Sending Complaints to ISPs

If you’d like to get some of these spammers and scammers shut down, then you should send complaints to their ISPs or hosting services. Not all ISPs and hosting services will follow through on complaints, but as you can see from reading this blog, a lot of them will take action.

First, you’re going to have to find out where the message originated from. To do this, you have to look at the message headers. The way you go about viewing the headers depends on which email service you are using. Instructions for viewing headers for many different email services are available at Spamheaders.com.

Once you have the headers, you will be able to see which servers were used for sending the message. As an example, let’s look at the headers for the one of the scam messages we’ve received. Here they are with the recipient’s name and email address removed. Look at the parts that are highlighted.

Delivered-To: *****
Received: by 10.150.134.1 with SMTP id h1cs217972ybd;
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)
Received: by 10.236.182.197 with SMTP id o45mr4437364yhm.330.1304001219652;
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)
Return-Path:
Received: from tiguan.websitewelcome.com (tiguan.websitewelcome.com [174.120.5.66])
by mx.google.com with ESMTPS id 22si6055883yhl.249.2011.04.28.07.33.39
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)

Received-SPF: neutral (google.com: 174.120.5.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) client-ip=174.120.5.66;
Authentication-Results: mx.google.com; spf=neutral (google.com: 174.120.5.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) smtp.mail=amy.lewis2333@gmail.com
Received: from [74.117.59.214] (port=1512 helo=zap-server)
by tiguan.websitewelcome.com with esmtpa (Exim 4.69)
(envelope-from )
id 1QFSHi-0004Xi-9u
for *****; Thu, 28 Apr 2011 09:33:38 -0500

MIME-Version: 1.0
Date: Thu, 28 Apr 2011 07:33:10 -0700
Message-ID:
X-Priority: 3 (Normal)
Subject: *****
Reply-To: amy.lewis2333@gmail.com
From: “amy”
To: “*****”
Content-Type: multipart/alternative;
boundary=”—–_chilkat_46d_7fe4_005a4654.a044ceca_.ALT”
In-Reply-To: BANLkTikfOSqJ1owwvdVPG2Wodc2TDSe3Zw@mail.gmail.com
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – tiguan.websitewelcome.com
X-AntiAbuse: Original Domain – gmail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – gmail.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (zap-server) [74.117.59.214]:1512

The sections highlighted in red and blue are the “Received:” headers. These headers, along with the “X-” headers at the bottom, are the most useful ones for determining who actually sent the message. They show the various servers and email accounts that were used for sending it. Even though the sender’s address is a Gmail address, the message was routed through two other servers before it got to the Gmail server.

The “Received:” headers should be read from bottom to top. The first of them, highlighted in blue, shows that the message was first sent from a machine with the IP address 74.117.59.214 to tiguan.websitewelcome.com. Above this we have an “Authentication-Results:” header and a “Received-SPF:” header, neither of which concern us. The second of the “Received:” headers, highlighted in red, shows that the message was then sent from tiguan.websitewelcome.com (IP 174.120.5.66) to mx.google.com. So the scammer routed the message through two machines before it was received by Gmail.

Now that we know the IP addresses of the servers that were used for sending this message, we can look up the ISPs for those servers and send them complaints. A good site for looking up this information is cqcounter.com/whois/. (Note: The site CQCounter is picky about this URL. It requires that you include that very last slash in the URL, otherwise it can’t find the page.)

Using this site, we see that the ISP for 74.117.59.214 is Psychz.net and that the ISP for tiguan.websitewelcome.com (174.120.5.66) is ThePlanet.com. The email addresses to which you should send complaints then are abuse@psychz.net and abuse@theplanet.com. When you send the complaints, be sure to include copies of the message and headers.

In addition to sending complaints to the ISPs that were used for sending the messages, you should also send complaints to the ISP that is hosting the scam site. You can use cqcounter.com/whois/ to find out this ISP, too.

Another step that you can take, especially if you have lost money to one of these scams, is to file a complaint with the FBI. You can do that at www.ic3.gov. Contacting your local authorities and state’s Attorney General’s office would also be a good idea in this case, too.

31 Responses to Sending Complaints to ISPs

  1. terrance wafer says:

    i thought SexxxxMatch‏.com was valied site and now i find it to be a scam. in big red numbers it has no charge completely free but i see a charge to my card

    • andrew says:

      Yeah…you probly shouldn’t be giving your cc # out to websites that say they won’t charge it. Haha! Maybe especially if it starts with sex. What made you think that was a valid site!? Haha…well hope you aren’t too in debt. Oh. And if they said it’s for “age verification” that’s bs cuz they can’t find that out with your credit card.

  2. they [verifydaters.com] laied to sign me up to a porn site and would like to get my money back all of it they post a ad in craigslists as girls and then ask if want to get known them you must fill out a form online whitch is post tobe free and then charge its to your account. would like to get my money back asap. so be aware of those ads asking to verify or even ask for your info leave it be.

  3. rob wormgoor says:

    I was verifiing my identity through Craig’s List to meet to this woman and it brought me to sexxxmatch.com, what a waste of time and I hope they don’t have access to my account. I didn’t give that porn site my info, but they have my e-mail address, so I may get spammed.

    [Administrator Comment: It is not possible to verify your identity through Craigslist. The site that rob wormgoor visited was casualmeetup.com, which is a fake verification site. In fact, none of these verification sites are legitimate, regardless of any promises they make. They often say something like “As seen on MSNBC, CNN… [etc.]”, but this is a lie. The company CraigSecure was never featured on any news programs beacuse it doesn’t exist. There is no CraigSecure, no verification service; the site is just a mock-up that leads you to a sign-up form for porn sites.]

  4. thomasshea says:

    how can i get this charge off my credit card?

    • Anonymous says:

      Contact your credit card company and explain everything to them. They might reverse the charges. Also, do not delete any of the scam email messages you received, keep them as evidence. You might also want to file a complaint with the FBI at ic3.gov.

  5. Adam says:

    I had a someone telling me to go to a site that it is free and we could communicate through there, but had to pay. I did not and she then emailed me and basically said…take care! Now if I had joined the sexxmatch.com I would have been suckered. Thank goodness for reviews!

  6. frank says:

    I got it also. from kayla b..http://greatlocalnsa.com/ and look up “sexbebe6532” followed the next day by michsanch, also sent me to a link, different link, but also a scam. I thank You for addresses to contact for cancellelations and hope I got them cancelled quick enough.

  7. Justin Lee says:

    New scam website: http://www.IHOOKUPNSA . COM
    Scammer’s email: kim2walker15@aol.com

  8. kevin says:

    wow i wish i would not have been so ignorant about this.they got me for $ 100.00 , i had to cancel my card and have investigated. i got a long list of email names and pics (witch are stolen im sure) and good lil stories …i wil collect them and post in a cpl days ….

  9. anonymous says:

    My boyfriend has been recieving messages from citysex.com every since he went to craigslist it has made us do nothing but argue and fight because it made me think he was trying to cheat until i found this site

    • Lora says:

      trust me if he is getting sex spam from being on craigslist you should have searched through the personal ads.

  10. J says:

    Here is another site http://bit.ly/op3Asd I was asked to go to verify i wasnt some creep by a CL personal contact namely tiffanybt7@flingsafe.com . It was another “Find Singles Online” scam site.

  11. anon says:

    kim1thomson99@aol.com “nice i believe we can hit it off, all my photos are on IHOOKUPNSA . COM give me your handle Ill friend you.”

    go report and flag em guys.

  12. Stan Martin says:

    Same thing. Below is CL ad and I got 2 responses below that:

    thick mature bbw feelin horny .. – w4m (Tigard)

    Date: 2011-12-10, 4:42AM PST
    Reply to:

    i am a little bit on the heavy side but a lot of people secretly want me because that means my jugs are big and fun. i know what guys want, but they are too afraid to be seen with a fatter lady, and what other people will think of them. i know your secret and want to hook up in the bedroom.

    On Mon, Dec 12, 2011 at 6:03 PM, wrote:
    cool i believe we will click, all my photos are on IHOOKUPNSA . COM send me your handle I will msg you.

    On Mon, Dec 12, 2011 at 5:52 PM, wrote:
    cool i believe we will hit it off, some of my pictures are on IHOOKUPNSA . COM give me your username I’ll message you.

  13. david seals says:

    o boy yep i tried that age and background check luckily i used a stopped credit card it tried charge $40 at three diff places totaling $120 sense i had card off my bank called me to find out why i was trying to use it lol got them with luck I never use active card for anything but paypall

  14. Justin says:

    I think there might be a new one out. Its called craigs-nsa.com I got a similar message saying contact her on this website. But I have to input my credit card info for age verification. And if u look it up on google there’s nothing about a scam. Its an invite only website. I dunno. Just a heads up. I didn’t give them any info.

  15. John says:

    Here’s a new one….
    hmm i see,
    I really do wish to follow through with this but there is no way I can have a healthy conscious about meeting a stranger without him doing verification first.

    If you check http://www.safercraigs.com/members/amber91222 youll see verification is totally free, don’t worry about having to pay for anything, verification is just for my safety!

    I guess you heard about CL serial killer (caught eventualty)? Well, I hope that’s a good enough reason for you to understand why this is so important before I meet you face to face.
    After you are confirmed i have no problems about sending you more dirty pics and then meet u up if we both agree.

    Hope this 2 pics will give you an idea how serious Im :)

    Pls make up your mind, millions of people are spamming me from that damn ad…pfffff :))

    Amber :*

  16. James Gray says:

    I got sent a fake email, then was sent to this sure that was supposed to be free. Next thing i know im getting all kinds of charges. There is no unsubscribe button.

  17. Ebb Rivers says:

    WOW!!! This has been going on now for almost 3 years (from what I see documented here), and this whomever is still sending out the same crap. Worse yet…apparently allowed to do so without any recourse. Yesterday, I received this beauty, luckily I smelt the stank in the air as I read the email. I have received emails similar to this before and as soon as I receive the “third party” need to verify cause I had a bad experience crap of a line, I hit spam and push them on. I have noticed the individual (s) have become a little more sly with how they word their emails to appear to be that of an interested lady that would like to possibly meet for a drink or what-not. IMPORTANT!!!! most of these are being sent with attached photos. These photos are lifted or stolen or acquired in some way from some place and used in multiple “dating sites” as a site bot. The purpose here is to not only to give the appearance of more women members leading a fellow to think he may have a better chance of meeting a lady on the site, they also are used to send messages to the individual after they fill out the “free member” profile. Then the unsuspecting guy, thinks he has made a good move to go ahead and build that profile, it was free to do (and it is free), however, when making an attempt to reply to the bot’s message, he will be redirected to an “upgrade” page and that’s where they hook em. However, with some of these sites, it is much better disguised and the poor sap actually is allowed to reply to the site bot babe (why not? she’s not real and it helps to hook him deeper), and there will be another message that the “free member” will receive sometimes before, but maybe after the first has been replied to (in either case, it is done with savvy enough to send one after so much time has passed without receiving a response from the “free member” asking him why he wasn’t interested and blah blah blah, or after he has replied describing himself and where he would take the “girl” for the first date, you get the picture. The “free member” will receive a second message of how much they are surprised to receive an actual legible or intelligent response and how they would love to get with them and yada yada yada…send me your phone number or what ever it is to get them to write back to the bot girl a second time (which just so happens to exceed his limits as a “free member” and redirected to a VIP or upgrade screen to input the ole card number and become a “full member”. WHY HAVE THESE THIEVES BEEN STOPPED BY NOW??? I have not personally been financially victimized by these Pieces of S#!*, but if I were to meet up with one and learn that they have been behind all the scam/spam bull that one has to go through to meet another person or just try to sell a belonging on Craigslist, I WOULD PUNCH THEM DIRECTLY IN THE THROAT!!!

    A little tool to help you combat these scammers is this site

    http://tineye.com/

    Here you can either upload the image or input the URL of the image that you received with your spam mail and search (up to 50 per day free of charge) for duplicates of that photo (they call it fingerprinting the photo). This can help you determine if the email your received is legitimate or bogus. CAUTION AND DISCLAIMER…I STATED IT COULD HELP YOU DETERMINE IF BOGUS OR NOT, this site does not claim this and it is up to YOU and YOU ALONE, TO DETERMINE THE LEGITAMACY OF THE SEARCHED IMAGE UPON RECEIVING THE RESULTS OF THE SEARCH…ALWAYS USE CAUTION AND COMMON SENSE WHEN REPLYING TO EMAILS FROM UNKNOWN SOURCES.

    I do not work for or am I in any way affiliated with tineye.com or any of it’s affiliates and I make no claims or statements on their behalf, nor do I receive or have I received any compensation from tineye.com or any of it’s affiliates at all whatsoever.

  18. 10irwao says:

    This website and emails are big time scammers:
    http://www.GlobalPetroleumResources.com
    http://h2528v01.hyperfive.com/Cms/Ppvas/page/1.1/281.php
    USA MAILING ADDRESS CONTACT PHONE NUMBERS
    Global Petroleum Resources, LLC
    Edward C. Bahl
    Founder & CEO

    Innisbrook Resort & Golf Club
    36750 U.S. Highway 19 North
    Maidstone 2725
    Palm Harbor, FL 34684-1239

    Off: +1727-344-9029
    Cell: +1303-877-6567
    EdBahl@GlobalPetroleumResources.com

    Inquiryl@GlobalPetroleumResources.com
    Info@GlobalPetroleumResources.com

    Peggy Walla
    anotherstroke@hughes.net
    979-732-3454 Fax: 979-732-5499
    LPR Investigations website

  19. onefastcamaro23@yahoo.com says:

    i believe i got suckered into it to but i used one of those prepay credit cards one only charged me like 30 bucks the rest said free only had 50 bucks on the card

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: