This web site is no longer maintained and may be outdated. It is retained primarily for historical reasons.
cyberangels.nl
«The history of a spamhaus exposed»
>> Cyberangels.nl domain now owned by spam fighters
On July 3 2003, cyberangels.nl was registered by Spamvrij.nl, a Dutch foundation fighting spam. Previously,
the domain was owned by the company Cyberangels, who have been majorly involved
in spamming. When news hit the net about who was possibly behind Cyberangels,
the domain was suddenly dropped - and we acted fast and registered it. We feel that
the name «Cyberangels» suits us better, anyway. After all, we're
cleaning the net to keep it workable. And we're doing that angelically, with
beatific smiles, occasionally hitting a spammer with a harp.
We want to warn all former CyberAngels contacts that, from now on,
any mail - private or business - sent to any cyberangels.nl e-mail address
will not go to that spamming and spam facilitating company, but directly to us.
As almost all e-mails sent to addresses within the cyberangels.nl is spam, all
e-mail is fed to anti-spam blocklists.
However, if you want to send us an e-mail, please use the address reacties@spamvrij.nl as the e-mail
accounts within the domain cyberangels.nl are currently flooded with bounces of
spams.
- Who were Cyberangels? Who is Martijn Bevelander?
- News archive and chronology
- Evidence and hunches
- About Spamvrij.nl
>> Who were Cyberangels? Who is Martijn Bevelander?
The story in a nutshell:
Cyberangels are major spammers and spam facilitators. Amongst others, they
facilitated Superzonda, who in themselves are responsible for an estimated 20
to 30 million spams per day. Initially, it wasn't clear who was running
Cyberangels; the contact information provided in SIDN's database - SIDN is the Dutch domain registrar -
was of course false. Nevertheless, slowly information started to trickle out
or was delved up. It looks like Cyberangels is - or was - owned by
Megaprovider, a company in turn owned
by Martijn Bevelander. Bevelander himself previously gained some notoriety for
being a domain hijacker. In March 2002, Bevelander's company Bevelander Internet
Services went bankrupt.
When the first big story about possible connections between Bevelander and
Cyberangels was published, things speeded up fast. Bevelander denied most
and admitted some, then later on, he denied everything. Currently, he claims that
he merely registered cyberangels.nl and .be when he was a domain hijacker. Predictably,
he is also threatening to sue. Meanwhile, several other Dutch ISPs have decided to no
longer peer with Bevelander's Megaprovider. Finally, Megaprovider requested Prenames
to please discontinue the domain cyberangels.nl, which Spamvrij.nl registered twenty minutes later, in order to use the old
spamming domain as a place to collect information about Cyberangels.
>> News archive and chronology
Last news is on top. For the uninitiated, you might want to read this section starting
at the end, working your way upwards, witnessing how the story unravels.
- > 08-07-2003, 17:23: Interview with NLIP about Megaprovider's
suspension
- Planet Multimedia interviews Hans Leemans, chair of NLIP, about Megaprovider's
three month suspension. The reason: one of their owners, Martijn Bevelander,
is connected to the Cyberangels spamhaus.
- > 08-07-2003,
15:45: NLIP suspends Megaprovider (Dutch)
- The Dutch Association of ISPs (NLIP) have suspended Megaprovider. One of Megaprovider's
three owners, Martijn Bevelander, was linked to spamming. The suspension is valid
for three months. Within that period, either Bevelander needs to give up his
spamming companies or Megaprovider needs to sack Bevelander. Otherwise, NLIP will
boot Megaprovider after three months. Dutch readers might be interested in reading
NLIP's
press release about the matter.
- > 08-07-2003,
10:10: Spamvij gives Bevelander 'free webmail' (Dutch)
- Since Spamvrij published mail addressed to martijn@bevelander on its site, Webwereld
congratulated Bevelander about having acquired ' free webmail'.
- > 08-07-2003, 03:13: Verio Europe kicks Megaprovider
- Due to massive abuse, Verio Europe decides to no longer accepts traffic for
Megaprovider. Also, they have stopped providing DNS services for Megaprovider.
- > 07-07-2003, 15:12: Our cybernail-mail analysis gets slashdotted
- ... and quite a few readers glee over this novel notion of being able to read
the incoming mail of a spammer.
- > Mail for martijn@cyberangels.nl
- While going through the incoming Cyberangels mail, we found a mail from a
guy mailing martijn@cyberangels.nl about
his prices. Is that Martijn Bevelander, or is there a Martijn not-Bevelander
working at Cyberangels?
- > 07-07-2003,
11:06: Known spammer worked for Bevelander (Dutch)
- Webwereld elaborates on the story that The Register published: a known porn
spammer, Brian Westly, was working for (or with) Bevelander in MAPS
Holding.
- > 07-07-2003: Spamvrij.nl analyses incoming
Cyberangels mail
- Since MX-records for cyberangels.nl now point to spamvrij.nl too, we get all their
mail: bounces, spam complaints and what have you. Have a peek: what does a spammer
receive in the course of three days? By now, we have a very precise answer: 6305
mails. Here is the breakdown.
- > 06-07-2003, 22:03: Dutch mass spammer loses grip
- The Register describes how Bevelander's reputation - and with it, that of his
company, the ISP Megaprovider
- is grinding to a halt. The Dutch Association of Internet Providers
(NLIP) has started an investigation
and may discharge Megaprovider as a member later this week. The Register also
points out that Brian Westly was a board member of MAPS Holding (apparently another
company owned by Bevelander) until May this year. In April, Westly had to appear
for a US
District Court (Northern Illinois) for running an allegedly illegal spam operation
that used deceptively bland subject lines, false return addresses and empty 'reply-to'
addresses.
- > 03-07-2003, 15:22: Spamvrij.nl registers cyberangels.nl
- Within half an hour of somebody dropping
the domain name, Spamvrij.nl
manages to secure it. Our chair, Rejo Zenger, has been rather helpful in unraveling
the plot surrounding the Cyberangels spamhaus.
- > 03-7-2003, 15:00: Bevelander has lied about Cyberangels.nl
(Dutch)
- Planet Multimedia concludes that evidence that Martijn Bevelander of Megaprovider was
heavily involved in Cyberangels is piling up. Prenames - who Bevelander claimed was
the registrar of cyberangels - states that Bevelander had personally and
recently registered the domain through them (which belies Bevelander's previous
claim that he registered this domain while being a hijacker). Prenames further disclosed
that Megaprovider, Bevelander's company, requested that Prenames would discontinue it.
On top of that, Planet discovers a pile more of evidence and hints that Bevelander
was closely connected to Cyberangels.
- > 03-07-2003,
08:29: Several Dutch ISPs refuse peering with Megaprovider (Dutch)
- Dutch ISP IS Internet Services has
canceled its peering contracts with Megaprovider, Bevelander's ISP. So have
TrueServer, LambdaNet en 2Fast. IS also claims that other providers have started
to filter out incoming e-mail originating from Megaprovider. Finally, the Dutch
digital rights organisation Bits Of Freedom (BOF)
hints that the Dutch ISP association NLIP
should start wondering about taking measures against Megaprovider.
- > 02-07-2003: Dutch national news picks up the story (Dutch)
- The story itself doesn't offer much. The interesting thing is that it has hit the
Dutch national news site.
- > 02-07-2003, 14:40: Planet Multimedia speaks with Bevelander
(Dutch)
- Planet Multimedia phones with Bevelander twice; both recordings are on-line. In the
first recording, Bevelander claims that Cyberangels.nl was registered by Prenames,
a company he has nothing to do with. (But the next day, Bevelander requests Prenames
to discontinue cyberangels.nl. Well...) Planet also discover that Bevelander has used
'Cyberangels' as a trade name for Domain for Web BV, one of his companies. Very
interesting details.
- > 02-07-2003,
12:54: Bevelander 'unveiled' as a spammer (Dutch)
- A major Dutch newspaper caught on :) It claims that Bevelander is considering to
sue the BBC and considers the story about himself to be mere 'gossip'.
- > 02-07-2003,
11:44: Webwereld: Bevelander is furious about previous article (Dutch)
- Bevelander, who only hours ago didn't care what people said about him, is now
threatening to sue.
- > 02-07-2003,
10:52: Webwereld concludes: BBC discovers that Bevelander is a spammer (Dutch)
- The Dutch webzine was the first one in NL to publish the news. They summarize
the BBC story and give a run-down of Bevelander's business track. Says Bevelander:
«I don't care what people say about me.»
- > 02-07-2003, 04:33: Telefonica-data.com drops Cyberangels and
SuperZonda
- Steve Linford of Spamhaus informs that SuperZonda and CyberAngels.nl were terminated
yesterday by their upstream provider telefonica-data.com, after Spamhaus placed the
corporate mail relays of telefonica-data.com on the SBL for providing 'spam support
service'.
- > 01-07-2003, 20:38: Slashdot spreads the news
- Slashdot - whose readership have never been very happy with SuperZonda - brings
the BBC story to the nerds. Says Slashdot: 'The BBC point the finger at Martijn
Bevelander of MegaProvider as being not the innocent party he seems. The BBC
provide some evidence to back this up, and are not known for rash accusations.'
- > 01-07-2003, 16:45: BBC connects Cyberangels to Bevelander
- BBC journalist Andrew Bomford tries to track down Superzonda, a South American
spam gang. While doing so, he discovered that Cyberangels was providing services
for one of the sites spamvertised by Superzonda (beautifulwomentodate.com.
Upon further investigation of Cyberangels, Martijn Bevelander kept popping up.
Bevelander first denied even knowing Cyberangels, then claimed that they were
an old customer of his which he had dumped, and finally has to face the evidence
that he is an 'investor' in Cyberangels. During his conversations with Bomford,
Bevelander suddenly discarded the cyberangels.be domain - which was connected to
him. To top things off, Bomford links Megaprovider to spamming and spammers.
- > 30-06-2003, 19:26: Cyberangels finally kicked off Telefonica
- The BBC's phonecalls (and the Spamhaus listings) combined, finally did the trick:
Telefonica cut off Cyberangels for spamming. Here's the first triumphant thread
in news.admin.net-abuse.email.