Update: ======= I was talking to VDI owner about spam on several occasions. They do seem to be concerned about the spam problem, and trying to remove their abusing customers as soon as they can. Removed from the list. Older: ====== Virtual Development INC (VDI) - harboring spammers, moving them around to evade blocklisting, and sending cartooneys about being blocked, instead of kicking their spammers off their networks. vdi.net, [66.78.0.0 - 66.78.63.255], [209.3.31.0 - 209.3.33.255], [216.10.0.0 - 216.10.31.255], [216.74.64.0 - 216.74.127.255]: Access denied! === Cartooney from VDI === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!newsfeed.stanford.edu!postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: VDI blocks Date: 22 Oct 2002 13:41:24 -0700 Organization: http://groups.google.com/ Lines: 33 Message-ID: NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035319284 10632 127.0.0.1 (22 Oct 2002 20:41:24 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 22 Oct 2002 20:41:24 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1841022 Many clients complaining, effecting businesses. #1 - Emails are over a year in some cases, need to get this mail block filter in a better system. #2 blocking /23 /24 is Inane, many server are assigned /27 and effecting the wrong systems. #3 I have lost several account do to Spews $ crew mistakes over and over again. If VDI Ranges are not removed by end of day, there will be a very large problem a rightfull legal action will take place. This is considered Distributed Denial of service. Which is illegal. Spam getting stopped is one thing, targeting to the spam is another. System needs to be improved asap. Blocking blindly is a very poor system. Hours of tech supports to fix these issues moving accounts off blocks that are in block. Since april !!! |-------------------- 1, 66.78.61.211, 18orless.com 1, 66.78.61.128/25, 18orless.com / NETHOST.RU (interserver.net/VDI.net) 1, 216.10.26.175, 18orless.com / NETHOST.RU 1, 216.10.26.83, "/~kozmetik/vcard/ordercell.html" 1, 216.10.26.128/25, 18orless.com (interserver.net/VDI.net) 1, 216.10.26.0/24, 18orless.com (interserver.net/VDI.net) === Replies - 1 === Path: uni-berlin.de!fu-berlin.de!nntp.cs.ubc.ca!logbridge.uoregon.edu!HSNX.atgi.net!cyclone-sf.pbi.net!168.103.84.164!ns.osirusoft.com!not-for-mail From: joliver@john-oliver.net (John Oliver) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 22 Oct 2002 21:39:26 GMT Organization: OsiruSoft Research & Engineering Lines: 70 Message-ID: References: NNTP-Posting-Host: 64.119.217.40 X-Trace: ns.osirusoft.com 1035322766 32639 64.119.217.40 (22 Oct 2002 21:39:26 GMT) X-Complaints-To: news@news.osirusoft.com NNTP-Posting-Date: 22 Oct 2002 21:39:26 GMT User-Agent: slrn/0.9.7.1 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:1841046 On 22 Oct 2002 13:41:24 -0700, wjensen wrote: > Many clients complaining, effecting businesses. Good! Then it's working... > #1 - Emails are over a year in some cases, need to get this mail block > filter in a better system. All you need to do is post proof that the spammer or spam-support is gone, and SPEWS will take note. > #2 blocking /23 /24 is Inane, many server are assigned /27 and > effecting the wrong systems. No... it's forcing you to deal with your spammers. If you allocate a /27 to a spammer, and blocking that range doesn't get you to boot them, then the logical next step is to increase the size of the blocklist until you scream Uncle! > #3 I have lost several account do to Spews $ crew mistakes over and > over again. They aren't mistakes. You'll keep on losing customers until you write and enforce a strongly anti-spam AUP. > If VDI Ranges are not removed by end of day, there will be a very > large problem a rightfull legal action will take place. This is > considered Distributed Denial of service. Which is illegal. And just who will be on the receiving end of your "rightfull legal action"??? > Spam getting stopped is one thing, targeting to the spam is another. Ahh. You believe in blocking the spammer, but letting them continue spamming. This is why your traffic is unwelcome on my network. > System needs to be improved asap. Blocking blindly is a very poor > system. The system works quite well, thank you. The blocking isn't "blind". Go read the FAQ http://www.spews.org/faq.html > Hours of tech supports to fix these issues moving accounts off blocks > that are in block. Ahhh! So you move your spammers around! I'm sure you can expect the SPEWS-listed ranges to increase even more now. > 1, 66.78.61.211, 18orless.com > 1, 66.78.61.128/25, 18orless.com / NETHOST.RU > (interserver.net/VDI.net) > 1, 216.10.26.175, 18orless.com / NETHOST.RU > 1, 216.10.26.83, "/~kozmetik/vcard/ordercell.html" > 1, 216.10.26.128/25, 18orless.com (interserver.net/VDI.net) > 1, 216.10.26.0/24, 18orless.com (interserver.net/VDI.net) What else do you expect? I would imagine you'll shortly be seeing 1, 216.10.24.0/22, 18orless.com (interserver.net/VDI.net) quite soon. IIWY, I would boot 18orless.com off of my network *now*. -- John Oliver, CCNA http://www.john-oliver.net/ Linux/UNIX/network consulting http://www.john-oliver.net/resume/ *** sendmail, Apache, ftp, DNS, spam filtering *** **** Colocation, T1s, web/email/ftp hosting **** === Replies - 2 === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!feed2.news.rcn.net!feed1.news.rcn.net!rcn!not-for-mail From: Jules Dubois Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: Tue, 22 Oct 2002 18:55:47 -0400 Lines: 67 Message-ID: References: X-Trace: UmFuZG9tSVYQVMyWoXr+iYD9WX0lYOm8XPa0mzTINH1jioiH3qfe/30H8RkBRYwz X-Complaints-To: abuse@rcn.com NNTP-Posting-Date: 22 Oct 2002 22:55:52 GMT X-Newsreader: MicroPlanet Gravity v2.60 Xref: uni-berlin.de news.admin.net-abuse.email:1841085 In article , wjensen@vdi.net says... > Many clients complaining, effecting businesses. Thanks, SPEWS! > #1 - Emails are over a year in some cases, need to get this mail block > filter in a better system. 18orless.com is still at the same VDI IP address. > #2 blocking /23 /24 is Inane, many server are assigned /27 and > effecting the wrong systems. You didn't terminate your 18orless.com spammer, regardless of the number of IP addresses it uses. By expanding the listing, SPEWS is informing you that, in its sole opinion, it does not approve of your inaction. > #3 I have lost several account do to Spews $ crew mistakes over and > over again. There's no mistake here. You kept 18orless.com as a customer and now you "have lost several account[s]". You made your decision, now live with it. > If VDI Ranges are not removed by end of day, there will be a very > large problem a rightfull legal action will take place. I'm sure you'll discover that threats of "rightfull" [sic] legal action will get you into more blocklists than it will get you out of. > This is > considered Distributed Denial of service. No, it isn't "considered Distributed Denial of service" but only because it isn't. > Which is illegal. Please cite the legal codes which you believe have been violated. > Spam getting stopped is one thing, targeting to the spam is another. > System needs to be improved asap. System is working properly; it got your attention, didn't it? > Blocking blindly is a very poor > system. Agreed. Unfortunately for you, however, the blindness is yours. > Hours of tech supports to fix these issues moving accounts off blocks > that are in block. You kept 18orless.com as a customer but you spent "[h]ours of tech supports to fix these issues". You made your decision, now live with it. > Since april !!! In other words, you've had six months to fix your problem without having done so. Perhaps now would be a good time for you to begin. -- We therefore categorically reject the argument that a vendor has a right, under the Constitution or otherwise, to send unwanted material into the home of another. --- U.S. Supreme Court, 397 U.S. 728. BURGER, J., Chief Justice. Opinion of the Court. === Replies - 3 === Path: uni-berlin.de!fu-berlin.de!cox.net!nntp2.aus1.giganews.com!nntp.giganews.com!nntp3.aus1.giganews.com!nntp.speakeasy.net!news.speakeasy.net.POSTED!not-for-mail NNTP-Posting-Date: Tue, 22 Oct 2002 17:31:16 -0500 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: knews 1.0b.0 (mrsam/980423) References: From: Sam Subject: Re: VDI blocks Newsgroups: news.admin.net-abuse.email Cc: wjensen@vdi.net (wjensen) Followup-To: news.admin.net-abuse.email X-1: ------------------------------------------------------------------------ X-2: NOTE - spamtrap in use, valid address, legit mail accepted, but delayed. X-3: ------------------------------------------------------------------------ Organization: Kookbusters X-Goober-FAQ: http://www.killfile.org/~tskirvin/faqs/grubor.html X-SpeedBump-FAQ: http://www.ultranet.com/~eclipse/sbfaq.html X-NutScum-FAQ: http://www.netscum.org/ X-Grep-Bait-1: qmail, Archimedes Plutonium, turkey, Kibo, meow, Vulis, Grubor. X-Grep-Bait-2: "Some people are alive only because it is illegal to kill them." Message-ID: Date: Tue, 22 Oct 2002 17:31:16 -0500 Lines: 70 X-Trace: sv3-uV5dvQZpsVskzrgSAjUrzZCVn4OtP5ZocDLcAO+xQGFLXLUzGv9ClLeIV8bq/5c6BnOBfmubwxI575n!scr/t+5LsCBtZ4bPo6Yagp3hlTVj/BiqOa+ywWDy9TslBMK1YJN3u55f8FnDgtlOAgquzSJ1l5HY!kO1d4dGGz6kxqDO69Y6xtgOE X-Complaints-To: abuse@speakeasy.net X-DMCA-Notifications: http://www.giganews.com/info/dmca.html X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.1 Xref: uni-berlin.de news.admin.net-abuse.email:1841072 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In article , wjensen@vdi.net (wjensen) writes: > #2 blocking /23 /24 is Inane, many server are assigned /27 and > effecting the wrong systems. On the contrary, it is "effecting" precisely the systems it's intended to effect. You just don't understand: SPEWS is not a list of spammers; SPEWS lists entire networks that refuse to shut down their spambags. In the example you've cited, 18orless.com is receiving spam DNS service from your IP address 216.10.26.175. You are refusing to terminate this spamming parasite. Therefore, your entire network is subject to be listed by SPEWS, at will. > #3 I have lost several account do to Spews $ crew mistakes over and > over again. Tough shit. Keep hosting this spambag, and this /24 might turn into a /20. > Spam getting stopped is one thing, targeting to the spam is another. > System needs to be improved asap. Blocking blindly is a very poor > system. The system is working as intended. The spam hoster (you), is being driven into bankruptcy. This spammer must be shut down. If you won't pull the plug, you'll just be blacklisted into chapter 11. Have a nice day. > Since april !!! You're full of shit. This spammer is still live on your network. Today. # dig @216.10.26.175 18orless.com mx ... 18orless.com. 14400 IN MX 0 18orless.com. ;; AUTHORITY SECTION: 18orless.com. 14400 IN NS ns3.nethost.ru. 18orless.com. 14400 IN NS ns.nethost.ru. ;; ADDITIONAL SECTION: 18orless.com. 14400 IN A 66.78.61.211 ns3.nethost.ru. 14400 IN A 216.10.26.175 ns.nethost.ru. 14400 IN A 216.74.79.211 ;; Query time: 19 msec Go and rot in blacklist hell. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: http://www.geocities.com/SiliconValley/Peaks/5799/GPGKEY.txt iD8DBQE9tdGz3ejdWUS0ltARAuQxAJ9e6c5UjYMDD/MJuMl1GuLaMkMz1ACghNPe 5QoDVHo4BEAMCROYvTMImDc= =S3+V -----END PGP SIGNATURE----- === Replies - 4 === Path: uni-berlin.de!fu-berlin.de!cox.net!nntp2.aus1.giganews.com !nntp.giganews.com!wn12feed!worldnet.att.net!204.127.198.204!attbi_feed4 !attbi.com!rwcrnsc52.ops.asp.att.net.POSTED!not-for-mail Message-ID: User-Agent: Hamster/1.3.23.4 Hamster/1.3.23.4 Newsgroups: news.admin.net-abuse.email From: morelydotes+nanae@spamblocked.com (Morely "Prisoner of SPEWS" Dotes) Subject: Re: VDI blocks Organization: Castle Anthrax Spanking Brigade References: X-Newsreader: News Xpress 2.01 X-From: remote-printer.Free_Copies_of_Spam/to_Marc_Summers@441622755060.iddd.tpc.int Lines: 24 NNTP-Posting-Host: 12.225.54.15 X-Complaints-To: abuse@attbi.com X-Trace: rwcrnsc52.ops.asp.att.net 1035324644 12.225.54.15 (Tue, 22 Oct 2002 22:10:44 GMT) NNTP-Posting-Date: Tue, 22 Oct 2002 22:10:44 GMT Date: Tue, 22 Oct 2002 22:10:44 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1841063 In article , wjensen@vdi.net (wjensen) wrote: > >If VDI Ranges are not removed by end of day, there will be a very >large problem a rightfull legal action will take place. This is >considered Distributed Denial of service. Which is illegal. Tell ya what, Wjensen; I am blocking VDI space locally on my servers at spamblocked.com and all customer accounts. Try sueing me and see how much you end up owing me in damages for frivolous litigation, libel, attempted interference with chattel, attempted trespass to chattel, attempted theft by conversion, and aggravated mopery. This, by the way, is in ADDITION to the SPEWS listing(s), which I also use. -- Want SPEWS-filtered and SBL-filtered email? http://www.spamblocked.com/index.html Fight spam! Help Joey McNichol! http://t3-v-mcnicol.ilaw.com.au/ === Followup responce from the same VDI person === Path: uni-berlin.de!fu-berlin.de!nf3.bellglobal.com!snoopy.risq.qc.ca !cyclone.bc.net!newsfeed.stanford.edu!postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 23 Oct 2002 10:42:08 -0700 Organization: http://groups.google.com/ Lines: 57 Message-ID: References: NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035394928 3225 127.0.0.1 (23 Oct 2002 17:42:08 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 23 Oct 2002 17:42:08 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1843608 The whole point here is this, #1 this is not a VDI client, this is a client within the data center, so an email would have to go to our support or noc@vdi.net. This has not been done. #2 VDI abuse staff responds to hundreds of emails everyday, we notify the client or company, site terminated. #3 The responses that this group shows no professionalism what so ever to allow me to even want to work with this group. #4 The correct response should have stated: these are the complaints, it is not since April of 2002. The site is still active for the last 1/2 year, no complaints since i assume when they were warned they stopped. SO if there are recent spam issues, well please inform us. #5 In order for more companies to add spews to their mail servers, RBL list what ever the group here needs to show professionalism. SAM put a response that "spews would put a company into chap 11?" Quote "The system is working as intended. The spam hoster (you), is being driven into bankruptcy. This spammer must be shut down. If you won't pull the plug, you'll just be blacklisted into chapter 11. Have a nice day." This is not what a organization should say to a company. VDI is not a spam friendly data center, as you know certain size companies will have spammers floating around it's network, hopping from company to company, thus this is not the intent of the parent company. Your Job is work with the parent company and track it down, not ridicule, insult and try to harm the parent company business. Your responses if seen by those who are using this system will turn people away from using it. Thus everyone loses. You want more people to use spews, RBL or what ever to rid the spam problem; you need to show more professionalism. The spam problem has not reduced at all, it is getting worst everyday, and I get thousands of spam to our mail boxes, so I strongly suggest someone out there understand my point of view. In closing, retaliation or abuse to demonstrate power of spews is another reason it will fall apart. Use your head wisely, a whisper is more powerful then someone screaming at you. William Jensen === My reply === Path: uni-berlin.de!cust-62-219-88-98.cust.bezeqint.NET!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 23 Oct 2002 19:03:52 GMT Organization: Private person Lines: 127 Sender: Alexander Sheremet Message-ID: References: NNTP-Posting-Host: cust-62-219-88-98.cust.bezeqint.net (62.219.88.98) X-Trace: fu-berlin.de 1035399832 29122877 62.219.88.98 (16 [104765]) X-SPEWS: I am not X-newsgroup: news.admin.net-abuse.email X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:1843649 On 23 Oct 2002 10:42:08 -0700 wjensen wrote in message : > The whole point here is this, > > > #1 this is not a VDI client, this is a client within the data center, > so an email would have to go to our support or noc@vdi.net. This has > not been done. Whenever VDI provides any service to the abusers, the correct e-mail address to complain is abuse@ and/or postmaster@, as adviced by RFC. It's not the job of abuse victims to dive into the abuser providers' company structure. > #2 VDI abuse staff responds to hundreds of emails everyday, we notify > the client or company, site terminated. The site obviously was NOT terminated, otherwise you wouldn't end up in SPEWS, and this whole thread wouldn't appear on NANAE. > #3 The responses that this group shows no professionalism what so ever > to allow me to even want to work with this group. This is news.admin.net-abuse.email, not the alt.show.me.your.professionalism newsgroup. Besides, nobody wanted you to come here to "work with". You did it on your own. So, don't expect others to play by your rules. > #4 The correct response should have stated: these are the complaints, > it is not since April of 2002. > > The site is still active for the last 1/2 year, no complaints since i > assume when they were warned they stopped. SO if there are recent > spam issues, well please inform us. Which shows that your #2 responce is false - the site was NOT terminated. > #5 In order for more companies to add spews to their mail servers, RBL > list what ever the group here needs to show professionalism. Wrong. The level of the professionalism in NANAE has nothing to do with the quality of service of such DNSBLs as SPEWS. Only the quality of the list, itself, will make more companies to use it. Besides, if you have missed it, the goals of SPEWS is not to make as many companies to use them, as possible, but to stop the spam from reaching of *their own* property. Although, they were generous enough to share their own opinion with the Internet, as a DNS-queriable list, and more and more of users and companies use it daily, which means that the quality is good enough for them. > SAM put a response that "spews would put a company into chap 11?" > Quote > "The system is working as intended. The spam hoster (you), is being > driven into bankruptcy. This spammer must be shut down. If you won't > pull the plug, you'll just be blacklisted into chapter 11. > Have a nice day." > > > This is not what a organization should say to a company. When the company helps their abusers to abuse the organization's resources, and refuses to stop providing services to the abusers, the most common wish for that company would be to go bancrupt ASAP. > VDI is not a spam friendly data center, <...> Obviously, SPEWS has a different opinion by listing the part of your network. And somehow I trust their opinion more than one of some cartooney-throwing individual who thinks that he can order others on what to do with their private property (talking about the professionalism). > Your Job is work with the parent company and track it down, not > ridicule, insult and try to harm the parent company business. Do you pay spam victims for doing this Job? Then it is not MY job to work with you to resolve YOUR spam problems. Spam victims spend their own time and resources to trace your spammers and report them to you as a gift of a good will - they are not paid for it. Mind you, nobody is required to send spam complaints - blocking the IP range is a much easier task, and solves the problem 100%. VDI has rejected that gift by ignoring complaints, so blocking is used instead. > Your responses if seen by those who are using this system will turn > people away from using it. Thus everyone loses. Riiiily? Then why you even bother to post here, if you believe that fewer and fewer people will be using SPEWS? Just wait till the problem solves itself. > You want more people to use spews, RBL or what ever to rid the spam > problem; you need to show more professionalism. We (TINW) don't want more people to use spews, RBL or what ever. TANW want spam to stop, that's all. No amount of the shown professionalism will stop spam. > The spam problem has not reduced at all, it is getting worst everyday, > and I get thousands of spam to our mail boxes, so I strongly suggest > someone out there understand my point of view. I barely get 2-3 e-mail spams a week now, while my access denied logs grow quite big (my combined DNSBL, local rejects and "user unknown" ones is 80+kB for this month, so far). That's cause the reputable networks are on one side, and the spam-friendly, disreputable ones, that ignore and don't act on complaints, very fast find themselves to be on another side. The side that can't send e-mails here. Guess, what side VDI is situated on? Did you understand my point of view? > In closing, retaliation or abuse to demonstrate power of spews is > another reason it will fall apart. Use your head wisely, a whisper is > more powerful then someone screaming at you. > > William Jensen Says who? One who came here (TINH), screaming and waving his cartooney, thinking to impress somebody with its power? With such an attitude I hope you will stay blocked until the company that hires you will go belly-up (and it wouldn't be a mating season). Rest assured that you will stay blocked here with a (dis-)honourable "550 Access denied - VDI - harboring spammers and cartooneys against blocklists" message. Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === And one more "gem" from William Jensen === Path: uni-berlin.de!fu-berlin.de!headwall.stanford.edu!newsfeed.stanford.edu !postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 23 Oct 2002 15:43:07 -0700 Organization: http://groups.google.com/ Lines: 50 Message-ID: References: <20021023115535.05562.00003635@mb-fc.aol.com> NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035412987 25843 127.0.0.1 (23 Oct 2002 22:43:07 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 23 Oct 2002 22:43:07 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1843814 Q:Why do i post in here ? Q41: How does one contact SPEWS? A41: One does not. SPEWS does not receive email - it's just an automated system and website, general blocklist related issues can be discussed in the public forums mentioned above. The newsgroup news.admin.net-abuse.email (NANAE) is a good choice, and Google makes it quite easy to post messages there via the Web as M@ilGate does via email. First time newsgroup posters should read the NANAE FAQ. Note that posting messages in these newsgroups & lists will not have any effect on SPEWS listings, only the discontinuation of spam and/or spam support will. Be aware that posting ones email address to any publicly viewable forum or website makes it instantly available to spammers. If you're concerned about getting spammed, change or "mung" the email address you use to post with. I have not received any complaints to abuse@vdi.net, noc@vdi.net about the issues reguarding blocked ips. I have searched the databases, nothing.. Is this spam continuing ??? I sure have not seen a single complaint. The last issue I see is april 2002 and no spam since then... I was surprised to see other "Admins claiming to block thier network from VDI, and i assume thats all 3 servers on your network. :) Matter of fact no mention of the network you are blocking from. I really hate spam, i can`t stand it, I would choke the sh*t out of the person hitting the enter key. but after seeing the close minded people of the this anti-spam group and the thought process involved. I got this feeling there must be too many generations of serious inbreeding going on here. Due to ..... how you guys handle this, you will surely loose this battle of the spam. I think it`s time for a group of adults to make a new type of anti spam group. You just lost all my respect. The threatened action of spews.org members is a clear violation of the normal process. Their system is unorganized, unregulated and prone to their whims and delusions of grandeur. These accusations are completely false and without merit. In fact, to our knowledge, there has only been only one single (unverified) complaint against this website back in April of 2002. === Replies - 1 === Path: uni-berlin.de!fu-berlin.de!newsfeed01.sul.t-online.de!t-online.de !newspeer1-gui.server.ntli.net!ntli.net!diablo.theplanet.net !newsfeed1.cidera.com!Cidera!news.ntplx.net!not-for-mail From: John Dutka Subject: Re: VDI blocks Newsgroups: news.admin.net-abuse.email References: <3DB71852.70705@FahQ2.com> X-No-Archive: yes User-Agent: tin/1.4.4-20000803 ("Vet for the Insane") (UNIX) (SunOS/5.8 (sun4u)) Lines: 9 Message-ID: Date: Thu, 24 Oct 2002 02:16:01 GMT NNTP-Posting-Host: 204.213.232.3 X-Trace: news.ntplx.net 1035425761 204.213.232.3 (Wed, 23 Oct 2002 22:16:01 EDT) NNTP-Posting-Date: Wed, 23 Oct 2002 22:16:01 EDT Organization: NETPLEX Internet Services - http://www.ntplx.net/ Xref: uni-berlin.de news.admin.net-abuse.email:1843929 Larry M. Smith wrote: : Thanks John... I was waiting to see the "18orless.com was nuked but : SPEWS has it out for me!" post... : Looks to me that VDI.NET has some problems w/ spam support. Especially since I DID complain to both abuse@vdi.net and noc@vdi.net, and they haven't done jack sh*t with their pet spammers. === Replies - 2 === Path: uni-berlin.de!fu-berlin.de!news.maxwell.syr.edu!wn11feed!worldnet.att.net !204.127.198.204!attbi_feed4!attbi_feed3!attbi.com!sccrnsc02.POSTED !not-for-mail Message-ID: User-Agent: Hamster/1.3.23.4 Newsgroups: news.admin.net-abuse.email From: morelydotes+nanae@spamblocked.com (Morely Dotes: Spamhunter) Reply-To: morelydotes+usenet@spamblocked.com Subject: Re: VDI blocks Organization: Society for Involuntary Euthanizing of Spammers References: <20021023115535.05562.00003635@mb-fc.aol.com> X-Newsreader: News Xpress 2.01 X-From: relaytest@aol.com Lines: 63 NNTP-Posting-Host: 12.225.54.15 X-Complaints-To: abuse@attbi.com X-Trace: sccrnsc02 1035468825 12.225.54.15 (Thu, 24 Oct 2002 14:13:45 GMT) NNTP-Posting-Date: Thu, 24 Oct 2002 14:13:45 GMT Date: Thu, 24 Oct 2002 14:13:45 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1844121 In article , wjensen@vdi.net (wjensen) wrote: > >Matter of fact no mention of the network you are blocking from. Look at my email address. Duh. >Due to ..... how you guys handle this, you will surely loose this >battle of the spam. I doubt anyone cares if the battle is loose or tight. >I think it`s time for a group of adults to make a new type of anti >spam group. > >You just lost all my respect. Fairy nuff, you've never had mine, due to your netwrok's long-time blatant support for spammers, and your first post here threatening legal action against person or persons unknown, for exercising their right to control of their private property. You're blustering, bewildered bully who can't find anyone who will take his threats seriously, and you have the brass balls to claim that *you're* an adult? It is to laugh. >The threatened action of spews.org members What members? Are you claiming to know who SPEWS is? I ask because I, like many other admins, owe SPEWS one Helluva lot of $BEVERAGE if they are ever identified. >is a clear violation of the normal process. What "normal" process? The one VDI uses? "Pay us, and you can spam until your server melts down." That process? >Their system is unorganized, unregulated and prone to their whims and >delusions of grandeur. Pot, kettle, black? No. Pot, stainless steel saucepan... VDI is a spam-support operation and has been for years. SPEWS is a well-organized and obviously well thought-out defense against unscrupulous scumbags such as yourself. >These accusations are completely false and without merit. In fact, >to our knowledge, there has only been only one single (unverified) >complaint against this website back in April of 2002. Then you are either deliberately ignorant, or a liar. Or both, that seems possible. "Saying an abuse desk doesn't deliver pizza is like a dentist saying he can't grow pizza so he can't help you with your anchovy problems." - Clifto, NANAE, 28 Sep 2002 -- Want SPEWS-filtered and SBL-filtered email? http://www.spamblocked.com/index.html Fight spam! Help Joey McNichol! http://t3-v-mcnicol.ilaw.com.au/ === VDI refuses *all* SpamCop complaints === Path: uni-berlin.de!fu-berlin.de!headwall.stanford.edu!newsfeed.stanford.edu !postnews1.google.com!not-for-mail From: ivan@spamcop.net (Ivan) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 23 Oct 2002 18:46:14 -0700 Organization: http://groups.google.com/ Lines: 26 Message-ID: <521629a4.0210231746.24249501@posting.google.com> References: NNTP-Posting-Host: 67.117.56.34 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035423974 6537 127.0.0.1 (24 Oct 2002 01:46:14 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 24 Oct 2002 01:46:14 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1843914 wjensen@vdi.net (wjensen) wrote in message news:... Dear Sir, I have your IP ranges listed because of its refusal to accept legitimate reports of abuse from the popular UCE reporting service known as SpamCop. Please note that unlike some other ISPs that have their preference set to refuse munged reports (which I also block), VDI actually has the unmitigated gall to refuse ALL SpamCop reports. An ISP that refuses abuse reports has no place on the Internet, and will not be unblocked until such decision is reversed. Sincerely, Ivan -------------------------------------------------------------------------------- ------------- Why do they all complain about being blocked? If they didn't want to be on the blocklist, they shouldn't have opt'ed in, in the first place. What?!? What do you mean someone must have used your address without your knowledge. Why would anyone do that? I can't be bothered to do a confirmed opt-in on everyone I add to my blocklist. I'm afraid, you'll have to follow the removal instructions. See http://spews.org/faq.html === More VDI posts === Path: uni-berlin.de!fu-berlin.de!headwall.stanford.edu!newsfeed.stanford.edu !postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 24 Oct 2002 09:57:58 -0700 Organization: http://groups.google.com/ Lines: 21 Message-ID: References: NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035478678 8659 127.0.0.1 (24 Oct 2002 16:57:58 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 24 Oct 2002 16:57:58 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1844202 Ok, lets try this once more. 1, 66.78.61.211, 18orless.com 1, 66.78.61.128/25, 18orless.com / NETHOST.RU (interserver.net/VDI.net) 1, 216.10.26.175, 18orless.com / NETHOST.RU 1, 216.10.26.83, "/~kozmetik/vcard/ordercell.html" 1, 216.10.26.128/25, 18orless.com (interserver.net/VDI.net) 1, 216.10.26.0/24, 18orless.com (interserver.net/VDI.net) 18orless.com #1 Contacted owner, site been terminated. #2 The web site is not responding. #3 can any one provide any "complaints with headers, from anytime in the last 3 months ? Thank you. William Jensen VDI === Replies - 1 === Path: uni-berlin.de!fu-berlin.de!newsfeed.news2me.com!newsfeed2.easynews.com !newsfeed1.easynews.com!easynews.com!easynews!cyclone.swbell.net!pln-e!spln!dex !extra.newsguy.com!newsp.newsguy.com!enews4 From: CM Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: Thu, 24 Oct 2002 10:42:31 -0700 Organization: http://extra.newsguy.com Lines: 65 Message-ID: References: Reply-To: cmize@goiter.com NNTP-Posting-Host: p-704.newsdawg.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7Bit User-Agent: KNode/0.7.1 Xref: uni-berlin.de news.admin.net-abuse.email:1844228 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 wjensen wrote: > Ok, lets try this once more. > > 1, 66.78.61.211, 18orless.com > 1, 66.78.61.128/25, 18orless.com / NETHOST.RU > (interserver.net/VDI.net) > 1, 216.10.26.175, 18orless.com / NETHOST.RU > 1, 216.10.26.83, "/~kozmetik/vcard/ordercell.html" > 1, 216.10.26.128/25, 18orless.com (interserver.net/VDI.net) > 1, 216.10.26.0/24, 18orless.com (interserver.net/VDI.net) > > 18orless.com > #1 Contacted owner, site been terminated. > #2 The web site is not responding. > > #3 can any one provide any "complaints with headers, from anytime in > the last 3 months ? > > Thank you. > > William Jensen > VDI nethost.ru is still providing DNS for 18orless.com: ; <<>> DiG 9.2.1 <<>> 18orless.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28275 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;18orless.com. IN A ;; ANSWER SECTION: 18orless.com. 14389 IN A 66.78.61.211 ;; AUTHORITY SECTION: 18orless.com. 14389 IN NS ns3.nethost.ru. 18orless.com. 14389 IN NS ns.nethost.ru. ;; ADDITIONAL SECTION: ns.nethost.ru. 86389 IN A 216.74.79.211 ns3.nethost.ru. 86389 IN A 216.10.26.175 ;; Query time: 30 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Oct 24 10:41:37 2002 ;; MSG SIZE rcvd: 123 - -- GUI admin tools have no HONOR. It is a good day to vi. GPG Key: http://www.goiter.com/key.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iD8DBQE9uDEL7np1QAE9cTcRAvtsAJ9lLLb3yFoJhDE0EEVVEiq7+PuaYACfdguW DQD9vi5x3SIfef6baMk3OU8= =tZ0u -----END PGP SIGNATURE----- === Replies - 2 === Path: uni-berlin.de!fu-berlin.de!fr.usenet-edu.net!usenet-edu.net!proxad.net !proxad.net!kibo.news.demon.net!news.demon.co.uk!demon !jupiter.gwalter.demon.co.uk!not-for-mail From: Graham Walter Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: Thu, 24 Oct 2002 18:40:33 +0100 Organization: thamesys.co.uk Lines: 33 Message-ID: <4hbgru0o9toij91mlfm6tcqj78jk412uv9@4ax.com> References: NNTP-Posting-Host: mars.gwalter.demon.co.uk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Trace: news.demon.co.uk 1035481737 14148 62.49.12.31 (24 Oct 2002 17:48:57 GMT) X-Complaints-To: abuse@demon.net NNTP-Posting-Date: Thu, 24 Oct 2002 17:39:54 +0000 (UTC) X-Newsreader: Forte Agent 1.92/32.572 Xref: uni-berlin.de news.admin.net-abuse.email:1844220 wjensen@vdi.net (wjensen) wrote: >Ok, lets try this once more. > >1, 66.78.61.211, 18orless.com >1, 66.78.61.128/25, 18orless.com / NETHOST.RU >(interserver.net/VDI.net) >1, 216.10.26.175, 18orless.com / NETHOST.RU >1, 216.10.26.83, "/~kozmetik/vcard/ordercell.html" >1, 216.10.26.128/25, 18orless.com (interserver.net/VDI.net) >1, 216.10.26.0/24, 18orless.com (interserver.net/VDI.net) > >18orless.com >#1 Contacted owner, site been terminated. >#2 The web site is not responding. > >#3 can any one provide any "complaints with headers, from anytime in >the last 3 months ? Ok, let's try this once more. You will find a lot of recent complaints there, along with others dating back quite a while. You can tune it to just look at the last three months. On a quick try of recent postings there, 2 out of 3 sites were responding (and 9 out of 10 cats said their owners preferred Whiskas). Graham -- Isn't it wonderful to think that one day this tiny acorn will grow into a mighty ash. === And here, VDI are "good guys" (d'oh) === Path: uni-berlin.de!fu-berlin.de!nntp.cs.ubc.ca!newsfeed.stanford.edu !postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: Re: VDI blocks Date: 24 Oct 2002 18:31:32 -0700 Organization: http://groups.google.com/ Lines: 16 Message-ID: References: <4hbgru0o9toij91mlfm6tcqj78jk412uv9@4ax.com> NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1035509492 14615 127.0.0.1 (25 Oct 2002 01:31:32 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 25 Oct 2002 01:31:32 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1844449 > > > You will find a lot of recent complaints there, along with others > dating back quite a while. You can tune it to just look at the last > three months. On a quick try of recent postings there, 2 out of 3 > sites were responding (and 9 out of 10 cats said their owners > preferred Whiskas). > > Graham Over 7 years, thats alot ?? all those sites were killed, like duh. what wrong with you, 680,000 domains, i think we do a damn good job beating spam. open your mind and hear the ears pop. wake up!! We are the good guys. === Replies - 1 === Path: uni-berlin.de!fu-berlin.de!news.stealth.net!news.stealth.net !ngpeer.news.aol.com!audrey-m1.news.aol.com!not-for-mail Lines: 18 X-Admin: news@aol.com From: frederi108@aol.com (Frederick the amateur spam killer) Newsgroups: news.admin.net-abuse.email Date: 25 Oct 2002 02:28:55 GMT References: Organization: AOL http://www.aol.com X-Newsreader: Session Scheduler (Queue Name: gng-fk) Subject: Re: VDI blocks Message-ID: <20021024222855.12709.00000034@mb-fk.aol.com> Xref: uni-berlin.de news.admin.net-abuse.email:1844493 In article , wjensen@vdi.net (wjensen) writes: >Over 7 years, thats alot ?? all those sites were killed, like duh. > >what wrong with you, 680,000 domains, i think we do a damn good job >beating spam. open your mind and hear the ears pop. > >wake up!! We are the good guys. You don't end up on SPEWS by being "good guys". SPEWS listings don't happen by accident. Frederi108@aol.com (Frederick) This e-mail address is whitelisted. "Because I'm a CRAZY one-armed spam-fighter with a hand coming out of my neck, so gimme some coffee!" http://hometown.aol.com/frederi108 === And the result is: the site is "cratered", BUT - 3 weeks later! === Path: uni-berlin.de!fu-berlin.de!headwall.stanford.edu!newsfeed.stanford.edu !postnews1.google.com!not-for-mail From: wjensen@vdi.net (wjensen) Newsgroups: news.admin.net-abuse.email Subject: 18orless..com Date: 15 Nov 2002 14:51:57 -0800 Organization: http://groups.google.com/ Lines: 8 Message-ID: NNTP-Posting-Host: 216.10.5.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1037400717 22629 127.0.0.1 (15 Nov 2002 22:51:57 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 15 Nov 2002 22:51:57 GMT Xref: uni-berlin.de news.admin.net-abuse.email:1858401 Issue with dns / ip / spam has been removed from network http://www.spews.org/html/S1377.html Please Unspew this range.. Thanks in advanced. === And the proof that they are the spammers was shown to VDI 2 weeks ago === Path: uni-berlin.de!cust-62-219-88-94.cust.bezeqint.NET!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: Re: 18orless..com Date: 16 Nov 2002 22:08:30 GMT Organization: Private person Lines: 62 Sender: Alexander Sheremet Message-ID: References: <2b1btu8m0gm72tp5vht5rcv49p0pjaoeje@4ax.com> <1037456578.760679@phoenix.mix.org.uk> NNTP-Posting-Host: cust-62-219-88-94.cust.bezeqint.net (62.219.88.94) X-Trace: fu-berlin.de 1037484510 16086761 62.219.88.94 (16 [104765]) X-SPEWS: I am not X-newsgroup: news.admin.net-abuse.email X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:1858893 On Sat, 16 Nov 2002 14:22:38 GMT MiX - no email replies thx wrote in message <1037456578.760679@phoenix.mix.org.uk>: > "Dolphin" wrote in message > news:slrnatb4mo.ltn.usenet-nov+nanae@orca.dolphinwave.org... > >> Even then, he has heard a LOT about them 3 weeks ago: >> http://www.DolphinWave.org/spam/vdi.net.txt >> >> Even if after that it took them 3 weeks to just pull the plug on >> those abusers, then there is no reason to accept any e-mail from >> such a network, that terminates their abusers' accounts with such >> a resistance. > > Careful, Dolphin, you might invoke another cart00ney out of VDI.net ;) I rather doubt that they are going to fall into the same "hole" twice. Although, even on October 31st I've proved them no doubt that 18orless were in fact spammers, and not something they lied to be (joe-job victims). My points were simple: It was not a joe-job. 18orless are spammers, and they've spammed many times in the past, at least since February 20th, 2002. Let me explain why I think that it wasn't somebody's attack against them... Google shows the "Premium Smokes at Generic Prices..." spam for the yahoo drop box in February 20th, 2002: http://groups.google.com/groups?selm=3C73D3F1.F3F220D8%40sneakemail.com It came from the dsp-487-omaha.radiks.net IP. Now, another person reports the same subject spam on April 27th, 2002, spamvertising the http://18orLess.com web page: http://groups.google.com/groups?selm=f8bmcus65luu5dderpttdkbj4mlvhugiil%40news.g enuity.com The spam was sent from... right: dialup-207-232-88-13.omaha.radiks.net Here, we have yet another spam, came June 7th, 2002. A bit different subject: "Smoke 4 M*U*C*H less... Have a look!...", and spamvertises this new page: http://www.glorybehosting.com/18orless And the spam source is... the same old dialup-207-232-89-59.omaha.radiks.net: http://groups.google.com/groups?selm=15617.7617.424315.5766%40capsicum.wsrcc.com Now we go farther (skipping more spam reports). We have the same spam again, on July 4th, 2002. The same subject, but now spamvertising the web page on chinese servers: http://www.theygo.com/fe2005 The spam source?.. Right, dialup-207-232-89-118.omaha.radiks.net again: http://groups.google.com/groups?selm=20020704121609.A22296%40cadeau.d-and-d.com Now, tell me, how often have you seen somebody was joe-jobbing a web site for at least 5 months in a row, from the same dialup account, and most important - following the "victim" when the "victim" was creating new pages? Tell me, how the supposed joe-jobber was going to find out that your spamm^W client has created this page http://www.glorybehosting.com/18orless, and then - this one http://www.theygo.com/fe2005 after his main one was taken down?! Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461