Overview of spam from Level3.net

6 Jul 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 1 reports

date	posts	total	BI
25 Feb 2000	36	360	113.84	full headers

full history also available

General information about Level3.net

Added 27 Jan 2000 when Tom Saylor started spamming from there.

Level 3 is a major network service provider with pro-spam policies. They have provided hosting to Kevin Lipsitz, Daniel Khoshnood/global2000.com, Brendan Battles, MLeads.com, mediatrec.com, friends.earthscreen.com, Datran, iMedia Networks, Boris Mizhen, Expedite Media Group, E-ListDirect, and many others.

Ownership & Contact Info
Site history
Sample Spam

Ownership & Contact Info

Whois identifies level3.net as

Level 3 Communications, Inc. (LEVEL35-DOM)
   1025 Eldorado Boulevard
   Broomfield, CO 80021
   US

   Domain Name: LEVEL3.NET

   Administrative Contact:
      Level   Customer Care Department  (LC2644-ORG) support@LEVEL3.COM
      +1 (877) 453-8353
   Technical Contact, Zone Contact:
      Level 3 Domain Registrar  (LD339-ORG) dom-reg@LEVEL3.COM
      303-635-9750, Fax- 303-635-9750
   Billing Contact:
      Level 3 Billing Contact  (LB334-ORG) billing@LEVEL3.COM
      (303) 635-9610, Fax- (303) 635-9530

Site history

1 Nov 1999: Hosting Kevin Lipsitz.
27 Jan 2000: Added to tracking list.
Mar 2005: Listed in SPEWS for hosting Daniel Khoshnood / global2000.com. Listed in Spamhaus for hosting Brendan Battles, MLeads.com, and mediatrec.com.
22 May 2006: Currently hosting friends.earthscreen.com phishing site.
22 May 2006: Currently contains 32 Spamhaus listings, including Datran, iMedia Networks, Boris Mizhen, Expedite Media Group, and E-ListDirect,

Sample Spam


  Path: newsfeed.berkeley.edu!newsfeed.enteract.com!netnews.com!
	newshub.northeast.verio.net!verio!news.chicago1.Level3.net!
	news.denver1.Level3.net!Level3!not-for-mail
  From: Zuba Lesleie Stahl <q39za5u3@i272a2d8.com>
  Subject: SUPER-SEXY TOTALLY.HARDCORE
  Newsgroups: alt.sex.stories.bondage,alt.sex.stories.cuckold,
	alt.sex.stories.d,alt.sex.stories.gay,alt.sex.stories.hetero,
	alt.sex.stories.incest,alt.sex.stories.so,alt.sex.stories.tg,
	alt.sex.strip-clubs,alt.sex.strippers.jobs
  Date: 28 Jan 2000 00:12:29 GMT
  Lines: 724
  Message-ID: <3890deed$0$24147@news.sanjose1.level3.net>
  NNTP-Posting-Host: ns1.interx.net
  X-Trace: news.sanjose1.level3.net 949018349 24147 root@209.0.37.2


  begin 755 2000v_L.jpg
  M_]C_X``02D9)1@`!`@$`2`!(``#_[0"X4&AO=&]S:&]P(#,N,``X0DE-`^T`
  M`````!``2`````$``0!(`````0`!.$))30/S```````(``````````$X0DE-
  M)Q````````H``0`````````".$))30/U``````!(`"]F9@`!`&QF9@`&````

  [718 lines of uuencoded binary deleted]

To report spam, contact abuse@level3.net

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Level3.net.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.