John,

In addition to checking their WHOIS database registration (and that of upstream providers, as indicated), it is sometimes helpful to check for a website containing information, such as at <http://www.TCSOURCEONE.COM>, with a "Who We Are" webpage at <http://www.TCSOURCEONE.COM/who_we_are/who_we_are.html>.

"Crawling" their website reveals references to <http:///www.tcscomputers.com>.  The WHOIS database record on <tcscomputers.com> reveals:

Registrant:
 TCS Inc.
 2150 N. Main
 Logan, Ut 84341
 US

 Domain Name: TCSCOMPUTERS.COM

 Administrative Contact:
    Loosle, Tony  [log in to unmask]
    2150 N. Main
    Logan, Ut 84341
    US
    435.753.2756

 Technical Contact:
    [same as above]

 Billing Contact:
    [same as above]

 Registration Service Provider:
    TCS Inc. dba SourceOne Internet, [log in to unmask]
    435.753.2756

*** Notice that while the telephone exchange and number is the same, the area code is "435", not "801", as coded in the WHOIS database record for TCSOURCEONE.COM. ***

Are you certain that they are sending the spam?  They provide Internet access and web hosting services.  The spam may be originating with one of their clients, or they may have an open relay hijacked by a spammer.  If you cannot reach a domain owner, sometimes you can contact their upstream provider as denoted by their DNS or by determining the owner of the Netblock of IP numbers that includes their allocation.

If you could publish the headers from one of the spams, we could likely help identify the originator and the ISP's involvement, if any.

Michael


At 05:04 PM 4/3/02 -0500, John L. Mottl wrote:
>Does anybody know how to contact this group?
>
>They are sending spam to us and maybe others.
>
>Any ideas or suggestions would help,
>their whois phone number no longer works.
>
>There website is one of an ISP!?