[8014] in North American Network Operators' Group
RE: Paul Vixie did not spam you (this is an automated response)
daemon@ATHENA.MIT.EDU (Ry Jones)
Thu Mar 6 16:23:31 1997
From: Ry Jones <rjones@wicker.com>
To: "'Geoff White'" <geoffw@precipice.v-site.net>,
"peter@demon.net"
<peter@demon.net>
Cc: "geertj@ripe.net" <geertj@ripe.net>, "nanog@merit.edu"
<nanog@merit.edu>,
Paul Vixie <paul@vix.com>
Date: Thu, 6 Mar 1997 13:15:40 -0800
These are the same guys that the WA state AG shut down for mail fraud. =
I'm suprised they have the nuts to pop up again; this topic was beat to =
death on Seattle.General about 5 or 6 months ago.
----------
From: Geoff White[SMTP:geoffw@precipice.v-site.net]
Sent: Thursday, March 06, 1997 4:14 AM
To: peter@demon.net
Cc: Paul Vixie; geertj@ripe.net; nanog@merit.edu
Subject: Re: Paul Vixie did not spam you (this is an automated =
response)
On Thu, 6 Mar 1997, Peter Galbavy wrote:
> cc'ed to nanog@ FYI
>=20
> Paul Vixie wrote:
> > Today I started receiving a massive number of e-mail bounces and =
complaints
> > about spam. I immediately realized that someone had abused the =
network in my
> > name; sure enough, I shortly received the evidence shown below. I =
apologize
> > for this form letter response, but I'm expecting another 10,000 =
complaints and
> > I do not plan to send personalized replies to each one.
>=20
> [Posting from home, since thats where I get nanog@, but posting
> with my work hat on - Reply-To: set to peter@demon.net]
>=20
> Please note that we were hit by the same spammer. The original
> message went out, claiming it was from one of our customers (another
> thread last week) when in actual fact it is from an address block
> assigned the enterprise.net.
We have also been hit by the same spammer, he is using
exchangecurrency@forprofit.com as his reply-field (which is one of my
clients) Apparently one of the people at forprofit.com send a message to
on of the spammers "superiors" (I think he just sent the message to the
NOC contact of the host on a reply field that was sent to him :) and
shortly after that, their domain name was showing up in the reply field =
of
the spam. I am flushing all mail heading for
exchangecurrency@forprofit.com to /dev/null. I've done a little =
research,
aparently the original postings were using a domain...
precipice:{root}67-> whois moneyworld.com
Financial Connections, Inc (MONEYWORLD-DOM)
2508 5th Ave, #104
Seattle, WA 98121
=20
Domain Name: MONEYWORLD.COM
=20
Administrative Contact, Technical Contact, Zone Contact, Billing
Contact:
Williams, Bob (BW747) willie@MONEYWORLD.COM
206 269 0846
=20
Record last updated on 13-Oct-96.
Record created on 26-Oct-95.
=20
Domain servers in listed order:
=20
NSH.WORLDHELP.NET 206.81.217.6
NSS.MONEYWORLD.COM 205.227.174.9
No answer at the number and apparently non of these DNS machines are
currently on the net... hmm.
This guy is causing my mail queues to fill up with a ton of bounces and
flames and I don't appreciate it one bit. The guys at forprofit have =
some
friends at the FBI, but they say that everytime they try to go after =
these
guys, the ISPs won't co-operate :)
Geoff White
Virtual Sites
http://www.v-site.net
(415)437-4600 fax (415)437-4601
