Sample of fraudulent messages mailed out 12 August 1997.
The sending machine was ctynet.com, a system implicated in attacks throughout the past week. This machine is operated by nancynet.com, a well-known junk-mailing site.
These messages also showed Forrest Dayton's name. Some listed a return address and telephone number at the Internal Revenue Service. Dayton is the person whose name was used on several fraudulent mailings last week, sent from the same system, 205.199.4.215. This machine also sent messages last week with a from: address of "assistantdirector@fbi.gov".
The machine at 205.199.4.215 used in these attacks is on the AGIS
backbone. Here's a traceroute. Though the precise routing has changed in
the last 12 hours, the AGIS connection has not:
traceroute to 205.199.4.215 (205.199.4.215), 30 hops max, 40 byte packets [...] 8 f1-0.pennsauken1.agis.net (192.157.69.19) 9 a0.58.philadelphia1.agis.net (206.185.158.9) 10 ga005.losangeles2.agis.net (206.185.158.50) 11 * ga003.santaclara4.agis.net (206.84.226.245) 12 a5-0.68.santaclara3.agis.net (206.84.226.230) 13 * 205.254.168.18 (205.254.168.18) 14 205.199.4.215 (205.199.4.215)
I tried to call AGIS when this started around 8:50am EDT, but the receptionist hung up on me after saying "call the IEMMC (slam)" So, I called back. When I asked again several times, she claimed to take my my name and number, but nobody from AGIS has ever called me.
That's what's known right now. The reward for information leading to a successful criminal or civil prosecution of any responsible party is increased to $3,000. I'm not looking for traceroutes, guys. I need to know who did this, on whose authority, and why, and I have to be able to prove it. Give me what I need to complete this case and we'll take it from there. Harassment and terrorism in any form, in any venue, cannot be tolerated or permitted, and must be fought.
Received: from ctynet.com ([205.199.4.215]) by netone.net1comm.com
(post.office MTA v2.0 0813 ID# 0-12776) with ESMTP id AAA71
for <p@dq.com>; Tue, 12 Aug 1997 07:02:06 -0600
X-Advertisement: Visit http://www.iemmc.org for name removal information.
Date: Tue, 12 Aug 97 12:33:28 EST
From: jim@newmediagroup.com
To: munching@sunflower.seeds
Subject: RE: Jim Youll - AsShOlE AnTiSpAmMeR!
Message-ID: <Anti-Spammers are cunts with no lives!>
Reply-To: jim@newmediagroup.com
X-UIDL: Sponsored by FBI / DEA / State Department.
Message from the REAL REAL GENUINE ARTICLE SON-OF-A BITCH FORREST DAYTON!
I caught the spamming bastard who tried to discredit my cleancut churchgoing image!
His name is Kirby Smith and is beleived to have hacked accounts with:
demonics.co.uk
enterpricks.net
farce9.com
Please take action now! Help me somebody! I now have the State Department, the FBI,
the IRS and other government departments following my every move! (this has become
obvious as every time I go to the store about twelve limos with blacked out glass follow
me - anyone would think I was heading a goddam funeral procession!)
Help!
I even found a CCTV camera in the john! They even have pictures of my butt!
I now shit in a bucket! My finances are now dwindling! I need to sell some mass
mailers real bad!!!! PLEAZE BUY ONE!
Forrest Dayton - RELOCATED AT:
www.newmediagroup.com
To be remove from Church Of Forrest Dayton mailing list
Either:
A) Call 770-926-6559 and ask politely...
B) Change your email address...
C) Block every IP address in existence!!!
(c) Bad-Bad-Boyz
EXZZZZELLENT!
(alt.2600 addresses added to list 08/12/97)
PS JIM! HOWZ BUZINESS! HAHAHAHAHAHAHAHAHA!