Nunya, as in nunya business who it came from ?
-------------
Original Text
From "Joe Geiser" <[log in to unmask]>, on 6/6/98 10:40 PM:
Hmmm..  <he hears "ka-CHING!">

That's a US$500.00 invoice going out, after I check out whether this
company
really exists...

Here's a lesson on tracking down UCE, for those who are interested:

The postal address in the message does not match that of the domain name,
which, according to WHOIS (http://rs.internic.net/cgi-bin/whois/), is:

Baker Consulting Inc. BAKER2-DOM
   3216 Emerson St
   Palo Alto, CA 94306
   Domain Name: BAKER.COM
   Administrative Contact, Technical Contact, Zone Contact:
      Baker, Wendell  WB17  [log in to unmask]
      1 500 359 6539

... however, the NNTP Posting Host is:

VICON Networks INTERNETMLS-DOM
   1890 Buffalo Run Rd.
   Bellefonte, PA 16823
   USA
Domain Name: INTERNETMLS.NET
   Administrative Contact, Technical Contact, Zone Contact:
      Witmer, Michael  MW664  [log in to unmask]
      814-867-1179
   Billing Contact:
      Witmer, Michael  MW664  [log in to unmask]
      814-867-1179

which is rather close to the address shown in the message...  In addition,
real names and phone numbers are being used here, which means that they are
probably a regional (and real) ISP.  A check on the business yielded the
correct phone number (GTE SuperPages came up with it).

... and according to Finger - [log in to unmask] - is not a valid user:

Saturday, June 06, 1998 10:16:24PM
Finger [log in to unmask]
finger: nunya: no such user.

which means that the REPLY TO and FROM headers were forged... a no-no in
every legitimate user's book...

A check of GTE SuperPages (http://yp8.gte.net from http://www.lycos.net)
yielded only one hit on "Johnson Advertising" - and that's a "Johnson
Outdoor Advertising" here in Philadelphia -- the town mentioned in the
message below is out in Western PA, not here in "beautiful SE PA".
(Johnson
Outdoor is a billboard company - we see their "messages" from our cars all
the time, while driving down I-95, and while many may not agree with
billboards, spammers they're not).

A call to (814) 555-1212 yielded no telephone listing for "Johnson
Advertising" (is this a surprise?  No!  But it dosen't hurt to check ;)

So - this is a spammer, plain and simple.  The invoice goes to the address
in the message, with an e-mail to INTERNETMLS that their NNTP servers were
used for UCE, probably in violation of their terms and conditions of
service.  Include full headers, and they *might* be able to track down the
perpetrator and cut off their account.

If the invoice is not returned by the Post Office, then we're pretty sure
we
have someone.  (Now do you see why we charge $500.00 per?  It takes some
time to track these SOBs down).  If we get 'em, I'll let you know, and give
you the exact text of the letter that goes with the invoice :)

Cheers,
Joe


> -----Original Message-----
> From: HP-3000 Systems Discussion [mailto:[log in to unmask]]On
> Behalf Of [log in to unmask]
> Sent: Saturday, June 06, 1998 2:59 PM
> To: [log in to unmask]
> Subject: For YOU!!
>
>
> ------------------------------------------------------------------
> -------------
> --------------------------
> This message is sent 'as a paid for service' by Johnson Advertising.
>           Our Clients pay for advertising on a per response basis.
> ------------------------------------------------------------------
> -------------
> --------------------------
>
> One of our Clients is giving away a free phone card worth 50 free
> minutes to all United States residents who send a #10 self-addressed
> stamped envelope to
>
> Johnson Advertising
> Post Office Box 309
> Mount Union, Pennsylvania 17066
>