I've wondered for a while how harassers get all the info they need to, eg harass Beth Arnold. I got a standard 'MLM business reports' Ponzi scam, with the - now pretty standard - pseudo-business name as a mailing address: After the fiascos of the past couple of days I'm in just the right mood to take down a spammer or two. And I had an hour to kill, so I thought I'd see what I could find without moving from my keyboard. ----Spam---- > Return-Path: none@mail.lig > Received: from mail.lig (mail.lig.bellsouth.net [205.152.0.50]) by no3.superb.net (8.8.5/8.6.12) with ESMTP id WAA18200 for ; Tue, 3 Jun 1997 22:13:50 -0400 (EDT) > From: none@mail.lig > Received: from jw007 (slip166-72-182-182.nc.us.ibm.net [166.72.182.182]) > by mail.lig (8.8.5/8.8.5) with SMTP id WAA28288 > for ; Tue, 3 Jun 1997 22:13:03 -0400 (EDT) > Date: Tue, 3 Jun 1997 22:13:03 -0400 (EDT) > To: > Message-Id: <18161.235584.92359815 robonews@blighty.com> > Subject: Turn $20 into $50,000 in 90 days > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Content-Transfer-Encoding: 7bit > Status: > > > =============================================================== > This is a "ONE-TIME MESSAGE", you were randomly selected to [SNIP] > _________________________________________________________________ > REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTI-LEVEL SALES" > > ORDER REPORT #1 FROM: > > JW ENTERPRISES > 5629 Oleander Dr. Suite 114-260 > Wilmington, NC 28403 > > _________________________________________________________________ > REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ----EOF Spam---- The perp is >JW ENTERPRISES >5629 Oleander Dr. Suite 114-260 >Wilmington, NC 28403 The first Received line and the From were added by a clueless bellsouth mailserver, but the next one looks legit. Apparently from jw007, coming from an NC ibm.net dialup - slip166-72-182-182.nc.us.ibm.net Ties up with JW Enterprises quite nicely. A quick altavist and I find somebody called 'Jason Walter' jw007@ix.netcom.com http://members.aol.com/jwalter007/aftglow.htm entered their name and web page in a guestbook - listing themselves as coming from Wilmington, NC We have a definite suspect here.... The web page tries to autoforward us to http://www.afterglowimaging.com/, but first lets look at the AOL pages.... Digging around the aol.com web pages we discover he's doing a spot of web design for 'Mental Golf' (?), but I'll keep his clients contact info to myself - I wouldn't want anyone to wrongly filter or harass them. Now to look at http://www.afterglowimaging.com/ aka http://www.wipd.com/~jw007/ Seems to be a jack of all trades - purports to be selling home theater, but also has some unlisted web pages advertising wholesale PC parts. (An altavista search on jwalter007@aol.com brings up some off-charter ads for 'cheap computer hardware' and lots of ads for home theater stuff, and lots of ads for his shiny new virtual domain) Ah, ha. An address. Afterglow Imaging 5008 Wrightsville Ave Wilmington, NC 28403 (910) 397-0953 A quick whois on afterglowimaging.com confirms it's hosted by wipd.com, and the billing contact is Walter, Jason B (JBW21) jw007@WIPD.COM 910-397-0953 (FAX) 910-397-0952 JBW21 registered address 5008 Wrightsville Ave. Wilmington NC 28403 So it's another jw007 in NC.... The two addresses are 1.7 miles apart by road (thankyou map.yahoo.com) Thanks to http://www.bigbook.com/ I discover that 5629 Oleander Drive is a Mail Boxes Etc. (I tried http://www.mbe.com/ first, but their search engine was broken). Mail Boxes Etc 5629 Oleander Dr Wilmington, NC 28403-5800 (910) 799-7222 I think that confirms it.... The nice web search page at http://www.usps.gov/ncsc/locators/find-is.html tells me the local US Postal Inspection Service office is at POSTAL INSPECTION SERVICE UNITED STATES POSTAL SERVICE 2901 S INTERSTATE 85 SERVICE RD CHARLOTTE NC 28228-3000 Phone : 704-329-9120 Fax : 704-357-0039 A fax number. Cool. A bucks worth of long distance fax, and the USPIS know about this little scam. A quick email and so do netcom, AOL, ibm.net, southbell and wipd.com. Why not. And the IRS (net-abuse@nocs.insp.irs.gov). Running three businesses and a pyramid scam from what looks like a residential address? No way are his books clean. And he was stupid enough to send it to r b n ws@blg hty.c m, so the rules at http://www.blighty.com/spam.html kick into action - one invoice to Jason Walter for US$500. (He'll never pay it, and I'll probably not get around to pursuing it, but every little helps). Jason Walter, have a nice day!