To All COMCAST Account Holders

gDay,

I have received several spam messages of late from "people" masquerading as
a comcast.net account holders - I have now black listed the comcast.net
domain on my system. I've also tried to tell comcast that they are being
misused by spammers by sending a message to wemaster@xxxxxx.

If Comcast account holders complain en-masse, rather than just one dude on
the other side of the planet, then one would hope they be more inclined to
do something about it. Please spare a minute to forward this to your
comcast office.

If appropriate feel free to cross post this elsewhere.
--
TUT
__________________________________

I think the best way to give Comcast feedback on this issue is by forwarding
individual spam messages, including headers, to abuse@xxxxxx. That
gives them something concrete to take action against. If you feel that the
response is inadequate, you could try SpamCop.

http://www.spamcop.net/

That's a real live.com address you are using to post, isn't it? This may
help.

http://en.wikipedia.org/wiki/E-mail_spam
http://en.wikipedia.org/wiki/Stoppin...ser_techniques

"E-mail addresses are collected from chatrooms, websites, newsgroups, and
viruses which harvest users' address books, and are sold to other spammers."

For the purposes of the above, this forum is a "newsgroup".

Cheers,

Earle

"Urbane.Tiger" <viking.warrior@xxxxxx> wrote in message
news:c56dneyv_rWbMKnVnZ2dnUVZ_sHinZ2d@xxxxxx

On Thu, 22 May 2008 09:15:12 +1000, Urbane.Tiger wrote:
I posted an example of spam sent through the Comcast SMTP email servers, and
used that as an explanation for why Windows Live Hotmail had blocked those
Comcast servers. The only Comcast users to comment on my post didn't like
hearing that email service operators were willing to block Comcast mail
servers. They seemed to take umbrage with the idea that such abuse was a
Comcast problem.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

I don't understand. You want us to complain to Comcast because
some spammers are forging Comcast.net as their return address?
How sure are you that the origin of that spam really is Comcast.net?

Anyone can use any return address. That's no reflection on the
forged domain. Comcast can't prevent spammers from doing that.

--
Gary VanderMolen, MS-MVP


"Urbane.Tiger" <viking.warrior@xxxxxx> wrote in message news:c56dneyv_rWbMKnVnZ2dnUVZ_sHinZ2d@xxxxxx

I get no spam into viking.warrior
I do not download mail from viking.warrior
Harvesters act on addresses they find in multiple locations, I only use
viking.warrior on m.p.w.l newsgroups
If spam becomes a problem on viking.warrior I'll cancel the account, create
another and change the settings for the m.p.w.l newsgroups

Why use a real account, well if someone here wants to send me a mail then
they should be able to so without having to decipher any obscure disguises.
In newsgroups where I don't want mail then I use fictitious addresses e.g.
sxMB4nzR@xxxxxx

I sent message to abuse@xxxxxx, postmaster failed to deliver ?, yes I
typed it right. That's why I sent to webmaster@xxxxxx which I assume
has been delivered because the postmaster has not told me otherwise. Have
forwarded that email to Spamcop as suggested.
--
TUT
__________________________________

"Earle Horton" <earleh_nospam_@xxxxxx> wrote in message
news:074C78E5-0B2E-41C6-991D-A82727D9FCCC@xxxxxx

It was probably your comments in an earlier post here that made me notice
that this spam was from comcast.net, hence my post

@LarryE posted a messages a day or two ago saying the "problem" had been
fixed, well my evidence is that ain't been fixed


"N. Miller" <anonymous@xxxxxx> wrote in message
news:1d153piva8vwo$.dlg@xxxxxx

When I look at my list of blocked senders most of the senders have obscure
domain names, the following are conspicuous by there absence -- yahoo.com,
hotmail.com, gmail.com, live.com, msn.com, aol.com, verizon.net, demon.net,
bigpond.com, optusnet.com, iinet.com, tpg.com.

Surely that can't be a coincidence, the ones I've listed above as being
absent from my black list must be doing something to stop their domain names
being used - the last four are the bigger Aussie ISP's.

I would have thought that spammers would prefer well known domain names..
Some of the other domain names in my black list are winners.net,
actionambulance.com, fembank.com, holymary.com and ubbi.com, comcast.net is
one of the few domains that has multiple entries (winners.com and
holymary.com are blocked at the domain level), the only others with multiple
entries include are teleconnect.fr (French ISP) and hetnet.nl (Dutch ISP).

I understood that MS recently blocked comcast.net on Hotmail because so much
spam was emanating from that domain. Bad as MS might be, I don't believe
they would block a domain as "big" as comcast.net without just cause and
without thinking that Comcast could do something about it.
--
TUT
__________________________________

"Gary VanderMolen" <Gary@xxxxxx> wrote in message
news:#e7BI#6uIHA.1768@xxxxxx

On Thu, 22 May 2008 13:29:52 +1000, Urbane.Tiger wrote:
When I look at my MTA logs, at the "MAIL FROM" addresses, some of those
domains you listed are very conspicuous by their presence:

| T 20080510 005304 482471df Connection from 166.214.63.245
| T 20080510 005304 482471df EHLO mobile-166-214-063-245.mycingular.net
| T 20080510 005305 482471df MAIL From:<%User_ID%@msn.com>
| E 20080510 005305 482471df Host 166.214.63.245 blocked by Spamhaus - message rejected.
| T 20080510 005305 482471df Connection closed with 166.214.63.245, 1 sec. elapsed.
|
| T 20080512 001658 48262bce Connection from 219.84.61.41
| T 20080512 001659 48262bce HELO 69.110.230.82
| T 20080512 001659 48262bce MAIL FROM:<%User_ID%@yahoo.com>
| E 20080512 001659 48262bce Host 219.84.61.41 blocked by Spamhaus - message rejected.
| T 20080512 001659 48262bce Connection closed with 219.84.61.41, 1 sec. elapsed.
|
| T 20080521 000124 48334c45 Connection from 124.217.22.21
| T 20080521 000125 48334c45 HELO com4
| T 20080521 000125 48334c45 MAIL FROM:<%User_ID%@west.verizon.net>
| E 20080521 000125 48334c45 Host 124.217.22.21 blocked by Spamhaus - message rejected.
| T 20080521 000134 48334c45 RSET
| T 20080521 000134 48334c45 QUIT
| T 20080521 000134 48334c45 Connection closed with 124.217.22.21, 10 sec. elapsed.
|
| T 20080521 000402 48334c48 Connection from 70.92.238.220
| T 20080521 000403 48334c48 EHLO CPE-70-92-238-220.wi.res.rr.com
| T 20080521 000404 48334c48 MAIL FROM:<%User_ID%@hotmail.com>
| E 20080521 000404 48334c48 Host 70.92.238.220 blocked by Spamhaus - message rejected.
| T 20080521 000405 48334c48 Connection closed with 70.92.238.220, 3 sec. elapsed.
|
| T 20080521 030810 48334c50 Connection from 99.200.16.30
| T 20080521 030810 48334c50 HELO mail.ordernow.com
| T 20080521 030811 48334c50 MAIL FROM:<%User_ID%@gmail.com>
| T 20080521 030829 48334c50 RCPT TO:<%User_ID%@aosake.net>
| E 20080521 030829 48334c50 554 Recipient address rejected: User not allowed in recipient maps table (in reply to RCPT TO command)
| T 20080521 030829 48334c50 Connection closed with 99.200.16.30, 19 sec. elapsed.
|
| T 20080521 094438 48334ca1 Connection from 77.185.81.9
| T 20080521 094439 48334ca1 EHLO brln-4db95109.pool.einsundeins.de
| T 20080521 094441 48334ca1 MAIL FROM:<%User_ID%@hotmail.com>
| E 20080521 094441 48334ca1 Host 77.185.81.9 blocked by Spamhaus - message rejected.
| T 20080521 094442 48334ca1 Connection closed with 77.185.81.9, 4 sec. elapsed.

I have to be careful searching on a couple of the domains you listed; I have
friends with email on those services, and have to exclude them from the
search. A Copenic Desktop search on the networked drive holding my MTA logs
shows a lot of 'demon.co.uk' and 'demon.nl' email addresses; are they
related to 'demon.net' in some way?
Yes, it very well can be a coincidence. My own MTA logs have some of your
missing domains as used from blocked incoming connections.
I only have two domains blocked. I prefer blocking by IP address.
But, if you read the messages reporting the blocking, Hotmail stated that it
was the IP address blocked; probably Comcast's Emeryville, California
mailhost.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

On Thu, 22 May 2008 12:48:33 +1000, Urbane.Tiger wrote:
I wouldn't know. I just check my Hotmail account from time to time. Here are
the relevant headers from a spam item I reported through SpamCop:

| Received: from QMTA06.emeryville.ca.mail.comcast.net ([76.96.30.56]) by bay0-mc5-f7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
| Sat, 17 May 2008 14:10:17 -0700
| Received: from OMTA08.emeryville.ca.mail.comcast.net ([76.96.30.12])
| by QMTA06.emeryville.ca.mail.comcast.net with comcast
| id Skvu1Z0050FhH24A602t00; Sat, 17 May 2008 21:10:17 +0000
| Received: from localhost ([79.87.143.234])
| by OMTA08.emeryville.ca.mail.comcast.net with comcast
| id Sl8V1Z00P53eoV38U00000; Sat, 17 May 2008 21:10:12 +0000

What is, to my eyes, unusual about this spam item is that it is routed
through the Comcast mailhosts. These lines, not email addresses, are what I
use to determine whether spam is coming from Comcast, or someplace else.

The Comcast mailhost in Emeryville, California, had to have been
authenticated using a Comcast customer UserID+Password. Probably obtained by
way of a "phish". Windows Live Hotmail did not block the 'comcast.net'
domain. Read the message reporting the block:

| Diagnostic-Code: smtp; 550 SC-004 Mail rejected by Windows Live Hotmail for
| policy reasons. A block has been placed against your IP address because we
| have received complaints concerning mail coming from that IP address.

The IP address in my spam item, where Hotmail received the item from Comcast
is: 76.96.30.56. I clicked on the "Junk e-mail" item in the drop down menu,
and reported it to Hotmail. No doubt that contributed to Hotmail regarding
76.96.30.56 as a spam source, and blocking it.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

On Wed, 21 May 2008 18:59:52 -0700, Gary VanderMolen wrote:
I don't look at return email addresses. I look at headers. The relevant
headers from one spam item received in one of my Windows Live Hotmail
accounts, and duly reported to Hotmail as junk (and to SpamCop, as well):

| Received: from QMTA06.emeryville.ca.mail.comcast.net ([76.96.30.56]) by bay0-mc5-f7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
| Sat, 17 May 2008 14:10:17 -0700
| Received: from OMTA08.emeryville.ca.mail.comcast.net ([76.96.30.12])
| by QMTA06.emeryville.ca.mail.comcast.net with comcast
| id Skvu1Z0050FhH24A602t00; Sat, 17 May 2008 21:10:17 +0000
| Received: from localhost ([79.87.143.234])
| by OMTA08.emeryville.ca.mail.comcast.net with comcast
| id Sl8V1Z00P53eoV38U00000; Sat, 17 May 2008 21:10:12 +0000

This spam item very definitely was sent through Comcast mailhosts, and
SpamCop would have forwarded a report to Comcast abuse on my behalf. The
Windows Live Hotmail team would have aggregated my "Junk e-mail" report with
a multitude of similar reports from other Hotmail users, and imposed a block
against: 'QMTA06.emeryville.ca.mail.comcast.net ([76.96.30.56])'. It would
have taken coordination between Comcast and Hotmail admins to sort that out.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum