Overview of spam from Icl.lu

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

General information about Icl.lu

Previously identified as Vianews.com, it is now believed that the actual site is Icl.lu and the "vianews.com" portion of the Path header is forged.

Email to vianews.com bounces. The name may not even exist. Complaints should be set to postmaster@icl.lu, postmaster@randori.com, postmaster@pagesat.net and postmaster@he.net.

Typical header Paths looks like this:

    Path: ...!newsfeed.wli.net!news.he.net!news.pagesat.net!katana!
	news.icl.lu!news.vianews.com!sfdlvjh.com

    Path: ...!newsfeed.direct.ca!news.he.net!
	katana!news.icl.lu!news.vianews.com!sdlkfj.com

Update: icl.lu seems to have been disconnected from the net. No spam has been received since 8 April 98. It is not clear to me if icl.lu has disconnected vianews.com, or katana.randori.com has disconnected icl.lu or he.net has disconnected katana.randori.com or newsfeed.direct.ca has disconnected he.net.

Icl.lu is

	Inernet Club
	Luxembourg
	Contact: Boden Patrick

According to whoisRandori.com is

	Randori
	PO Box 409
	Mt Aukum, CA 95656-0409

	Administrative Contact:
	Gross, Diane S dsg@RANDORI.COM
	530-620-NEWS 530-620-4FAX

	Technical Contact, Zone Contact:
	Gross, Kevin L klg@RANDORI.COM
	916-620-NEWS 916-620-4FAX

To report spam, contact one or more of

• postmaster@icl.lu
• postmaster@vianews.com
• postmaster@pagesat.net

A complete history may also be available.

General notes:

• Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
• Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
• Some posts may be forgeries intended to look like they came from Icl.lu.
• The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.

This page maintained by Ed Falk