Deadbeats' Hall of Lame, Nancynet.com Page 1
Do not sign me up for any mail lists. Studio42 does not accept such unsolicited business. Also, since I've recently been getting a flood of such e-mail from various people and organizations I don't wish to deal with, their names will end up here, along with their home and business addresses, and phone numbers, whenever possible.
Please realize that 99.9% of internet users DON'T want your crap in our e-mail boxes.
Minimum fine for violation of this policy allows me to legally bill/invoice for $500 and this can be escalated to a court of law.
Last update: 08/31/1997 for a persistent spammer update. Three times so far.
And now, without further ado, Studio42 presents the:
Internet Deadbeats' HALL OF LAME, Special Nancynet.com Edition Page 1
Subject: FREE SAMPLES......FOREIGN SALES
Date: 08/04 6:22 AM
Received: 08/04 8:00 AM
From: Foreign Sales 4U, laohee@gosnet.com
Reply-To: scot2361@mohaveksonz.com
To: scot2361@mohaveksonz.com
See the spam
This person who can't find the caps lock key "found" me on the internet. Obviously
he bought some list. He wants to increase my foreign sales, mainly by making me
push their product. They want me to send them the email address of the president
of my company. That would be me. Wow, think of all the middle-people we just
bypassed!
Now, the "reply to" domain does not exist. I know this because I recieved an error
message when my automated spam fighter sent an auto response. This spam fighter
works on anything that sends me an email that does not contain a recipient that
is one of my valid accounts. Mailing lists show the list as the recipient, so you
can see how a HUGE majority of spam is auto flamed.
So, let's do some look-ups regarding this company that refuses to identify itself:
>whois gosnet.com
Global Online Solution Network (GOSNET2-DOM)
PO Box 273
Walnut, CA 91788
US
Domain Name: GOSNET.COM
Administrative Contact:
Castro, Russel (RC2846) datalink@GOSNET.COM
818-965-0227
Technical Contact, Zone Contact:
Gladys Crocker (GC29-ORG) gladys@NANCYNET.COM
415-440-2987
Billing Contact:
Castro, Russel (RC2846) datalink@GOSNET.COM
818-965-0227
Record last updated on 15-Dec-96.
Record created on 15-Dec-96.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
NS1.NANCYNET.COM 205.199.4.3
NS2.NANCYNET.COM 205.199.4.67
Well, we're off to a good, but bad start. I found out now that this is CyberPromo
garbage. Look at the CyberPromo 2 Page to see other
examples of NancyNet domains deliberately altering their whois entries to avoid
complaints.
>whois skypoint.com
Skypoint Communications (SKYPOINT-DOM)
640 Orchid Lane
Plymouth, MN 55447
US
Domain Name: SKYPOINT.COM
Administrative Contact:
Kemnitz, Greg (GK132) gk@SKYPOINT.COM
612-475-2959 (FAX) 612-449-0488
Technical Contact, Zone Contact:
Hostmaster, SkyPoint (SH1411) hostmaster@SKYPOINT.COM
(612) 475-2959
Billing Contact:
Department, Billing (BD390) nic-bills@SKYPOINT.COM
(612)-475-2959
Record last updated on 13-Dec-96.
Record created on 04-May-93.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
MINUET.SKYPOINT.NET 199.86.32.2
NS2.SKYPOINT.NET 199.86.32.4
NS1.ROCKYMTN.NET 166.93.1.3
So, let's look up "rockymtn.net" and "skypoint.net":
>whois skypoint.net
SkyPoint Communications (SKYPOINT2-DOM)
640 Orchid Lane
Plymouth, MN 55447
US
Domain Name: SKYPOINT.NET
Administrative Contact:
Kemnitz, Greg (GK132) gk@SKYPOINT.COM
612-475-2959 (FAX) 612-449-0488
Technical Contact, Zone Contact:
Hostmaster, SkyPoint (SH1411) hostmaster@SKYPOINT.COM
(612) 475-2959
Record last updated on 20-Dec-96.
Record created on 18-Jan-94.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
MINUET.SKYPOINT.NET 199.86.32.2
NS2.SKYPOINT.NET 199.86.32.4
NS1.ROCKYMTN.NET 166.93.1.3
>whois rockymtn.net
Rocky Mountain Internet (ROCKYMTN-DOM)
2860 South Circle Drive, Suite 2202
Colorado Springs, CO 80906
USA
Domain Name: ROCKYMTN.NET
Administrative Contact, Technical Contact, Zone Contact:
Dingess, Richard (RD46) rkd@RMI.NET
(719) 576-6845
Billing Contact:
Dingess, Richard (RD46) rkd@RMI.NET
(719) 576-6845
Record last updated on 12-Mar-96.
Record created on 22-Nov-93.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
NS1.ROCKYMTN.NET 166.93.1.3
NS2.ROCKYMTN.NET 166.93.8.2
NIS.ANS.NET 147.225.1.2
NS.ANS.NET 192.103.63.100
Oh joy. More to look up. Remember, ALL of these addresses are valid complaint addresses,
as far as I'm concerned.
>whois ANS.NET
ANS CO+RE Systems, Inc. (ANS-DOM)
100 Clearbrook Road
Elmsford, NY 10523
Domain Name: ANS.NET
Administrative Contact:
Hershman, Ittai (IH4) ittai@ANS.NET
(914) 789-5337
Technical Contact:
ANS Network Operations Center (ANS-NOC) noc@ANS.NET
1-800-456-6300
Zone Contact:
ANS Hostmaster (AH-ORG) hostmaster@ANS.NET
(800)456-6300 fax: (914)789-5310
Record last updated on 03-Jan-97.
Record created on 27-Sep-90.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
NS.ANS.NET 192.103.63.100
NIS.ANS.NET 147.225.1.2
>whois RMI.NET
Rocky Mountain Internet (RMI3-DOM)
2860 South Circle Drive, Suite 2202
Colorado Springs, CO 80906
USA
Domain Name: RMI.NET
Administrative Contact, Technical Contact, Zone Contact:
Dingess, Richard (RD46) rkd@RMI.NET
(719) 576-6845
Record last updated on 05-Jan-97.
Record created on 20-Jan-95.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
NS1.ROCKYMTN.NET 166.93.1.3
NS2.ROCKYMTN.NET 166.93.8.2
Now let's look up the listed reply address. Look at the spam for this one.
>whois servmail.com
Servmail Technologies (SERVMAIL-DOM)
P O Box 980371
Rowland Heights, CA 91748
US
Domain Name: SERVMAIL.COM
Administrative Contact:
Kabale, Mary (MK3652) mary@SERVMAIL.COM
818-810-2478 (FAX) 818-810-2479
Technical Contact, Zone Contact:
Fricke, David (DF822) dave@SEINC.NET
414-942-0479 (FAX) 414-942-0503
Billing Contact:
Kabale, Mary (MK3652) mary@SERVMAIL.COM
818-810-2478 (FAX) 818-810-2479
Record last updated on 03-Jul-97.
Record created on 03-Jul-97.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
MAILBACK.VCITY.NET 207.7.23.71
WINTER.VCITY.NET 207.7.23.3
DILBERT.VCITY.NET 207.7.23.17
Damn, more to look-up. This is CyberPromo due to all the domains involved.
>whois VCITY.NET
Southwind Enterprises, Inc. (VCITY3-DOM)
8600 Sheridan Road
Kenosha, WI 53143
Domain Name: VCITY.NET
Administrative Contact, Technical Contact, Zone Contact:
Fricke, David (DF822) dave@SEINC.NET
414-942-0479 (FAX) 414-942-0503
Billing Contact:
Fricke, David (DF822) dave@SEINC.NET
414-942-0479 (FAX) 414-942-0503
Record last updated on 24-Jul-96.
Record created on 22-Mar-96.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
WINTER.VCITY.NET 207.7.23.3
DILBERT.VCITY.NET 207.7.23.17
Almost done. I think...
>whois SEINC.NET
Southwind Enterprises, Inc. (SEINC3-DOM)
8600 Sheridan Road, PO Box 4055
Kenosha, WI 53143
US
Domain Name: SEINC.NET
Administrative Contact, Technical Contact, Zone Contact:
Fricke, David (DF822) dave@SEINC.NET
414-942-0479 (FAX) 414-942-0503
Billing Contact:
Fricke, David (DF822) dave@SEINC.NET
414-942-0479 (FAX) 414-942-0503
Record last updated on 13-Dec-96.
Record created on 13-Dec-96.
Database last updated on 4-Aug-97 04:29:21 EDT.
Domain servers in listed order:
WINTER.VCITY.NET 207.7.23.3
DILBERT.VCITY.NET 207.7.23.17
MAILBACK.VCITY.NET 207.7.23.71
Still, looking back, this is NancyNet, and therefore at least an Agis.net customer.
This is definately a spamming domain. I don't hvae time to do traceroutes, and my poor
analog connection is taking more hits than a crack-head on a binge. This will be updated
shortly with any interesting traceroutes, either done at home or from the office. Either
way, the traces will be done through the same service provider, so only the first gateway
address will be different.
In the meantime, just to my skills don't get rusty:
telnet> open servmail.com 25
Trying 207.7.21.171...
Connected to servmail.com.
Escape character is '^]'.
220 X1 NT-SMTP Server servmail.com (IMail 4.0 1413-2)
vrfy user2361
250 ok, its for
Valid user. So at least I know the address they want me to reply to is valid.
Subject: suggestion
Date: 08/07 11:27 PM
Received: 08/08 8:20 AM
From: Kate, ace@sfsac.com
Reply-To: Catherine Lake, catherine@ctynet.com
To: onlinepublic@large.com
See the spam
My suggestion to this idiot is to stop spamming their horrible contact manager.
Yet another IEMMC. Now they are spamming my MediaCity account. Now I get to
start the "removal" process again.
Let's do a few "whois" look-ups, mainly out of force of habit. This will most likely
be the final entry to this page. Now I get to start a new page.
>whois ctynet.com
42nd Street Productions (CTYNET-DOM)
P.O. Box 161018
San Diego, CA 92176
US
Domain Name: CTYNET.COM
Administrative Contact:
Guido Puchini (GP38-ORG) puchini@CTYNET.COM
619-281-2792
Technical Contact, Zone Contact:
Gladys Crocker (GC29-ORG) gladys@NANCYNET.COM
415-440-2987
Billing Contact:
Guido Puchini (GP38-ORG) puchini@CTYNET.COM
619-281-2792
Record last updated on 07-Dec-96.
Record created on 07-Dec-96.
Database last updated on 8-Aug-97 04:26:38 EDT.
Domain servers in listed order:
NS1.NANCYNET.COM 205.199.4.3
NS2.NANCYNET.COM 205.199.4.67
And so it begins. See a pattern?
sfsac.com is a bogis domain. No shocker there.
>whois large.com
Consultants at Large (LARGE-DOM)
3890 F S. Atchison Way
Aurora, CO 80014
US
Domain Name: LARGE.COM
Administrative Contact:
Notov, Daniel (DN43) danno@LARGE.COM
(303) 766-2680
Technical Contact, Zone Contact:
Phillips, Chris (CP3) ckp@RMII.COM
(719) 576-6845
Record last updated on 30-Dec-96.
Record created on 05-May-94.
Database last updated on 8-Aug-97 04:26:38 EDT.
Domain servers in listed order:
NS1.ROCKYMTN.NET 166.93.1.3
NS2.ROCKYMTN.NET 166.93.8.2
Hmm, I've looked up "rockymtn.net" in the past. Let me look up the other listed domain.
>whois RMII.COM
Rocky Mountain Internet (RMII-DOM)
2860 South Circle Drive, Suite 2202
Colorado Springs, CO 80906
USA
Domain Name: RMII.COM
Administrative Contact, Technical Contact, Zone Contact:
Dingess, Richard (RD46) rkd@RMI.NET
(719) 576-6845
Record last updated on 05-Jan-97.
Record created on 25-Jun-94.
Database last updated on 8-Aug-97 04:26:38 EDT.
Domain servers in listed order:
NS1.ROCKYMTN.NET 166.93.1.3
NS2.ROCKYMTN.NET 166.93.8.2
Now let's look up the domain. I'll have to check the web site to find a contact address.
>whois sfsace.com
Santa Fe Software (SFSACE-DOM)
16835 W. Bernardo Drive, #209
San Diego, CA 92127
USA
Domain Name: SFSACE.COM
Administrative Contact:
Smart, Rhonda (RS4732) berkley@SFSACE.COM
619-673-5313 (FAX) 619-673-7399
Technical Contact, Zone Contact:
Adams, Scott (SA389) sadams@COMPUWEB.COM
215-751-0122 (FAX) 215-751-0121
Billing Contact:
Berkley, Bill (BB3505) berkley@SFSACE.COM
619-673-5313 (FAX) 619-673-7399
Record last updated on 27-Jan-97.
Record created on 12-Apr-96.
Database last updated on 8-Aug-97 04:26:38 EDT.
Domain servers in listed order:
CHELSEA.COMPUWEB.COM 206.233.204.2
HELLSKITCHEN.COMPUWEB.COM 206.233.204.4
Well, I found my contact address, damn spammers.
Sheesh. No break for me. More to look up.
>whois COMPUWEB.COM
Compuweb (COMPUWEB4-DOM)
PO Box 42186
Philadelphia, PA 19101
US
Domain Name: COMPUWEB.COM
Administrative Contact, Technical Contact, Zone Contact:
Adams, Scott (SA389) sadams@COMPUWEB.COM
215-751-0122 (FAX) 215-751-0121
Billing Contact:
Adams, Scott (SA389) sadams@COMPUWEB.COM
215-751-0122 (FAX) 215-751-0121
Record last updated on 02-Aug-97.
Record created on 02-Aug-97.
Database last updated on 8-Aug-97 04:26:38 EDT.
Domain servers in listed order:
CHELSEA.COMPUWEB.COM 206.233.204.2
SEC1.DNS.PSI.NET 38.8.92.2
SEC2.DNS.PSI.NET 38.8.93.2
PSI, the new tolerant nationwide service provider.
All done. Damn spammers.
But wait, there's more!
Subject: suggestion
Date: 08/07 11:27 PM
Received: 08/08 8:07 AM
From: Kate, ace@sfsac.com
Reply-To: Catherine Lake, catherine@ctynet.com
To: onlinepublic@large.com
See the spam
This time my master account for a domain is being spammed. Hold it, that's how the
previous one is too. I think this scammer is targeting MediaCity just out of defiance
to their spam fighting package.
In my early morning rage, I skipped a listed domain. In order to maintain accuracy,
I'll document that one now: gen6.com, which is a bogus domain, so I'll do a DNS lookup:
DNS look-up to: 208.9.77.65 failed.
It does exchange between MCI and Sprint, so I think this is a relatively new address
because my ISP uses OSPF(Open Shortest Path First) to ensure most reliable and fastest
service. It is distinctly possible that this address is valid, but as a static IP
on a dial-up type account. At any rate, it's not online as I type this one up.
So, I go back to IEMMC yet again and have other addresses removed. You know, this crap
is getting old real quick. I also know for a fact that IEMMC is not actually removing
addresses, I think they just move them to another list so the victim can cool off, and
after a week or so, the spam starts again. Keep checking my IEMMC Report
page for the lastest in this ongoing saga of pointlessness.
UPDATE: December 22, 1999
No spam case is ever considered closed around here. Despite this beeing at least 2
years old, I still take the time to update the records. This is being posted intact
with the permission of the author. This shows the negative that spammers intentionally
create to the victim's domain they forge. This will count as an "other".
See the update
Subject: Net Sales & Fraud with Credit Cards
Date: 08/29 9:35 PM
Received: 08/30 9:12 AM
From: 70451580@aol.com
Reply-To: 4profittomorrow@urawinerin1998.net
To: 4profittomorrow@urawinerin1998.net
See this spam
At first I assumed this was so I could be assisted in committing credit card
fraud. Since this is spam, it would not be beyond these people.
No, instead they claim to prevent credit card fraud by charging you WAY too
much per transaction to verify the card. They are running their own rip-off
scam.
Of course, they are using bogus email addresses and covering their tracks.
Don't all respectable businesses do that?
>whois urawinerin1998.net
No match for "URAWINERIN1998.NET".
See? A forged addressed, to prevent flames. That doesn't mean they can't be
caught. That's what headers are for, although CyberPromo does seem to have
the edge in forging headers as well.
This did come from Pacific Bell's internet service, where I've already filed
a complaint. I am also reporting this to my ISP so they can take new measures
to block spam using invalid IP addresses.
Let's check out the web site that is so bogged down that it won't accept connections.
This is most likely from people like me deliberately abusing the service in ways not
explained on this site.
>whois ascella.net
Online Marketers Association (ASCELLA-DOM)
60 Canterbury Court, #701
Orange Park, FL 32065
Domain Name: ASCELLA.NET
Administrative Contact:
Staff (STA8-ORG) webmaster@REGULUS.NET
[No phone]
Technical Contact, Zone Contact:
Fluorov, Alex (AF1148) af@REGULUS.NET
[No phone]
Billing Contact:
Staff (STA8-ORG) webmaster@REGULUS.NET
[No phone]
Record last updated on 28-Jul-97.
Record created on 11-Feb-97.
Database last updated on 30-Aug-97 04:34:09 EDT.
Domain servers in listed order:
NS1.REGULUS.NET 205.199.4.206
NS2.NANCYNET.COM 205.199.4.67
Aha! NancyNet garbage. I can stop right now.
Subject: Selling on the Net & Credid Card Fraud
Date: 08/30 5:48 PM
Received: 08/30 10:24 PM
From: 33699685@aol.com
Reply-To: profittomorrow@winnerin1998.net
To: profittomorrow@winnerin1998.net
See this spam
Apparently once isn't enough for this bastards. I'll quickly look up their new bogus
domain, out of habit.
>whois winnerin1998.net
No match for "WINNERIN1998.NET".
Gee, no shocker there. Same path through Pacific Bell. This sure saves me a lot of time.
However, I should have reported their phone numbers earlier. Sorry for those of you
who like making operator assisted collect calls to voice your feelings about spam:
904-385-0499, voice
916-847-1052, hey, that is fairly local to me. I think I'll bitch them out tomorrow.
If you are one of the dilweeds who sent me unsolicited email or are someone thinking about it, drop dead.
Also, if you've got a complaint about my anti-spam feelings or want to scold me for being justifiably sick of spam, I have the following words of wisdom for you:
BLOW IT OUT YOUR ASS!
Anyone else, I'd like to hear from you. Click below and drop me a line.
Anti-Spam Site administrator
|
The Deadbeats Hall of Lame
