Internet Spam Help

[Mbarb]

Hello,

I usually chase down most of the spam that comes my way. I mostly go after those that include a URL of some kind and get the sites closed down. This one has me a bit baffled. here is the URL from the e-mail http://www.freeyellow.com|casinomoney|@3637035541/casinomoney/files/

I played long enough to find out the the only relavent part of the URL is http://3637035541/casinomoney/files/
This url points to a site at homestead. IP 216.200.194.21. How do you get from 3637035541 to a ip of 216.200.194.21. I checked network Solutions and 3637035541 is not a registered domain name ( and notice that it does not need a .com ,.net etc to work)

So, could you please enlighten me on how this works

[jad1097]

I have been playing with this for a while now and this also works 216.200.194.21/casinomoney/files/ It appears to be some clever java script.
The name of the company is 3 diamond casino I would file a complaint with yellow.com and homestead.com since they are hidding behind both of their sites. THe IP is to the homesite member login. You could download their program to find out more but I will not. I am going to do a search for them now.


Also this works to but does not go anywere but to the homestead.co member login page. http://3637035541/

[This message has been edited by jad1097 (edited 05-24-2000).]

[Mbarb]

Thanks. I sent acomplaint to Homestead and yellow earlier tonight. I found a link to this site. http://www.apnic.net/apnic-bin/whois.pl?search=3637035541 . If you enter the 3637035541 in the look up it reports. "Converting 3637035541 to 216.200.194.21"

[jad1097]

Now I am pissed!! They just sent me some spam @ my hotmail account!!!!!

[smokin1]

Hi Mbarb
To answer the first part of your question, spammers try to hide by changing their IP to a dword value, that is what the 3637035541 actually is. Also, all the garbage before the @ sign is just that...garbage...you could have typed anything there as long as the @ is included. You can make your own IP # into a dword using a scientific calculator..change to hex first then change to dec...
http://sysopt.earthweb.com/forum/smile.gif

[Mbarb]

Thank You!! That was just the information I was looking for. After reading your post I searched the net for more information about this and right off I found 2 good pages, I'll include links to them. http://www.nwi.net/~pchelp/obscure.htm

http://www.fichtner.net/tools/ip2dword/

[bhess]

How do you "chase down " spam. Lately I have been getting spammed a lot. The sender and my email name are the same. I.E. from xxx@net and to xxx@net. My email isn't even listed.
It's really starting to annoy me. Some have a link to remove yourself from the list but they don't work.
thanks

[Mbarb]

One point for the "good" guys. Homestead has removed the page that the url pointed to. I'm sure the guy will have a new account somewhere by noon but because this page is closed it makes all the e-mail he sent yesterday point to a bad address.

Thanks for all the help !!!