TWiki . Edumacation . SpamFraudAnalysisSagonet	TWiki . { Main | Edumacation | TWiki | Test }
	Edumacation . { Home | Users | Changes | Search | Go }

This page does not imply that Sagonet acted intentionally, maliciously, or negligently with respect to the indicated fraud, only that Sagonet provided network access to the parties involved.

Preliminary analysis:

1. identity specified in message body: Dwight, a manager at Nationwide First
   • Nationwide First what???
2. sender address: user dwight at domain 24-7lenders.net
   • domain registered to: Mandi Smith, 34155 maple street extension, Miami, Florida 33139
   • registrar: Go Daddy Software possible facilitator
3. relayed by: ALille-208-1-5-157.w80-15.abo.wanadoo.fr ([80.15.105.157])
   • address registered to: Wanadoo Interactive, 48 rue Camille Desmoulins, 92791 Issy Les Moulineaux Cedex 9, FR
   • phone: +33 1 58 88 50 00
   • email: user abuse at domain wanadoo.fr
   • negligent or intentional facilitator
   • identified as open proxy in telecom.fr by http://selwerd.cx/xbl/
4. domain specified in message body: bestmortgagelenders.net
   • domain registered to: Mandi Smith, 34155 maple street extension, Miami, Florida 33139
   • registrar: Go Daddy Software facilitator
5. bestmortgage lenders.net resolves to 66.118.180.241
   • service provider: Sago Networks facilitator
6. address specified in message body: http://216.30.204.18 (image bug)
   • registered to: National Resource Center, 410 Spruce Av, Altoona, PA 16601
     • phone: 814-944-1108
     • web site: http://nrc.net
   • service provider: FiberNet of West Virginia
   • home page purports to be http://1stunitedmortgage.com
     • page is bogus, domain specified has expired, not found in google, not found in archive.org
   • home page purports to be copyrighted by desolved.com
   • desolved.com registered to wiggins, spencer saw@nrc.net, repsonse america, 301 union ave #375, altoona, pa 16602
   • phone: 814-944-9292
7. domain specified in linked web page: 61.252.143.13
   • service provider (per http://nic.or.kr): HANINTERNET, SK Twintech A 1009, 345-9 Kasan Kumchon
   • contact: Sunhwa Jung, phone +82-2-860-8160, user iservice at domain haninternet.co.kr

Here are the charges:

1. Go Daddy: allowing an unverified domain registration
2. wanadoo.fr: operating an open proxy
3. telecom.fr: allowing continued operation of an open proxy
4. Sago Networks: allowing facilities to be used for fraudulent purposes
5. Natonal Resource Center: accomplice
6. FiberNet: allowing facilities to be used for fraudulent purposes
7. Haninternet: facilitating fraudulent use of network by cloaking network address ownership

file attachment:	action:	size:	date:	who:	comment:
sago_linkedpage1.txt	view update	82942	28 Jun 2003 - 22:42	EliMantel	web page linked from message body
sagonet_body.txt	view update	2258	28 Jun 2003 - 22:02	EliMantel	html source of message body
sagonet_full.txt	view update	2893	28 Jun 2003 - 21:17	EliMantel	full text of message
	add

Topic SpamFraudAnalysisSagonet . { Edit | Ref-By | Attach | Diffs | r1.1 }

You must register before editing pages or using other extended features on this TWiki system.

Revision r1.1 - 28 Jun 2003 - 21:16 by EliMantel  Privacy Policy

Copyright © 2000-2005 by the contributing authors. All material on this collaboration tool is the property of the contributing authors. Collect email addresses here. Ideas, requests, problems regarding TWiki? Send feedback.