Spam Quick Reference

This web page is intended to act as a quick way to identify a specific spammer or other person or organization involved in the fight against spam. It is perpetually under development.

If you can add any information about any particular spammer, please contact me at falk@despams.r.us.com

Similar lists are carried at The Spamhaus Project, Spammers Speak, Worldwide Online, Spam Huntress.

*Note:

Spammers often go to great lengths to hide their identities. Addresses in this file are those provided by the Internic or other sources and are often fraudulent. Do not firebomb anybody's house based on what you read here.

Names

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z IP Addresses
H
See Globalipx and Spamhause.org entry.

On 13 Mar 2012, sentenced to 15 months for mail fraud; see press release.
Owner of Atriks and Fresh Healthy Stuff, LLC
Purveyor of spamware. See Industry Standard article Who's Spamming Whom?
See Firepower.com
See Foonet
Professional spammer, connected with Americaint spam factory. See also Keith Taub
See Alan Ralsky
Alias of AdultSight.
Porn spammer. See Morgan Hill Entertainment.
Owner or associate of eDirect. See OptInInc Uncovered web page.
Porn spammer. Kevin Freeman, 47 Campbell St., Red Bank, NJ 07701, Kevin@WCD.NET
Email spammer, kicked off the net by AGIS, then CyberEnet, Gstdata.net, Sprint, Netcom and Digex.net. Currently hosted by Netcom.
Also known as Savoynet and Merchant Direct. Notorious for the fact that they published their "remove" list on the net for other spammers to download. Currently using domain names that look like IP addresses but aren't (e.g. "209.214.12.258.com") Visit The Harris Tracker for more information.
Opinion poll company. Added to RBL in 2000 for spamming opinion polls. Responded by suing AOL, MAPS. See Yahoo news article CLARIFICATION of BW2679, NY-HARRIS-INTERACTIVE for more information. A copy of the lawsuit may be found on the MAPS website.
Owner of LibidoX.
Computer hardware vendor. Spams anyone who has ever given them their email address. Claims to respect opt-out requests, but spams you again anyway. Never give your email address to Hardwarestreet.com.
Intenet and spamming services provided by Netline.com. For more information, see netnews thread "HARDWARESTREET.COM"
Owner or admin of Peacefire.
Alias of Noel Westerlind, owner of Adult Sights
Porn and drug spammer. Sued for $12.8 million by AOL. See CNN article With shovels, AOL looks for retribution
(last update: 16 Aug 2006)
Admin of Media3
Domain owned by Joe Melle
Medical spammer. See Jason Vale. Contact: cianide70@aol.com Hosted by Deltanet
Scam-spammer. See Natural Instincts for more.
Registered owner of Special-FX.
Owner of Specialized Programming and Marketing
Computer manufacturer. Known to advertise via spam.
Nick-name of a rogue netnews canceller who was active for several months. For more information, see:
Alias of Tom Saylor
Porn spammer. See http://www.HONet.com/Nadine/default.htm#Hirsch

There is at least one documented case of Hirsch sending spam to an address used to register a Canon scanner.

See also Naviant, Rokso registry, Spam Kings excellent analysis
(last update: 22 Feb 2006)

Major ISP in Hong Kong. Source of some netnews spam.
Owned by Hong Kong Telecom. Network service provider to most isps in Hong Kong, including Ctinet.
Alias of Rick Yang. See Optin Global.
Porn spammer. Unified Productions (HOLLYWOODWHORES2-DOM), PMB 345 2251 N. Rampart Blvd., Las Vegas, CA 89128-7640 Contact: Admin, Up Air (UA79) root@SERVER.TRISTARCREATIONS.COM (800)882-5284
Known to advertise via spam
Original registrant of HotSexNow. Suspected of being the Baltimore Blaster.

Honick insists that he is not the true owner of HotSexNow; that it was his college roommate borrowing his computer that registered the domain under his name. He declines to identify the roommate.

See HotSexNow web page for more info.

Porn site. HostAll, Inc., 11715 Fox Road Suite 400-126, Indianapolis, IN 46236, Jacob Cazzell, jacobcaz@NETDIRECT.NET, (317) 823-3924 (FAX) (317) 826-1997. See whois info for more.
Believed to be alias or partner of Empire Communications. They deny this in netnews article "EMP - BI>28200 - Matt Middleton's dedicated spam-feed through newsfeed.poshnet.com (2)". This thread is worth reading, as it shows very clearly that Hostcomm, Poshnet, Empire, and PDXFiber are all very thoroughly intertwined.
Web service provider. Permits spamming by their customers as long as the spam is done from third-party systems.

Update: I am informed that Hostpro has nuked at least one spammer. Perhaps they've turned themselves around. (last update: 28 Apr 2000)

Email porn spammer in Hallandale, FL. See Whois entry.
Adware vendor. See Ziff-Davis article Symantec files suit to label adware. Recently merged with 180solutions to form Zango. See Adware makers 180solutions, Hotbar merge
(last update: 07 Jun 2006)
Alias of OverTheAir.
See L5computing.
Large ISP whose name is often forged into spam. Hotmail is usually innocent, although they are sometimes used as the "drop-box".

Hotmail admins advise that Ids beginning with numbers are not valid (e.g. "2abd@hotmail.com"). Also, all outgoing messages from Hotmail with contain an "X-originating-IP" header line.

Porn spammer, 537 Bonnie Meadow, New York, NY. See HotSexNow info page. Probably related to ChickenShack
Porn spammer. As of 24 June 1998, posting through Home.com. Web site hosted by Atmnet.
Email spammer, associated with TheHitMan.com. Possible alias of John Hufnal Smith? Owner of DEAA. AKA "Genesis II Spammer". (last update: 25 Aug 2000)
I
Credit card processing service that provides service to spammers. Placed on the RBL in 1998. Returned to the RBL in July, 2000.

Leaked 17 million customer records to the internet in 2005, including names, phone numbers, addresses, e-mail addresses internet IP addresses, logins, passwords, credit card types, and purchase amounts. See Wired news article Porn Billing Leak Exposes Buyers.
(last update: 09 Mar 2006)

Mortgage lead company, uses spam to obtain leads. See MSNBC article Who profits from spam? Surprise
Internet Connection Inc. Network service provider. Possibly rogue. See ICI Info page
Network service provider. Possibly rogue. Provides connectivity to Exodus.net.
ICon CMT Corp, 1200 Harbor Blvd, Weehawken, NJ 07087. Contact: dns-admin@ICONNET.NET 201-601-2000 Ext. 1600 Technical Contact: Rod Nayfield, rod@ICONNET.NET 201-601-2000 (FAX) 201-601-2018
Sellers of email spam lists. See Dow Jones article Some e-mail ads use a new "Netiquette"
Internet E-Mail Marketing Council. Hosted by AGIS. President Walter Rines, president of QuantumCom. An attempt to legitimize email spam by instituting a global "remove" list and rules of ethics for spammers. IEMMC rules were ignored by the members right from the beginning, and IEMMC was widely regarded as a sham. See AGIS FAQ.
Alias of Worlddata
Associate or alias of Premier Services. 28262 Sorrento Suite 137; Laguna Niguel, CA 92677
IMC Marketing, PO Box 61798, Boulder, CO 89006. Owned by Joe Melle See whois info. Note that address may be at least partly fraudulent. Zip code 89006 is Boulder City, NV, not Boulder, CO. Phone number given in whois info is for Rickie Rodriguez, Chino, CA.
Alternate address: MBE # 1874, 806 BUCHANAN BLVD STE 115, BOULDER CITY, NV 89005-2144, Phone: (702)293-5788 Fax: (702)293-2164, IN SHOPPING CENTER NEXT TO SAV-ON.

Infospace.com gives amusing information for this phone number. (Go to reverse lookup page and enter 909-627-3557.)

Scam spammer selling Vigorex and other nostrums via spam. Believed to be owned by Steve Repsis. Hosted by e.spire.
Mortgage lead company, employs spammers to obtain leads. See MSNBC article Who profits from spam? Surprise
On-line credit-card billing service. Associated with Tom Gartman
Owner or owned by Nanycnet. See Spam Information Center for more info.
Alias of Netzilla
Service provider to email spammers. See netnews article "More interaccess.com spam, despite AUP".
American ISP known to host spyware and other malware. For more details, see Washington Post article ISPs hosting spyware - who are they?.

Associated with Atrivo.
(last update: 03 Dec 2007)
Alias of Tom Saylor
Alias of Tom Gartman. Current address: 512 Main Street, Suite 803; Fort Worth, TX 76102. Old address: 201 Main St; 13th Floor Suite 1350; FortWorth, TX 76102. Note that old address is identical to Dfw.net. (last update: 26 Oct 2000)
See Eddy Marin
Internet Service Provider owned by PSI.net
Internet Response Systems, P.O. Box 613, Columbia, SC 29202. See whois info for more details.
Web site used (Dec, 1998) by JTSR. Suspected rogue site, see netnews article Re: "This company is Cookin'- JTSR '97 thru '98 300% Revenue Growth" JT's Restaurants - at it again!
Purveyor of fine financial software. Known to collect personal information from its customers and sell it to spammers. Never give your real email address or other personal information to Intuit. See netnews thread: Intuit sells customer mailing list to Mattel Interactive
Internet Professional Network Solutions, 715 SW Morrison #908, Portland, OR 97205. Zone Contact: Daniel Nolan, dan@IPNS.COM 1-503-205-4767 (FAX) 1-503-205-4768 Rogue site; host of GDMS
"Bullet-proof" spam hosting service operated by Bill Stanley.
Owner of Crown Industries.
Church spammer that offers money for doing their mission work. Possible cover for a MLM scam.
Web service provider to spammers. Rogue site. Postmaster and abuse addresses previously routed to /dev/null. If email does not reach Isrv, call them at 1-724-445-2488 or 1-724-431-4778. Added to RBL Sept, 2000; see RBL nominations.
Alias of LibidoX.
Service provider to Crown Industries.
Mortgage broker; uses spam to advertise (possibly unknowingly). See MSNBC article Who profits from spam? Surprise
J
Alias of newsfeeds.com.
AKA Gaven Stubberfield. Aliases and/or associates include: GS Enterprises, Vanderbilt International, Killer Web Concepts, Neohosting Networks, Innovative E Commerce, National Wealth Builders, Free Webland, livexxxaction, Sean Hearn, Jeremy Jones, jerj@MINDSPRING.COM, pussyvalley. Associates include: Frank Bell, Raleigh, NC; Bill Jaynes, Raleigh, NC; David Sinclair, Vic Stuart, Raleigh, NC; Fred Anderson, Charlotte, NC; Franklin Thomas, Raleigh, NC; David Martin, AKA David Martinelli, Terryville, CT.

First spammer actually jailed for spamming. See AP article " Judge Sentences Spammer to Nine Years". Sentenced along with his sister Jessica DeGroot. Associate Richard Rutkowski was acquitted.

See Rokso listing for more info.

From the Rokso listing:
A non-stop group of porn spammers with T1 access. Multiple machines pumping scam and porn spam around the clock. Notorious for "horsey porn" spam starring "Rambo." Jeremy Jaynes, aka "Gaven Stubberfield" seems to be in charge of this sleazy operation. Richard Ruckowski (Richard Rutkowski) signs up for much of the hosting service.
Nashville ISP, disconnected Absolute Write web site after bogus DMCA claim from a scammer exposed by Absolute Write. See BoingBoing article Anti-publishing-scam site shut down by "agent"
(last update: 31 May 2006)
Email spammer, based at UUNet. John Groves, , w: 649/446-0002, h: 649-446-0002.
See netnews articles "How to identify a spammer's identity while he is still on-line!" and "jgroves spammer LOCATED" for more info.
Seller of spamware. Alias of Crown Industries
Alias of Jerry Nardini.
California politician running for governer. Sent out campaign spam in violation of California law, relaying through an open elementary school server in Korea, defense department computers, and others. See Sacramento Bee article Jones Web site yanked after flood of e-mail, netnews article Bill Jones' internet abuse an "urban myth"?, www.billjonessucks.com/, and Wikipedia.

Sample headers:

	Received: from vm5-ext.prodigy.net (127.0.0.1) by vm5-wfldad with
		ESMTP; Wed, 27 Feb 2002 16:17:54 -0500
	Received: from msn.com (210.95.103.194) by vm5-ext.prodigy.net
		(8.11.0.pi.sasl.milter.rejectatdoor.disable/8.11.0) with SMTP id
		g1RLGGB74918; Wed, 27 Feb 2002 16:16:17 -0500
	Date: Wed, 27 Feb 2002 16:16:17 -0500
	Received: from unknown (HELO smtp-server6.tampabay.rr.com)
		(152.175.243.132) by rly-yk04.mx.aol.com with local; Thu, 28 Feb 2002
		08:16:11 -1100
	Received: from mail.gmx.net (48.177.114.26) by rly-xl05.mx.aol.com
		with QMQP; 27 Feb 2002 20:11:15 +0100
	Received: from unknown (153.130.245.65)by m10.grp.snv.yahoo.com with
		smtp; Wed, 27 Feb 2002 15:06:19 +0600
	Received: from 148.206.87.144 (148.206.87.144) by
		rly-yk04.mx.aol.com with QMQP; 27 Feb 2002 21:01:24 -0000
	Received: from 83.220.79.235 (83.220.79.235) by smtp4.cyberec.com
		with local; 27 Feb 2002 12:56:28 +0800
	Reply-To: <Katie7546f02@msn.com>
	Message-Id: <007b17a22eba$7743b0e3$4ae04ab2@bglamv>
	From: <Katie7546f02@msn.com>
	Subject: Bill Jones for California Governor 8086RfOMl8
	
Note that the first IP address listed in the header belongs to Wandosoan Elementary School, a Korean elementary school. Other header lines are forged. The subject line contains a hash buster intended to help spam evade filters.

See also spam sent to famous non-existant "nadine" account.
(last update: 28 Feb 2007)
Owner of "Golf Balls Unlimited". Persistant email spammer.
Owner of "Dirty Dick's Erotic Cartoons", webmaster@dirtydicks.com 245 E. Fifth, floor 2, Erie, PA 16507; P.O. Box 1513, Erie, PA 16512. Spams via AT&T Worldnet. Hosted by imagiware.com. (Imagiware is hosted by Netcom.) (whois)
Aliases of Christopher William Smith
Scam spammer. Sells a penny stock called "JT's Restraunt". Almost certainly a fraud. Connectivity provided by Intersponse.com. Contact the SEC at enforcement@sec.gov. If the spam claims that JT's Restraunt is on NASDAQ (they're not), also send mail to isfeedback@nasdaq.com. See also: EvenTemp.
Large ISP whose name is often forged into spam. Juno is usually innocent, although they are sometimes used as the "drop-box".

It is believed that Juno does not allow user ids that start with a digit, so anything that fits that pattern may safely be discarded as spam.

Sex spammer. Spams in alt.sexual.abuse.recovery. Hosted by UUNet
K
Founder and largest shareholder of fax.com
Original registered coordinator of International-isp. Associate or alias of Tom Gartman. (last update: 26 Oct 2000)
Originally an admin at Netcom, notorious for answering spam complaints by (wrongly) insisting the problem didn't come from Netcom, and enclosing a header-reading tutorial. Often, netnews spam complaints would result in an email tutorial and visa-versa. Often known as "Keman the Clueless"

Currently working at Exodus
(last update: 18 July 2000)

Associated with or alias of EscortGuide.
"Toner Cartridge" spammer. See netnews article Re: Two issues See also Benchmark Print Supply
Major porn spammer, given 5 years in prison for conspiracy, money laundering, fraud, and transportation of obscene materials.

See Spam Diaries, PC World, WiReD, East Valley Tribune.

See also James Schaffer, Andrew Ellifson, Kirk Rogers, and Jennifer Clason.
Alias of LibidoX.
Associated with or alias of EscortGuide.

Owner of Gevalia Kaffe coffee. Advertises via spam in violation of Can Spam act. See MSNBC article Who profits from spam? Surprise. Currently being sued by Hypertouch. See also: ISP Steaming Over Coffee Spam, Kraft sued over alleged Gevalia spam.

Also sued by LL Bean over parasitic spyware which placed popups over the LL Bean web site, in partnership with Gator.
(last update: 22 Jan 2006)

Registered agent for spamkiller.net and others associated with Netzilla
Major email spammer. See Expedite Media and Spamhaus record.
Porn spammer. Thundercom, Inc., 1725 California, San Francisco, CA, 94122. (address is probably fraudulent) Administered by Morgan Hill Entertainment
Multimedia Cablevision, Inc. See Roadrunner.
L
Spam site -- hosts spammer web pages as long as spam is sent via 3rd parties. Clients include the "Dental/Optical" spammer. Believed to be under investigation by Washington State Attorney General (protect@atg.wa.gov)
Owned by Turner Scott. 12311 Maplewood Ave., Edmonds, WA, 98026. Contact: Scott, Turner scotty@HOTHOTMAIL.COM, 425 889-0811
Connectivity provided by Queenanne.net.
Porn site owned by Adult Promo. AKA qtime.qtime.com.
Spyware distributor. Co-defendant with Sanford Wallace in fake anti-spyware software scandal.
Major spammer; see Spamhaus listing Gordon Lantz & Gretchen Aitken/emailoffer.net
Alias of Bill Waggoner
President of AGIS, an internet backbone provider with pro-spam policies. See AGIS FAQ.
Owner of Woodside Literary Agency.
Email porn-spammer hosted by AGIS. AKA WebPromo, AKA mail-promo. LCGM, 204 West Eleven Mile Rd., Madison Heights, MI 48071, Contact: Francis Sharrak, francis@LCGM.COM, FS325@FLASH.NET, (810)584-3300, (810)584-3400, Fax: (810)584-2229. Also: (415) 851-0251 (FAX) (415) 851-5668 (unverified).

Update: I am informed that this is actually the address of a barber shop.

News: Currently being sued by Hotmail.

AKA Neighborhood Loan. Mortgage lead broker, known to hire spammers, at least indirectly. Former business partner with Ameriquest. Notable for having sued Robert Braver in retaliation for his anti-spam lawsuit against them and Ameriquest.
Business owned by Ryan Pitylak
Co-founder of BumpTech
Alias of Tom Saylor
Associate or alias of Dean Westbury
(last update: 10 Jan 2002)
Alias of Crushnet.com.
Network service provider with pro-spam history. See Level 3 info page.
Porn spammer in Santa Monica, CA. See LibidoX info page.
Spammers; works by hijacking open proxies. Ernst Licht Embroidery and Imports (ERNSTLICHT-DOM); 347 Main Street, POBox 255; Oley, PA 19547; US. Service provided by Verio and Dial Tone Internet.
Porn spammer in New York, hosted by Sprint. See Whois info for more information.
Name attached to a chain letter. Possibly ficticious. See "Home Page of Karen Liddell" for more information. See also netnews thread "Karen Liddell spam-again"
Pill spammer. Business partner of Alan Ralsky. Pled guilty to three felony counts in Jan 2006.

See Spam Kings article Team effort on Lin case. Ralsky next?

According to Terrence Berg, US Dept of Justice, Lin is the first person ever prosecuted under CAN-SPAM, in April of 2004.
(last update: 23 Nov 2009)

Owner of iMedia Networks, and Galaxy-net.net
Alias of Tom Saylor
AKA E360Insight. AKA Northshore Hosting Company. Business associate of Brian Haberstroh. Details of their relationship are sketchy at this time. Linhardt seems to be the preferred service provider for Haberstroh. Also associated with Brian Kramer (Expedite Media Group) and bargaindepot.net.

See ROKSO record ROK7008

Obtained a TRO against Spamhaus in an Illinois court in 2006. See Spamhaus response.

Sample spams.
Spam-tolerant isp. Provider for, or the same as, Classy-Fieds.com. Rogue site, see letter. Disconnected by Netcom, 15 June 1998. Connected by Best, late June 1998.
Spammer. Aka "Krazy Kevin". Magazine spammer. Convicted of fraud June 1997. Returned October, 1999. See Lipsitz tracking page for more information.
Alias of Tom Saylor
Alias of Bill Waggoner
Porn spammer. Alias of SluttyGirls
Porn spammer. Alias of SluttyGirls
Email porn spammer. Hosted by Netcom. Reckless Romance Communications, 22156 Del Valle Street, Woodland Hills, CA 91364, Kiki Riedel, kiki9@IX.NETCOM.COM 818/340-0443. Email address is reported to be non-working.
Login Las Vegas, Major email spammer, including the "Princess "Diana Tee Shirt" spam. See Spam Information Center for more info. May be identical to NevWest.
Associated with Web877.com. Initials of Lawrence Wojtowicz. Believed to be a major binary spammer.
Mortgage broker; uses spam to advertise (possibly unknowingly). See MSNBC article Who profits from spam? Surprise
See Alan Ralsky
"Credit Repair" and "Internet Spy" email spammer, aka West Coast Publications, aka MyWebSiteOnline, Inc, aka Thesecretword.com. See FTC complaint and News Release. (last update: 20 Aug 1999)
Alias of Babenet.
See Empire Towers.
Porn site; advertised by Jerry Nardini.
M
News server used (Nov 1998) by Tom Saylor to inject spam. Owned and/or operated by Karl Denninger. Same as or sharing facilities with GTMI. Connectivity provided by nap.net.
Alias of Tom Saylor
See T3 Direct and Wikipedia.

Prosecuted by Australian Communications Authority; see ZDNet article ACA to prosecute alleged spammer and Infoworld Nederlands article Landmark spam case begins in the Australian court. Update: see court order.

Seen 11 May 2006, advertising a seminar on email marketing.

Fined $5.5 million by Australian Federal Court in October, 2006 for sending 280 million spam emails. See News.com.au article Company fined $5.5m for spam emails.

Fined $95,000 for spamming, Aug 2013 http://www.stuff.co.nz/business/industries/9041805/Spam-leads-to-95-000-fine


(last update: 14 Aug 2013)

Florida vaction spammer. Contact: 813-908-9448. See E-Travel.
Mail Abuse Protection System. Operator of the Realtime Blackhole List (RBL). The MAPS database lists sites which are the source of spam or maintain open relays being used by spammers. See the maps.vix.com website for more information.

Media Articles:

Email porn-spammer. Alias of LCGM.
Alias of Bill Waggoner
Name often attached to spam. Not known if this is actually related to the real mailexcite.com
Florida porn and gambling spammers. Former cocaine dealer & drug money launderer. AKA Internet Video Network, AKA Interplex, AKA OneRoute, AKA One Stop Data, AKA Direct Marketing Entertainment. Joined forces with Thomas Cowles who subsequently stole their computer equipment and fled to Ohio. Described by a Miami Herald reporter as "A pathetic little guy I met three years ago in a deserted porn warehouse".

See New Times article South Florida's Eddy Marin went from cocaine to porn to spam

See Chickenboner.com for more information.

Court cases:

Generic spammers. Spam begins with a line saying "this is not a spam".
Author of fake spyware-removal software. Co-defendant with Sanford Wallace in fake anti-spyware software scandal.
Porn vender that advertises via spam in alt.sexual.abuse.recovery. Associated with Tom Gartman (see <25049812.0306@sprynet.com>). Fort Lauderdale Network, 1299 E. Commercial Blvd., Fort Lauderdale, FL 33334. Contact: dns@LAUDERDALE.NET (954)489-3981 (FAX) (954)489-3986
Owner or operator of Firstfamily.
Shell corporation which owns Bargain Depot and is owned by David Linhardt. See affidavit and business search.
Domain owned by Max Stemple.
Maxcom (NOCOSTPORN2-DOM), PO BOX 1711, Fort Worth, TX 76018.
Contact: Stemple, Max (MS22564) max@INETCHARGE.COM 1-817-905-7529 (FAX) 1-817-905-7529
Major ISP. 244 listings at Spamhaus as of Feb 2006. Now merged with UUnet and Verizon
(last update: 07 Jul 2006)
Rogue news server operated by Tom Gartman. Not associated with MCI in any way. Connectivity provided by PSI.
Porn spammer. See Web877.com info page.
Registered owner of Inetcharge.com. Brother in law of Tom Gartman. Sentenced to 30 months in prison on obscenity charges August 24, 2006.
Macro Computer Solutions
See Scott Richter. Previously known as OptinRealBig. In 2009, settled a class-action lawsuit concerning "cramming" mobile cell phone customers with unauthorized charges (Vandyke et al v. Media Breakaway, LLC, No. 08-cv-22131.)
Porn spammer in Clearwater Fl. See Media 1 Info Page.
Network service provider -- hosts known spammers. See Peacefire for more info.
Allegedly part of the Extractor Pro spamglomerate. See netnews article tekker.com begs not to be held accountable
See EmailResults.net
Email porn spammer. Profesional Teleconferences Inc., 7028 Bandera Rd, Ste. 176, San Antonio, Tx 78238, David Myles, video1@TOOEASY.NET, 210/681-7770. Domain Servers: NS1.TOOEASY.NET, WWW.TOOEASY.NET Connectivity provided by MCI through TooEasy.net.
Chain letter scam. See "Cracking the MEGA$NETS Chain Letter Scam" by Wallace Wang at Boardwatch. See also MMF Hall Of Shame Update: the Mega$Nets author, Kalvin P. Schmidt, has signed a consent decree with the federal trade commission agreeing to cease and desist distributing Mega$Nets.
Dutch internet service provider. Associates or owners of Cyberangels. Operated by Martijn Bevelander. Known to hack into innocent computers to use them as web page hosts. See BBC article Spam peddlers hijack computers, spamvrij.nl article Cyberangels.nl domain now owned by spam fighters, and spamvrij.nl article Analysis of incoming cyberangels.nl mail.

Kicked off spanish service provider Telefonica 30 June 2003.

Porn spammer. See apeepingtom.com
Alias of Bill Waggoner
Spammer. Brother of Joe Melle. See Industry Standard article Who's Spamming Whom?
Former email spammer. No longer found on Rokso list. See New York Times article "The American Way of Spam" for more info.
Alias of Joe Melle.
Alias of Harris Marketing.
Email spam site. MerchantOnline.com, 1600 S Dixie Hwy, Boca Raton, FL 33432. Contact: Tarek Kirschen, 561/395-3585, 800/316-1936, fax 451/482-5253. See internic entry for more. Hosted by UUNet.
Dedicated spam site. Blackhole them.
Metropolis Internet Group, Rochester, NY. (See whois info for more details.) Service provider with a pro-spam policy. See netnews article "Metranet says "Just hit delete" for more.
Alias of EscortGuide.
Major corporate monopoly. Known to advertise via spam. See InfoWorld article "Don't look now, Microsoft might be spamming you".

Update: Found themselves listed by SpamCop, Feb 2006 for spamming again. See Spam Kings Illegal spam from Microsoft.
(last update: 03 Feb 2006)

See Campbell, Rusty.
Rogue network service provider. Connected with TheHitMan.com. See netnews article Spammer Attitude(tm) at MIDATLANTIC-ISP.NET
Owner of Empire Communications. See also Middleton info page.
Beer manufacturer. Hired Equifax and Naviant to track down people who had managed to escape their spam list and add them back in. See Spam Kings' excellent analysis
Also known as pm0.net. Email spammer. Web site includes removal methods which do not work. (info provided by a reader, not verified) (last update: 9 Jan 2002)
Television psychic. Known to advertise via spam.
Mortgage lead company, employs spammers to obtain leads. See MSNBC article Who profits from spam? Surprise
Professional spam site. Tricked PaeTec Communications into signing a pink contract and obtained a restraining order when PaeTec tried to disconnect them. See CNet article Giving spam the network boot. Customers include OverStock.com, ProFlowers.com, Ourhouse.com and Giftbackets.com

See http://litigation.paetec.net for more information.

Morgan Hill Entertainment, 1032 Irving Street, Ste# 978, San Francisco, CA 94122, 415-541-5093.
Admin for porn sites Nymphette.com Cherrypoppers.com and sexypussy.com. Currently (30 Jan 1998) spamming from Ici.
Hosted by CRL
AKA: 24hrxxx Online, All Amateurs Online, Barely19 Online, Cherrypoppers Onlne, Dirtysecrets.com, fleshzone.com, 24hoursex.com, pussykat.com, sexpussy.com, quim.com, fasterpussy.com, m-gallery.com, Naughty Girls Co., Stormworx Direct Video, ThudnerCom, XXX Streams Online, etc. See Morgan Hill Info Page for more info.
Alias or associate of Richard Scoville. See SamSpade.org info.
Major email spammer; found guilty under CAN SPAM act in June, 2005. Faces $350,000 in fines and 3 years in jail. See Internet Patrol article How to Go from Spamming to Prison in 6 Short Months. Unrepentant to the last; see his comments.
Mountain States Communications, 14444 California Ave., Suite D, Victorville, CA, 92392. Rogue site; permits email spam from its customers. Contact: Tim Harris, tim@mscomm.com, 619-245-1161 (FAX) 619-245-1860. Hosted by bbnplanet.net.
Service provider to Cybercreek. Rogue provider.
Microsoft-owned ISP. Known to advertise via spam. See MSN Info Page. Also a major source of spam from its customers. MSN is also frequently used as the fake "From" address. It is believed that MSN does not allow user ids that start with a digit, so anything that fits that pattern may safely be discarded as spam.
Music seller. Known to spam. See netnews article "musicblvd.com spam"
Matrix On-Line. See MXOL info page.
"White hat" provider -- has an effective AUP and enforces it.
Alias of Tom Saylor
See Gilberto Lopez
See Alan Ralsky
N
Adware program installed by 180solutions.
Alias of Advanced Internet Technologies.
Major email spammer. Owned by Walter Rines. For more information, see Spam Information Center for more info.
Porn spammer. Owner of lustland.com, clubteen.com, amateur-sex.com, dikes.com, teentown.com, sexbabes.nu. Notorious for sending explicit porn ads to alt.sexual.abuse.recovery.
Whois gives the following information:
112a Cervantes Street, San Francisco, CA 94123. 415/928-6025. jnardini@ISP.NET
25 Stillman st. #200, San Francico, CA 94109. 415/281-3104. jn@slip.net
Aliases include "Jan Nicholson", "JN Publishing". Reminder: some or all of this information may be fraudulent. Currently spamming through Epoch.
Hosted by Galaxy-Net.net.
See Jerry Nardini info page for more.
Porn spammer, part of the Morgan Hill Entertainment spamglomerate.
Nasty Girls Co., 3131 Market Street Suite 399, Redwood City, CA 94064. (address is probably fraudulent)
Purveyor of collector's coins. Advertised heavily via spam through subcontractors starting in 2002. See sample spam (source)

Fined $369,000 in 2005 for their "Freedom Tower" coin scam.
Mortgage company that advertises via spam. See c|net article.
Alias of Dfw.net
Alias of Tom Saylor
Medical spammer. See Jason Vale. Contact: cianide70@aol.com Hosted by bbnplanet.net.
Scam spammer. Jason Heckel. See Wired coverage. More links at
Professional spam operation, associated with Scott Hirsch As of Feb 2006, working for Miller and Equifax. See Spam Kings excellent analysis Inside the creepy Miller Brewing spam probe.
Spam site. Creates ficticious downstream sites to spam. Then, when you complain to NCSDI, they collect your email address for more spam. Associated with USA-MERCHANT aka TrafficBoost. See netnews thread "Spammer's new tactic Re: NCSDI.NET".
See Robert Soloway
Pay-per-click advertiser that uses spammers for advertising. See Guardian article An unwelcome guest of spam
Porn spammer that posts to alt.sexual.abuse.recovery. 8330 Rustling Leaves, Houston, TX 77083 Peer Ben, bpeer@WXS.COM, 713/286-8777
Marketing company that uses spam. See Rokso record
(last update: 16 Mar 2006)
Marketing company that hires known spammers. Formerly YFDirect Inc. AKA Marketsurveygroup.com, AKA EasyEZStreet.com, AKA MinglyComp.info, AKA EveryFreeGift.com

See Hypertouch Web site for info about various lawsuits against NetBlue. See expert witness testimony for details on how they work.
Major ISP with a pro-spam policy. See Netcom info page.
See Hostpro
Service providers and spammers-for-hire for hardwarestreet.com. For more information, see netnews thread "HARDWARESTREET.COM"
Largest ISP in Hong Kong. Recently acquired by Hkstar.com.
Porn-spammer. See NetVirgins info page.
Makers of PGP and other crypto software, McAfee VirusScan and other products. Now spamming via email. See netnews threads "McAfee/Network Associates spamming again" (news.admin.net-abuse.email) and "More spam from NAI/McAfee :(" (alt.security.pgp)
See Alan Ralsky.
Domain owned by Tom Gartman
See Alan Ralsky
The largest netnews porn spammer on the internet. See Netzilla info page.
Alias of Bill Waggoner
Major email spam source. For more information, see the Nevwest info page at e-scrub.com. Currently hosted by ACSI. May be identical to LLV.
Alias of Bill Waggoner
Known spamhaus. Sellers of spamware. Client of Media 3
See Alan Ralsky
Domain owned by Tom Gartman
newsfeeds corp, 3799 Las Vegas Blvd. South, Las Vegas, NV 89109 Contact: postmaster@JAM.NET. Contact phone number in whois info is fradulent. Network service provider for Brian Schuster and sexylolitas.net. Originally a rogue site. Believed to be an alias of Netzilla. More recently, Newsfeeds seems to have become a legitimate business. (last update: 22 July 2000)
Website occasionally accused of spamming. They do have an anti-spam policy statement, and they seem to enforce it properly.
National Integrated FoodService Corporation. New name for JT's Restraunt. See PR announcement at http://biz.yahoo.com/prnews/981210/ny_nat_l_i_1.html
Owner and/or operator of the sites sexplosion.com, usachat.com, blitzit.com and xxx-18.com.
Innova Interactive, 225 S. Lake Ave., Suite 300, Pasadena, CA, 91101. FAX: 626-405-2358 (disconnected)
See netnews article Re: NEED HELP TO STOP SPAM!!!
nLayer Communications. Service provider to Findmorepill, and Atrivo.
(last update: 25 Apr 2006)
Fraudulent name often attached to spam. Nowhere.com is innocent and welcomes polite reports of spam sent out in their name.
Fraudulent name often attached to spam. Nodomain.com is innocent.
National Organization of Internet Commerce. Spammers union. President Joe Melle attempted to blackmail AOL into accepting spam. See L.A. Times article "Group Says It May Post AOL User Addresses" Only known members of NOIC are Joe Melle and Connectup.
See Yourleadsource.com
Alias of David Linhardt
Mortgage company that advertises via spam. See c|net article.
Seller of networking software. Known to sell email addresses to itsimazing.net for spamming purposes.
Owner of or associated with C.N. Enterprises. Found guilty of forging flowers.com in from: header of spam. See court ruling
Fraudulent name often attached to spam. Nowhere.com is innocent and welcomes polite reports of spam sent out in their name.
Network Solutions Inc. Company that currently holds the government contract to run domain registration for the major top-level domains (.com, .net, etc.) Also sells spamming services on the side. See internet.com article "No Escaping Junk E-Mail From Network Solutions".

See also: The Sordid Saga of Sex.com, Sex.com Saga Still Sizzling, Network Solutions Liable For Sex.com Theft, NSI screws over grad student, gets away with it, Domain Winner Loses Big, E-Riots Threaten EToys.com, Excite.com Goes to Illinois, vy.com stolen due to NSI error, and New York's Oldest ISP Gets Domain-Jacked

Spam-friendly web hosting provider. Specifically allows spammers to maintain web sites there. Service provider to Steve Repsis. See netnews article Re: Spam-friendly host
See Alan Ralsky
See Netzilla
Alias or partner of Empire Communications
Porn spammer. THUNDERCOM,INC., 1725 California, San Francisco, CA 94122. Contact: J Sears, stormwx@EARTHLINK.NET 510-874-4735, 415-541-5093 (address is probably fraudulent) Administered by Morgan Hill Entertainment.
O
See eDirect
Professional spammers. AKA offshoredirect. Same as or associated with Bulk ISP
Offshore ISP Corp; 3759 Cardiff Avenue Suite 307 (actually an apartment, not an office); Los Angeles, CA 90034; Phone / Fax: (310) 839-1363. Hosted by CoreComm
Mainsleeze spammer. See Usenet thread Just got done talking with Omaha steaks. Hosted by UUNet.
Porn spam site owned by Christopher Ferri. See Online18 info page.
Parent site to TheHitMan.com
Site which sells spam services and hosts web pages. Down stream from Linkus.com.
"Bullet proof" spam hosters. Listed by SPEWS as having pumped more spam than any other network in the world (see SPEWS record S2537). Dubbed "worst spam network on earth". Believed associated with Scott Richter; see records S511, S2067, and S2378. Service provided by Above.net.
Now known as Media Breakaway.
Major email spam operation; fined by FTC in 2006. See ROKSO record for more.
(last update: 13 Apr 2006)
Florida porn spammers. Associated with Eddy Marin
See Jared Lansky
See Jay Echouafni
Open Relay Blocking System. Similar to the MAPS blackholelist, the ORBS database lists sites which maintain open relays which may be abused by spammers. The ORBS database is more aggressive than the MAPS databse. See the Orbs.org website for more information.

ORBS is considered excessively aggressive by many. For example, sites that do not permit ORBS to scan their IP ranges, or which otherwise piss off the ORBS administrators, are added to the ORBS database in retaliation.

It should be remembered that a listing in the ORBS database does not mean that the listed site is or ever was a source of spam. It merely means that the listed site has an open relay or has done something to annoy the ORBS administrators.

In late 1998, Orbs was kicked off the internet by their backbone provider BCTAC in response to complaints. As most service providers in the area received connectivity from BCTAC, it was very difficult for Dorkslayer to return to the net. See netnews article " BCTAC and Dorkslayers - BCTAC response" for the full story.

See also the Stop ORBS.org and Direct Email Advertisers Association web sites.

Alias or associate of Scott Wilkerson
Web site owned by Melvin Sleight, used in the "Diana Tee Shirt" web page.
Online drug dealer. Advertises via email spam. Registered to Michalis Del A Sol, 12 Miller Street, Hill End, Brisbane, Queensland 4101, Australia, +617 33427350, devmug@optusnet.com.au
(last update: 27 Jan 2006)
On-line business that advertises by spam. Customer of MonsterHut.
On-line business that advertises by spam. Customer of MonsterHut.
2054 East Desert Inn Rd. Suite C, Las Vegas, NV 98109, Owned and/or administered by Joe Tajalle, 702/733-1028. Aggressive email spammer, currently being sued by AOL and by Strong Funds. AKA: babeview, hotgrrls, xtc4u2c, camelot, atlantis.
ISP known for harboring spammers. See SPEWS listing for details.
P
Pacific Bell -- rogue site. See Pacbell page.
Alias of or associated with Bill Waggoner
Network provider to Atrivo. Began serving Atrivo around 12 Sept 2008 when other network providers were disconnecting them. Reversed their decision about 22 Sept.

President David Grieshaber said he took Atrivo on as a customer because he was good friends with Atrivo founder Emil Kacperski. See Washington Post article Internet Shuns U.S. Based ISP Amid Fraud, Abuse Allegations

Previously hosted/routed Scott Richter and Alan Ralsky. Removed from Spamhaus 22 Sep 2008.
(last update: 22 Sep 2008)
Alias or partner of Empire Communications
PaeTec Communications. Network provider tricked into signing pink contract with Monsterhut. See http://litigation.paetec.net for more information.
Unsuccesfully sued relays.orisoft.com for listing their open server.
Travel agency in Ormond Beach, FL. Sued by Verizon Wireless for sending 98,000 spam text messages to Verizon customers. See Reuters article Verizon Wireless wins injunction in spam case.
(last update: 02 Feb 2006)
Creator of Lightspeed Marketing, makers of "Nexus" and "Dark Mailer" spam software. Pled guilty as part of the case against Alan Ralsky
On-line payment processing service aimed at servicing on-line auctions. Known to sell its customer's email addresses to spammers.
Business owned by Ryan Pitylak
Alias of or front for Empire Communications Hosted by Verio.net. Rogue site.
Non-profit political site. In July, 2000, Peacefire was moved by their network provider, Media3, into a block of addresses which were in the rbl. This may have been at Peacefire's request, in which case it was likely to have been done as a publicity stunt. It is also likely that Media3 moved Peacefire into the RBL'd block as a sort of "human shield." Neither Media3 nor Peacefire are willing to clarify this.

When email to Peacefire began to bounce, Peacefire began to complain loudly of censorship. Peacefire admin, Bennet Haselton refused all suggestions that he move back out of the RBL'd netblock, and refused all offers of free internet hosting with other providers.

For more information, see netnews article The truth behind Peacfire/Media3 and San Francisco Chronicle article Spam Wars -- Markets battle with e-mail activists over your inbox.

Porn spammer. Quixotik, Inc (PEARLSPUSSY-DOM), 2533 N. Carson St., Suite 2982, Carson City, Nevada 89706.
Contact: techassistance@COMSTAR.NET 702.841.3965 (FAX) 702.883.2384
Contact: Quixotik, Inc. - Domains (QID-ORG) domains@IMPULSIVE.COM 702.841.3965, Fax- 702.883.2384
Connectivity provided by Icix.net.
Email spammer. Owner of T-Rex Media. Former sales manager for Scott Richter. See Spam Kings
(last update: 26 Jan 2006)
Porn spammer. OK Internet Services, Inc., PO Box 1013, Urbana, IL 61803, 217/398-7326 (FAX) 217/398-7326.
Apparent porn spammer. 1299 E. Commercial Blvd, Fort Lauderdale, FL, 33334. Hosted by Lauderdale.net
Alias of Woodside
Nickname of spammer Walter Rines. See netnews post Spam Report sent to IEMMC.ORG on the occasion of their being lying bastards...
Alias of Zango
Major mortgage spammer; former college student at University of Texas. Once considered fourth worst spammer in the world, sending 25 million spams/day.

See It's a Spammer's Life, Email Battles article After fines, convicted spammer opens anti-spam service, SC magazine article Former spam king Pitylak now trying to earn firms' trust as anti-spam consultant, San Antonio Express news article Former spam king seen as good kid gone astray (Article indicates that he had more than 3,000 domain names, 100,000 Hotmail addresses, and 300 assumed business names), his op-ed piece Confessions of a former spam king, Guardian article Spam king Ryan Pitylak turns "activist", DN Forum thread Looking for Ryan Pitylak or Mark Trotter and Rokso entry 4555.

Settled with Microsoft and state of Texas for $10 million, June 2006.

Now claims to be an "ex-spammer" and has a blog called combatspam.
(last update: 23 Jun 2006)

Contact management service. Causes you to receive emails puportedly from friends, asking you to update your contact info. Believed to be used by spammers to build email lists. It is probably best to ignore unsolicited emails from Plaxo. See also letter of apology from Plaxo president.
Porn spammer. Images Marketing GRoup, 23 Cedrus St. Sunnybank, Brisbane, QLD 4109, AU.
Administrative Contact: Steven Harris steve@PLAYGAL.COM +61-7-3863 1599 (FAX) +61-7-3863 1297 Techinical Contact: Network Control Center, support@EXODUS.NET (408) 486-5000 (FAX) (408) 486-5001.
Connectivity provided by Exodus.net
Alias of Tom Saylor
Email spammer. Pop Mail, Bayonne, NJ 07002 Contact: admin@POP4MAIL.COM 201-823-9705.
Connectivity provided by Exodus.net
See Empire Towers.
Dial-up access provider. Very poor response to spam complaints. Note that legitimate email from popsite does not have "popsite" in the Received: headers. If you receive email with "popsite" in the Received: headers, it is spam.
Porn spammer. Joseph Reynolds, 1550 Terrell Mill Rd. Apt 25B, Marietta, GA 30067. jgreynolds@MINDSPRING.COM 770-956-9558, 314-416-1982, Fax- 314-416-1982 Connectivity provided by Completeweb.net
Porn spammer. Christopher, Connally. p.o. box 748, DeFuniak Springs, FL 32435. 847-818-8458j, 705-721-6680. Has over 500 domain names. Connectivity provided by Brevard.com.
Porn spammer. IMA Enterprises PORNOMASTER-DOM 4057 US Hwy 9 North Suite 177, Howell, NJ 07731. Contact: Pete Erickson, roselle@SUPERLINK.NET 1-800-502-2761, (FAX) 732-918-8103, Daryl Gregg, daryl@IMA-WEB.COM. Connectivity provided by Completeweb.net
Porn spammer based at powernet.co.uk. European Connections, Suite 20, Singel 417, Porn spammer based at powernet.co.uk. European Connections, Suite 20, Singel 417, 1012 WP 1012 WP, NL. Contact: Steven Scott, Euroconnections@HOTMAIL.COM 003120 6258455 (FAX) 003120 6387894.
Last seem spamming from Shaw Fiberlink Limited.
Alias or partner of Empire Communications
Alias of C-Flash.net.
See Alan Ralsky
See Alan Ralsky
Alias of Tom Saylor
Professional email spam operation. Premier Services; 22934 Johnson Drive, Clarkesville, TN 37042 615-394-2834.
Read all about them in detail in Behind Enemy Lines -- Premier Services Exposed.
Alias of Tom Saylor.
Alias of SJ Enterprises.
On-line business that advertises by spam. Customer of MonsterHut.
Performance Systems International. Once considered a rogue site. Recently discovered to issue pink contracts. See PSI Info Page for more information.
Viagra spammer. Arrested April, 2001. See Smh.com.au article Australian Viagra Mogul indicted to US
Porn spammer. MILE HIGH PRODUCTIONS, 1938 ARTHUR RD, WINDSOR, ON N8W4V4, CA. See nic listing for more info. (Note that whois entry contains at least some fraudulent information.) Connectivity provided by AdvanceNet Corporation, 201 W. Springfield, Suite 909, Champaign, IL 61820.
Q
Alias of LLV.com
Major email spammer. Owned by Walter Rines. For more information, see Spam Information Center.
Porn-spammer; spams alt.sexual.abuse.recovery. The Quantum Leap BBS, P.O. Box 1524, Bellmawr, NJ 08099. Domain Name: WEBSEXNOW.COM. Contact: Dianne E Ursini, webmistress@NETCRUISER.NET (609) 931-4566 (FAX) (609) 931-4013. Connectivity provided by interactive.net.
Online ad company. Sued for $2M by New York times over fraudulent subscriptions. See Online Media Daily article Times Wins Suit Against Online Ad Company.
(last update: 22 Jan 2006)
Mortgage broker; uses spam to advertise. See MSNBC article Who profits from spam? Surprise, c|net article, and PC World article Spam Slayer
Internet service provider. Host of the berrytrim and Asian-girl-erotica.com spammers. The abuse address for qwest is abuse@qwest.net. Do not contact abuse@qwest.com; that number is for abuse from qwest employees only.
\n\n
R
Web page hosting service. Permits customers to spam as long as spam is sent via a third party.
Pro-spam network service provider. Has anti-spam policy but was extremely lax about enforcing it. Clients have included herbmeister.net, Josh Baer, Alan Ralsky, penisgrowth.com and many others.

More recently have acquired a good reputation for fighting spam, now considered to be (mostly) one of the good guys.
(last update: 06 Jul 2009)
Dalls police officer and partner to Tom Gartman. Sentenced to 33 months in prison on obscenity charges March 5, 2004.
Wife of Garry Ragsdale. Sentenced to 30 months in prison on obscenity charges March 5, 2004.
Well-known spammer, moves from ISP to ISP. Uses a lot of domain names. Connectivity previously provided by Sprint and UUNet. Domains include 123asdf.com, alotta34.com, bemybabey.com, checkingone12.com, coolman01.com, daychore.com, domainstop.org, fixit02.com, goingoutforlunch.com, grindbind.com, happyday01.com, lopermanagement.com, myworld02.com, networkbeat.net, networkpride.net, newpowerdomain.com, numberop.com, powernets.org, poxteam2001.com, rellingup.com, servicenetbest.com, theslotsaretalkingtome.com, tivodom.com, yellowsun01.com (this list is probably out of date)

Convicted 1994 of falsifying documents to defraud two banks in Michigan and Ohio. See c|net story for more convictions and other legal actions.

See http://hairy.linuxnuts.net/anti-spam/ralsky/ for a more complete domain list.

Ralsky-owned domains can often be identified by their use of networkbeat.net and grindbind.com as name servers.

More recently, Ralsky has been using ISPs in China.

For more information, see the Spamhaus Project and c|net story Inside the spammer's world

Raided by FBI, October 2005.

Connected to convicted pill spammer Daniel Lin, see Spam Kings article Team effort on Lin case. Ralsky next?

Once rumored arrested in late April 2006. See Infoworld article Hackers quaking over reported Spam King's arrest.

Indicted on multiple charges including money laundering and stock fraud, Jan 2008.

Pled guilty to conspiracy, fraud, and money laundering, June 2009.

Sentenced to more than four years, November 2009.

See also, video of Terrence Berg, from the US Dept. of Justice's presentation Case Study: The Spam King
(last update: 23 Nov 2009)

See Steven Rombom
Alias of Tom Gartman
PO Box 171139, Arlington, TX 76003. Alias of Tom Gartman
2110 Gorky Park Ln, Dallas, TX 76006 Alias of Tom Gartman
Royal Bank of Canada. Advertise via forged email spam. See netnews article RBC Dominion Securities: "UBE is not SPAM". See also netnews article containing a copy of the spam.
Realtime Blackhole List. See MAPS for more information.
Alias of AISI
Suppliers of Real Audio and other multimedia software. Progressive Networks, Inc, 1111 Third Avenue, 29th Floor, Seattle, WA 98101. Advertise via spam. When downloading files from real.com, they ask for your email address. There's a box you can check to indicate that you don't want spam, but they ignore it. NEVER give your email address to real.com. It has been demonstrated that "remove" requests cause you to be *added* to the spam list. Service provided by eli.net.

NOTE: It has been discovered that Real.com's CD player software automatically sends information to Real.com every time you play a music CD. Software also searches your disk for music stored there and sends results to Real.com. See New York Times article CD Software Is Said to Monitor Users' Listening Habits

UPDATE: Real.com has been taken to court. See the following:

UPDATE: 19 July 2000 Real.com has been caught distributing spyware again. This time it's their smart downloader product which sends a report back to real.com every time you download something from the internet. See netnews thread Caught illegally snooping, Real Networks makes Cartoony Threats against Steve Gibson. According to one poster, Real.com's software even sends them a report when you uninstall the software.

(last update: 7 June 2000)

Internet domain registry. Known to sell its email list to spammers.
Porn spammer. Owns LiveWhoreHouse.com, livenudepussy.com, cumcravers.com and pinkpussyclub.com. Previously hosted by Netcom which has a pro-spam policy. Current whereabouts unknown.
See Alan Ralsky
Scam. Web site which accepts your email address for a "global remove list", but in fact probably gives it to spammers. Service provided by Concentric.net.
Scam. Web site which accepts your email address for a "global remove list", but in fact gives it to spammers. Operated by PinPoint Media (Bulkbarn.com, AdultPatrol.com, etc.) See netnews article "Update on Remove-List"
Alias of ExtractorPro.
Spammer. Known for the "pheremone" scam, the "cable descrambler" scam and "Quitsmokingforever". See Repsis info page for more.
Clearing house of email addresses for email marketing. See netnews thread does the Return Path company provide spam support?

Consensus seems to be that they do everything possible to avoid spamming.

Filed an Amicus Brief on behalf of Spamhaus in 2007.
(last update: 13 Mar 2007)
Owner of Netzilla.
Seller of web page obfuscation program intended to make it harder to reverse-engineer html code. Sometimes used by spammers to make tracking difficult. Author of rezsoft insists that this was an unintended consequence.
Associate or alias of Ronnie Scelson
Father of Scott Richter. Acts as Scott's lawyer and president of Media Breakaway.
(last update: 06 Jan 2008)
Major spammer; owner of OptinRealBig, myemailwizard.com, CPA Empire.com, Media Breakaway. May have run WholesaleBandwidth. Successfully sued by Microsoft. See Reuters article Microsoft settles suit against one-time 'spam king' and Register article Lawsuits drive 'Spam King' Richter to bankruptcy.

Successfully Sued in New York for deceptive business practices, Dec 2003.

Switched to opt-in and removed from ROKSO in July 2005. See also SPEWS records S511, S2067, and S2378.

Attempted to sue SpamCop for listing him as a spammer, May 2004.

Sued Sept 2006 by Infinite Monkeys & Co., LLC for spamming. See press release and complaint (pdf).

Sued Jan 2007 by MySpace for phishing and spamming.

Sued June 2007 in small claims court for spamming.

Seems to be trying to go legit; hired anti-spam lawyer Pete Wellborn in 2007. Major donor to David Ritz defense fund, 2008.

Daily Show interview.
(last update: 31 Jan 2008)
Suspected alias of Bill Stanley, see Spammer makes threats to shut down site
Brother of Walter Rines; former VP of sales and marketing for GTMI. Owner of MediaHeights LLC, aka EmailResults.net. See Spam Kings article The duke of spam
(last update: 8 Dec 2005)
Owner of QuantumCom and Nancynet, president of IEMMC, owner and/or operator of GTMI. Former partner of Sanford Wallace. Accused of installing spyware by FTC; see WiReD article Spyware Purveyor in Cross Hairs
Alias of Christopher William Smith
Porn spammer, hosted by Above.net. Owner or associate of porn sites totallyteens.com, iwantnetsex.com, maximumcash.com, greenstedcom.com, karasxxx.com, teenx.com, karasamateurs.com, tranniesonline.com, asianpleasures.com, majormelons.com, teensteam.com, absolutelymale.com, justasianteens.com, exithits.com, ebonyfantasy.com, classicmature.com, lesbianpink.com, sinfulmail.com, razormagazine.com
Major ISP, hosts Mike Cunningham and Andrew Amend.
See Foonet
Alias or associate of Joe Melle. See IMC-Marketing for more info.
Major porn spammer, pled guilty to porn spamming, Jan 2006

See Spam Diaries, U.S. Newswire.

See also Jeffrey Kilbride, James Schaffer, Andrew Ellifson, and Jennifer Clason.
AKA Steven Rambam. Owner of or associated with Pallorium.com. Unsuccesfully sued relays.orisoft.com for listing their open server. Publicly arrested July 2006 by the FBI on charges of impersonating a federal investigator and witness tampering.
President of 30 Minute Mortgage, a mortgage spam site shut down by the FTC in 2006.
Porn site hosted by Netcom. Advertises via spam.
Associate and co-defendent of Jeremy Jaynes
Russian hosting site that offered "bulletproof" hosting to various questionable activites such as viruses, malware, spamming, child porn and others. See Washington Post article Shadowy Russian Firm Seen as Conduit for Cybercrime and Spamhaus info page.
Partner of Bill Stanley, owner of Anti-Spam-America.com and Qedmediagroup. See Rokso entry or search for "Russo" at Rokso.
(last update: 10 Jun 2006)
Malicious spammer. Lost his account at joes.com and retaliated with forged spam intended to look like it came from joe@joes.com, in order to cause trouble for joes.com. The backlash from people who did not know the message was a forgery was sufficient to effectively destroy joes.com. This is the origin of the term "Joe Job". See archived messages from Rutman at The "El Cheepo" and "Thinning Hair" Email Spam Headers
Alias of Richard Ruckowski

Back to top

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.

This page maintained by Ed Falk