepts'', aka SAFEDOMAIM.COM, aka OneRoute SBL10651 38.113.203.0/24 cogentco.com 20-Sep-2003 00:26 GMT Topica, Inc. - advizeadmmbc.com SBL9896 207.153.108.0/24 cogentco.com 28-Jul-2003 22:48 GMT 4bulk.com / excuria.com / ixii.us, aka colo.ws, lab99.net SBL9190 66.28.76.0/22 cogentco.com ***** 29-May-2003 19:49 GMT IMG Direct / Steve Hardigree / Frank Bernal Fastduck.net SBL8935 66.28.62.209/32 cogentco.com ***** 10-May-2003 15:20 GMT Penn Media / Shagmail ENTERTAININGNEWS.COM SBL8119 66.28.35.0/24 cogentco.com 02-Apr-2003 10:21 GMT emf0.com / emailfactory.com === Cogent lies to their customers about not hosting spammers anymore === Newsgroups: news.admin.net-abuse.blocklisting From: "Bferrara" Subject: Re: S373 [WAS: Please remove my class c IP 38.117.150.0] Approved: NANAB Moderators Injection-Info: z14g2000cwz.googlegroups.com; posting-host=38.117.150.70; posting-account=7LXJ3g0AAAAkog2Ub_5fdOR9lm4dAGbO Content-Type: text/plain; charset="iso-8859-1" X-Complaints-To: groups-abuse@google.com User-Agent: G2/0.2 Complaints-To: groups-abuse@google.com Sender: nanab@zorch.sf-bay.org (Charlie Root) Nntp-Posting-Date: Wed, 4 May 2005 18:14:43 +0000 (UTC) NNTP-Posting-Host: 38.117.150.70 Organization: http://groups.google.com Message-ID: <1115230478.684797.269340@z14g2000cwz.googlegroups.com> References: <1115218770.085624.40730@z14g2000cwz.googlegroups.com> X-Trace: posting.google.com 1115230483 6879 127.0.0.1 (4 May 2005 18:14:43 GMT) Mime-Version: 1.0 Date: Wed, 4 May 2005 17:45:25 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 22 Path: x-privat.org!area.cu.mi.it!news.mailgate.org!cyclone.bc.net !newsfeed.stanford.edu!zorac!blocklisting.com!robomod!not-for-mail Xref: x-privat.org news.admin.net-abuse.blocklisting:14993 1st problem is I'm in new York and my building is wired for cogent I really don't have a choice and as far providers for a t3 other than (verizon which big $$$$$$$)....2nd when I called cogent (before I posted here) and ask about omni point marketing they told me that this company is no longer a client (far as I understand). Their solution is to give me a new class c that is way too much work for a being black listed for no reason. This just not fair too me or businesses that been following the rules and still get hurt by spews... How can I contact spews since they do everything in shadows...I feel there not willing to talk to people because they know there are wrong on how they do business. There are affecting my business directly and about 100 other people jobs and they are not making a different with big internet providers just make hard on small companies like us ,and do you think cogent even gives a shit if a small company like mine leaves them ...hell no -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === And the lie brought to the light === Newsgroups: news.admin.net-abuse.blocklisting From: Socks the Whitehouse Cat Subject: Re: S373 [WAS: Please remove my class c IP 38.117.150.0] Approved: NANAB Moderators X-Complaints-To: abuse@supernews.com User-Agent: Xnews/5.04.25 Sender: nanab@zorch.sf-bay.org (Charlie Root) Organization: is overrated Message-ID: References: <1115218770.085624.40730@z14g2000cwz.googlegroups.com> <1115230478.684797.269340@z14g2000cwz.googlegroups.com> Date: Wed, 4 May 2005 20:19:49 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 55 Path: x-privat.org!area.cu.mi.it!nntp.eutelia.it!itgate.net!news.rh-tec.net !news.bawue.net!newsfeed.stueberl.de!logbridge.uoregon.edu !newsfeed.stanford.edu!zorac!blocklisting.com!robomod!not-for-mail Xref: x-privat.org news.admin.net-abuse.blocklisting:15008 "Bferrara" wrote in news:1115230478.684797.269340@z14g2000cwz.googlegroups.com: > I feel there not willing to > talk to people because they know there are wrong on how they do > business. they dont talk to people because they aren't interested in being lied to by people. Cogentco did not terminate the spammer, they lied to you when they said that they did, and you accepted their lie without verifying it. First we look at Eddie's cogent related spamhaus record: SBL11936 38.117.17.0/24 cogentco.com 08-Nov-2003 06:33 GMT Eddy Marin - Oneroute ''SCR Concepts'', aka SAFEDOMAIM.COM, aka OneRoute then I run a whois on SAFEDOMAIM.COM: (snipped most of record) Record last updated 11-06-2003 02:56:40 PM Record expires on 11-04-2005 Record created on 11-04-2003 Domain servers in listed order: NS1.SAFEDOMAIM.COM 69.6.61.11 NS2.SAFEDOMAIM.COM 38.117.17.10 Note the address on the second DNS server. Let's do a dig on that one to see if it is still there: Yep. Nice little A record pointing right to 38.117.17.10 Case closed. -- "...Life is not a journey to the grave with the intention of arriving safely in one pretty and well preserved piece, but to slide across the finish line broadside, thoroughly used up, worn out, leaking oil, and shouting GERONIMO!!!" -- Bill McKenna, date unknown -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === Another proof === Newsgroups: news.admin.net-abuse.blocklisting From: David LU Subject: Re: S373 [WAS: Please remove my class c IP 38.117.150.0] Approved: NANAB Moderators Content-Type: text/plain; charset=us-ascii; format=flowed X-Accept-Language: en-us, en X-Complaints-To: abuse@earthlink.net User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) Sender: nanab@zorch.sf-bay.org (Charlie Root) Nntp-Posting-Date: Wed, 04 May 2005 13:00:10 PDT Nntp-Posting-Host: 4.246.123.196 Content-Transfer-Encoding: 7bit Organization: The Spammish Inquisition. Message-ID: <427929C8.5000302@justthe.net> References: <1115218770.085624.40730@z14g2000cwz.googlegroups.com> <1115230478.684797.269340@z14g2000cwz.googlegroups.com> X-Trace: newsread3.news.pas.earthlink.net 1115236810 4.246.123.196 (Wed, 04 May 2005 13:00:10 PDT) Mime-Version: 1.0 Date: Wed, 4 May 2005 19:29:19 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 96 Path: x-privat.org!area.cu.mi.it!nntp.eutelia.it!nntp.infostrada.it!xmission !logbridge.uoregon.edu!newsfeed.stanford.edu!zorac!blocklisting.com!robomod !not-for-mail Xref: x-privat.org news.admin.net-abuse.blocklisting:15005 Bferrara wrote: > 1st problem is I'm in new York and my building is wired for cogent I > really don't have a choice and as far providers for a t3 other than > (verizon which big $$$$$$$)....2nd when I called cogent (before I > posted here) and ask about omni point marketing they told me that this > company is no longer a client (far as I understand). Their solution is > to give me a new class c that is way too much work for a being black > listed for no reason. This just not fair too me or businesses that been > following the rules and still get hurt by spews... How can I contact > spews since they do everything in shadows...I feel there not willing to > talk to people because they know there are wrong on how they do > business. There are affecting my business directly and about 100 other > people jobs and they are not making a different with big internet > providers just make hard on small companies like us ,and do you think > cogent even gives a shit if a small company like mine leaves them > ...hell no > You can not contact SPEWS. Read the message on the web. The only people who can help you is cogentco. If they do not care, get a land shark. Charge them for the difference and get a real ISP. traceroute to OMNIPOINTMARKETING.COM (38.117.17.11), 30 hops max, 40 byte packets 10 p6-0.core01.iah01.atlas.cogentco.com (66.28.4.5) 85.932 ms 11 p15-0.core01.tpa01.atlas.cogentco.com (66.28.4.46) 104.486 ms 12 p5-0.core01.mia01.atlas.cogentco.com (66.28.4.57) 110.345 ms 13 g0-2.na01.b015452-0.mia01.atlas.cogentco.com (66.250.14.178) 110.344 ms 14 SCRConcepts.demarc.cogentco.com (38.112.1.130) 113.274 ms 15 * * * 16 * * * 17 nemesis.pro-dot.com (38.117.17.11) 117.180 ms Registrant: Pro-Dot Networks 5079 N. Dixie Highway Suite 341 Fort Lauderdale, FL 33334 US 954-202-6162 Domain Name: PRO-DOT.COM Administrative Contact: Controller, Network abuse@pro-dot.com 5079 N. Dixie Highway Suite 341 Fort Lauderdale, FL 33334 US 954-202-6162 Technical Contact: Controller, Network abuse@pro-dot.com 5079 N. Dixie Highway Suite 341 Fort Lauderdale, FL 33334 US 954-202-6162 Record last updated 05-26-2004 11:52:23 AM Record expires on 05-23-2005 Record created on 05-23-2004 Domain servers in listed order: NS0.PRO-DOT.COM 208.250.0.10 NS1.PRO-DOT.COM 69.6.61.11 http://groups-beta.google.com/groups?q=5079+N.+Dixie+Highway Results 1 - 10 of 67 for 5079 N . Dixie Highway -- Sorted by relevance Sort by date WholesaleBandwidth, Inc. (Richter) / ProDot Networks (Marin) ... com 5079 N. Dixie Highway Suite 341 Fort Lauderdale, FL 33334 US 954-202-6162 Technical Contact: Controller, Network a...@pro-dot.com 5079 N. Dixie Highway ... news.admin.net-abuse.email - Aug 23 2004, 9:56 pm by a_netcop - 2 messages - 2 authors ****************************************** * This is the Spammish Inquisition * * Not Lumber Cartel Unit 75 [TINLC] * * http://bobcathoh.50megs.com/tinLC/ * * david l kayp at earthlink dot net * ****************************************** -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === Let's see if those pages are really accessible on Cogent? === === Yes, they still are - on 5-May-2005, 03:16:27 (GMT+0300) === $ wget -O - omnipointmarketing.com --03:16:27-- http://omnipointmarketing.com/ Resolving omnipointmarketing.com... 38.117.17.11 Connecting to omnipointmarketing.com[38.117.17.11]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 10,707 [text/html] Email Marketing: Opt in email, opt in email marketing, opt in marketing,opt in list, opt in, opt email, direct marketing list, lead generation and direct mail marketing by Omni Point Marketing