Help - Search - Members - Calendar
Full Version: Earthlink rejecting complaints
hsc message board > Main > hsc Software Support
dtabbutt
Here's what I'm getting from them lately:

QUOTE
Hello,

Thank you for submitting a report to the EarthLink Network Abuse
Department. Unfortunately, we are unable to investigate the email you
forwarded because it does not appear to have originated from the
EarthLink network.

For instructions on determining the origin of an email, please
visit:
http://www.earthlink.net/go/support_8382

If, after reading the above article, you find that the email did NOT
originate from the EarthLink network, we encourage you to submit the
email to the appropriate network.

If you find that the email DID originate from the EarthLink network,
please reply directly to this email.

The EarthLink Appropriate Use Policy, Users Agreement, and Privacy
Policy are available at: http://earthlink.net/about/policies

We appreciate your assistance.

Sincerely,

EarthLink Network Abuse

>Here is the SMTP information.

>SMTP Info Start ====================================

>Received: from asmtp-a063f35.pas.sa.earthlink.net ([207.217.120.220])
>          by sccqmxc91.asp.att.net (sccqmxc91) with ESMTP
>          id <20040721142936q9100k3h1se>; Wed, 21 Jul 2004 14:29:37 +0000
>X-Originating-IP: [207.217.120.220]
>Received: from ppp-78.tvcom.ru ([80.246.69.90])
> by asmtp-a063f35.pas.sa.earthlink.net with asmtp (Exim 4.34)
> id 1BnI0i-0008CF-SO; Wed, 21 Jul 2004 07:24:03 -0700
>Message-ID: <004301c4705a$aa9b4e2b$bff5af47@phkqdsxjyvil>
>Reply-To: "=?windows-1251?B?ZmFu?=" <sarette@dynasty.net>
>From: "=?windows-1251?B?ZmFu?=" <eloisa@softhome.net>
>Subject: =?windows-1251?B?SmFwYW5lc2Ugc2x1dCBnZXRzIGN1bSBvbiBoZXIgZmFjZQ==?=
>Date: Thu, 22 Jul 2004 09:12:23 -0500
>MIME-Version: 1.0
>Content-Type: text/html;
> charset="windows-1251"
>Content-Transfer-Encoding: 7bit
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook Express 6.00.2800.1081
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
>X-ELNK-Trace:
>131c12d8cb2a67580cc1426638a40ef67e972de0d01da940ff5a5c8d2afb26a16a7b90a8fe73
>c41e350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
>X-Originating-IP: 80.246.69.90


><html><body><p><font face="Arial" size="2"><font
>color="#FFFFFF">piesyhgdzeroqwwgdyhbrladiahknocyxsawmcyaygpexshbjleenv<br>
></font>Nasty Asian Cum Drinking Babes<font color="#FFFFFF"><br>
>gzkndugjgqvzyhyzquccolggul<br><img border="0"
>src="http://www.mishkalapusdurik.com/teros.jpg" width="500"
>height="459"><br>
>uesmdlowgjsdashtxuwo<br></font><a
>href="http://www.mishkalapusdurik.com/index.html">
><font color="#000000">Two Asian Sluts Taking Cum Loads</font></a><font
>color="#FFFFFF">
><br>pwqqrvnjphnpibqtprjwxqexdrkgufmnixdxzkwdsghdnsxzjlyxibfrarkdovdqsoursdzb
>hacaaejzln<br>ayiritvslwidhjjfyebkchyxuzududdurzeyyjztovmithrdpadrecgkopyitk
>mhagvhhmvgmfwenvnqpyihvmllwbn<br>tzdnkujhbvdphpedexxggjhygtrnglddowqlgavwepv
>wmdexd<br>
><img border="0" src="http://www.mishkalapusdurik.com/pisa.jpg" width="348"
>height="15"> </font>
><a href="http://www.mishkalapusdurik.com/sera.html"><font
>color="#000000">nutaixypiuxdduxpxz</font></a><font color="#FFFFFF"><br>
>vfoaxaekoukizzibzjkrfqnulhztfuirhxdmdpuyftkatrqvcssvvgxthfouokgnhupstyzadyjf
>jzzsznvidyabxicljsvcsyy<br>zxyuaserwdfmztffb<br>mqgxrixcwxvvmpzhgtzlntpnmtzv
>icebyzdveduznkxdaqmclupxeji</font></font></p>
></body></html>

>SMTP Info End ======================================

>Generated by SpamX Version 1.3.0
>http://www.hendricom.com
Jeff Hendrickson
The email you posted came from Earthlink, no doubt about it.

You should follow up on this, and by all means, keep reporting the Earthlink spammers.
dtabbutt
Jeff,

How can you tell it's from Earthlink?

80.246.69.90 is from Tver in Russia (according to the RIPE database).

Please help me understand so I can do battle with Earthlink.

Thanks,

Don
dtabbutt
I just got yet another reply from Earthlink saying it's not their network.

With three different spams, this makes three reports in a row to Earthlink, with them rejecting all three.

What's going on?

Thanks,

Don
Jeff Hendrickson
Hi Don,

Assuming that Earthlink is not your ISP, consider this entry in the header that you posted.

Received: from asmtp-a063f35.pas.sa.earthlink.net ([207.217.120.220])
by sccqmxc91.asp.att.net (sccqmxc91) with ESMTP
id <20040721142936q9100k3h1se>; Wed, 21 Jul 2004 14:29:37 +0000

According to this, a machine in the att.net domain received this spam from asmtp-a063f35.pas.sa.earthlink.net ([207.217.120.220]), which is in the Earthlink domain, so they should get the spam complaint.

Is Earthlink your ISP or involved in the delivery of your email?

Regs,
-Jeff
Tifferg
Jeff, I see 2 ">X-Originating-IP:" lines in that header, one is the Earthlink one, the other is 80.246.69.90 which looks up as Tver Russia. Could SpamX or Earthlink be getting crossed wires on this? SpamX says it's Earthlink as that is the first one it parses, they say it is Tver.

As to which is the *real* Originating IP ...

Chris

80.246.69.90
ppp-78.tvcom.ru
JSC "TeleNET"
Tver Russia
Russian Federation
Source: whois.ripe.net[B]
Jeff Hendrickson
Hi Chris,

This email probably did originate in Russia, but the delivery server was in the Earthlink domain, so they get the spam report.

Regs,
-Jeff
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2012 Invision Power Services, Inc.