Subject:     Re: Fwd: Great Shirt
Date:        7/12/98 11:46
To:          Joseph Thomas, jfthomas@mindspring.com

On 7/12/98 02:01, Joseph Thomas sent the following ASCII stream:

>Hi ho....
>
>Talk about gall....
>
>At the end of this one, it says, 
>
>To remove yourself from all future mailings please enter the global remove
> list at:  http://www.remove-list.com    Thank You, Worldnet Marketing, Inc. 
>
>Which is a link to a page that offers to have you removed from spam lists
>for a fee.  I have to pay this guy to stop him from sending me spam?????
>
Sounds like extortion to me. "Pay me some protection money" basically, as they harvest and 
sell your email address to the entire world.


>I sent my complaint about this one to turbo.kean.edu.  Here's hoping that
>user500.mel1net34.net loses his internet privileges and flunks etiquitte.
>

Uhm you just flunk "header reading 101".  mel1net34.net is an invalid domain. Doesn't exist.

>I'm thinking about having a spam page on my website, and wonder if you mind
>my (1) stealing stuff from your website and (2) linking to your website. 

Depends on what you want to steal. You may link, and you can add a link back to yourself.


>
>Joe
>
>Here's the spam...

Starting with your UNEDITED headers:

Return-Path: <barbra@networld.com.br> 
Received: from turbo.kean.edu
(TURBO.Kean.EDU [131.125.1.1]) 
by camel10.mindspring.com (8.8.5/8.8.5)
with ESMTP id VAA13570; 
Sat, 11 Jul 1998 21:26:02 -0400 (EDT) 
From:
barbra@networld.com.br 
Received: from user500.mel1net34.net by
turbo.kean.edu (8.8.7/1.1.20.3/16Feb98-1127AM) 
id VAA0000020166; Sat, 11
Jul 1998 21:19:55 -0400 (EDT) 
Message-Id:
<199807120119.VAA0000020166@turbo.kean.edu> 
To: jfs@icf.hrb.com 
Subject:
Great Shirt 
Reply-To: barbra@networld.com.br 
Date: Wed, 4 Jul 98 16:24:52
EST 

Hmm, the squashed formatting makes it hard for me to read.

Return-Path: <barbra@networld.com.br> 
Received: from turbo.kean.edu
(TURBO.Kean.EDU [131.125.1.1]) 
by camel10.mindspring.com (8.8.5/8.8.5)
with ESMTP id VAA13570; 

OK, the hijacked server is:
>nslookup 131.125.1.1
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    TURBO.Kean.EDU
Address:  131.125.1.1
Confirmed.

Sat, 11 Jul 1998 21:26:02 -0400 (EDT) 
From:
barbra@networld.com.br 
Received: from user500.mel1net34.net by
turbo.kean.edu (8.8.7/1.1.20.3/16Feb98-1127AM) 
id VAA0000020166; Sat, 11
Jul 1998 21:19:55 -0400 (EDT) 

Unfortunately, the server is poorly configured. I don't feel like bouncing test messages 
when offering assistance. This is all you need to see to know this is a forgery:

>whois mel1net34.net
No match for "MEL1NET34.NET".


Message-Id:
<199807120119.VAA0000020166@turbo.kean.edu> 
To: jfs@icf.hrb.com 

Yeah, like this is really "to" you.

Subject:
Great Shirt 
Reply-To: barbra@networld.com.br 

Address forgery.

Date: Wed, 4 Jul 98 16:24:52
EST 

Now the removal site:
>nslookup www.remove-list.com
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    sun.remove-list.com
Address:  142.176.13.105
Aliases:  www.remove-list.com

cpickett@MediaCity>traceroute www.remove-list.com
traceroute to sun.remove-list.com (142.176.13.105), 30 hops max, 40 byte packets
 1  grfge002 (205.216.172.1)  0.371 ms  0.300 ms  0.286 ms
 2  bordercore2-hssi0-0-0.SanFrancisco.mci.net (166.48.15.249)  2.355 ms  2.270ms  2.232 ms
 3  bordercore3.WestOrange.mci.net (166.48.8.1)  68.343 ms  68.333 ms  68.346 ms
 4  bell-advance-communications.WestOrange.mci.net (166.48.9.250)  78.658 ms  78.103 ms 78.892 ms
 5  bxnrt-atm1-0.halifax.canet.ca (205.207.238.78)  96.053 ms  94.938 ms  94.825 ms
 6  gw-mttac.halifax.canet.ca (206.108.110.34)  97.404 ms  95.167 ms  94.877 ms
 7  142.177.160.6 (142.177.160.6)  100.913 ms  101.193 ms  96.569 ms
 8  bis-i012.mtt.net (142.177.130.15)  128.155 ms  128.278 ms  129.173 ms
 9  sun.remove-list.com (142.176.13.105)  133.241 ms  156.740 ms  131.326 ms

>whois remove-list.com

Registrant:
PinPoint Media (REMOVE-LIST-DOM)
   15 Hillview Dr.
   Dartmouth, ns b2w4j2
   CA

   Domain Name: REMOVE-LIST.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Rose, Chris  (CR1502)  chris@PINPOINT.NS.CA
      (902) 499-0588 (FAX) (902) 466-1189
   Billing Contact:
      Rose, Chris  (CR1502)  chris@PINPOINT.NS.CA
      (902) 499-0588 (FAX) (902) 466-1189

   Record last updated on 25-Jun-98.
   Record created on 24-Feb-98.
   Database last updated on 12-Jul-98 08:36:20 EDT.

   Domain servers in listed order:

   DZ1.SKYDIVER.NET             142.176.13.84
   METIS.AAIT.COM               142.176.13.80

Non-routable addresses. Complain to: abuse and postmaster @ canet.ca

Done.



OK, the phone number:
Indicates something in the south Bay Area. Basically: south of San Fransciso and north of San Jose.
1-650-617-3754