Re: FW: Resolution of Spam

[furio ercolessi <]

On Mon, Mar 11, 2002 at 01:41:25PM -0000, paul@localhost wrote:
> > Paul Wouters wrote:
> 
> > You want ISP's to cancel a lient if you receive a promoting spam about
> > their client?
> >
> > Let's see, let me see what happens when I send out a spam advertising
> > Cactushop ASP shopping cart v4.1 just to get you off the market.....
> >
> 
> Good point, but when it's nice looking HTML email and every image is pulled
> from that www domain, you start to think it might be genuine. Surely their
> abuse guys are smart enough to look at the HTML source...

... and also note that both the spam emitting source and the advertised
web sites are in 209.245.127.0/24.

If anyone wants to examine a sample, here is one chosen randomly
(and indicating that Level3 knows about this spammer since at 
least 26 february):
http://groups.google.com/groups?selm=4DB92B9A7A58D311955E0008C7CFA8C5F4784F%40SACR01EXC20
- transmitted by: 209.245.127.12
- advertising :   209.245.127.9

The spammer's servers seems to be in their Los Angeles colocation 
facility, so they probably have a lot of bandwidth available.

I refuse to believe that Level3 abuse is unable to assess the
situation because it is very clear.  On the other hand, I would 
readily believe that Level3 abuse proposed termination, but other 
parts of the company did not approve it: because we have already
seen too many similar cases occurring in large backbones.

furio ercolessi
Spin