FT. LAUDERDALE, FLORIDA--Cyberpromo's website in Fort Lauderdale is
dead and gone. The server that served it is now sitting in the office
of Nick Nolter, at PGNC Leasing, a high bandwidth provider in South
Florida.

Nolter can't decide what to do with it. He's holding it for Sanford
Wallace to come pick it up, but he's also considering how much fun it
would be to take it out in the parking lot and demolish it with a
sledgehammer.

"He can sue me," Nolter says of Wallace.

Nolter's third-party relationship with cyberpromo has cost him several
thousand dollars. This weekend, cyber-attackers took out his dns
servers, and one of his backbone providers cut him off for thirty
hours and then, he says, lied about it.

It all started months ago, when one of his customers, the New
Millennium Cafe, responded to an ad from cyberpromo, seeking to buy
extra bandwidth on T1-or-faster circuits.

Candy Cremona runs the cafe, and her claim to fame is that unlike the
other internet cafes, her T1 makes the webpages at her cafe fly up on
her screens. But she had more bandwidth than she was using. 

She'd never heard of Wallace Sanford and cyberpromo. She got the
unsolicited email like everybody else, but she tossed the savetrees
and answerme messages in her cybertrashcan without ever investigating
further.

When she asked cyberpromo what they wanted the site for, she says they
told her "to host webpages." She believed them. All they wanted was a
vacant port on her router and some of her bandwidth, and they offered
her cash. It sounded like a good deal.

Cyberpromo shipped her a computer, a keyboard and a monitor, and told
her how to configure it. She hooked it to her router, and the webpages
appeared. They were, strangely enough, anti-spam.

Then, in July, she started getting messages from her provider and from
the net-at-large, that her site was being used as a spamhaus. Serious
discussions with cyberpromo ensued, and, she says they pledged not to
do it again. She got her upstream provider to restrict outbound mail
from that host, and Wallace's machine sat quietly in the cafe,
silently serving its webpages that 'dissed spam.

...until Wallace needed it. 

When Agis cut Wallace and cyberpromo off last week, he needed to move
his www.cyberpromo.com presence, and he pressed his little minion at
the cafe into action.

But that was like showing a red flag to a bull. An army of anti-spam
activists whose tactics ranged from lawful to renegade descended upon
the chain of providers that gave connectivity to the cafe. BBNPlanet
stonewalled, saying it was a "customer of a customer," but behind the
scenes, the pressure placed on PGNC leasing was tremendous. 

They in turn, put pressure on the cafe. "I just don't believe what has
come down around here," said Cremona.

Things are relatively quiet again at the cafe. Coffee and tea are
still served, and the net connection has been restored. The cyberpromo
machine is gone and will not return.

But it raises the question of how many more cyberpromo trojan horses
are sitting on internet cul-de-sacs waiting to become
www.cyberpromo.com, or to be pressed into service as
spammer.for.a.day.

And how many people who don't follow the internecine warfare between
the spam and anti-spam armies will be caught in the next crossfire
when cyberpromo elevates some other hidden site to primary host
status.


Jerry Trowbridge
--at the Flying Pig Ranch

-- 
 Replies to:  c
              e   ubvb.c
              n   l    o
              sor@c    m