>> Cyberangels.nl domain now owned by spam fighters

On July 3 2003, cyberangels.nl was registered by Spamvrij.nl, a Dutch foundation fighting spam. Previously, the domain was owned by the company Cyberangels, who have been majorly involved in spamming. When news hit the net about who was possibly behind Cyberangels, the domain was suddenly dropped - and we acted fast and registered it. We feel that the name «Cyberangels» suits us better, anyway. After all, we're cleaning the net to keep it workable. And we're doing that angelically, with beatific smiles, occasionally hitting a spammer with a harp.

We want to warn all former CyberAngels contacts that, from now on, any mail - private or business - sent to any cyberangels.nl e-mail address will not go to that spamming and spam facilitating company, but directly to us. As almost all e-mails sent to addresses within the cyberangels.nl is spam, all e-mail is fed to anti-spam blocklists.

However, if you want to send us an e-mail, please use the address reacties@spamvrij.nl as the e-mail accounts within the domain cyberangels.nl are currently flooded with bounces of spams.

1. Who were Cyberangels? Who is Martijn Bevelander?
2. News archive and chronology
3. Evidence and hunches
4. About Spamvrij.nl

>> Who were Cyberangels? Who is Martijn Bevelander?

The story in a nutshell:

Cyberangels are major spammers and spam facilitators. Amongst others, they facilitated Superzonda, who in themselves are responsible for an estimated 20 to 30 million spams per day. Initially, it wasn't clear who was running Cyberangels; the contact information provided in SIDN's database - SIDN is the Dutch domain registrar - was of course false. Nevertheless, slowly information started to trickle out or was delved up. It looks like Cyberangels is - or was - owned by Megaprovider, a company in turn owned by Martijn Bevelander. Bevelander himself previously gained some notoriety for being a domain hijacker. In March 2002, Bevelander's company Bevelander Internet Services went bankrupt.

When the first big story about possible connections between Bevelander and Cyberangels was published, things speeded up fast. Bevelander denied most and admitted some, then later on, he denied everything. Currently, he claims that he merely registered cyberangels.nl and .be when he was a domain hijacker. Predictably, he is also threatening to sue. Meanwhile, several other Dutch ISPs have decided to no longer peer with Bevelander's Megaprovider. Finally, Megaprovider requested Prenames to please discontinue the domain cyberangels.nl, which Spamvrij.nl registered twenty minutes later, in order to use the old spamming domain as a place to collect information about Cyberangels.

>> News archive and chronology

Last news is on top. For the uninitiated, you might want to read this section starting at the end, working your way upwards, witnessing how the story unravels.

> 08-07-2003, 17:23: Interview with NLIP about Megaprovider's suspension

Planet Multimedia interviews Hans Leemans, chair of NLIP, about Megaprovider's three month suspension. The reason: one of their owners, Martijn Bevelander, is connected to the Cyberangels spamhaus.

> 08-07-2003, 15:45: NLIP suspends Megaprovider (Dutch)

The Dutch Association of ISPs (NLIP) have suspended Megaprovider. One of Megaprovider's three owners, Martijn Bevelander, was linked to spamming. The suspension is valid for three months. Within that period, either Bevelander needs to give up his spamming companies or Megaprovider needs to sack Bevelander. Otherwise, NLIP will boot Megaprovider after three months. Dutch readers might be interested in reading NLIP's press release about the matter.

> 08-07-2003, 10:10: Spamvij gives Bevelander 'free webmail' (Dutch)

Since Spamvrij published mail addressed to martijn@bevelander on its site, Webwereld congratulated Bevelander about having acquired ' free webmail'.

> 08-07-2003, 03:13: Verio Europe kicks Megaprovider

Due to massive abuse, Verio Europe decides to no longer accepts traffic for Megaprovider. Also, they have stopped providing DNS services for Megaprovider.

> 07-07-2003, 15:12: Our cybernail-mail analysis gets slashdotted

... and quite a few readers glee over this novel notion of being able to read the incoming mail of a spammer.

> Mail for martijn@cyberangels.nl

While going through the incoming Cyberangels mail, we found a mail from a guy mailing martijn@cyberangels.nl about his prices. Is that Martijn Bevelander, or is there a Martijn not-Bevelander working at Cyberangels?

> 07-07-2003, 11:06: Known spammer worked for Bevelander (Dutch)

Webwereld elaborates on the story that The Register published: a known porn spammer, Brian Westly, was working for (or with) Bevelander in MAPS Holding.

> 07-07-2003: Spamvrij.nl analyses incoming Cyberangels mail

Since MX-records for cyberangels.nl now point to spamvrij.nl too, we get all their mail: bounces, spam complaints and what have you. Have a peek: what does a spammer receive in the course of three days? By now, we have a very precise answer: 6305 mails. Here is the breakdown.

> 06-07-2003, 22:03: Dutch mass spammer loses grip

The Register describes how Bevelander's reputation - and with it, that of his company, the ISP Megaprovider - is grinding to a halt. The Dutch Association of Internet Providers (NLIP) has started an investigation and may discharge Megaprovider as a member later this week. The Register also points out that Brian Westly was a board member of MAPS Holding (apparently another company owned by Bevelander) until May this year. In April, Westly had to appear for a US District Court (Northern Illinois) for running an allegedly illegal spam operation that used deceptively bland subject lines, false return addresses and empty 'reply-to' addresses.

> 03-07-2003, 15:22: Spamvrij.nl registers cyberangels.nl

Within half an hour of somebody dropping the domain name, Spamvrij.nl manages to secure it. Our chair, Rejo Zenger, has been rather helpful in unraveling the plot surrounding the Cyberangels spamhaus.

> 03-7-2003, 15:00: Bevelander has lied about Cyberangels.nl (Dutch)

Planet Multimedia concludes that evidence that Martijn Bevelander of Megaprovider was heavily involved in Cyberangels is piling up. Prenames - who Bevelander claimed was the registrar of cyberangels - states that Bevelander had personally and recently registered the domain through them (which belies Bevelander's previous claim that he registered this domain while being a hijacker). Prenames further disclosed that Megaprovider, Bevelander's company, requested that Prenames would discontinue it. On top of that, Planet discovers a pile more of evidence and hints that Bevelander was closely connected to Cyberangels.

> 03-07-2003, 08:29: Several Dutch ISPs refuse peering with Megaprovider (Dutch)

Dutch ISP IS Internet Services has canceled its peering contracts with Megaprovider, Bevelander's ISP. So have TrueServer, LambdaNet en 2Fast. IS also claims that other providers have started to filter out incoming e-mail originating from Megaprovider. Finally, the Dutch digital rights organisation Bits Of Freedom (BOF) hints that the Dutch ISP association NLIP should start wondering about taking measures against Megaprovider.

> 02-07-2003: Dutch national news picks up the story (Dutch)

The story itself doesn't offer much. The interesting thing is that it has hit the Dutch national news site.

> 02-07-2003, 14:40: Planet Multimedia speaks with Bevelander (Dutch)

Planet Multimedia phones with Bevelander twice; both recordings are on-line. In the first recording, Bevelander claims that Cyberangels.nl was registered by Prenames, a company he has nothing to do with. (But the next day, Bevelander requests Prenames to discontinue cyberangels.nl. Well...) Planet also discover that Bevelander has used 'Cyberangels' as a trade name for Domain for Web BV, one of his companies. Very interesting details.

> 02-07-2003, 12:54: Bevelander 'unveiled' as a spammer (Dutch)

A major Dutch newspaper caught on :) It claims that Bevelander is considering to sue the BBC and considers the story about himself to be mere 'gossip'.

> 02-07-2003, 11:44: Webwereld: Bevelander is furious about previous article (Dutch)

Bevelander, who only hours ago didn't care what people said about him, is now threatening to sue.

> 02-07-2003, 10:52: Webwereld concludes: BBC discovers that Bevelander is a spammer (Dutch)

The Dutch webzine was the first one in NL to publish the news. They summarize the BBC story and give a run-down of Bevelander's business track. Says Bevelander: «I don't care what people say about me.»

> 02-07-2003, 04:33: Telefonica-data.com drops Cyberangels and SuperZonda

Steve Linford of Spamhaus informs that SuperZonda and CyberAngels.nl were terminated yesterday by their upstream provider telefonica-data.com, after Spamhaus placed the corporate mail relays of telefonica-data.com on the SBL for providing 'spam support service'.

> 01-07-2003, 20:38: Slashdot spreads the news

Slashdot - whose readership have never been very happy with SuperZonda - brings the BBC story to the nerds. Says Slashdot: 'The BBC point the finger at Martijn Bevelander of MegaProvider as being not the innocent party he seems. The BBC provide some evidence to back this up, and are not known for rash accusations.'

> 01-07-2003, 16:45: BBC connects Cyberangels to Bevelander

BBC journalist Andrew Bomford tries to track down Superzonda, a South American spam gang. While doing so, he discovered that Cyberangels was providing services for one of the sites spamvertised by Superzonda (beautifulwomentodate.com.
Upon further investigation of Cyberangels, Martijn Bevelander kept popping up. Bevelander first denied even knowing Cyberangels, then claimed that they were an old customer of his which he had dumped, and finally has to face the evidence that he is an 'investor' in Cyberangels. During his conversations with Bomford, Bevelander suddenly discarded the cyberangels.be domain - which was connected to him. To top things off, Bomford links Megaprovider to spamming and spammers.

> 30-06-2003, 19:26: Cyberangels finally kicked off Telefonica

The BBC's phonecalls (and the Spamhaus listings) combined, finally did the trick: Telefonica cut off Cyberangels for spamming. Here's the first triumphant thread in news.admin.net-abuse.email.

>> Evidence and hunches

> All there's to connect...
> Telephone interviews by Peter Olsthoorn (planet.nl) with Bevelander: first, a second, 02-07-2003
> Spamvrij.nl analyses incoming Cyberangels mail
> Preliminary injunction against Brian Westly for spamming, April 22 2003, US Disctrict Court, Northern Illinois. Westly was a board member of MAPS Holding until May 2003.
> Spamhaus listing for Cyberangels.nl
> Google's chache of the old Cyberangels index page

>> About Spamvrij.nl

> Contact: reacties@spamvrij.nl.
> Spamvrij.nl news and announcement page
> Board, volunteers and statutes of Spamvrij.nl.