[Spam] Picture of a Comcast Zombie in Comcast HSI

Re: [Spam] Picture of a Comcast Zombie

Sun, 23 Apr 2006 20:45:31 EDT

said by JTRockville :

Just curious as to how you went about selecting 67.161.116.127 as an example. What makes it different from all the other Comcast IPs that spew spam?

I have only one entry in my MTA log:

T 20060310 134722 441149e6 Connection from 67.161.116.127
T 20060310 134723 441149e6 HELO c-67-161-116-127.hsd1.wa.comcast.net
T 20060310 134724 441149e6 MAIL FROM: 
E 20060310 134724 441149e6 Host 67.161.116.127 blocked by Spamhaus - message rejected.
T 20060310 134725 441149e6 QUIT
T 20060310 134725 441149e6 Connection closed with 67.161.116.127, 3 sec. elapsed.

But I have heard from this particular Comcast spam zombie (among scores of others).

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Re: [Spam] Picture of a Comcast Zombie

Sun, 23 Apr 2006 17:05:27 EDT

newview :

said by JTRockville :

What makes it different from all the other Comcast IPs that spew spam?

A number of circumstances . . .

•This IP spammed me personally
•The spam sent was indicative of being sent by notorious spammer Bob Soloway
•The IP is in Washington State, (with the toughest anti-spam laws in the US); a complaint was filed with the Washington State AG
•I posted the original thread entitled Paging Comcast Abuse Dept: Zombie Spammer Sighting #45 on Mar 25, 2006 in Comcast.net's Email Forum
•On March 26, an answer to my post from a forum moderator indicated that the issue had been escalated to the Comcast Abuse Department
•A week later, this IP was still spamming
•The next day the moderator posted that the issue had been resolved
•A week later the IP was still spamming
•The same day the moderator posted that, "Abuse was looking into it".
•The following day, the moderator posted that "Abuse is aware and is actively working with this customer."
•The IP is still spamming to this day
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: [Spam] Picture of a Comcast Zombie

Sun, 23 Apr 2006 14:58:39 EDT

JTRockville :

said by newview :

Comcast . . . with their four months knowledge of this IP's constant spamming and their inaction in terminating this customer's account, has crossed the line from incompetence into the realm of outright spam support.

Just curious as to how you went about selecting 67.161.116.127 as an example. What makes it different from all the other Comcast IPs that spew spam?

Re: [Spam] Picture of a Comcast Zombie

Sun, 23 Apr 2006 05:48:42 EDT

CajunTek : Here ya go...

»/faq/11091
--
da Cajun Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Sun, 23 Apr 2006 03:12:55 EDT

newview :

said by cracker 52 :

It wouldn't hurt for anyone who are really upset about this matter to call Comcast executive complaint center at their headquarters to register a complaint.

Phone number, please?
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 22:30:27 EDT

CajunTek : Well they appear to be taking the weekend off again..

Report on IP address: 67.161.116.127
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.4 -66%
Last 30 days 4.7 -33%
Average 4.9

What is this?? a 9 to 5 spammer??? I'm looking forward to see what next week brings :(
--
da Cajun Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 17:02:24 EDT

anon : It wouldn't hurt for anyone who are really upset about this matter to call Comcast executive complaint center at their headquarters to register a complaint. They were very helpful with my connection problems after my getting nowhere with local/regional management. Involvement of top management can finally force those responsible to make necessary action.

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 14:15:21 EDT

NormanS :

said by newview :

•What it is: A negotiated secret deal with otherwise reputable ISPs to circumvent their published AUP/TOS; a deal that weakens or waives the ISPs’ abuse policies in exchange for much higher fees.
•Why they do it: To buy the silence and neglect of the ISPs.
•Does it work? In a few cases, yes.

Used to be a link about "PinkBell" (Pacific Bell) on this site:

»www.loganet.net/~doumakes/abuse/

Doesn't seem to work any more, though. Possibly because PacBell no longer exists, except as a domain name. It is just "at&t", now.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 08:01:13 EDT

newview :

said by CajunTek :

said by newview :
You're starting to suspect Pink Contract, right?

YES

The same thought has crossed my mind.

I would not put it past their sleazy, spam-friendly marketing department to sell Pink Contracts.

Edit:

For those that don't know what a Pink Contract is:

•What it is: A negotiated secret deal with otherwise reputable ISPs to circumvent their published AUP/TOS; a deal that weakens or waives the ISPs’ abuse policies in exchange for much higher fees.
•Why they do it: To buy the silence and neglect of the ISPs.
•Does it work? In a few cases, yes.
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 05:47:10 EDT

CajunTek :

said by newview :
You're starting to suspect Pink Contract, right?

YES
--
da Cajun Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Sat, 22 Apr 2006 00:11:51 EDT

newview :

said by CajunTek :

If this person is a Zombie.. (for some reason I don't think so..)

You're starting to suspect Pink Contract, right?

The evidence is certainly there to show continued spamming from this IP with no action from Comcast to terminate. We have no other recourse but to question why.

Comcast's history regarding spam certainly leads us to suspect that distinct possibility.
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 21:50:26 EDT

CajunTek :

said by newview :
Comcast . . . with their four months knowledge of this IP's constant spamming and their inaction in terminating this customer's account, has crossed the line from incompetence into the realm of outright spam support.

And that is a real bummer.. If this person is a Zombie.. (for some reason I don't think so..) then they should have been shutdown immediately.. and if a business customer.. then, even quicker!!!
--
da Cajun

Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 21:43:49 EDT

NormanS :

Ex .. Ex .. Exactly! {Oops! That was plagiarism, wasn't it!} :D
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 21:02:42 EDT

newview : Comcast . . . with their four months knowledge of this IP's constant spamming and their inaction in terminating this customer's account, has crossed the line from incompetence into the realm of outright spam support.

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 19:06:47 EDT

jbob :

said by madylarian :

This customer should not be allowed to own a computer.
mady

I'll do you one better...the Comcast personnel responsible should not have a job with Comcast, or at least in managing SPAM. :(

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 18:29:51 EDT

madylarian :

said by newview :

Well the spew is back UP again today . . . this is what is consistantly happening.

Spew for a day or two, then drop off the radar for a short time -
spew for a couple days, then drop off the radar for a little while.
{rinse - repeat}

I bet it's part of a large bot net where the various owned machines can be cycled in and out of spam runs to try to avoid detection. Of course, the computer should have been cut off at first notice and by now the account dropped completely. This customer should not be allowed to own a computer.

mady
--
Honi soit qui mal y pense

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 12:45:29 EDT

Morty :

said by CajunTek :

bummer :(

I wonder what these negotiations with the customer are all about... payoffs maybe !?! :o

I honestly think »Annoyed with Comcast abuse dept. is a good answer.

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 06:59:43 EDT

CajunTek : bummer :(

I wonder what these negotiations with the customer are all about... payoffs maybe !?! :o
--
da Cajun Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Fri, 21 Apr 2006 05:44:41 EDT

newview :

said by CajunTek :

Well according to Senderbase the spewing has still dropped off considerably.. I haven't looked at the other reports..

Report on IP address: 67.161.116.127
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.5 -62%
Last 30 days 4.8 -22%
Average 4.9

Well the spew is back UP again today . . . this is what is consistantly happening.

Spew for a day or two, then drop off the radar for a short time -
spew for a couple days, then drop off the radar for a little while.
{rinse - repeat}

04/21/06 - 5:35Am EST
Report on IP address: 67.161.116.127
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 5.2 78%
Last 30 days 4.8 -30%
Average 4.9

»www.senderbase.org/?searchBy=ipa···.116.127
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 22:06:14 EDT

CajunTek : Well according to Senderbase the spewing has still dropped off considerably.. I haven't looked at the other reports..

Report on IP address: 67.161.116.127
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.5 -62%
Last 30 days 4.8 -22%
Average 4.9
--
da Cajun Darn I hate Malware

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 21:00:56 EDT

items : And I do advocate the use of port 465 as well. I do like running submission w/TLS on port 587 and have since configured this on the mail server I manage at work since this discussion started several months ago.

I don't use any of these sorts of services you list (except Comcast now and then) as I go with my own hosting company. I would hope that more and more consumers would ask their ISPs to do this.

md

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 16:12:35 EDT

NormanS : They aren't blocking port 587, they just aren't listening. If you go to the Comcast site, and look through their Help menus, you will find out how to configure mail clients to use port 465 with SSL for accessing the Comcast message submission servers. It should work just as well from the Comcast network as from an at&t connection (which is, mostly, port 25 blocked).

As for other services, well; maybe ISPs aren't compliant, but many mail services are:

AIM Mail: Port 587 (I have not tested whether it requires STARTTLS)
at&t (formerly SBC): Port 587w/oSTARTTLS
Comcast: Port 465w/SSL
GMail: Port 465w/SSL, Port 587w/STARTTLS
GMX Mail: Port 465w/SSL, Port 587w/STARTTLS
MyRealBox: Port 465w/SSL
Yahoo! Mail (U.S.): Port 587w/oSTARTTLS

That is, by no means, an exhaustive list. I believe Earthlink should be included. There are others.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 15:51:24 EDT

items : A good idea... though that would require every other mail service to be RFC compliant, which is not happening anytime soon. Comcast apparently does not care about SMTP submission either as I see port 587 is blocked on their mail servers.

md

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 13:48:25 EDT

NormanS : If Comcast would just follow the lead of Cox, Bellsouth, and at&t. Block outbound port 25 to SMTP servers other than their own message submission servers.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 12:11:34 EDT

99664227 : So easy to pull the plug on the fools who cannot control there PC's. Comcast just terminate the service problem over....

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 10:54:58 EDT

TK Junk Mail :

said by newview :

If a picture is worth a thousand words . . . then this one speaks volumes.

If the Comcast Abuse dept was properly staffed and did its job, these bot controlled PCs would be taken offline until the customer learned to protect their computers. And Comcast just has to take the chance that these idiots will not like that and will go to another provider.
--
--
Join Red Room Forum
BLOG tkjunkmail.blogspot.com
My Web Page

Re: [Spam] Picture of a Comcast Zombie

Mon, 17 Apr 2006 06:12:10 EDT

Morty : I'd get a kick if that computer is really: »Annoyed with Comcast abuse dept.

At least the states match up :o

Re: [Spam] Picture of a Comcast Zombie

Sun, 16 Apr 2006 14:47:15 EDT

newview :

said by CajunTek :

Of course, they're likely just taking Easter off.. :(

Ex..Ex..Exactly

Re: [Spam] Picture of a Comcast Zombie

Sun, 16 Apr 2006 13:54:03 EDT

CajunTek : Senderbase says it's getting better..
Report on IP address: 67.161.116.127
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.7 -41%
Last 30 days 4.8 -20%
Average 4.9

Of course, they're likely just taking Easter off.. :(
--
da Cajun Darn I hate Malware

[Spam] Picture of a Comcast Zombie

Sun, 16 Apr 2006 07:54:15 EDT

newview : If a picture is worth a thousand words . . . then this one speaks volumes.

This IP has been spamming since 12-07-05