A Visit From Virtumundo -- Prelude and Spam in a Minor Key

This file is one of the evidence, example or data files that accompanies the "Nadine" Story, an account of commercial mailing lists gone amok. See the main page for the details.

In the web server logs we find the following interesting line:

65.164.176.254 - - [27/Dec/2001:14:07:41 -0600] "GET /Nadine/ HTTP/1.1" 200 36767 "http://google.yahoo.com/bin/query?p=Networkpromotions.com&hc=0&hs=0" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461; AIRF)"

This tells us that somebody using Internet Explorer, from a computer at IP address 65.164.176.254 looked at the page at 14:07 local time on 27 December 2001. It would appear that they were asking the Google search engine about "Networkpromotions.com", a name eerily similar to one of the domains that has sent some items to Nadine.

There is a fair bit of evidence that this is a machine belonging to Virtumundo.com. When we ask the registry at whois.arin.net who the owner of that IP might be, we get:

mdr@altramar /usr/home/mdr $ whois -h whois.arin.net 65.164.176.254
Sprint (NETBLK-SPRINTLINK-2-BLKS) SPRINTLINK-2-BLKS65.160.0.0 - 65.174.255.255
VIRTUMUNDO (NETBLK-FON-110131219277468) FON-110131219277468
                                               65.164.176.192 - 65.164.176.255

mdr@altramar /usr/home/mdr $ whois -h whois.arin.net NETBLK-FON-110131219277468
VIRTUMUNDO (NETBLK-FON-110131219277468)
   4600 MADISON #500
   KANSAS CITY, MO 64112
   US

   Netname: FON-110131219277468
   Netblock: 65.164.176.192 - 65.164.176.255

   Coordinator:
      MCREYNOLDS, JEFF  (JM2465-ARIN)  JMCREYNOLDS@VIRTUMUNDO.COM
      (816)680-3479

About fifteen minutes later, another visit from the same address:

65.164.176.254 - - [27/Dec/2001:14:22:03 -0600] "GET /Nadine/ HTTP/1.1" 200 37295 "http://google.yahoo.com/bin/query?p=Networkpromotions.com&hc=0&hs=0" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461; AIRF)"

Between the first visit and the second I had placed an updated copy of the page on the site, so the size of the file is now different (36767 the first time, then 37295).

Then, at 21:05 local time, another visitation from the same organization, this time by email.

(Weird to see that according to arin.net, the IP address 155.251.246.235, from which the email was sent, supposedly belongs to Enron Corporation.)

Back to The Nadine Story.