NetVision Ltd. - ignoring their spammers, "warning" those who have already spammed with 100+kB e-mail bomb spams 3 times in a row, and allowing them to spam with the same "bombs" for the fourth time! Update: and the same spammer still spams through the same NetVision servers even after 4 complaints and being blocked! Update: 4-Ort-2004: NetVision deletes abuse reports without reading. netvision.net.il, [194.90.0.0 - 194.90.255.255], [199.203.89.0 - 199.203.104.255], [212.143.0.0 - 212.143.255.255], [212.235.0.0 - 212.235.127.255], [217.132.0.0 - 217.132.255.255]: Access denied! === 1st spam, my complaint === From: Admin Organization: Private person Subject: [email] Spam! [Fwd: book] Date: Fri, 24 Sep 2004 06:55:41 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1741116 X-KMail-Link-Type: forward To: , spam@uce.gov, nanas@killfile.org, abuse@netvision.net.il, , postmaster@yahoo.com, postmaster@nana.co.il, abuse@nana.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: Multipart/Mixed; boundary="Boundary-00=_Nj6UBGmSyRQshom" Message-Id: <200409240655.41353@2004.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: --Boundary-00=_Nj6UBGmSyRQshom Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Content-Disposition: inline Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Spammer: DSL212-235-24-242.bb.netvision.net.il [212.235.24.242] Used mailserver: mxout4.netvision.net.il [194.90.9.27] Mail from: barak43mail@yahoo.com Remove box: stopmailstop@yahoo.com Spamvertised web page: http://planet.nana.co.il/mail2mail2004/book.htm ---------- Forwarded Message ---------- Received: from mxout4.netvision.net.il (mxout4.netvision.net.il [194.90.9.27]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i8N27ueZ021192 for ; Thu, 23 Sep 2004 04:07:58 +0200 Received: from avi-7ucy1j1gyqu ([212.235.24.242]) by mxout4.netvision.net.il (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0I4H00G981VIES@mxout4.netvision.net.il> for abuse@dolphinwave.org; Thu, 23 Sep 2004 04:07:08 +0200 (IST) Date: Thu, 23 Sep 2004 05:06:55 +0300 From: book Subject: book To: 2 Message-id: <413-2200494232655653@avi-7ucy1j1gyqu> MIME-version: 1.0 Content-type: multipart/related; boundary="Boundary_(ID_MfCSH7HB37ZE6Yqcm1Mqlg)" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.27.0.11; VDF 6.27.0.70 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: MAIL2MAIL11.5703 285True175600004389120035941025926125728026228310$$9,=0Y>L4N98S\3"$]0'05Fals e1C:\barak\index-barak.htm1297560000106920007Truehp deskjet 5550 serieswinspoolLPT1:"```97560000106920007True"```286True1228600TrueTrueTrueTr ue00-1304800243True128772553175317570TrueTrueTrueTrueTrue2821342177288Empty16 711680524792636713421772167377921338250216777215-1True(�� ��) 2285857522860000(`@`````````26726826351101837751101852002someone@example.com �� �� � ����� � ��FORMDATA.HTM1http://example.microsoft.com/~user/ispscript.cgi TrueTrue3(```````````(```````````029270590004741672image298.jpg TrueTrue3(```````````(```````````0294image311.jpg -------------------------------------------------------
[image002.jpg removed] [image004.jpg removed] === 2nd spam, the same spammer, my complaint === From: Admin Organization: Private person Subject: [email] Persistent netvision.net.il spammer (www.mybait.co.il)! [Fwd: my bait] Date: Fri, 24 Sep 2004 07:08:55 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1741138 X-KMail-Link-Type: forward To: , spam@uce.gov, nanas@killfile.org, abuse@netvision.net.il, , postmaster@yahoo.com, abuse@bezeqint.net, abuse@atarimplus.co.il, abuse@sweethome.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: Multipart/Mixed; boundary="Boundary-00=_ov6UBe5OgE2obuN" Message-Id: <200409240708.56129@2004.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: --Boundary-00=_ov6UBe5OgE2obuN Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Content-Disposition: inline This is already the second spam from the same netvision.net.il spammer, sent to my abuse@ role address! Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Refusing to deal with your spammers will lead your whole IP range to be blocked from accessing my mailservers ever again, and this info will be shared with other admins and public blocklists! Spammer: DSL212-235-24-242.bb.netvision.net.il [212.235.24.242] Used mailserver: mxout5.netvision.net.il [194.90.9.29] Mail from: mybaitmail2@yahoo.com Remove box: stopmailstop@yahoo.com Spamvertised web page: http://www.mybait.co.il www.mybait.co.il [212.179.58.177] ================ domain: mybait.co.il descr: Orlov Irena descr: Hayarden 100 descr: Tveria descr: 14100 descr: Israel phone: +972 4 6725888 fax-no: +972 4 6725888 e-mail: info@mybait.co.il admin-c: YS842-IL tech-c: YS842-IL zone-c: YS842-IL nserver: ns1.atp.co.il nserver: ns2.atp.co.il changed: domain-registrar@isoc.org.il 20031019 (Assigned) changed: domain-registrar@isoc.org.il 20040314 (Changed) person: Yonatan Shachar address: Atarim Plus address: Dan 117 address: Maa'le-Shomron address: 44852 address: Israel phone: +972 3 9627144 e-mail: info@atarimplus.co.il nic-hdl: YS842-IL changed: domain-registrar@isoc.org.il 20020721 BEZEQINT-HOSTING IP block [212.179.58.0 - 212.179.58.255] Upstream: BEZEQINT (bzq-179-0-2.cust.bezeqint.net). Nameservers: ns.atp.co.il ---------- Forwarded Message ---------- Received: from mxout5.netvision.net.il (mxout5.netvision.net.il [194.90.9.29]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i8O0tceZ014615 for ; Fri, 24 Sep 2004 02:55:40 +0200 Received: from avi-7ucy1j1gyqu ([212.235.24.242]) by mxout5.netvision.net.il (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0I4I00LNVT6RRC@mxout5.netvision.net.il> for abuse@###; Fri, 24 Sep 2004 02:54:50 +0200 (IST) Date: Fri, 24 Sep 2004 03:54:29 +0300 From: mybait Subject: my bait To: 2 Message-id: <416-22004952405429225@avi-7ucy1j1gyqu> MIME-version: 1.0 Content-type: multipart/related; boundary="Boundary_(ID_P05KcxzaQUu5x2toWrUbYA)" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.27.0.12; VDF 6.27.0.71 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: MAIL2MAIL11.5703 285True175600004389120035941025926125728026228310$$9,=0Y>L4N98S\3"$]0'05Fals e1C:\bait\index-bait.htm1297560000106920007Truehp deskjet 5550 serieswinspoolLPT1:"```97560000106920007True"```286True1228600TrueTrueTrueTr ue00-1304800243True128772553175317570TrueTrueTrueTrueTrue2821342177288Empty16 711680524792636713421772167377921338250216777215-1True(�� ��) 2285857522860000(`@`````````26726826351101837751101852002someone@example.com �� �� � ����� � ��FORMDATA.HTM1http://example.microsoft.com/~user/ispscript.cgi TrueTrue3(```````````(```````````0292image298.jpg TrueTrue3(```````````(```````````0294image311.jpg -------------------------------------------------------
[image002.jpg removed] [image004.jpg removed] ======= PREVIOUS SPAM WAS ======= [PREVIOUS SPAM QUOTE SNIPPED] === 3rd spam, the same spammer, my complaint === From: Admin Organization: Private person Subject: [email] Persistent netvision.net.il spammer (3rd spam: mybait.co.il/mcam4u.co.il)! [Fwd: mcam4u2] Date: Sun, 26 Sep 2004 07:15:57 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1741215 X-KMail-Link-Type: forward To: , spam@uce.gov, nanas@killfile.org, abuse@netvision.net.il, wanabuse@netvision.net.il, , postmaster@yahoo.com, abuse@bezeqint.net, abuse@atarimplus.co.il, abuse@sweethome.co.il X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: Multipart/Mixed; boundary="Boundary-00=_NClVBUagagzvALe" Message-Id: <200409260715.57653@2004.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: --Boundary-00=_NClVBUagagzvALe Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Content-Disposition: inline This is already the THIRD spam from the same netvision.net.il spammer, sent to my abuse@ role address with 100kB+ e-mail bombs! Please, terminate the spammer's accounts as soon as possible! Thanks! ======= ATTENTION: NetVision! One more spam from that abuser, still being your customer, and you will be blocked! Spammer: DSL217-132-169-199.bb.netvision.net.il [217.132.169.199] Used mailserver: mxout2.netvision.net.il [194.90.9.21] Mail from: mcam4umail@yahoo.com Remove box: stopmailstop@yahoo.com Spamvertised web page: http://www.mcam4u.co.il Previously spamvertised web page: http://www.mybait.co.il www.mcam4u.co.il [199.203.20.64] ================ domain: mcam4u.co.il descr: A.M.PROTECTION&SECURITY PRODUCTS-DIRECT MARKETING LTD descr: AHOTSVIM6 descr: MEVASSERET ZION descr: 90805 descr: Israel phone: +972 66 804044 fax-no: +972 66 804044 e-mail: bombacam2000@yahoo.com admin-c: SM9127-IL tech-c: RA324-IL zone-c: RA324-IL nserver: dns.netvision.net.il nserver: nypop.elron.net changed: domain-registrar@isoc.org.il 20040104 (Assigned) changed: domain-registrar@isoc.org.il 20040128 (Changed) person: SHIMON MYRIAM address: A.M.PROTECTION&SECURITY PRODUCTS-DIRECT MARKETING LTD address: AHOTSVIM6 address: MEVASSERET ZION address: 90805 address: Israel phone: +972 66 804044 fax-no: +972 66 804044 e-mail: bombacam2000@yahoo.com nic-hdl: SM9127-IL changed: domain-registrar@isoc.org.il 20040104 person: Rami Addady address: activetech address: asimony daviv 2 address: Herzila address: 46367 address: Israel phone: +972 9 9566398 fax-no: +972 9 9566398 e-mail: rami@active.co.il nic-hdl: RA324-IL changed: registrar@ns.il 19990914 ORT Israel IP block [199.203.20.0 - 199.203.23.255] which is in the Elron Technologies IP range [199.203.0.0 - 199.203.255.255]. Upstream: NetVision (gi1-1.srvc02.hfa.nv.net.il). Nameservers: dns.netvision.net.il, nypop.elron.net. www.mybait.co.il [212.179.58.177] ================ domain: mybait.co.il descr: Orlov Irena descr: Hayarden 100 descr: Tveria descr: 14100 descr: Israel phone: +972 4 6725888 fax-no: +972 4 6725888 e-mail: info@mybait.co.il admin-c: YS842-IL tech-c: YS842-IL zone-c: YS842-IL nserver: ns1.atp.co.il nserver: ns2.atp.co.il changed: domain-registrar@isoc.org.il 20031019 (Assigned) changed: domain-registrar@isoc.org.il 20040314 (Changed) person: Yonatan Shachar address: Atarim Plus address: Dan 117 address: Maa'le-Shomron address: 44852 address: Israel phone: +972 3 9627144 e-mail: info@atarimplus.co.il nic-hdl: YS842-IL changed: domain-registrar@isoc.org.il 20020721 BEZEQINT-HOSTING IP block [212.179.58.0 - 212.179.58.255] Upstream: BEZEQINT (bzq-179-0-2.cust.bezeqint.net). Nameservers: ns.atp.co.il ---------- Forwarded Message ---------- Received: from mxout2.netvision.net.il (mxout2.netvision.net.il [194.90.9.21]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i8PNEoeZ023204 for ; Sun, 26 Sep 2004 01:14:53 +0200 Received: from avi-7ucy1j1gyqu ([217.132.169.199]) by mxout2.netvision.net.il (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0I4M00MBTDWAF2@mxout2.netvision.net.il> for abuse@###; Sun, 26 Sep 2004 01:14:50 +0200 (IST) Date: Sun, 26 Sep 2004 02:14:35 +0300 From: mcam4umail Subject: mcam4u2 To: mcam4u2 Message-id: <414-220049625231435261@avi-7ucy1j1gyqu> MIME-version: 1.0 Content-type: multipart/related; boundary="Boundary_(ID_aMqI/mfPDRwWRqCzKKAwdA)" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.27.0.12; VDF 6.27.0.72 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: -------------------------------------------------------
[image2981.jpg removed] [image311.gif removed] [image312.gif removed] [image3131.jpg removed] ======= PREVIOUS SPAMS WERE ======= [PREVIOUS SPAMS QUOTE SNIPPED] === NetVision abuse desk replies === Received: from ntx.netvision.net.il (ananas1.netvision.net.il [199.203.100.202]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i8QEH7eZ011997 for ; Sun, 26 Sep 2004 16:17:09 +0200 Received: from Internal Mail-Server by ananas1 with SMTP; 26 Sep 2004 16:23:43 +0300 Received: from ntx2.forest.netvision.net.il ([172.20.30.33]) by vidius-pa.forest.netvision.net.il with Vidius PA ESMTP; Sun, 26 Sep 2004 16:17:06 +0200 X-PA-Host: vidius-pa.forest.netvision.net.il X-MIMEOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [email] Persistent netvision.net.il spammer (3rd spam: mybait.co.il/mcam4u.co.il)! [Fwd: mcam4u2] Date: Sun, 26 Sep 2004 16:17:05 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [email] Persistent netvision.net.il spammer (3rd spam: mybait.co.il/mcam4u.co.il)! [Fwd: mcam4u2] Thread-Index: AcSjiKK19gJP7ew5SPilEKelTHMkkQAStIeg From: "Abuse" To: "Admin" Content-Type: text/plain; charset="iso-8859-1" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.27.0.12; VDF 6.27.0.72 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.dolphinwave.org id i8QEH7eZ011997 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: Dear Sir/Ms, We have contacted the responsible NetVision customer, and explained the severity of performing abuse. Should you encounter further abuse from this or any other NetVision customer, please feel free to send your complaint to us, and we will take the appropriate action. This may include, but is not limited to, warning the responsible account holder or discontinuing the account's membership with NetVision. Should you have any questions regarding our mail to you, please feel free to reply to this Email and we will provide you with additional information. Always enclose previous letters when contacting us. Regards, Liat Schwartz NetVision Abuse Team -------------------------------------------------------------------------------------------- NetVision's Abuse Team: abuse@netvision.net.il NetVision Ltd. Omega Center, MATAM, Haifa 31905 The No.1 Israeli Internet & Intranet Services Provider HOME PAGE: http://www.netvision.net.il -------------------------------------------------------------------------------------------- -----Original Message----- [MY SPAM COMPLAINT QUOTE SNIPPED] === 4th spam, the same spammer, my complaint === From: Admin Organization: Private person Subject: [email] Unstoppable netvision.net.il spammer (4th spam: mybait.co.il/mcam4u.co.il/alternativli.co.il/dietshop.co.il/wis.co.il/gns.co.il/webgate.co.il)! [Fwd: mcam4u] Date: Wed, 29 Sep 2004 19:47:39 +0200 User-Agent: KMail/1.5 X-KMail-Link-Message: 1741314 X-KMail-Link-Type: forward To: , spam@uce.gov, nanas@killfile.org, abuse@netvision.net.il, wanabuse@netvision.net.il, , postmaster@yahoo.com, abuse@bezeqint.net, abuse@atarimplus.co.il, abuse@sweethome.co.il, abuse@hivelocity.net, spamtool@level3.net, postmaster@hivelocity.net, postmaster@hivelocity.com, abuse@level3.net, abuse@mci.com X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Content-Disposition: inline Message-Id: <200409291947.40034@2004.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: This is the FOURTH spam from the same netvision.net.il spammer, sent to my abuse@ role address with 100kB+ e-mail bombs, and all NetVision did till now was just telling the spammer not to do it again! Please, terminate the spammer's accounts as soon as possible! Thanks! ======= ATTENTION: NetVision! You obviously don't mind your abuser flooding others' e-mail boxes with 100+kB e-mail "bombs", allowing him to do it for the FOURTH time in a row! There is no reason to accept any e-mail coming from your networks, where abusers can spam from over and over again. Spammer: DSL212-235-107-245.bb.netvision.net.il [212.235.107.245] Used mailserver: mxout2.netvision.net.il [194.90.9.21] Mail from: alternativlimail@yahoo.com Remove box: stopmailstop@yahoo.com Spamvertised web page: http://www.alternativli.co.il Previously spamvertised web pages: ================================== http://www.mybait.co.il http://www.mcam4u.co.il Other spammer's domains: ======================== dietshop.co.il [69.46.23.114] wis.co.il [69.46.23.118] gns.co.il [192.114.70.222] webgate.co.il [66.96.87.5] www.alternativli.co.il [69.46.23.114] ====================== domain: alternativli.co.il descr: G.O.S Internet Marketing&Trade L.T.D. descr: Fainshtein5 descr: Rishon Lezion descr: 11111 descr: Israel phone: +972 52 686242 e-mail: info@dietshop.co.il admin-c: GA3218-IL tech-c: GA3218-IL zone-c: GA3218-IL nserver: wg1.webgatenet.net nserver: wg2.webgatenet.net nserver: ns3.wis.co.il changed: registrar@ns.il 20000712 (Assigned) changed: domain-registrar@isoc.org.il 20031014 (Changed) changed: domain-registrar@isoc.org.il 20031016 (Changed) changed: domain-registrar@isoc.org.il 20031019 (Changed) changed: domain-registrar@isoc.org.il 20040105 (Changed) changed: domain-registrar@isoc.org.il 20040418 (Changed) changed: domain-registrar@isoc.org.il 20040509 (Changed) changed: domain-registrar@isoc.org.il 20040530 (Changed) person: Gershon A address: WEBGATE INTERNET SOLUTIONS address: Dov Fridman 23/b address: Ramat-Gan address: Israel phone: +972 53 242837 fax-no: +972 3 6704845 e-mail: admin@webgate.co.il nic-hdl: GA3218-IL changed: registrar@ns.il 20000627 HIVELOCITY VENTURES CORP IP block [69.46.0.0 - 69.46.31.255]. Upstream: UUNET (hivelocity-gw.customer.alter.net). Nameservers: wis.co.il, gns.co.il <== SPAMMERS. www.mcam4u.co.il [199.203.20.64] ================ domain: mcam4u.co.il descr: A.M.PROTECTION&SECURITY PRODUCTS-DIRECT MARKETING LTD descr: AHOTSVIM6 descr: MEVASSERET ZION descr: 90805 descr: Israel phone: +972 66 804044 fax-no: +972 66 804044 e-mail: bombacam2000@yahoo.com admin-c: SM9127-IL tech-c: RA324-IL zone-c: RA324-IL nserver: dns.netvision.net.il nserver: nypop.elron.net changed: domain-registrar@isoc.org.il 20040104 (Assigned) changed: domain-registrar@isoc.org.il 20040128 (Changed) person: SHIMON MYRIAM address: A.M.PROTECTION&SECURITY PRODUCTS-DIRECT MARKETING LTD address: AHOTSVIM6 address: MEVASSERET ZION address: 90805 address: Israel phone: +972 66 804044 fax-no: +972 66 804044 e-mail: bombacam2000@yahoo.com nic-hdl: SM9127-IL changed: domain-registrar@isoc.org.il 20040104 person: Rami Addady address: activetech address: asimony daviv 2 address: Herzila address: 46367 address: Israel phone: +972 9 9566398 fax-no: +972 9 9566398 e-mail: rami@active.co.il nic-hdl: RA324-IL changed: registrar@ns.il 19990914 ORT Israel IP block [199.203.20.0 - 199.203.23.255] which is in the Elron Technologies IP range [199.203.0.0 - 199.203.255.255]. Upstream: NetVision (gi1-1.srvc02.hfa.nv.net.il). Nameservers: dns.netvision.net.il, nypop.elron.net. www.mybait.co.il [212.179.58.177] ================ domain: mybait.co.il descr: Orlov Irena descr: Hayarden 100 descr: Tveria descr: 14100 descr: Israel phone: +972 4 6725888 fax-no: +972 4 6725888 e-mail: info@mybait.co.il admin-c: YS842-IL tech-c: YS842-IL zone-c: YS842-IL nserver: ns1.atp.co.il nserver: ns2.atp.co.il changed: domain-registrar@isoc.org.il 20031019 (Assigned) changed: domain-registrar@isoc.org.il 20040314 (Changed) person: Yonatan Shachar address: Atarim Plus address: Dan 117 address: Maa'le-Shomron address: 44852 address: Israel phone: +972 3 9627144 e-mail: info@atarimplus.co.il nic-hdl: YS842-IL changed: domain-registrar@isoc.org.il 20020721 BEZEQINT-HOSTING IP block [212.179.58.0 - 212.179.58.255] Upstream: BEZEQINT (bzq-179-0-2.cust.bezeqint.net). Nameservers: ns.atp.co.il ---------- Forwarded Message ---------- Received: from mxout2.netvision.net.il (mxout2.netvision.net.il [194.90.9.21]) by mail.dolphinwave.org (8.12.8/8.12.8) with ESMTP id i8TGU9uf006930 for ; Wed, 29 Sep 2004 18:30:13 +0200 Received: from avi-7ucy1j1gyqu ([212.235.107.245]) by mxout2.netvision.net.il (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0I4T00B8A9TN3Y@mxout2.netvision.net.il> for abuse@###; Wed, 29 Sep 2004 18:30:01 +0200 (IST) Date: Wed, 29 Sep 2004 18:29:49 +0200 From: alternativli Subject: mcam4u To: 8 Message-id: <416-220049329162949724@avi-7ucy1j1gyqu> MIME-version: 1.0 Content-type: multipart/related; boundary="Boundary_(ID_4uu0lErx4sC4SOpYFfHNeg)" X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.27.0.12; VDF 6.27.0.78 X-Loop: dev.null@dolphinwave.org Status: R X-Status: N X-KMail-EncryptionState: X-KMail-SignatureState: ------------------------------------------------------- øé÷
======= 100+kB of images attachments removed ======= [image2981.jpg] [image3111.jpg] [image313.jpg] ======= PREVIOUS SPAMS WERE ======= [PREVIOUS SPAM QUOTE SNIPPED] === My post to news.admin.net-abuse.email about it === Path: uni-berlin.de!not-for-mail From: Dolphin Newsgroups: news.admin.net-abuse.email Subject: [BLOCK] netvision.net.il - allowing repeating 100+kB abusers to spam Date: 29 Sep 2004 18:17:32 GMT Organization: Private person Lines: 55 Sender: Alexander Sheremet Message-ID: X-Trace: news.uni-berlin.de imwiHHZ9lGBfXfNRB1QFXg7FVJyzg9yUZ0fPc517swNEa2H/Dk X-SPEWS: I am not X-ROT-13: fcnzgenc@dolphinwave.org X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 User-Agent: slrn/0.9.7.4 (Linux) Xref: uni-berlin.de news.admin.net-abuse.email:2252746 In short: Sep-23: 1st spam from their ADSL customer, through their mailserver (103kB). My complaint to NetVision did nothing. Sep-24: 2nd spam, the same account (197kB). My second complaint, still nothing. Sep-26: 3rd spam, the same spammer, the same NetVision's mailserver (135kB). Spammer's page is also hosted by NetVision: www.mcam4u.co.il [199.203.20.64]. My third complaint. Sep-26: NetVision replies: We have contacted the responsible NetVision customer, and explained the severity of performing abuse. Sep-29: 4th spam, the same everything (96kB). Spammer's page is still up on NetVision, too: $ wget -O - www.mcam4u.co.il --20:09:33-- http://www.mcam4u.co.il/ Resolving www.mcam4u.co.il... done. Connecting to www.mcam4u.co.il[199.203.20.64]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 615,204 [text/html] mcam4u [SNIP] Full spams, NetVision reply, and more spams are archived: http://www.DolphinWave.org/spam/netvision.net.il.txt Blocking: netvision.net.il, [194.90.0.0 - 194.90.255.255], [199.203.89.0 - 199.203.104.255], [212.143.0.0 - 212.143.255.255], [212.235.0.0 - 212.235.127.255]. Anybody with more of NetVision's IP ranges? Dolphin. -- URL: http://www.DolphinWave.org Mail: on the web page (no spam) ICQ: 6615461 === More opinions === Path: uni-berlin.de!fu-berlin.de!peer01.cox.net!cox.net!priapus.visi.com !orange.octanews.net!news.octanews.net!news-out.visi.com!petbe.visi.com !news-3.mpls.visi.com.POSTED!not-for-mail From: "Karen in MN" Newsgroups: news.admin.net-abuse.email References: Subject: Re: [BLOCK] netvision.net.il - allowing repeating 100+kB abusers to spam Date: Wed, 29 Sep 2004 13:39:34 -0500 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Lines: 77 Message-ID: <415afee4$0$97288$a1866201@newsreader.visi.com> Organization: VISI.com NNTP-Posting-Date: 29 Sep 2004 13:28:53 CDT NNTP-Posting-Host: 6fc4d5a9.newsreader.visi.com X-Trace: DXC=E1d88\Q];U@cPVMH;EY6PDm90:^S@hD3OXm`l_bH^GNR440Q8?I?IbP wrote in message news:slrncllv1m.cpu.usenet-Sep+nanae@orca.dolphinwave.org... > In short: > > Sep-23: 1st spam from their ADSL customer, through their mailserver (103kB). > My complaint to NetVision did nothing. > > Sep-24: 2nd spam, the same account (197kB). > My second complaint, still nothing. > > Sep-26: 3rd spam, the same spammer, the same NetVision's mailserver (135kB). > Spammer's page is also hosted by NetVision: www.mcam4u.co.il [199.203.20.64]. > My third complaint. > > Sep-26: NetVision replies: > > > We have contacted the responsible NetVision customer, and explained the > severity of performing abuse. > > > Sep-29: 4th spam, the same everything (96kB). > Spammer's page is still up on NetVision, too: > > $ wget -O - www.mcam4u.co.il > --20:09:33-- http://www.mcam4u.co.il/ > > Resolving www.mcam4u.co.il... done. > Connecting to www.mcam4u.co.il[199.203.20.64]:80... connected. > HTTP request sent, awaiting response... 200 OK > Length: 615,204 [text/html] > > > > mcam4u > [SNIP] > > > Full spams, NetVision reply, and more spams are archived: > http://www.DolphinWave.org/spam/netvision.net.il.txt > > Blocking: > netvision.net.il, > [194.90.0.0 - 194.90.255.255], > [199.203.89.0 - 199.203.104.255], > [212.143.0.0 - 212.143.255.255], > [212.235.0.0 - 212.235.127.255]. > > Anybody with more of NetVision's IP ranges? > > Dolphin. > > -- > URL: http://www.DolphinWave.org > Mail: on the web page (no spam) > ICQ: 6615461 I have gotten recent virus spams from netvision IPs 217.132.71.238, 217.132.85.77, 217.132.83.124 and 217.132.82.242 -- I suspect these all were the result of reporting a netvision spam because of the address the virus spams are going to -- it's the one that is used only for spam reporting. Got the usual auto-acks from netvision. Last year, I was getting repeatedly spammed by one of their clients at a photography center, and reported them three times. The only action I got was the auto-ack, and then some nasty emails from the photography center, first claiming that I was spamming them, and then blaming it on a virus. I don't have a lot of faith in netvision's abuse desk. === Other people were also complaining on that spammer === Path: uni-berlin.de!not-for-mail From: "Dick Cardy" Newsgroups: news.admin.net-abuse.email Subject: Re: [BLOCK] netvision.net.il - allowing repeating 100+kB abusers to spam Date: Fri, 1 Oct 2004 00:23:08 +0200 Lines: 28 Message-ID: <2s3fc5F1gf00qU1@uni-berlin.de> References: X-Trace: news.uni-berlin.de OsXEAnhuhnvhmQg/Zn3ZpwT5fQwTLAfDUgdKcJd/0SUhVC5gWh X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Xref: uni-berlin.de news.admin.net-abuse.email:2253180 "Steven Maesslein" wrote in message news:slrnclovs6.4i2.nobody@127.0.0.1... > On 29 Sep 2004 18:17:32 GMT, Dolphin coughed into > news.admin.net-abuse.email and left this in > : > > > Blocking: > > netvision.net.il, > > Why not s/netvision\.net// ? > > Given the spew level of just about every ISP over there it probably > wouldn't be a great loss - unless, of course, you have any reason to > communucate with that country. > > -- > Steve > The problem is that Dolphin is in IL. In fact we are neighbours - he is (.18) and I am (.19) As an aside I have just reported the same spammer to netvision Dick === And the spammer still spams from the same NetVision servers, after 4 === === complaints sent there - now blocked (Sendmail logs, GMT+0200) === Sep 30 23:50:15 orca sendmail[9283]: i8ULo4uf009283: ruleset=check_rcpt, arg1=, relay=mxout2.netvision.net.il [194.90.9.21], reject=550 5.0.0 ... Access denied - NetVision - allowing spammers to spam-bomb multiple times, despite on complaints - http://www.DolphinWave.org/spam/netvision.net.il.txt Sep 30 23:50:20 orca sendmail[9283]: i8ULo4uf009283: from=, size=136192, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=mxout2.netvision.net.il [194.90.9.21] === NetVision deletes abuse reports without reading === Path: uni-berlin.de!fu-berlin.de!news.glorb.com!border1.nntp.dca.giganews.com !nntp.giganews.com!news-out.visi.com!petbe.visi.com!news-1.mpls.visi.com.POSTED !not-for-mail From: "Karen in MN" Newsgroups: news.admin.net-abuse.email References: <2s0pcqF1fokv9U1@uni-berlin.de> Subject: Re: [BLOCK] netvision.net.il - allowing repeating 100+kB abusers to spam Date: Mon, 4 Oct 2004 09:26:16 -0500 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Lines: 25 Message-ID: <41615b12$0$59522$a1866201@newsreader.visi.com> Organization: VISI.com NNTP-Posting-Date: 04 Oct 2004 09:15:51 CDT NNTP-Posting-Host: 58675ea4.newsreader.visi.com X-Trace: DXC=De^J] wrote in message news:2s0pcqF1fokv9U1@uni-berlin.de... > > "Dolphin" wrote in message > news:slrncllv1m.cpu.usenet-Sep+nanae@orca.dolphinwave.org... > > In short: > > > > Sep-26: 3rd spam, the same spammer, the same NetVision's mailserver > (135kB). > > Spammer's page is also hosted by NetVision: www.mcam4u.co.il > [199.203.20.64]. > > My third complaint. > > LART sent via SC today. > > Dick > My virus spam from their space is increasing over the past week, but reports to them are coming back with a "deleted not read" return receipt.