On Sat, 6 Jun 1998 22:40:45 -0400, Joe Geiser <[log in to unmask]>
wrote:

>Hmmm..  <he hears "ka-CHING!">
>
>That's a US$500.00 invoice going out, after I check out whether this company
>really exists...
>
>Here's a lesson on tracking down UCE, for those who are interested:
>
>The postal address in the message does not match that of the domain name,
>which, according to WHOIS (http://rs.internic.net/cgi-bin/whois/), is:
>
>Baker Consulting Inc. BAKER2-DOM
>   3216 Emerson St
>   Palo Alto, CA 94306
>   Domain Name: BAKER.COM
>   Administrative Contact, Technical Contact, Zone Contact:
>      Baker, Wendell  WB17  [log in to unmask]
>      1 500 359 6539
>
>... however, the NNTP Posting Host is:
>
>VICON Networks INTERNETMLS-DOM
>   1890 Buffalo Run Rd.
>   Bellefonte, PA 16823
>   USA
>Domain Name: INTERNETMLS.NET
>   Administrative Contact, Technical Contact, Zone Contact:
>      Witmer, Michael  MW664  [log in to unmask]
>      814-867-1179
>   Billing Contact:
>      Witmer, Michael  MW664  [log in to unmask]
>      814-867-1179
>
>which is rather close to the address shown in the message...  In addition,
>real names and phone numbers are being used here, which means that they are
>probably a regional (and real) ISP.  A check on the business yielded the
>correct phone number (GTE SuperPages came up with it).
>
>... and according to Finger - [log in to unmask] - is not a valid user:
>
>Saturday, June 06, 1998 10:16:24PM
>Finger [log in to unmask]
>finger: nunya: no such user.
>
>which means that the REPLY TO and FROM headers were forged... a no-no in
>every legitimate user's book...
>
>A check of GTE SuperPages (http://yp8.gte.net from http://www.lycos.net)
>yielded only one hit on "Johnson Advertising" - and that's a "Johnson
>Outdoor Advertising" here in Philadelphia -- the town mentioned in the
>message below is out in Western PA, not here in "beautiful SE PA".  (Johnson
>Outdoor is a billboard company - we see their "messages" from our cars all
>the time, while driving down I-95, and while many may not agree with
>billboards, spammers they're not).
>
>A call to (814) 555-1212 yielded no telephone listing for "Johnson
>Advertising" (is this a surprise?  No!  But it dosen't hurt to check ;)
>
>So - this is a spammer, plain and simple.  The invoice goes to the address
>in the message, with an e-mail to INTERNETMLS that their NNTP servers were
>used for UCE, probably in violation of their terms and conditions of
>service.  Include full headers, and they *might* be able to track down the
>perpetrator and cut off their account.
>
>If the invoice is not returned by the Post Office, then we're pretty sure we
>have someone.  (Now do you see why we charge $500.00 per?  It takes some
>time to track these SOBs down).  If we get 'em, I'll let you know, and give
>you the exact text of the letter that goes with the invoice :)
>
>Cheers,
>Joe
>
>
>> -----Original Message-----
>> From: HP-3000 Systems Discussion [mailto:[log in to unmask]]On
>> Behalf Of [log in to unmask]
>> Sent: Saturday, June 06, 1998 2:59 PM
>> To: [log in to unmask]
>> Subject: For YOU!!
>>
>>
>> ------------------------------------------------------------------
>> -------------
>> --------------------------
>> This message is sent 'as a paid for service' by Johnson Advertising.
>>           Our Clients pay for advertising on a per response basis.
>> ------------------------------------------------------------------
>> -------------
>> --------------------------
>>
>> One of our Clients is giving away a free phone card worth 50 free
>> minutes to all United States residents who send a #10 self-addressed
>> stamped envelope to
>>
>> Johnson Advertising
>> Post Office Box 309
>> Mount Union, Pennsylvania 17066
>>
Just curious ... have you EVER received money from any spammers?
Will a collection agency buy the invoices from you?

David