Path: sn-us!sn-xit-06!supernews.com!news.maxwell.syr.edu!wn1feed!worldnet.att.net!bgtnsc05-news.ops.worldnet.att.net.POSTED!not-for-mail Reply-To: "Sleepy Turtle" From: "Sleepy Turtle" Newsgroups: news.admin.net-abuse.email Subject: Whitehat / Cartoony from trueserver.nl? (longish) Lines: 138 Organization: sun bathing X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: Date: Sat, 22 Jun 2002 22:54:21 GMT NNTP-Posting-Host: 12.82.248.194 X-Complaints-To: abuse@worldnet.att.net X-Trace: bgtnsc05-news.ops.worldnet.att.net 1024786461 12.82.248.194 (Sat, 22 Jun 2002 22:54:21 GMT) NNTP-Posting-Date: Sat, 22 Jun 2002 22:54:21 GMT Xref: sn-us news.admin.net-abuse.email:790250 I received yet another porn spam that advertised an envy.nu site: http://fogliodicarta.envy.nu redirected to a russian porn site: acodon.hotbox.ru or 80.68.244.32 and ended up at the porn dialer site hosted by trueserver.nl at: 213.239.160.56 I larted trueserver.nl for the second or third time about this site and received two e-mails in response. The first started one started out as a cartoony, which I don't understand since the spews reference I included in my lart was directed at eli.net and envy.nu: . It ended, however, in a somewhat whitehat fashion, as did the follow-up e-mail. I'll post each here for you to inspect. 1st e-mail: Return-Path: Received: from smtp.cb3rob.net ([213.239.156.240]) by mtiwgwc28.worldnet.att.net (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020622220817.FBNI7515.mtiwgwc28.worldnet.att.net@smtp.cb3rob.net> for ; Sat, 22 Jun 2002 22:08:17 +0000 Received: from chaos.cb3rob.net (chaos.cb3rob.net [80.247.209.10]) by smtp.cb3rob.net (Postfix) with ESMTP id C5CC95E35C; Sun, 23 Jun 2002 00:08:15 +0200 (CEST) Date: Sun, 23 Jun 2002 00:05:47 +0200 (CEST) From: Sven Kamphuis To: Kevin Moberly Cc: abuse@eli.net, postmaster@envy.nu, admin@0catch.com, noc@rbc.ru, postmaster@rbc.ru, abuse@cb3rob.net, postmaster@trueserver.nl, vincent@trueserver.nl, uce@ftc.gov, xennt@cyberbunker.com, ramon@atlantiz.nl, legal@cb3rob.net Subject: Re: In-Reply-To: <001301c21a36$bb81d740$c2f8520c@default> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII maintaining and publicizing blacklists is illegal, we will see to it that spews is brought down asap. whatever you do, if we find we cannot bill our customers because of some lame block imposed by spews we will sue the participants for damages. as far as our own terms of use is concerned: we discontinue spammers immediately, but this is not one of our "direct" customers. (we have pointed out the fact that spamming is evil to them about 500 times so far though, so maybe someone needs to do something about it ;) furthermore pluginaccess is a customer of atlantiz.nl, which seems not to a lot about it indeed.... think they need their asses kicked but its not up to me (not entirely at least ;). spamming is evil but this ip blacklisting thing is just plainly illegal so i expect spews to terminate its activities asap. (we will take care of this spammer ;) -- Sven Kamphuis, Technical Manager, CB3ROB BBS / CyberBunker B.V. ============================================================================ = CB3ROB BBS - Remote Computing Facilities & Network Security ============================================================================ = Address: P.O. Box 2226 KvK: 37089253 NL-4460 ME Tax ID: NL-190827336B01 GOES Bank: 56.64.08.287 (ABN-AMRO Castricum) The Netherlands Giro: 9074112 (Postbank) Phone: +31/251-316800 Fax: +31/251-316799 e-Mail: info@cb3rob.net ============================================================================ = Inexpensive, reliable webhosting: http://www.turbohost.net/ EUR 150.- /year incl: domain, mysql, shell, php, ssi, cgi, 100MB ============================================================================ = 2nd e-mail: Return-Path: Received: from smtp.cb3rob.net ([213.239.156.240]) by mtiwgwc29.worldnet.att.net (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020622223637.WOGC16447.mtiwgwc29.worldnet.att.net@smtp.cb3rob.net> for ; Sat, 22 Jun 2002 22:36:37 +0000 Received: from chaos.cb3rob.net (chaos.cb3rob.net [80.247.209.10]) by smtp.cb3rob.net (Postfix) with ESMTP id CE9455E35C; Sun, 23 Jun 2002 00:36:36 +0200 (CEST) Date: Sun, 23 Jun 2002 00:34:08 +0200 (CEST) From: Sven Kamphuis To: Kevin Moberly Cc: abuse@eli.net, postmaster@envy.nu, admin@0catch.com, noc@rbc.ru, postmaster@rbc.ru, abuse@cb3rob.net, postmaster@trueserver.nl, vincent@trueserver.nl, uce@ftc.gov Subject: Re: In-Reply-To: <001301c21a36$bb81d740$c2f8520c@default> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII atlantiz has been told to remove these sites by the ceo handling dedicated hosting & co-location activities. lets see... ;) -- Sven Kamphuis, Technical Manager, CB3ROB BBS / CyberBunker B.V. ============================================================================ = CB3ROB BBS - Remote Computing Facilities & Network Security ============================================================================ = Address: P.O. Box 2226 KvK: 37089253 NL-4460 ME Tax ID: NL-190827336B01 GOES Bank: 56.64.08.287 (ABN-AMRO Castricum) The Netherlands Giro: 9074112 (Postbank) Phone: +31/251-316800 Fax: +31/251-316799 e-Mail: info@cb3rob.net ============================================================================ = Inexpensive, reliable webhosting: http://www.turbohost.net/ EUR 150.- /year incl: domain, mysql, shell, php, ssi, cgi, 100MB ============================================================================ = cb3rob: LIKKE LIKKE LIK I guess all I can say is I'll take what I can get