Nunya, as in nunya business who it came from ? ------------- Original Text From "Joe Geiser" <[log in to unmask]>, on 6/6/98 10:40 PM: Hmmm.. <he hears "ka-CHING!"> That's a US$500.00 invoice going out, after I check out whether this company really exists... Here's a lesson on tracking down UCE, for those who are interested: The postal address in the message does not match that of the domain name, which, according to WHOIS (http://rs.internic.net/cgi-bin/whois/), is: Baker Consulting Inc. BAKER2-DOM 3216 Emerson St Palo Alto, CA 94306 Domain Name: BAKER.COM Administrative Contact, Technical Contact, Zone Contact: Baker, Wendell WB17 [log in to unmask] 1 500 359 6539 ... however, the NNTP Posting Host is: VICON Networks INTERNETMLS-DOM 1890 Buffalo Run Rd. Bellefonte, PA 16823 USA Domain Name: INTERNETMLS.NET Administrative Contact, Technical Contact, Zone Contact: Witmer, Michael MW664 [log in to unmask] 814-867-1179 Billing Contact: Witmer, Michael MW664 [log in to unmask] 814-867-1179 which is rather close to the address shown in the message... In addition, real names and phone numbers are being used here, which means that they are probably a regional (and real) ISP. A check on the business yielded the correct phone number (GTE SuperPages came up with it). ... and according to Finger - [log in to unmask] - is not a valid user: Saturday, June 06, 1998 10:16:24PM Finger [log in to unmask] finger: nunya: no such user. which means that the REPLY TO and FROM headers were forged... a no-no in every legitimate user's book... A check of GTE SuperPages (http://yp8.gte.net from http://www.lycos.net) yielded only one hit on "Johnson Advertising" - and that's a "Johnson Outdoor Advertising" here in Philadelphia -- the town mentioned in the message below is out in Western PA, not here in "beautiful SE PA". (Johnson Outdoor is a billboard company - we see their "messages" from our cars all the time, while driving down I-95, and while many may not agree with billboards, spammers they're not). A call to (814) 555-1212 yielded no telephone listing for "Johnson Advertising" (is this a surprise? No! But it dosen't hurt to check ;) So - this is a spammer, plain and simple. The invoice goes to the address in the message, with an e-mail to INTERNETMLS that their NNTP servers were used for UCE, probably in violation of their terms and conditions of service. Include full headers, and they *might* be able to track down the perpetrator and cut off their account. If the invoice is not returned by the Post Office, then we're pretty sure we have someone. (Now do you see why we charge $500.00 per? It takes some time to track these SOBs down). If we get 'em, I'll let you know, and give you the exact text of the letter that goes with the invoice :) Cheers, Joe > -----Original Message----- > From: HP-3000 Systems Discussion [mailto:[log in to unmask]]On > Behalf Of [log in to unmask] > Sent: Saturday, June 06, 1998 2:59 PM > To: [log in to unmask] > Subject: For YOU!! > > > ------------------------------------------------------------------ > ------------- > -------------------------- > This message is sent 'as a paid for service' by Johnson Advertising. > Our Clients pay for advertising on a per response basis. > ------------------------------------------------------------------ > ------------- > -------------------------- > > One of our Clients is giving away a free phone card worth 50 free > minutes to all United States residents who send a #10 self-addressed > stamped envelope to > > Johnson Advertising > Post Office Box 309 > Mount Union, Pennsylvania 17066 >