Subject: Notice - Scam Alert

From: [email-masked]
Date: 10/23/98 11:06:44 PM Pacific Daylight Time

!!!!!!!!!SCAM ALERT!!!!!!!!

FlimFlam.com is a non-profit (labor of love) web site dedicated to exposing fraud and deceptive marketing practices. This email is a public service announcement. If you receive email purporting to come from FlimFlam.com which tries to sell you something or asks for any money at all, please report it to us immediately. If you do not wish to receive any more Scam Alert email notices, please reply to this message with REMOVE as the email subject and you will be immediately removed from our notification lists.

If you are receive an offer you think is meant to defraud a large number of people, please email us with the particulars of the offer. If we can determine it is obviously fraudulent or grossly deceptive, we will list it on our web site. Also, if you receive an offer that seems too good to be true, please check our web site to see if there is more information regarding the offer.

FOR IMMEDIATE RELEASE

A FlimFlam Scam: World Currency Cartel a.k.a. World Conference Cartel a.k.a. EBSN a.k.a. Diamond International a.k.a. TLU a.k.a. NBT. This flimflam scam has been received as an email by some of our readers. Those who sent money received nothing of significant value for their money. This scam asks for cash or money order. The following postal addresses have been reported to us: 

EBSN
PO BOX 66
ROSELLE PARK, NJ 07204

DIAMOND  INTERNATIONAL
9903  SANTA  MONICA  BLVD.
SUITE #   405
BEVERLY  HILLS,  CA 90212
U.S.A.

NBT
PO BOX 1129
UNION, NJ 07083-1129

TLU 
PO BOX 824 
Lone Pine, CA 93545 

Sincerely,

The Editor, FlimFlam.com

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 24 Oct 1998 08:12:51 -0600 (MDT)

> From: "vinton g. cerf" <[email-masked]>

> Dear editor,
>
> I looked at your web site and while I agree this is a good idea
> and it was nice to see some of the well-known scams listed,
> your message is considered spam and is considered improper on
> the ietf mailing list and, more generally, on the mail service 
> through which it was sent. 
>
> Your business plan may be in jeopardy if you are prosecuted
> for spamming, no matter how noble the intent. The fact that
> ...

A lot of spam using similar wording, supposedly warning about "scams" has
been sent from various domains starting about a year ago.  I am personally
convinced that this message was merely a new instance of the old "scam
alert" spam, but from a new domain.  

As far as I can recall, the World Currency Cartel spammers have been quiet
since their activies and certain actions of various law enforcement
agencies were written up in the "Wall Street Journal" last spring or
summer.  Have you seen any World Currency Cartel spam lately?  As I recall,
the "scam alert" spam was always a little short on genuine news.

Finally, notice the administrative and billing contacts for FlimFlam.com.
Few legitimate domains have contact names at free email outfits (excepting,
of course,the free email outfits themselves), but plenty of spammers use
them.

I've already complained to Uunet and simple.net, the hosts of the
FlimFlam.com, and to flash.net, the source of the spam.  It would not hurt
if others would also complain.   Too many ISP's care only when spam bothers
them personally, i.e. if they get a lot of complaints.

Most spam today seems to come form Uunet dialups, with larger Uunet
customers and CompuSpam a close second.  Yes, some of the dialups might
be resold by others and the perps. may not be direct customers of Uunet.
Nevertheless, if Uunet would impose real sanctions on its customers, the
Uunet part of the spam problem would be radically improved.  Merely
cancelling a throw-away account does not qualify as a sanction.  $500/day
or $50 per validated complaint is real and effective, as Earthlink has
demonstrated.

Vernon Schryver    [email-masked]

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 24 Oct 1998 15:41:20 -0600 (MDT)

> With regard to UUNet, for the most part, all of the port capacity
> for UUNet provided on a wholesale basis to others who validate
> the callers, etc (e.g. Microsoft, AOL). Even the billing is done
> by the third parties so defending against repeat violators may
> mean tracking down use of the same credit card to open/re-open
> abused accounts. Even the individual dial-up users of CompuServe
> are now under AOL management, as I understand the three-way
> business arrangement between CompuServe, UUNet and AOL.
>
> Perhaps the most effective way to deal with this is to covey
> these ideas to the principal resellers of UUNet's dial up facilities.

No, those guys have been point fingers at each other since the mail spam
problem got bad years ago.  If they really cared, they'd do the obvious,
which has been pointed out to them countlessly by hordes.  Essentially
every spam account has an associated credit card number.  If they cared
more about stopping spam than selling spam-for-a-day accounts, they'd
including provisions in their terms like those Earthlink started using.
If they charged $500 per day of spamming, the spammers would find another
pasttime, or at least another way to operate.  And no, I don't buy the
often repeated nonsense that Uunet et al cannot figure out which account
was using which dialup when spam was sent.  Since they're in the business
of selling time on those ports, they necessarily have a few clues who is
using which port and when.  Yes, it would (and does now) take money to
check through accounting records to find which credit card number to ding
(or now an account to cancel after a day of spam); so charge the spammers
for that too.  Yes, Uunet would have to force their own, reselling
customers to go along, which they could easily do by charging their
resellers for spam and letting the resellers deal with the spammers.  Yes,
such efforts would involve a non-zero false-positive rate; so also charge
the spammers for insurance to cover the damages paid to people mistakenly
zapped.  Yes, a lot of the credit cards would not be good for the charges,
but credit card fraud is a felony and the spammers would soon enough quit
the whole game, at least using UUnet dialups.

As for CompuServe--I've been unable to detect any change there, except
that they replaced Earthlink as the first choice of professional spammers.
Until I gave up and blackholed them a few months ago, in response to valid
complaints about their spam they were still sending disinformation that
only the termincally clue-challenged might swallow.

As everyone who has spent much time fighting spam has realized, the problem
is not the spammers, but the ISP's.  The sudden halt in Earthlink spam
is a case study in that truth.  Yes, you still see occassional Earthlink
spam, but no more than BBN or the other outfits that are serious about
spam, and zilch compared to their problem 18 months ago.

I've probably said too far much on this subject in this mailinglist.  As
far as I can see, there is nothing the IETF can do about spam, other than
informally encouraging IETF participants to talk to ISP's.  That suggests
spam is not a fit subject for the list.

Well, there is one other thing.  If an outfit won't clean up its spam
problem, then deal with them as you deal with disreputable real life
businesses, such as dealers in drugs, stolen goods, and sex.  You don't
give them your home address.  You don't resell their goods or services,
at least not openly.  If you deal with them at all, is from the anonymity
of the street.  In other words, blackhole them on the networks you care
about (at least for port 25), and use 'free' accounts if you do deal with
them.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 24 Oct 1998 15:41:20 -0600 (MDT)