Help needed please

[Ed30]

I have found out that someone has registered the domain swift-search.com and put my whois details as the owner (but their email or false email) and is sending out enormous amounts of spam. I have notified the registrar of the domain, but what else can I do to stop this?

Thanks

 

[JMJ]

Contact the host aswell. But most like they have spoofed the IPs

 

[Ed30]

Thanks NM, but how do I find out who the host is? They've done the same thing with sexdrivein.net by the way.

 

[Blarian]

I would talk to a lawyer right away and get a lawsuit in the works, especially if this is hurting your business!

You shouldn't have much trouble subpoening the registrar to get the info? Somebody had to pay for it which would create a paper trail.

 

[JMJ]

Do a IP traceroute. http://network-tools.com/ It will jump through several datacenters most likely the last few are the ones you want to focus on. Any host or datacenter should be more than willing to help you out. For one the person is getting their IPs blacklisted, another is they already have the spammers cash and most likely a TOS with a fee charge for such a case.

 

[nts]

The ip traces back to http://layeredtech.com/ (http://network-tools.com/default.asp?prog=trace&Netnic=whois.arin.net&host=216.32.93.254)

 

[JMJ]

If they happen to be in some third world country blasting out spam theres not alot that can be done. Even if they are doing it from the US they know they will be shut down soon enough. It's a constant battle for a host that most people don't realize. Someone has been Spoofing my IPs and customers domain names for some time now. The clients don't understand why the server keep going down and there's nothing we can do about it really besides except turn off the mail server altogether.

 

[nts]

I would go to http://layeredtech.com/contact.shtml and ask to have thier swift-search.com hosting account deleted at least. As for the domain I guess you could file a complaint here: http://wdprs.internic.net/

 

[JMJ]

The ip traces back to http://layeredtech.com/ (http://network-tools.com/default.asp?prog=trace&Netnic=whois.arin.net&host=216.32.93.254)

Yeah it seems EV1>savvis.net>layeredtech.com>spammer . Thats if it's really were the emails are originating.

 

[Ed30]

Thanks everyone for your help. I have sent emails to savvis.net and layeredtech.com pointing out what's happened. We'll see what they come up with.