Please read this page carefully

Please read this
page carefully.
It contains the
reason for the
listing and who
to contact about it.

Ref: SBL6045

66.102.32.0/20 is listed on the Spamhaus Block List (SBL)

05-Nov-2004 05:12 GMT | SR

Webfinity/Dynamic Pipe

66.102.32.0/20 is listed on the Register Of Known Spam Operations (ROKSO) database as being assigned to, under the control of, or providing service to a known professional spam operation run by Webfinity/Dynamic Pipe.

dynamicpipe.com / pythonvideo.com / webfinity.net

Has been on and kicked of of muliple networks since this listing.

There is a huge amount of spam related to Dynamicpipe and it has continued for months (see earlier SBL listing, below). Dyamicpipe.com has been thoroughly notified; the current abuse.net listing of abuse@gt.ca, abuse@peer1.net, abuse@bellnexia.net, and postmaster@dynamicpipe.com has been in place since October 3, 2002, and pythonvideo.com has been pointed to abuse@gt.ca, abuse@peer1.net, dp-abuse@peer1.net, and postmaster@pythonvideo.com since September 21, 2002. Despite the notifications, the spam continues unabated.

This is a summary of SBL listings in 216.130.0.0/16 including this listing:

216.130.222.0/23 SBL3232 Jun 19 2002 - 2:2hrs GMT
Creative Media Internet Associates (NETBLK-CMIA-BLK-1) (webfinity.net)

216.130.214.32/27 SBL3278 Jun 25 2002 - 3:54hrs GMT
CanaHosting (NETBLK-CANH-BLK-2) webfinity.net

216.130.200.0/27 SBL3711 Aug 1 2002 - 9:31hrs GMT
Creative Media Productions (NETBLK-DATC-BLK-1) webfinity.net

216.130.192.0/19 SBL4197 Sep 6 2002 - 20:54hrs GMT
dynamicpipe.com / pythonvideo.com / webfinity.net

216.130.202.0/22 SBL5139 Nov 7 2002 - 21:58hrs GMT
dynamicpipe.com / nameshift.com

Here is a summary of the spamvertised domains on Dynamicpipe during Nov. 24, 2002, to Dec. 1. This is one week's worth of spam!

<A HREF="http://amy.pythonvideo.com/forms/signup.phtml?pre_mask=front&site_mask=1261128820&pni=648">

(Link still works just fine as of 1 Dec.)

www.wildflics.com A 216.130.208.70
wildflics.com NS ns.pythonvideo.com
wildflics.com NS ns2.pythonvideo.com
ns.pythonvideo.com A 216.130.196.20
ns2.pythonvideo.com A 216.130.212.11

officialauctions.com A 216.130.199.81
officialauctions.com NS ns.pythonvideo.com
ns.pythonvideo.com A 216.130.196.20

preview.freepornsecrets.net A 216.130.223.139
freepornsecrets.net NS NS1.WEBFINITY.net
freepornsecrets.net NS NS2.WEBFINITY.net
NS1.WEBFINITY.net A 216.130.222.11
NS2.WEBFINITY.net A 216.130.222.12

camgang.com A 216.130.197.216
camgang.com NS ns.pythonvideo.com
camgang.com NS ns2.pythonvideo.com
ns.pythonvideo.com A 216.130.196.20
ns2.pythonvideo.com A 216.130.212.11
camgang.com MX 0 mail.pythonvideo.com
mail.pythonvideo.com A 216.130.212.11

amy.pythonvideo.com A 216.130.196.28
pythonvideo.com NS ns.pythonvideo.com
pythonvideo.com NS ns2.pythonvideo.com
ns.pythonvideo.com A 216.130.196.20
ns2.pythonvideo.com A 216.130.212.11

farm.freakview.com A 216.130.197.248
freakview.com NS NS.PYTHONVIDEO.com
freakview.com NS NS2.PYTHONVIDEO.com
NS.PYTHONVIDEO.com A 216.130.196.20
NS2.PYTHONVIDEO.com A 216.130.212.11

xxxpassport.com A 216.130.207.111
xxxpassport.com NS ns.pythonvideo.com
xxxpassport.com NS ns2.pythonvideo.com
ns.pythonvideo.com A 216.130.196.20
ns2.pythonvideo.com A 216.130.212.11

banners.dollarmachine.com A 216.130.197.181
banners.dollarmachine.com A 216.130.199.98
dollarmachine.com NS ns.casarosso.com
dollarmachine.com NS ns2.casarosso.com
ns.casarosso.com A 216.130.208.60
ns.casarosso.com A 216.130.197.20
ns2.casarosso.com A 216.130.212.87

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Pythonvideo Inc PYTV-BLK-1A (NET-216-130-196-0-1)
216.130.196.0 - 216.130.199.255

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Dynamic Pipe Inc. DYNP-BLK-2 (NET-216-130-208-0-1)
216.130.208.0 - 216.130.209.255

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Pythonvideo Inc PYTV-BLK-2A (NET-216-130-212-0-1)
216.130.212.0 - 216.130.213.255

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Creative Media Internet Associates CMIA-BLK-1 (NET-216-130-222-0-1)
216.130.222.0 - 216.130.223.225
(webfinity.net)

================================================================== ================================================================== ==================================================================

25 Nov 2002:

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Pythonvideo Inc PYTV-BLK-1A (NET-216-130-196-0-1)
216.130.196.0 - 216.130.199.255

Oct 30 2002: 216.130.192.0/19 removed

6 Sep 2002: subject: dynamicpipe.com / pythonvideo.com / mach10hosting.com / adultmaildirect

http://groups.google.com/groups?q=pythonvideo+insubject:email&scoring=d
http://groups.google.com/groups?q=Dynamicpipe&scoring=d
http://groups.google.com/groups?selm=GzmX7.14449%24XC5.13503%40www.newsranger.com

Dynamicpipe.com, long-time host of the Webfinity.net spamgang, has teamed up the Mach10hosting.com gang with their own Pythonvideo.com gang. If they responded at all (which they don't), they'd probably use the same old "affiliate" excuse that all the other porn spammers use. But just like all the others, the spam doesn't stop, the spamvertised pages don't die, they keep getting "hits," and they continue to reap the returns from the spam...including this listing.

Previous SBL listings regarding Dynamicpipe.com:
216.130.200.0/27 live SBL3711 Creative Media Productions (NETBLK-DATC-BLK-1) webfinity.net
216.130.214.32/27 SBL3278 CanaHosting (NETBLK-CANH-BLK-2) webfinity.net
216.130.222.0/23 SBL3232 Creative Media Internet Associates (NETBLK-CMIA-BLK-1) (webfinity.net)

Previous SBL listings regarding Mach10hosting.com:
204.1.28.0/23 SBL3313 mach10hosting.com
65.205.98.0/24 SBX3163 mach10hosting.com
65.205.98.0/24 SBX3064 gnbinternet.com / mach10hosting.com
65.205.98.0/24 SBX3065 gnbinternet.com / mach10hosting.com
65.205.98.0/24 SBX3066 gnbinternet.com / mach10hosting.com
157.238.56.0/24 SBL4194 gnbinternet.com / mach10hosting.com / iccinetwork.com / adultmaildirect.net
157.238.60.0/24 SBL4195 gnbinternet.com / mach10hosting.com / iccinetwork.com / adultmaildirect.net

Dynamic Pipe Inc. DYNAMIC-PIPE-BLK-1 (NET-216-130-192-0-1)
216.130.192.0 - 216.130.223.255
Creative Media Internet Associates CMIA-BLK-1 (NET-216-130-222-0-1)
216.130.222.0 - 216.130.223.225

AS19961 (DynamicPipe) feeds are AS6539 (gt.ca), AS577 (bellnexxia.net), and AS13768 (peer1.net).

OrgName: Dynamic Pipe Inc.
OrgID: DYNAMI-102
ASNumber: 19961
ASName: DYNAMIC-PIPE
ASHandle: AS19961
Comment:
RegDate: 2001-03-08
Updated: 2002-02-25
TechHandle: ON30-ARIN
TechName: Network, Operattons
TechPhone: +1-416-530-2709
TechEmail: abuse@dynamicpipe.com

Sample spam:
>Received: from ncmx02.mgw.rr.com ([24.93.67.222]) by mail5.sc.rr.com with Microsoft SMTPSVC(5.5.1877.757.75);
> Tue, 27 Aug 2002 19:39:26 -0400
>Received: from mx5.adultmaildirect.net (mx5.adultmaildirect.net [157.238.60.63])
> by ncmx02.mgw.rr.com (8.12.2/8.12.2) with SMTP id g7RMwpbt002277
> for <xxxx@sc.rr.com>; Tue, 27 Aug 2002 18:58:51 -0400 (EDT)
>Message-Id: <200208272258.g7RMwpbt002277@ncmx02.mgw.rr.com>
>Received: (qmail 27211 invoked by uid 99); 27 Aug 2002 22:52:52 -0000
>Received: from unknown (HELO adultmaildirect.net) (157.238.56.14)
> by mx5.adultmaildirect.net with SMTP; 27 Aug 2002 22:52:52 -0000
>Date: Tue, 27 Aug 2002 17:17:24 -0500
>From: stacey@adultmaildirect.net
>Subject: Super Sl*ts in XXX Action! FREE! ADULT
>To: Subscribers@ncmx02.mgw.rr.com
>Precedence: 1
>Importance: High
>Reply-to: chillin23@rome.com
>X-MSMail-Priority: High
>X-Priority: 1 (Highest)
>X-Server: 4
>Content-type: text/html
>X-SuperMailer: 1.0
>Return-Path: stacey@adultmaildirect.net
>

<hml>
<head>
<title>Blowqueen</title>
</head>

<body bgcolor="#000000">

<TABLE WIDTH=511 BORDER=0 CELLPADDING=0 CELLSPACING=0 ALIGN="CENTER">
<TR>
<TD>
</TD>
<TD>
</TD>
<TD>
</TD>
</TR>
<TR>
<TD COLSPAN=3>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
</TR>
<TR>
<TD ROWSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
<TD COLSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
</TR>
<TR>
<TD COLSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
</TR>
<TR>
<TD COLSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
<TD ROWSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
</TR>
<TR>
<TD COLSPAN=2>
<A HREF="http://www.supersluts.com/index.phml?1261265620">
</A></TD>
</TR>
</TABLE>

<center>
 
<a href="http://8c1a193c2c96f5319502fd14fc5bf69d.purvebucks.com/"><img src="http://www.adultmaildirect.net/bighard.gif"> Sumthin' For the Ladies!</a> 
 

<hr size="3" width="60%">
 
you have received this letter because
you or someone posing as you opted in to receive promotional materials, 
you can cancel immediately by using the link below. 


<a href="http://www.adultmaildirect.net/cgi-bin/remove.cgi">Cancel Your Subscription
Here cancelling will remove you from our list, and deactivate your free membership</a> 
Under Bill s.1618 TITLE III passed by the 105th US Congress this letter cannot be 
considered,
Spam as long as the sender includes contact information & a method of removal. To be removed 
from future mailings just click on the link above 
<a href="mailto:abuse@adultmaildirect.net"><img src="http://www.adultmaildirect.net/spam.gif" border="0">
</a>


</body>
</hml>

spam samples:
dynamicpipe.com
pythonvideo.com
webfinity.net
whois -h whois.abuse.net dynamicpipe.com
whois -h whois.abuse.net pythonvideo.com

Notes for ARIN Abuse/Security

A listing in the ROKSO database means that this spammer has already been terminated by a minimum of 3 Internet networks for spam offenses. ROKSO spammers are professional spam gangs, they will use every trick in order to stop you from terminating them. Please do not allow your network to be a haven for ROKSO spammers, doing so puts your network in the position of "Knowingly providing Spam Support Service".

ROKSO records for Webfinity/Dynamic Pipe (dynamicpipe.com / pythonvideo.com / webfinity.net)

Removal Procedure

As this is a known professional spam operation, it is important that all service to the Webfinity/Dynamic Pipe spam operation be terminated before this listing can be removed from the SBL. There can be no functioning web site, mail or DNS server still serving the spam operation in 66.102.32.0/20.

To have record SBL6045 (66.102.32.0/20) removed from the SBL, the Abuse/Security representative of ARIN (or the Internet Service Provider responsible for connectivity to 66.102.32.0/20) needs to contact the SBL Team to advise how the spam problem has been terminated.

If you are a representative of ARIN, you also need to see this:
Current ARIN SBL Listings

The SBL is an international anti-spam system maintained by The Spamhaus Project and used by Internet networks to protect customers from spam sources and spam services. The SBL lists only IP addresses (not domains or addresses). If you are unable to send email due to this SBL listing, please contact your Internet Service Provider and show them this page - your Service Provider needs to contact Spamhaus to resolve the issue. (If you are not the Internet Service Provider, please do NOT contact us.)