harvesting. The first past shows where I actually sent the complaint,
and the rest shows how I deduced where to send it.
Subject: [Fwd: CUM BUY MY AMATEUR VIDEO I'M 18 AND MASTURBATING]
Date: Sun, 15 Dec 2002 14:50:45 -0500
From: "William A. Levinson" <wlevinso ix.netcom.com>
To: admin megagiga.com, admin sexplanets.com, abuse hostcentric.com,
ipadmin adelphia.net, abuse adelphia.net
I've seen "Free Adult Hosting" enough times to decide to do something
about it.
Hostcentric, they're right above you in the traceroute. Please enforce
http://www.hostcentric.com/Company/AcceptableUsagePolicy.asp
Begin with the full headers to get the E-mail source. Commentary is in a different color from what is actually in the headers. Also remember that @s have been removed from innocent addresses to prevent harvesting from this page.
Status: U
Return-Path: <nighttraindb aol.com>
Received: from MULTIMEDIA ([68.67.224.133])
by merlin (EarthLink
SMTP Server) with SMTP id
AOL is of course phony. 68.67.224.133
is the IP address of the E-mail.
18nAAd7eb3NZFlq0 for <wlevinso ix.netcom.com>; Sun, 15
Dec 2002 07:21:32 -0800 (PST)
From: "EasyAmber" <nighttraindb aol.com>
To: <wlevinso ix.netcom.com>
Subject: CUM BUY MY AMATEUR VIDEO I'M 18 AND
MASTURBATING
Mime-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Date: Sun, 15 Dec 2002 10:21:34
Message-ID: <200212150721.18nAAd7eb3NZFlq0@merlin>
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: 18nAAd7eb3NZFlq0.0
wlevinso ix.netcom.com CUM BUY MY AMATEUR HOME VIDEO: See me in my first
homemade video EASYAMBER2002
MASTURBATING you'll be surprised at the positions I can place myself
in.
There's also a surprise ending mmmmmmmmmmm he's
good. http://www.free-adult-hosting.net/easyamber
This is the site you want to have taken down.
-------------------------------------
Go to UXN Spam Combat and use the
ARIN lookup http://combat.uxn.com/ for 68.67.224.133. (I tried RIPE first
because the Web site, as shown below, seems to be hosted from Europe. It
was a lot easier when there was a single IP address registry!)
Here is what you get. This one is very easy because the spammer did
not even
use a Super Sekrit Klingon Kloaking spamkit to scramble its headers.
E-mail account: Search results for: 68.67.224.133
Adelphia Cable Communications ADELPHIA-CABLE-4 (NET-68-64-0-0-1)
68.64.0.0 - 68.71.255.255
Adelphia 68671920-Z5 (NET-68-67-192-0-1)
68.67.192.0 - 68.67.255.255
Click on "Adelphia Cabel Communications" to get
OrgName: Adelphia Cable Communications
OrgID: ADEL
NetRange: 68.64.0.0 - 68.71.255.255
CIDR: 68.64.0.0/13
NetName: ADELPHIA-CABLE-4
NetHandle: NET-68-64-0-0-1
Parent: NET-68-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.ADELPHIA.NET
NameServer: NS2.ADELPHIA.NET
NameServer: NS3.ADELPHIA.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-12-19
Updated: 2002-04-10
TechEmail: ipadmin adelphia.net
OrgTechEmail: arin adelphiacom.net
so include abuse "at adelphia.com in your complaint.
Now for the spammer's Web site: use UXN Spam Combat's or
http://Xwhois.com/ to find out where this spammer lives:
Checking server [whois.crsnic.net]
Checking server [whois.opensrs.net]
Results:
Registrant:
SexPlanets Network
A.J. Ernststraat 199
1083 GV Amsterdam
Postbus 7827
Amsterdam, 1008AA
NL
Domain Name: FREE-ADULT-HOSTING.NET
Administrative Contact:
Planets, Sex admin sexplanets.com <============
Complain here
A.J. Ernststraat 199
1083 GV Amsterdam
Postbus 7827
Amsterdam, 1008AA
NL
34 123 424532
Technical Contact:
[same as above]
Registration Service Provider:
MegaGiga.Com Inc, admin megagiga.com <============
Complain here
972 3 560 4848
Registrar of Record: TUCOWS, INC.
Record last updated on 25-Jun-2002.
Record expires on 18-Dec-2002.
Record Created on 18-Dec-1999.
Domain servers in listed order:
NS1.MEGAGIGA.COM 66.40.9.150
NS2.MEGAGIGA.COM 66.40.9.201
Sexplanets' FAQ page at http://www.sexplanets.com/faq.html says that
spamming is cause for deletion of a Web site. In general, however, a traceroute
(available from UXN Spam Combat or even TRACERT.EXE in your own Windows
directory) can find the ISPs directly above the one to which you are complaining,
and copying them sometimes helps assure that action is taken.:
traceroute to FREE-ADULT-HOSTING.NET (66.40.9.138), 30 hops max, 40
byte packets
1 manny.Firewall.Opus1.COM (192.245.12.95) 4.882 ms
2 Opus-GW (207.182.35.49) 19.530 ms
3 Login-Opus-T1-2.Opus1.NET (207.182.63.106) 26.366 ms
4 opus1-gw.login.COM (165.64.254.49) 17.577 ms
5 F10.tus1.login.COM (165.64.254.77) 23.436 ms
6 66-162-41-17.gen.twtelecom.net (66.162.41.17) 17.577 ms
7 66-162-41-1.gen.twtelecom.net (66.162.41.1) 22.459 ms
8 216-136-127-9.gen.twtelecom.net (216.136.127.9) 22.459 ms
9 dist-02-so-0-0-0-0.mdso.twtelecom.net (168.215.53.30) 37.107
ms
10 dist-01-ge-2-3-0-0.mdso.twtelecom.net (168.215.55.101) 39.060 ms
11 dist-01-so-0-0-0-0.okld.twtelecom.net (168.215.55.77) 42.966 ms
12 peer-01-so-0-3-0-0.palo.twtelecom.net (66.192.250.38) 44.919 ms
13 paix.maxim.net (198.32.176.45) 41.990 ms
14 ATM1-0.FMT-2.hostcentric.com (209.25.214.181) 41.990 ms
15 VLAN5.FMT6509-1.hostcentric.com (66.40.24.70) 43.943 ms
16 uplink.summit4-2.hostcentric.com (209.25.128.132) 43.943 ms
17 web08.us.megagiga.com (66.40.9.138) 44.919 ms
So add abuse "at" hostcentric.com to your complaint. This will assure that someone in this chain (Sexplanets, Megagiga, Hostcentric) deals with the spammer.
In this case, Sam Spade's address digger could not uncover the same information. ARIN is unfortunately refusing Sam Spade contact due to high usage. (It's a popular anti-spam site, that's probably why.)