I am writing to you regarding these SBL records that popped up
recently:

SBL53298 - finegenerics
SBL58807 - finegenerics.com, rx-partners.biz
SBL59943 - rx-partners
SBL59701 - illegal pharma drug spammers - Rx-Partners.biz
SBL59816 - finegenerics.com, rx-partners.biz

I am writing on behalf of rx-partners.biz and associate domains. I am
writing here because we tried to follow removal instructions on the
site, but got no reply, and we see new SBL records popping up.

First of all, these records do not contain any information where or
when spam came from, except for one affiliate who spammed his site -
Finegenerics in April this year. We had a situation in April, where
one of our affiliates spammed his domain name on his hosting account,
but he had a link to our website. His account was shut down immediatly
after we have been contacted by RackSpace about the problem. In a
short time, SBL records were removed.

Now those old SBL records reappeared, and new ones created.

Hi all, I'm Gian Luca Sole, the system administrator of
the network involved in this listing (80.17.24.144/29),
that is: http://tinyurl.com/24m256

The apews listing is: http://tinyurl.com/ywwysb

Evidently is a problem of generic rDNS (never spam problems: the mail
server is correctly configured, and so the abuse mail addresses
postmaster and abuse) and the relay is allowed *only* to our internal
lan). The problem was probably originated by the massive change operated
in the past by my isp (telecomitalia.it/interbusiness.it) on the generic
PTRs associated to netblocks addresses, changing these from the form
hostXXX-XXX-static.XXX-XXX-interbusiness.it to the form
hostXXX-XXX-static.XXX-XXX-b.business.telecomitalia.it, and my
isp /misteriously LOOSED/ the correct PTR (mail.o************r.com).

Actually the problem is corrected, and the PTR associated to the
mail server is correct.

Thanks for your attention,
Gian Luca Sole

Hello,

I am representative of the ISP Neuf-Cegetel AS 15557, this AS is
blacklisted on UCE-Protect level 3. I understand why, and we are
trying to make the necessary to fix that.
The range 84.96.0.0/13 is blacklisted at the level 2, among all this
IP we can find dynamic range, static range and especially IPs of our
infrastructure which are very secure.
To my mind, blacklisted a /13 is too large.
Is it possible to remove from the UCE-Protect level2 list the
following subnets :
- 84.96.93.0/24
- 84.96.72.0/24

Regards

Thomas Guillemois

Hello,
It is my plesure to be part in process to fight spam around
the world.We are a well reputated ISP company,we have a mail server
which is protected by anti-spam system included anti-virus.I have a
problem with http://www.uceprotect.net site which list some of my IPs
as 3 level listing although that as we all know we can not control our
customer completeley and all steps taken individual usres will be
welcomed but not all my ASn as what happened in the site
http://www.uceprotect.net.Hope to reach to a compromise in this
problem to solve it as soon as possible.

Regards,

Hi there,

I get nearly 300 misdirected bounces a day, and I quick-report them to
SpamCop.

However, I feel that there is a missed opportunity in here.

1) backscatter comes in "near real time" and the info in the
backscatter has to be useful for blocklisting/spam filtering. I can't
take the time to do reports of the spamvertized URLs within them, but
I can do some basic filtering. Google filters the spams very well, and
I can pop them from my spam folder to my Thunderbird program on
Windows. Then I can run some filters there. I have used this method to
very quickly shut down blogspot.com sites, for example... I lart the
Barracuda box owners (as well as support@barracudanetworks.com to
remind them to tell their client to fix their broken configuration)
when I get backscatter from their boxes. There must be other potential
here that is uncapped, with the right tools and enough Backscatter
victims who contribute.

As most are already aware, Matthew Sullivan published a criticism page
taking issue with various aspects of www.dnsbl.com and the measurement
of SORBS effectiveness. I don't know why, but he took that page down
off his site. I cached it on my own site, here:
http://dnsblresourcedata.googlepages.com/criticismfromsorbs

Today, I received the following email, assumably due to the caching of
that page. I'm not going to respond to him, except through counsel as
needed. I'm sharing this here and elsewhere, based on the same reason
that one would post a "cartooney" threat -- when one takes it to the
realm of legal threats, one loses the opportunity to keep it off the
record.

(He, or somebody else claiming to represent SORBS, also filed a DMCA
takedown request against that page. I filed a counter notice.)

I've munged email addresses out of courtesy, below.

From: Matthew
Date: Oct 19, 2007 8:44 AM
Subject: NOTICE 19 Oct 2007
To: Al

In <1192175026.642995.179370@e34g2000pro.googlegroups.com>, on 10/12/2007
at 03:04 PM, joneastwood@gmail.com said:

If what they are doing causes other admins to reject e-mail from your
network, then you need to decide whether pleasing those customers is more
important than providing connectivity to your other customers. Presumably
even the customers responsible for sending UBE won't be happy about the
resulting blocking.

--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@library.lspace.org

In <1191837071.255712.104070@r29g2000hsg.googlegroups.com>, on 10/08/2007
at 12:36 PM, krykino gmail.com> said:

They're lying. They're the ones that are listed.

TMnet TELEKOM MALAYSIA has to clean up its network. If they refuse, or
continue lying to you, then move to a reputable provider.

--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@library.lspace.org

In <1191854191.214475.161240@g4g2000hsf.googlegroups.com>, on 10/08/2007
at 05:01 PM, janavgar@gmail.com said:

Only if he requests it for express delisting of erroneous listings. It's
perfectly reasonable if you were listed due to your own malfeasance,
misfeasance or nonfeasance.

--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@library.lspace.org

In <1191935855.238466.229230@d55g2000hsg.googlegroups.com>, on 10/09/2007
at 04:52 PM, joneastwood@gmail.com said:

While it looks like backscatterer.org is broken, so is your MTA. The 503
means sequence error, which is not the case in your scenario. Either 550
or 553 would seem appropriate.

Does the 50 Euro charge apply to correcting errors? Have you verified that
you are not sending backscatter?

--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@library.lspace.org