Here's the next level in the hierarchy of bottom-feeders commonly known as spammers.

This person bought in to one of those offers that's so good that no human should resist, and now he's a multi-level marketer. You can buy his products, or you can sign up to resell his products - such a deal. Here's a bit from both of his messages.

(spam on)

Return-Path: InterA@925net.com
From: InterA@925net.com
Errors-To: InterA@925net.com
To: pro@mail2me.net
Subject: Security Products to Protect your Family & Propterty!
Date: Tue, 25 May 99 23:10:17 Central Daylight Time
Reply-To: remove@925net.com

This is a Marketing Direct update. We do not send mail unsolicited. If
you wish to be removed from further updates please click here
http://www.925net.com
Or Click Here
================================================================\

Inter-American Security Products, Inc. can offer you a custom
designed and technologically advanced products for your
personal protection and defense. These products are non-toxic,
non-lethal and non-flammable. they are completely safe,
BETTER THAN GUNS !!

Check out our brochure an dlook for those items that willprovide
the level of protection you may require. You cannot put a value
onyourself and your family. It is of teh highest priority to establish
this kind of security around yourself.

(spam off)

Hard to put a value on spelling, grammar and typing skills too.

(spam on)

ACT NOW, TOMORROW MAY BE TOO LATE !!

AUTO TASER
Stop him before he Get To You
Air Taser Stops Attackers up to 15 feet away. Protect Your
Space... and Stay in Control.

BULLETPROOF VESTS AND BODY ARMOR
HANDCUFFS
OPTICS
PEPPER SPRAYS
SPY EQUIPMENT
STUN GUNS
BATONS

ACT NOW! TOMORROW MAY BE TOO LATE\

(spam off)

And if that's not enough to get your heart pumpin'...

(spam on)

Return-Path: More@925net.com
Received: from 208.170.205.146 ([208.170.205.146])
by franklin.concentric.net (8.9.1a/(99/04/26 5.23))
id BAA28280; Wed, 26 May 1999 01:06:28 -0400 (EDT)
[1-800-745-2747 The Concentric Network]
From: More@925net.com
Subject: Security Products to Protect your Family & Propterty!
Date: Tue, 25 May 99 23:57:31 Central Daylight Time
Reply-To: remove@925net.com

This is a Marketing Direct update. We do not send mail unsolicited.
If you wish to be removed from future updates please click below.
http://www.925net.com OR
Click Here

==================================================================
This is truly the EASIEST and the HOTTEST Home Business Today!
Voted as #1 Home Business TWO YEARS IN A ROW!
It is NOT a chain letter, NOT an illegal get-rich-quick scam. It is a
legitimate business which has been around for over THREE YEARS!

YOU HAVE
- ABSOLUTELY NO SELLING!
- ABSOLUTELY NO TALKING WITH ANYONE!
- NO MONTHLY PURCHASES!
- NO HANDLING INVENTORY OR PRODUCTS!

(spam off)

Man, I can hardly control myself - who do I call to sign up?

Better yet - how do I get myself *off* this list?

A couple things to notice. First, all addresses in this series point to the same place. So the easy first answer of replying to abuse@(insert domain name here) isn't going to work because the spammer owns the domain.

Keep in mind that in the junk mail game, all email addresses are worth money. People sell addresses of those who: bought from an email offer, requested more info from an email offer and, pay attention, asked to be removed from an email offer. Yes, those remove lists are, in many cases, simply a way to qualify your email address so it can be resold for a higher dollar amount.

Never reply to a spammer.

So, where to go? My first stop is to check the public records for info on how they're connecting to the net. Usually, one step up the chain is the place to complain to, and you can find that by looking at the listing for "Domain Servers"

The source for those records is:

http://www.networksolutions.com/cgi-bin/whois/whois

And here's the info on 925net.com (note: when looking up domain name info, you clip off the user name portion - the portion before the "at" symbol)

Registrant:
925net.com (925NET-DOM)
3317 Lee Trevino Dr. #204
El Paso, TX 79936
US

Domain Name: 925NET.COM

Administrative Contact, Technical Contact, Zone Contact:
Borland, Debbie (DB22300) afitzs42@EXCITE.COM
(915) 263-1130 (FAX) (915) 263-1131

Billing Contact:
Borland, Debbie (DB22300) afitzs42@EXCITE.COM
(915) 263-1130 (FAX) (915) 263-1131

Record last updated on 15-May-99.
Record created on 08-May-99.
Database last updated on 6-Jun-99 08:09:08 EDT.

Domain servers in listed order:

NS1.OPT-INS.NET 206.98.116.11
NS2.OPT-INS.NET 208.170.204.11

Well - we struck out there. "OPT-IN" is a term that refers to how you construct your mailing list. OPT-IN, for normal people, means you request to be added to the list before they send you anything. The fact that I already have 2 pieces of mail that I haven't requested signifies to me that they have a somewhat different definition of "OPT-IN" - and makes me leery of offering up my email address to them.

If the "Domain Server" name isn't a clear giveaway, many times I'll go visit the web site and look for a "Terms of Service" (TOS) or "Acceptable Use Policy" (AUP). If I wanted to try that in this case, I would substitute www for NS1 - giving me a web address to try of www.opt-ins.net.

I'll admit - I didn't go look at their website. Without a peek, I can tell you they're honest, upstanding folks who'd never send a thing out to anybody who didn't request it, and oh, by the way, just give us your email address for our free newsletter, or maybe a chance to win great prizes or, or, or...

The next tool to try is traceroute. If you're using a PC and you are online, you can open up a DOS window and use the command:

tracert (insert IP or www address here)

So, for this example I used:

tracert www.925net.com

and my results were:

Tracing route to www.925net.com [208.170.205.91]over a maximum of 30 hops:

  1   136 ms   128 ms   129 ms  ts011e01.sag-mi.concentric.net [207.155.213.3] 
  2   175 ms   150 ms   150 ms  207.155.213.1 
  3   155 ms   150 ms   150 ms  206.83.95.5 
  4   190 ms   150 ms   150 ms  206.83.91.105 
  5   200 ms   190 ms   150 ms  us-il-chi-core2-f5-0.rtr.concentric.net [207.88.48.33] 
  6   170 ms   160 ms   190 ms  us-il-chi-core4-a2-0d3.rtr.concentric.net [207.88.50.14] 
  7   169 ms   159 ms   189 ms  bordercore2-hssi0-0-0.WillowSprings.cw.net [166.48.23.249] 
  8   218 ms   230 ms   210 ms  ngcore1.Seattle.cw.net [204.70.9.129] 
  9   250 ms   250 ms   248 ms  core2.Seattle.cw.net [204.70.4.33] 
 10   245 ms   210 ms   200 ms  border5-fddi-0.Seattle.cw.net [204.70.203.50] 
 11   264 ms   310 ms   300 ms  znet.Seattle.cw.net [204.70.233.18] 
 12   300 ms   310 ms   290 ms  www.925net.com [208.170.205.91] 

Trace complete.

There are also free web-based trace route services, one located at:

http://www.research.digital.com/cgi-bin/trace

As well as telling you how fast your packets are getting there and back, you learn the route the packets are taking. From the info shown above, 925net.com is getting their access to the internet through cw.net.

I visited the cw.net web page, but didn't see any TOS or AUP document - not a good sign.

I did forward a copy of both messages to abuse@cw.net and received this response:

From: SPAMCOMPLNTS@BUS1-POP.PMM.CW.NET
Date: Wed, 26 May 1999 15:34:24 +0000 (GMT)
Subject: Re: re spam: Security Products to Protect your Family & Propterty!
To: dornbos@cris.com
Cc: spamcomplnta@BUS1-POP.PMM.CW.NET

Jim,

I am responding to your complaint about the messages you have been 
receiving from the C&W network.

C&W is very concerned that its services and products not be used to harass
others or abuse the network. We are looking into your complaint(s) and will 
take action as permitted under the relevant agreements that we have in place.

Thank you for calling our attention to this matter. Should you receive any
additional, similar message from our network, please feel free to contact 
us.

Regards,

Anna Gear
Spamcomplaints@cwixmail.com

And what that probably means is they issued a warning to their customer, and that's all that's going to happen for now.

Just because the results aren't exactly what you wanted doesn't mean it wasn't worth trying. Maybe next time.

Back to the Dornbos Press page

[an error occurred while processing this directive]