Jon Atherton

scammers suck, best to stay away from scammers.

The funny thing is, it probably isn't even his real name.

someone did do some research and found that was his real name...they tracked him down pretty well too...but he moved or some shit and just disappeared

some people got paid from Atherton, i know i didnt, although i took a lot of crap for having his ads on my site..

That is his real name and he does live in brisbane and that prick still owes a lot of money. He is untouchable though guys, he has serious protection. All we can do is hope him the illest will for the future.

http://www.spamhaus.org/rokso/eviden...kso_id=ROK2276

Supabill is a legally registered company in Australia.

Australian Securities and Investments Commission

Extracted from ASIC's database at 07:18:05 on 05/02/2003

- . Name: SUPABILL SERVICES
Registered state/no.: QLD BN17673975
- . Status: Registered
Principal Place ofBusiness: not available
- Jurisdiction: Office of Fair Trading, Queensland

They have been using a Canadian PO Box as a contact address

PO BOX 48953
595 BURRARD STREET
VANCOUVER, BC V7X1A8
CA

Note: 595 BURRARD STREET does NOT exist. But they do have the correct Postal code and a valid PO Box number for the Postal Station in the Bentall Centre

---------
PO: 48831-49000

Delivery Installation
- VAN STN - BENTALL CENTRE

Municipality: VANCOUVER




The address of this ROKSO record is: http://www.spamhaus.org/rokso/eviden...kso_id=ROK2276



and.....

domains ROK1967

The Atherton Family Trust (his mother must be so proud):

domain: atherton.net.au
descr: The Atherton Family Trust (ACN: 073884036)
PO Box 1240
MILTON QLD 4064
admin-c: JA22-CC-AU
tech-c: JA22-CC-AU
zone-c: JA22-CC-AU
nserver: ns1.dnsrack.com
nserver: ns2.dnsrack.com
notify: [email protected]
changed: [email protected] 20010502
source: CCAIR

person: Jon Atherton
address: Interative Network Services
address: 1/1 Fort Lane
address: Milton
address: QLD 4064
phone: +61 419 779 239
fax-no: +61 7 3876 2766
e-mail: [email protected]
nic-hdl: JA22-CC-AU
notify: [email protected]
notify: [email protected]
changed: [email protected] 19990729
source: CCAIR


These Supabill.com / dnsrack.com landing domains are usually located behind a spamvertised clickthrough "join" page:

teenisex.com
faceload.com
ebonypearls.com
lezbabes.com
pinkwet.com
pussyjapan.com
sickanal.com
sickoporn.com
sickoteen.com
xbitch.com
teenshave.com
xsluts.com
porncash.com

Domain registrations are similar to this:

whois.opensrs.net teenisex.com
Results:
Registrant:
SUPABILL SERVICES INCORPORATED
PO BOX 48953
595 BURRARD STREET
VANCOUVER, BC V7X1A8
CA

Domain Name: TEENISEX.COM

Administrative Contact:
INCORPORATED, SUPABILL SERVICES [email protected]
PO BOX 48953
595 BURRARD STREET
VANCOUVER, BC V7X1A8
CA
4197811274

Technical Contact:
INCORPORATED, SUPABILL SERVICES [email protected]
PO BOX 48953
595 BURRARD STREET
VANCOUVER, BC V7X1A8
CA
4197811274


Registrar of Record: TUCOWS, INC.
Record last updated on 16-Jul-2002.
Record expires on 08-Apr-2003.
Record Created on 08-Apr-2000.

Domain servers in listed order:
NS1.DNSRACK.COM 64.158.222.8
NS2.DNSRACK.COM 64.158.222.9


From April to September, 2002, a series of spams have used these domains to redirect to those Supabill domains:

www.nakedteenparty.com A 64.85.73.31
www.heavenlyamateurs.com A 64.85.73.31
www.meetemily18.com [64.85.73.31]
www.14incher.com [64.85.73.31]
www.comlipot.com [64.85.73.31]
www.kellyspornsite.com [does not resolve]
www.cock-videos.com [64.85.73.31]
www.amysgirlfriends.com [does not resolve]
alisha-and-alex.com [64.85.73.31]



The registration info is likely bogus:

Registrant:
David Leno
1444 W. Maple
Beverly Hills, CA 90210 US
Registrar: Dotster (http://www.dotster.com)
Domain Name: HEAVENLYAMATEURS.COM
Created on: 18-DEC-01
Expires on: 18-DEC-02
Last Updated on: 18-DEC-01
Administrative Contact:
Leno, David [email protected]
David Leno
1444 W. Maple
Beverly Hills, CA 90210 US
310-345-5006
Technical Contact:
Leno, David [email protected]
David Leno
1444 W. Maple
Beverly Hills, CA 90210 US
310-345-5006
Domain servers in listed order:
NS1.NAMERESOLVE.COM
NS2.NAMERESOLVE.COM

Registrant:
George Stanson
5845 Parkway Ln
Beverly Hills, CA 90210 US
Registrar: Dotster (http://www.dotster.com)
Domain Name: NAKEDTEENPARTY.COM
Created on: 06-AUG-02
Expires on: 06-AUG-03
Last Updated on: 06-AUG-02
Administrative Contact:
Stanson, George [email protected]
5845 Parkway Ln
Beverly Hills, CA 90210 US
456-457-4596
Technical Contact:
Stanson, George [email protected]
5845 Parkway Ln
Beverly Hills, CA 90210 US
456-457-4596
Domain servers in listed order:



The address of this ROKSO record is: http://www.spamhaus.org/rokso/eviden...kso_id=ROK1967

and...


Registrant:
POWERZEST IT LIMITED
37B NEW CAVENDISH STREET
LONDON, W1G W1G 8JR
UK

Domain name: ADSTATS.COM

POWERZEST IT LIMITED
37B NEW CAVENDISH STREET
LONDON, 81W 81W 8JR
UK

Domain name: PZEST.COM

So, it looks like Hoop probably knew of which he spoke.

http://www.lukeisback.com/archives/updates/040519.htm

>John Atherton (Adstats.com)

http://groups.google.com/groups?selm...&output=gplain

>|W3COM pty ltd (ADSTATS4-DOM) ADSTATS.COM

I wish there was an archived whois However...

>xsluts.com
>W3COM pty ltd (XSLUTS-DOM)
> PO Box 1240
> Milton, QLD 4064
> AU
>
> Domain Name: XSLUTS.COM
>
> Administrative Contact, Technical Contact, Zone Contact:
> Patterson, Jon (JA4011) [email protected]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Jon Patterson? I'm sure his name wasn't really Atherton.

http://groups.google.com/groups?selm...&output=gplain

>Wed, 28 Jul 1999 02:45:04 -0400 (EDT)
>From: [email protected]
>Received: from scoobie (203.37.180.52[203.37.180.52])
>by WWW(MailMax 2.013) with ESMTP id 0
>for [email protected];
>Wed, 28 Jul 1999 00:49:15 +0000 GDT
>Message-ID: 013701bed8c3$ab65cb30$34b425cb@scoobie
>To: [email protected]
>References: [email protected]
>Subject: Re: To Jon Atherton of INS INS-WEB.com and Telstra 07/27/1999
>Date: Wed, 28 Jul 1999 16:37:24 +1000

[snip]

>Here's a tip - don't piss people you don't know off too much, you never
>know how some weirdo people might retaliate.
>
>Bye
>Jon

http://groups.google.com/groups?selm...&output=gplain

>Subject: [email] -ADLT- Paris Hilton's Secret 3-some Video. WATCH
>[IMG SRC=3D"a/adstats/mailer_02.jpg"

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK1712




The address of this ROKSO record is: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3711



partner in spam...

PARTNER-IN-SPAM: Mark Caldwell [inettele.com] ROK3383

Or is "Mark Caldwell" an nom-de-spam for "Gaven Stubberfield"?




Domain name: INETTELE.COM

Registrant Contact:
Inettele INC.
Mark Caldwell ([email protected])
+1.18005306049
Fax: +1.18005306049
924 Hollyview Lane
West Chester, PA 19380
US

Administrative Contact:
Inettele INC.
Mark Caldwell ([email protected])
+1.18005306049
Fax: +1.18005306049
924 Hollyview Lane
West Chester, PA 19380
US

Technical Contact:
Inettele INC.
Mark Caldwell ([email protected])
+1.18005306049
Fax: +1.18005306049
924 Hollyview Lane
West Chester, PA 19380
US

Status: registrar-lock




c. Feb 23 2003:

[whois.abuse.net]
[email protected] (for inettele.com)
[email protected] (for inettele.com)
[email protected] (for inettele.com)
[email protected] (for inettele.com)






NetRange: 64.9.224.0 - 64.9.255.255
CIDR: 64.9.224.0/19
NetName: INETTELE-NET-01
NetHandle: NET-64-9-224-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS.INETTELE.COM
NameServer: NS2.INETTELE.COM
Comment:
RegDate: 2003-08-28
Updated: 2003-09-29

TechHandle: HOSTM282-ARIN
TechName: Hostmaster
TechPhone: +1-800-530-6049
TechEmail: [email protected]

OrgTechHandle: HOSTM282-ARIN
OrgTechName: Hostmaster
OrgTechPhone: +1-800-530-6049
OrgTechEmail: [email protected]


Related URLs

Also see association with ROKSO spammer "Gaven Stubberfield" as listed in SBL11686 64.9.224.0/19 (also SBL13224, removed).

whois -h whois.abuse.net inetelle.com (web lookup)

spam samples for INETELLE.COM



The address of this ROKSO record is: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK3383




Here's some more info I dug up on this spammer.

Aliases used by this spammer:

Jon Atherton, Jon Patterson, Peter Powell, The Tech Guy, Mr. Ins.

E-Mail addresses used by this spammer:

[email protected], [email protected], [email protected],
[email protected], [email protected], [email protected],
[email protected]

Company names used by this spammer:

Supabill Services Inc. (or just SUPABILL), Shervale Pty Ltd, The
Atherton Family Trust, Interative Network Services

Addresses used by this spammer:

PO Box 1240
MILTON, QLD 4064
AU

PO BOX 48953
595 BURRARD STREET
VANCOUVER, BC V7X1A8

1/1 Fort Lane
Milton
QLD 4064
AU

KEIZERSGRACHT 12
N/A
AMSTERDAM, CS 101
NL



To: Jon Atherton and Cyrus Lesser of INS ins-web.com and Interten.net
Doing business as
Interactive Network Services (INS)
Interactive Network Services Pty Ltd (INS-WEB-DOM)
W3COM pty ltd / Web Design
PO Box 1240 Milton, QLD 4064 AU
AND
InterTEN Networking (interten.net)
501 Queen Street Brisbane QLD 4000 AU
+61-7-1194 (FAX) +61-7-1196
Also associated with
domain: gsd.com.au
descr: GSD Pty Ltd
And INS machines with
MAC Address = 00-10-4B-24-39-B5
MAC Address = 00-60-08-CA-37-31

don't worry, "Karma" will hunt him.

I'm still waiting to meet you Jon

You know, it costs less than $10k to "find" anyone on earth. (not including travel expenses). If you really have an issue with someone all you have to do is ask around.

lol.. like he cares.. this is not the average $1k scammer.. this guy made millions and millions of greedy dumb webmasters. He probably living large right now far away from the keyboard.

Damn thats a lot of data... nice post.

This needs a minor correction, as far as I can see "BN17673975" is not actually an Australian company, it's just a registered business name. It is basically a licence for an individual or partnership to conduct a business under that name. It offers no liability/bankruptcy protection either.

Australian companies generally have "Pty Ltd" or "Ltd" appended to their names.

BTW a current search of ASIC shows that "SUPABILL SERVICES" has been deregistered. It may just mean that the periodic licence was not renewed.

http://www.search.asic.gov.au/cgi-bi...ext=&srchsrc=1

an easy $15mil+