This file is one of the evidence, example or data files that accompanies the "Nadine" Story, an account of commercial mailing lists gone amok. See the main page for the details.
In the web server logs we find the following interesting line:
126.96.36.199 - - [27/Dec/2001:14:07:41 -0600] "GET /Nadine/ HTTP/1.1" 200 36767 "http://google.yahoo.com/bin/query?p=Networkpromotions.com&hc=0&hs=0" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461; AIRF)"
This tells us that somebody using Internet Explorer, from a computer at IP address 188.8.131.52 looked at the page at 14:07 local time on 27 December 2001. It would appear that they were asking the Google search engine about "Networkpromotions.com", a name eerily similar to one of the domains that has sent some items to Nadine.
There is a fair bit of evidence that this is a machine belonging to Virtumundo.com. When we ask the registry at whois.arin.net who the owner of that IP might be, we get:
mdr@altramar /usr/home/mdr $ whois -h whois.arin.net 184.108.40.206 Sprint (NETBLK-SPRINTLINK-2-BLKS) SPRINTLINK-2-BLKS220.127.116.11 - 18.104.22.168 VIRTUMUNDO (NETBLK-FON-110131219277468) FON-110131219277468 22.214.171.124 - 126.96.36.199 mdr@altramar /usr/home/mdr $ whois -h whois.arin.net NETBLK-FON-110131219277468 VIRTUMUNDO (NETBLK-FON-110131219277468) 4600 MADISON #500 KANSAS CITY, MO 64112 US Netname: FON-110131219277468 Netblock: 188.8.131.52 - 184.108.40.206 Coordinator: MCREYNOLDS, JEFF (JM2465-ARIN) JMCREYNOLDS@VIRTUMUNDO.COM (816)680-3479
About fifteen minutes later, another visit from the same address:
220.127.116.11 - - [27/Dec/2001:14:22:03 -0600] "GET /Nadine/ HTTP/1.1" 200 37295 "http://google.yahoo.com/bin/query?p=Networkpromotions.com&hc=0&hs=0" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461; AIRF)"
Between the first visit and the second I had placed an updated copy of the page on the site, so the size of the file is now different (36767 the first time, then 37295).
Then, at 21:05 local time, another visitation from the same organization, this time by email.
(Weird to see that according to arin.net, the IP address 18.104.22.168, from which the email was sent, supposedly belongs to Enron Corporation.)