So what's wrong with Ibill? They aid some of the most persistent spammers on the net. After receiving multiple spams for fistdeep.com, cumageddon.com, and farmygirls.com (formerly at 203.55.85.123, now 203.55.84.65), and complaining to the upstreams (Virtuahost.net, Aussie.net, Webmail.com.au, He.net, etc.) to no avail, I included Ibill in the loop. They process credit card orders (possibly checks, too) for The Members Area. This is the account name used by these spammers.
I called the Ibill office and was told that I should send complaints to fraud@ibill.com, which I did. No response.
After more spams, I started sending to other addresses besides fraud, abuse, and postmaster@ibill.com. More spams arrive, and I feel like it's time to escalate again. I went to a Yahoo account (in case they were blocking my reports from the spammed account by now) and sent about a dozen copies of the spam to several ibill addresses, as well as aussie.net, webmail, telstra addresses. Lather, rinse, repeat for two or three other spams. Did it today, and got these:
I have made the following alterations: Removal of the Yahoo address used, removal of the unique web token which would be used to confirm the subscription, and insertion of the html tag BR to avoid printing each e-mail as a single line
A1FreePics
Focalex - With IP stamp
ConsumptionJunction
Cyberzine 1st Also with IP
Cyberzine 2nd Also with IP
The IP address listed in the 3 replies which include it is 206.154.135.7
ARIN shows the following info for it
Cable & Wireless USA (NETBLK-CW-O7BLK) CW-O7BLK 206.150.0.0 - 206.157.255.255
LOGICOM, INC. (NET-CW-NETBK-ITS32282) CW-NETBK-ITS32282
206.154.135.0 - 206.154.135.255
Again according to ARIN, the contact info for Logicom is
LOGICOM, INC. (NET-CW-NETBK-ITS32282)
5701 N PINE ISLAND, SUITE 350
TAMARAC, FL 33321
US
Netname: CW-NETBK-ITS32282
Netblock: 206.154.135.0 - 206.154.135.255
Coordinator:
Administrator, DNS (DA712-ARIN) dnsadmin@IBILL.COM
+1-954-718-3000 (FAX) +1-954-724-2801
Record last updated on 08-May-2001.
Database last updated on 30-Dec-2001 19:54:44 EDT.
More
Further, according to Samspade.org, "206.154.135.7 has valid reverse DNS of pix01.ibill.com"
Update
Checked the account again, and there are about 8-10 more items acknowledging my "subscription". I'll see if I can get IP addresses for them, and let the site owners know who is trying to use them as mailbombers.
Pornmail 1
EmailErotica 1
Pornmail 2
TeenMail4Free 1 This one and the other one like it had some HTML & images that I couldn't easily get from Yahoo
Pornmail 3
Pornmail 4
TeenMail4Free 2 Missing HTML & images that I couldn't easily get from Yahoo
TeenMail4Free 3 Missing HTML & images that I couldn't easily get from Yahoo
Postmaster Direct
Update - Cartooney!
Cartooney threat from Ibill!
Note: this person's name & email address appear nowhere else except in his irate email!
My reply
The Spampire Strikes Back
My 2nd reply
Make your own judgement about the company, but keep this in mind - rather than terminate a customer, they chose to spend their time forge-subscribing someone who was fed up enough to complain. I find it amusing that they chose to try to subscribe me to companies which apparently use confirmed opt-in. If they also sent my address to other places, I'll be watching.
Disclaimer: You shouldn't send complaints to anyone in a company other than abuse, postmaster, or registered complaint addresses. You also shouldn't send multiple copies for a single spam. I believe in adhering to this as long as you have the slightest doubt about the character of the companies involved. Ibill, and the others involved in supporting these spammers, removed all doubt for me.
Visit SPEWS.ORG today