Spammer Hangout's Membership Roster Left Exposed

MikeCapone writes "According to an article at Wired News, spammers feel the need to be part of a community too. The Bulk Club is one such community. A message on the site states that it offers, for a $20 monthly fee, a variety of how-to articles, spamming software, a members' message board area, and 300,000 FRESH e-mails/week. Unsurprisingly, the 'Law & Ethics' section is 'Members Only.' The good part is that, because of a glitch, the membership list of this charming organization was left exposed on the website."

Great quote:

[Saint Aardvark]

Spam? UCE? Opt-In? Double Opt-In?

What's the difference between these remarkle advertising vehicles? Don't be left without the proper knowledge when sending out your offering to the masses. Along with our other various How Tos, learn the difference before any mailing.

I have never felt so good to be part of the Slashdot effect.

BTW, as pointed to in the article, a list of members was posted to Usenet [google.com] w/a list of memberships. There was also a link to an archive of the contents of the site; here's a link:

http://jscript.dk/2003/8/thebulkclub.com.zip [jscript.dk]

and a mirror:

http://saintaardvarkthecarpeted.com/thebulkclub.co m/thebulkclub.com.zip [saintaardv...rpeted.com]

A list of the files in the archive can be found here:

http://saintaardvarkthecarpeted.com/thebulkclub.co m/contents.txt [saintaardv...rpeted.com]

Grab a copy and post your own links!

Re:Bah

[Wumpus]

One word: Putty. [greenend.org.uk]

Re:The disturbing thing is...

[Anonvmous Coward]

"Have a heart, people! Sure, spammers are jerks, we can laugh at them and make fun of them, but don't you have any sense of decency?"

Never measure one's decency based solely on an expression of their emotions. Imagine PETA frowning over use of the term "I'm so hungry I could eat a horse."

Re:hosting sites

[Anonymous Coward]

http://www.spamhaus.org/

Whois Search

[ZackSchil]

Who is the Bulk Club? I dunno, you tell me whois! By the way, I'd rather not call that phone number, can anyone confirm if it is fake or not? Last time I checked, 666 was not a local prefix.

Organization:
The Bulk Club LLC
The Bulk Club LLC The Bulk Club LLC
3867 W. Market St #272
Akron, OH 44333
US
Phone: [phone]
Email: [e-mail]

Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com

Domain Name: THEBULKCLUB.COM

Created on..............: Thu, Aug 29, 2002
Expires on..............: Sun, Aug 29, 2004
Record last updated on..: Tue, Aug 26, 2003

Administrative Contact, Technical Contact, Zone Contact:
The Bulk Club LLC
The Bulk Club LLC The Bulk Club LLC
3867 W. Market St #272
Akron, OH 44333
US
Phone: [phone]
Email: [e-mail]

Domain servers in listed order:

NS2.ITBRAZIL.COM - 216.162.103.31
NS0000.4AMDNS.COM - 202.54.192.205
NS5.4AMDNS.COM - 203.199.113.19

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Oh ho ho!

[4minus0]

Here you go:
This is the jackass that runs the site bulkclub.com

Drew Auman
The Bulk Club LLC
3867 W. Market St #272
Akron, OH 44333
330-666-7625

Last known home address from yahoo people search (the phone number matches from the contact on a whois on the site registration info):
Drew Auman
113 Hunt Club Dr
Copley, OH 44321-2759
330-666-7625

That prefix is quite fitting don't you think?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:What a disappointment:

[ncc74656]

If wget isn't on your system, try this:

c=0; while true; do lynx -dump http://www.thebulkclub.com >/dev/null; c=`expr $c + 1`; echo $c; done

If you don't have Lynx installed either, try this:

c=0; while true; do (echo "GET / HTTP/1.0"; echo "") | nc www.thebulkclub.com 80 >/dev/null; c=`expr $c + 1`; echo $c; done

If you don't have netcat installed, what kind of l4m3r are you? :-)

Give me an inch and I'll take a mile...

[MoeMoe]

Well while we're on the subject of revenge served cold... **Oops! SPAM SITES LIST [ontheweb.com]**

Seems I accidentally dropped a link... No what can we do to slashd- I mean 'fix' that?

Re:Oh ho ho!

[Anonymous Coward]

Crap, forgot to include what the OP wanted. :D
I'll reply to my own comment anonymously so as not to whore.
Auman's email contact for bulkmail.com is: [e-mail]
[e-mail] is the one listed with yahoo.

Re:What a disappointment:

[Saint Aardvark]

Here you go:

bash $ while [true] ; do curl -o - http://www.thebulkclub.com/benefits.asp > /dev/null ; done

Hit 'em where it hurts

[justMichael]

If you want to get rid of the spammers you are going to need to get rid of companies like this [send-safe.com]

If they can't just point and click there will be a lot less spammers just trying to make a quick buck.

Catalogs

[gregmac]

Drew Auman
113 Hunt Club Dr
Copley, OH 44321-2759
330-666-7625

Just to save you some time.. randomly pick a couple.. it only takes a couple minutes. And what better use of the /. effect can you think of?

catalog request [google.ca]

Re:Send them some mail

[gklinger]

Ah, but that is what Mailinator [mailinator.com] is for. It's one of those goofy ideas that amuses me no end and I've actually found useful. If you haven't checked it out, do so. It's really rather interesting.

Re:7.62??? Why not .50 caliber

[haggar]

Anyway, can't beat the ballistics on a .50 cal

Oh yes, you can: [world.guns.ru]

It fires 20 gramm (308 grains) tungsten dart (fleschette) with muzzle velocity of 1450 meters per second (4750 fps). At 1000 meters this projectile will penetrate a 40 mm of RHA (rollded homogenous steel armour) and will result in serious secondary fragmentation effect behind the armour. That said, it will penetrate two walls of any modern APC at one kilometer range. The trajectory is very flat and does not rise higher than 800 mm above the line of sight when fired to 1000 meters.

dont forget the other site

[Anonymous Coward]

dont forget the other site,

Organization:
The Bulk Club
Bulk Club
3867 W. Market Street #272
Akron, OH 44333-4506
US
Phone: [phone]
Email: [e-mail]

Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com

Domain Name: MYBULKCLUB.COM

Created on..............: Sat, Jan 25, 2003
Expires on..............: Sun, Jan 25, 2004
Record last updated on..: Thu, Jun 19, 2003

Administrative Contact, Technical Contact, Zone Contact:
The Bulk Club
Bulk Club
3867 W. Market Street #272
Akron, OH 44333-4506
US
Phone: [phone]
Email: [e-mail]

Domain servers in listed order:

DNS1.SERVERSTODAY.COM 209.123.49.192
NS1.ESPHINX.NET 216.127.76.56
DNS2.SERVERSTODAY.COM 209.123.49.193
NS2.ESPHINX.NET 216.127.76.243

and the IP address of the spammers home/biz machine (used for ftp upload)

somehost.affinity.com 207.150.221.94

Domain Name.......... affinity.com
Creation Date........ 2000-01-08
Registration Date.... 2001-02-16
Expiry Date.......... 2008-01-08
Organisation Name.... Affinity Internet Inc.
Organisation Address. 101 Continental Boulevard, 3rd Floor
Organisation Address. _
Organisation Address. El Segundo
Organisation Address. 90245
Organisation Address. CA
Organisation Address. UNITED STATES

Re:What a disappointment:

[Anonymous Coward]

For those Mac OS X people, the line is
bash-2.05a$ while [ true ]; do curl -o /dev/null http://www.thebulkclub.com/benefits.asp; done

Re:Oh ho ho!

[Swampfox]

It appears that our Mr. Auman has some other ventures. This one, "The Music Man DJ Service", even has a picture of him:

http://www.musicman-dj.com/meetdj/default.asp [musicman-dj.com]

I'm assuming that this is the same Drew Auman, as they both operate out of Akron, OH.

They even have an 800 # - 800-717-1476

$ whois musicman-dj.com
...
The Musicman DJ Service (MUSICMAN-DJ-DOM)
3094 Mayfair Rd.
Akron, OH 44312
...
Administrative Contact, Technical Contact:
Auman, Drew (DAC552) [e-mail]
Auman
747 FAIRWOOD RD
AKRON, OH 44319-4760
US
[phone] fax: [phone]

And OH! Is that a real phone # there at the bottom? I wonder if he's awake...

Re:MP !

[physick]

Don't use the fax number: it's a crime. Telephoning is ok until he tells you not to, and if you hang up early enough......

Re:7.62??? Why not .50 caliber

[linzeal]

Jesus christ how much does each bullet cost?

I will spend about 3-4 bucks per spammer, you are asking me to spend 20-30 bucks. 50. is fine.

Re:the site is a fake

[Dr. Shim]

That would be ironic. But, alas, the buttons are server-side. Disable JavaScript on your browser, and you still can't get through.

Re:Speaking of Spam

[Yekrats]

You should check out one of the free (as in beer) "fake" email services. Take a look at:

Sneakemail [sneakemail.com] Basic account is free, premium service is $2/month. This is a wonderful service where you set up an address that will act as a front door and forward mail to an address you specify. You can have dozens of addresses, each for a specific company. Whenever you like, you can delete the address; no more spam problem.

Mailinator [mailinator.com] If you ever need a temporary throwaway email address just to sign up for something you're unsure of, use Mailinator. Once you sign up for Mailinator (using your Sneakemail address above ;-) then you pick [e-mail], Mailinator will capture the email, and allow you to look at it. I saw this in Cringely's column, and really like it.

Two extremely handy services. I use both quite often!

Re:Birds Eye View

[shessel]

Actually, he lives in the Hunt Club apartment complex. I know because I used to live there, too. The house with the pool is the clubhouse, not his apartment - although he lives right around the corner from it. I wonder what would happen with repeated calls to the apt complex business office [greaterakronchamber.org] about wild 3:00am parties coming from 113....

Oh, not that I'd ever do such a thing....

Site Location

[Anonymous Coward]

When I tried it www.thebulkclub.com was down.

But this worked, though ...

http://64.78.42.11/tos.asp

Re:What a disappointment:

[ChadM]

update: it appears that they have changed their DNS tables to stave of a slashdotting. however, their IP address still points to their server!

while [ true ] ; do wget -O - http://64.78.42.11/benefits.asp > /dev/null ; done

let the slashdotting continue :)

Re:My good deed of today is done.

[splatter]

No they changed the DNS records around 6 hours ago so you have done nothing but bombarded an empty space. Try substituting the IP number..

They are not gone nor is the sight down. If you point to http://64.78.42.11/members/login.asp it is still up and running.

DP