Overview of spam from EscortGuide

23 Mar 2008

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

Overview of last 5 reports

Overview of history

full history also available

General information about EscortGuide

Chandler claims to have once operated an actual escort service.

Chandler was last seen spamming Usenet in May, 1998 for click-through web pages at Tripod and Cyberrealm which forwarded the user to Chandler's site. Spams were injected into news servers at Abac.com via systems at PSI.

Escortguide received its network connection and netnews connection from UUNet. Use ticket number UU462560 when contacting UUNet in regards to Escort Guide.

EscortGuide is also known as florida-isp.com, xxxyes.com, schoolgirlz.com, babesofage.com, cristysplayhouse.com, and metrosupport.com.

EscortGuide is associated with, or the same as, the following hosts: Knotwork.com, Kesl.net, "The Greatest Inc.", Special-FX, TeenSchoolGirls.Com.

Special-FX.com, kesl, Escort Guide, knotwork.com and so on are probably all part of the same "spamglomerate" often referred to as AdultAge. See their web page at http://www.adultage.com for more information. AdultAge is another "adult verification service" which drums up business by spamming.

After leaving the porn spam business, Chandler switched to pill spamming.

• Site History
• Domains
• Threats from Andrew Chandler

According to whois, escortguide.com is

CLASS ACT PERFORMANCES (ESCORTGUIDE-DOM)
   owner: Andrew Chandler, clas@ix.netcom.com
   22783 South St. Rd. 7 Ste. 43
   Boca Raton, FL 33428

   6503 N. Military Trail
   Boca Raton, FL 33496

   561-347-8330
   516-988-0401

   Domain Name: ESCORTGUIDE.COM

   Administrative Contact, Billing Contact:
      Domain Administrator hostmaster@ESCORTGUIDE.COM
      800-659-0550
   Technical Contact, Zone Contact:
      Network Administrator netadmin@KNOTWORK.COM
      902 453 1615

   Record last updated on 06-Aug-97.
   Record created on 22-Mar-96.
   Database last updated on 12-Aug-97 04:20:40 EDT.

   Domain servers in listed order:

   NS.ESCORTGUIDE.COM           208.223.162.2
   NS.KNOTWORK.NET              198.166.227.129
   NS.KESL.NET                  203.251.176.1

Knotwork.com is:

Digitalis Data Services (KNOTWORK-DOM)
   5822 Bilby Street
   Halifax, Nova Scotia B3K 1V8
   Canada

   Domain Name: KNOTWORK.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Metson, Mark  (MM339) aa332@CHEBUCTO.NS.CA
      +1 (902) 454-1615 or
      +1 (902) 453-1615

   Record last updated on 14-Jan-97.
   Record created on 31-Aug-95.
   Database last updated on 13-Aug-97 04:24:52 EDT.

   Domain servers in listed order:

   GOD.KNOTWORK.COM             198.166.227.1
   PEOPLE.KAYHAY.COM            207.216.122.2

Whois has the following information about "The Greatest Inc.":

The Greatest Inc. NETBLK-UU-208-223-162-GREAT
   499 E. Palmetto Park Rd
   Boca Raton, FL 33496
   US

   Netname: UU-208-223-162-GREAT
   Netblock: 208.223.162.0 - 208.223.162.255

   Coordinator:
      Metson, Mark aa332@CHEBUCTO.NS.CA
      +1 (902) 454-1615

   Record last updated on 18-Aug-97.
   Database last updated on 3-Sep-97 04:53:18 EDT.

These sites are administrated by Mark Graham Metson

12 Aug 1997:

Added due to porn spams in Alt.sexual.abuse.recovery.

28 Aug 1997:

Psi informs me that EscortGuide's account has been terminated. Spam continues to arrive via Psi, but this may be older spam trickling in.

5 Sept 1997:

Spam seems to have stopped coming through state.net, telecom.net.et, and Psi. This may indicate that open ports have been closed.

8 Sept 1997:

Florida-isp.com is now under full UDP. See netnews message "Full Phase II UDP For FLORIDA-ISP.COM" for more information.

8 Sept 1997:

Owner Andrew Chandler is now threatening to sue spam fighters.

15 Sept 1997:

Owner Andrew Chandler has threatened to sue me personally.

14 Oct 1997:

Now hijacking emai-to-news relay at auvm.american.edu

1 Nov 1999:

Back again after a long absence. Posting from Cable & Wireless

10 Nov 2000:

Still around. Selling viagra, propecia, etc. on-line. Still hosted by Cable & Wireless.

21 Feb 2003:

Terminated from Ciberlynx for spamming.

2004-present:

Owner of Global Affiliate Service, an affiliate management system for porn sites.

1 June 2005:

Advertising for spammers to help sell drugs online.

12 Sept 2005:

Seen advertising email porn-spam services on adult webmaster discussion board.

7 Aug 2007:

Chandler arrested on a fugitive warrant for passing bad checks.

Nov 2007:

Sued by ISP Suavemente over more than $38,000 in unpaid bills and bad credit card payments.

This is not a complete list. See ROKSO for a much longer list.

A complete history may also be available.

General notes:

• Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
• Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
• Some posts may be forgeries intended to look like they came from EscortGuide.
• The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.

This page maintained by Ed Falk