From: buchanan@gate.cybernex.net (Lysander Spooner) Subject: "Dirty Dozen" -- Top 12 Cancel Recipents (week 1) Date: 1997/04/25 Message-ID: X-Nntp-Posting-Host: nj010d-040.cybernex.net X-Complaints-To: Email abuse@news2.new-york.net if this posting is inappropriate X-Trace: 861965940 22154 (None) [207.198.145.40] Organization: Sisyphus Systems Newsgroups: news.admin.net-abuse.usenet I've decided to start posting a weekly summary of the cancels I issue against some of the more outrageous Usenet Spammers. This first report is actually for a six-day period (cancels issued between 4/18/97 and 4/23/97 inclusive), since I've been filing reports every other day. All results are given by Briedbart Index, not by number of articles/cancels. I may add that figure in future reports. All numbers refer ONLY to articles which I cancelled. They do NOT include articles cancelled by other de-spammers or the ones we all missed. TOTAL BI CANCELLED (all categories, not just these 12) -- 4/19/97 25,477 4/21/97 24,158 4/23/97 38,144 6-day TOT 87,779 BREAKDOWN BY CATEGORY First the 2-day BI subtotals -- Description 4/19/97 4/21/97 4/23/97 SpamZilla 1345.6 2182.7 4651.5 Ron Harris 1636.4 2496.8 3695.9 Holonet Spamsites 3278.5 2127.2 1952.2 T C Inc. 2738.7 2053.4 2435.9 Wet Nose Enterprises 2522.9 982.0 1393.3 VOL.IT UDP 619.4 1371.5 783.1 CBL 673.0 544.3 1490.6 Multione Web Services 1013.9 519.2 933.1 Dynamic Mail 274.0 464.0 1299.0 Joe Darvin 0.0 0.0 1830.0 Advantage Media Inc 445.0 72.0 1066.0 and the Cumulative BIs -- Description Cum BI SpamZilla 8179.8 Ron Harris 7829.1 Holonet Spamsites 7358.0 T C Inc. 7227.9 Wet Nose Enterprises 4898.3 VOL.IT UDP 2774.0 CBL 2708.0 Multione Web Services 2466.2 Dynamic Mail 2037.0 Joe Darvin 1830.0 Advantage Media Inc 1583.0 Total BI for TOP 12 48,891 (that's about 55% of all the Spam I cancelled, just for these 12 entities!) It looks like Ronnie Eroscum and Jerry SpamZilla are slugging it out for the honor of being Usenet Public Enemy #1, with Britto's Bombers from Holonet being challenged for third place by TC Inc. (which is interesting, since Holonet hosts dozens of Spamming websites, while TC has but one. 'smatter Spamboy? You going soft on us?) CBL deserves a "dishonorable mention" for making the list with almost-pure EMP. "Rookie Sleaze of the Week" goes to Joe Darvin, whose one-day vandalism puts him ahead of many determined veterans' six day totals. # Who Are These Peckers? # SpamZilla You know him. You hate him. He's Jerry Reynolds, a scumbag Spammer who actually follows the discussions in the net-abuse groups. (hi jer) His empire seems to be in a state of transition (dare we hope for a transition to non-existance?) The semi-sentient people at InterNIC say: v----------------------------------------------------------------------------------------v Intel Telecom Corporation (SEXZILLA-DOM) Box 954 Moorhead, MN 56561-0954 Domain Name: SEXZILLA.COM Administrative Contact, Technical Contact, Zone Contact: Rick, Haider (HR663) rick@NETZILLA.NET 218-233-5131 (FAX) 218-233-5131 Record last updated on 11-Apr-97. Record created on 25-Jun-96. Database last updated on 23-Apr-97 06:55:47 EDT. Domain servers in listed order: NS1.SEXZILLA.COM 205.198.56.62 NS2.SEXZILLA.COM 207.70.214.9 ^---------------------------------------------------------------------------------------^ Note when this record was last updated. Checking for other domains owned by Intel Telecom we find: Intel Telecom Corporation (NETZILLA2-DOM) NETZILLA.NET Intel Telecom Corporation (JOBTREK-DOM) JOBTREK.COM Intel Telecom Corporation (SEXZILLA-DOM) SEXZILLA.COM The NIC record for Netzilla is v---------------------------------------------------------------------------------------v NETZILLA (NETZILLA-DOM) 32 Lorraine Street Hartford, CT 06105 US Domain Name: NETZILLA.COM Domain Status: On Hold Administrative Contact, Technical Contact, Zone Contact: Lindh, Andrew S. P. (ASL2) andrew@NTPLX.NET (860) 233-1111 Billing Contact: Lindh, Andrew S. P. (ASL2) andrew@NTPLX.NET (860) 233-1111 Record last updated on 10-Mar-97. Record created on 06-Aug-96. Database last updated on 23-Apr-97 06:55:47 EDT. Domain servers in listed order: DNS.NTPLX.NET 204.213.176.1 DNS2.NTPLX.NET 204.213.176.2 ^---------------------------------------------------------------------------------------^ Also updated within the last few days. And what does "Domain Status: On Hold" mean? Jerry didn't pay his bills? ScumZilla's Web-Spam-Sites are hosted by Corpcomm.net, one of the two biggest WHORE web-hosts on the net. To borrow a phrase, Corpcomm holds Jerry's dick while he pisses on Usenet. For what it's worth, here's their NIC record: v---------------------------------------------------------------------------------------v Corporate Communications (NETBLK-CORPCOMM-BLK) 1700 42nd Street SW Fargo, ND 58103 Netname: CORPCOMM-BLK Netblock: 207.70.192.0 - 207.70.255.0 Maintainer: CORP Coordinator: Kirk, Douglas (DK62) dkirk@CORPCOMM.NET 701-277-0011 Domain System inverse mapping provided by: NS1.CORPCOMM.NET 199.165.217.101 NS2.CORPCOMM.NET 199.165.217.106 ^---------------------------------------------------------------------------------------^ If you'd like to tell Corpcomm what you think of them, you can send email to Kirk at the above address, or to postmaster@corpcomm.net , webmaster@cormpcomm.net They have no "abuse" account that I know of. What a surprise. If you'd like to watch your email get routed to /dev/null, try emailing Postmaster@netzilla.net , support@netzilla.net> Jerry's account at Corpcomm is zed@corpcomm.net Practically all the Zilla Spam is posted from GTE accounts to those god-forsaken UUnet NNTP-servers. Complaints will be cheerfully ignored at: abuse@gte.net, spam-complaint@uu.net (I'm about ready to declare UDP on GTE again, and this time it's going to take more than promises and platitudes to lift it.) Ron Harris Do the names "Shocking Pink" "Erotic Box Office" , "LibidoX", "DominationX" or "Erosnet" ring any bells? (If not there are a few dozen others that might.) This is the Eros Spamglomerate, run by Ronnie Harris, the reigning champion of Asshole Spammers. His daily volume of crap posted is occasionally exceeded by some flash-in-the-pan newbie mega-Spammer, but none have had the sheer longevity and consistency of Ronnie and his toadies. If I had to pick the one person most responsible for the current sad state of Usenet, it'd probably be Ronnie. I'll save the NIC data for a future report. 'tis a tangled web. Here's who to complain to (Thanks to David Ritz for these addresses, which come from his EXCELLENT Abuse Reports.) abuse@earthlink.net, abuse@supernews.com, abuse@loop.net, spam-complaint@uu.net, abuse@gte.net Holonet Spamsites This category covers all Spam which advertises _any_ of the websites hosted by this disgraceful excuse for an ISP. Most of these websites are part of either the Morgan Hill/Thundercom, or the SPI/TUTV, Spamglomerates. There are a few new (apparently) single-site customers Spamming as well. So why are all these websites grouped together? Well, ya see, I'm not cancelling them based on their BI (even though the BI for any single domain included is WELL over 20). I'm cancelling them because they are ALL FORGERIES! I'll explain... It seems Holonet has a clause in their TOS agreement stating that their customers may NOT advertise on Usenet NGs. But Artie Britto (the spineless gob of evolutionary phlegm who runs the Holonet Spam-Haven) oozes his way through a loophole by pointing out that none of the advertising is posted from Holonet's News-server. Furthermore, he contends that none of this Spam is being posted by his customers, coming instead from people who are trying to make his customers look bad. Uh-huh. So as a _pro bono_ service to Holonet et al, I've taken on the task of cancelling ANYTHING generated by this renegade gang of rogue advertising executives who are trying to smear the "good names" (gag) of Morgan Hill, SPI, Spamboy (Truth Lewis), and the rest. A relatively up-to-date list of these websites will come in a future report. A form letter may be obtained by complaining to abuse@holonet.net. A different form letter is available by emailing the Head Slug himself at ahbritto@holonet.net. I think Spamboy's account at truth@pop3.holonet.net is still active as well. That one might get you mailbombed though. As for the ISPs where the Spam is being posted, it's the "usual suspects" : abuse@gte.net, spam-complaint@uu.net, spams@mci.net T C Incorporated Believe it or not, this huge compost heap of Spam is all from/for a single website -- rawxxxfun.com. v---------------------------------------------------------------------------------------v TC Incorporated (RAWXXXFUN-DOM) 11014 NW 18th Dr Miami, FL 33322 Domain Name: RAWXXXFUN.COM Administrative Contact, Technical Contact, Zone Contact: Westerlind, Richard (RW2338) zone@BRIDGE.NET 954-472-8016 (FAX) 954-472-2822 Billing Contact: Westerlind, Richard (RW2338) zone@BRIDGE.NET 954-472-8016 (FAX) 954-472-2822 Record last updated on 10-Apr-97. Record created on 17-Jan-97. Database last updated on 24-Apr-97 06:43:39 EDT. Domain servers in listed order: NS1.SKYWEB.NET 205.216.248.111 NS2.SKYWEB.NET 205.216.248.112 ^---------------------------------------------------------------------------------------^ The Spam is coming from bridge.net, gdi.net and a new contestant in the Rogue ISP derby -- evcom.net. The usual Postmaster@ address seems to work for these. Wet Nose Enterprises These guys are the latest to be added to my list of "people in dire need of a hot-lead enema". The domains are: Wet Nose Enterprises (PORNGODESS-DOM) PORNGODESS.COM Wet Nose Enterprises (PORNKING-DOM) PORNKING.COM Wet Nose Enterprises (NUDESIGHTS-DOM) NUDESIGHTS.COM Wet Nose Enterprises (WHOISNAKED-DOM) WHOISNAKED.COM While there is considerable Spammage for Pornking and Porngoddess, the majority of the garbage is for nudesights. [SLAP] (hitting self on forehead with palm of hand) Well I'll be dipped in shit! I just did a whois for nudesights.com, and look at what comes back! Compare this to the one for TC Inc. I don't know HOW I missed this until now! v---------------------------------------------------------------------------------------v Wet Nose Enterprises (NUDESIGHTS-DOM) 21 Tiensch Ave Leonardo, NJ 07716 Domain Name: NUDESIGHTS.COM Administrative Contact, Technical Contact, Zone Contact: Westerlind, Noel (NW289) wcd@INFI-POS.COM 908-724-3518 Billing Contact: Westerlind, Noel (NW289) wcd@INFI-POS.COM 908-724-3518 Record last updated on 27-Feb-97. Record created on 27-Dec-96. Database last updated on 24-Apr-97 06:43:39 EDT. Domain servers in listed order: NS1.SKYWEB.NET 205.216.248.111 NS2.SKYWEB.NET 205.216.248.112 ^---------------------------------------------------------------------------------------^ Notice the surname of the Admin contacts? Richard and Noel Westerlind? It's possible that these are separate customers of Skyweb.net, and that the Westerlind Twins handle the tech & admin duties for their repsective clients, but I have a funny feeling that my next report is going to lump Wet Nose and TC into the same category. (Class C Net-ID 208.208.223 belongs to UUnet, but seems to be leased to WCD.net. A few of the addresses in that block -- 208.208.223.2 www.wcd.net 208.208.223.3 www.party123.com 208.208.223.4 www.ccrocks.com 208.208.223.5 www.event-scape.com 208.208.223.6 www.focuspro.com 208.208.223.7 pete.wcd.net 208.208.223.8 www.cyberspace-stripclub.com 208.208.223.10 daryl.wcd.net 208.208.223.11 www.whoisnaked.com 208.208.223.13 www.rawxxxfun.com 208.208.223.14 www.pornking.com 208.208.223.15 www.porngodess.com 208.208.223.17 www.njrocks.com and why is Westerlind#2's email address "wcd@infi-pos.com"? Just what I don't need -- another maze-like Spamglomerate!) I'll finish the category descriptions in the next report. I've got some digging to do.... -- Rick ---------- ** DEATH before Spam **