http://aolsvc.news.aol.com/news/article.adp?id=20031121131809990001&_...

"The search warrants were executed at homes in San Antonio and
Belleaire, Texas; Johnson City and Fulton, N.Y.; and Waukesha, Wis.
Another search was conducted at the office of The Planet, a
Dallas-based Internet service provider."

Although thePlanet is *not* the subject of the investigation, perhaps
it should be since they are still hosting an AOL phisher which is
still live after being both reported to their abuse department and
posted in NANAE.  They didn't even acknowledge receipt of the LART.

::  <quote>  ::

ab...@thePlanet.com,  please cancel the AOL phisher hosted by you at 
/...@rfedp.biz  which is still very much alive on  67.19.148.74

/...@rfedp.biz

This AOL niche spammer seems to like your service, but others would
prefer that you cancel their account for violation of your TOS/AUP. 
One would think that you now have grounds to cancel all of Bernie
Peters / SPEWS S2134 / Reflected.net domains hosted with you.

Google Search: theplanet spews s2134

Results 1 - 10 of about 87 for theplanet spews s2134

<http://groups.google.com/groups?q=theplanet+spews+s2134&hl=en&lr=&ie=...>

Thank you for your time and consideration in this matter.

Best Regards,

::  </quote>  ::

More information is expected today about the massive arrests and
search warrants executed by the US government.  If only they would
execute a few of the spammers as an example as well.

Cheers,

SuN

--
"Nobody saw me.  I didn't do it.  You can't prove a thing."
-O.J. Simpson,   or was it Bart?

Feds launch Internet crime crackdown, From Terry Frieden
CNN Thursday, August 26, 2004 Posted: 1502 GMT (2302 HKT)

edition.cnn.com/2004/TECH/08/26/cybercrime.probe/

CU
Roland

"The FBI seized computers, software and equipment as part of an investigation
into illegal sharing of copyright movies, music and games..."

--
--

Paging Snotty Richter, please pick up the red "You're Fucked Now" phone.
Keep the Internet clean, practise spammus interruptus

Thane

--
Avoid reality at all costs.
$email =~ s/n(.)a(.)n(.)a(.)e(.+)invalid/$1$2$3$4$5au/;

"Your tip has been successfully submitted."

Oh, Phil, Behalten Sie Ihre Oren Steif.

Listen for the knock.  :)

Cheers,

SuN

--
"Nobody saw me.  I didn't do it.  You can't prove a thing.

Hmm, we'll (tinw) see what the FBI has to say about that!

Internet America began buying smaller ISP's a few years back.  When
they did, both customer service and satisfaction deteriorated.  Spammy
knows how to "play" ISP's who try to grow too fast and who value money
over good buisiness ethics.

Still, thePlanet.com *never* did acknowledge the LART and the phisher
is *still* live.  That bad belongs to thePlanet.

CustName: Internet America
Address: 350 N. St. Paul, Suite 3000
City: Dallas
StateProv: TX
PostalCode: 75201
Country: US
RegDate: 2004-05-19
Updated: 2004-05-19

NetRange: 67.18.240.0 - 67.18.255.255
CIDR: 67.18.240.0/20
NetName: NETBLK-PLNT-IA-1
NetHandle: NET-67-18-240-0-1
Parent: NET-67-18-0-0-1
NetType: Reassigned
Comment: ab...@airmail.net
RegDate: 2004-05-19
Updated: 2004-05-19

TechHandle: PP46-ARIN
TechName: Pathos, Peter
TechPhone: +1-214-782-7800
TechEmail: ab...@theplanet.com

OrgAbuseHandle: ABUSE271-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-214-782-7802
OrgAbuseEmail: ab...@theplanet.com

OrgNOCHandle: TECHN33-ARIN
OrgNOCName: Technical Support
OrgNOCPhone: +1-214-782-7800
OrgNOCEmail: adm...@theplanet.com

OrgTechHandle: TECHN33-ARIN
OrgTechName: Technical Support
OrgTechPhone: +1-214-782-7800
OrgTechEmail: adm...@theplanet.com

Cheers,

SuN

--
"Nobody saw me.  I didn't do it.  You can't prove a thing."
-O.J. Simpson,   or was it Bart?

For some spammers, there are rbl's.
For one certain Bastard elsewhere, there's iptables.
Used to block jackasses all over the world.
Dont recieve mail without it.
http://mail.btfh.net/spam.txt
http://mail.btfh.net/asia-spam.txt

203.123.36.0/255.255.255.224
61.16.172.192/255.255.255.192
202.147.31.128/255.255.255.128
218.38.14.0/255.255.255.0
67.18.240.0/255.255.240.0
202.197.112.0/255.255.240.0
140.115.0.0/255.255.0.0
148.208.0.0/255.255.0.0
211.206.0.0/255.254.0.0
211.208.0.0/255.252.0.0

--
Avoid reality at all costs.
$email =~ s/n(.)a(.)n(.)a(.)e(.+)invalid/$1$2$3$4$5au/;

www.rfedp.biz is *still* very much alive on  67.19.148.74

Information about this AOL phisher hosted by thePlanet.com/Internet
America on  67.19.148.74  was firsted posted on 23 AUG 04.

<http://groups.google.com/groups?selm=20040824001010.10778.00003071%40...>

RFEDP.BIZ

Website Title:  You've Got Pictures@AOL
Response Code:  206
SSL Cert:       No valid SSL on this Host
Website Status: Active
Reverse IP:     Web server hosts 28 websites
Server Type:    Apache/1.3.31 (Unix) mod_auth_passthrough/1.8
mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.3.8 FrontPage/5.0.2.2634a

IP Address:     67.19.148.74
IP Location:    Theplanet.com Internet Services Inc

--------------------------------------------------------------------------- -----

Domain Name:                                 RFEDP.BIZ
Domain ID:                                   D7115805-BIZ
Sponsoring Registrar:                        TUCOWS INC.
Domain Status:                               ok
Registrant ID:                               TUGBCVPEO2LJPUAL
Registrant Name:                             Rumble Inc
Registrant Organization:                     Rumble Inc
Registrant Address1:                         509 Tuesley Road
Registrant City:                             Grange
Registrant State/Province:                   PL
Registrant Postal Code:                      5725
Registrant Country:                          Australia
Registrant Country Code:                     AU
Registrant Phone Number:                     +1.41673618274 x912
Registrant Email:                          
nameserver_sp4m_...@erchost.com
Administrative Contact ID:                   TUGBCVPEO2LJPUAL
Administrative Contact Name:                 Rumble Inc
Administrative Contact Organization:         Rumble Inc
Administrative Contact Address1:             509 Tuesley Road
Administrative Contact City:                 Grange
Administrative Contact State/Province:       PL
Administrative Contact Postal Code:          5725
Administrative Contact Country:              Australia
Administrative Contact Country Code:         AU
Administrative Contact Phone Number:         +1.41673618274 x912
Administrative Contact Email:              
nameserver_sp4m_...@erchost.com
Billing Contact ID:                          TUGBCVPEO2LJPUAL
Billing Contact Name:                        Rumble Inc
Billing Contact Organization:                Rumble Inc
Billing Contact Address1:                    509 Tuesley Road
Billing Contact City:                        Grange
Billing Contact State/Province:              PL
Billing Contact Postal Code:                 5725
Billing Contact Country:                     Australia
Billing Contact Country Code:                AU
Billing Contact Phone Number:                +1.41673618274 x912
Billing Contact Email:                      
nameserver_sp4m_...@erchost.com
Technical Contact ID:                        TUGBCVPEO2LJPUAL
Technical Contact Name:                      Rumble Inc
Technical Contact Organization:              Rumble Inc
Technical Contact Address1:                  509 Tuesley Road
Technical Contact City:                      Grange
Technical Contact State/Province:            PL
Technical Contact Postal Code:               5725
Technical Contact Country:                   Australia
Technical Contact Country Code:              AU
Technical Contact Phone Number:              +1.41673618274 x912
Technical Contact Email:                    
nameserver_sp4m_...@erchost.com
Name Server:                                 NS8.SERVER-HOST101.COM
Name Server:                                 NS9.SERVER-HOST101.COM
Created by Registrar:                        TUCOWS INC.
Last Updated by Registrar:                   TUCOWS INC.
Domain Registration Date:                    Tue Jun 08 04:39:27 GMT
2004
Domain Expiration Date:                      Tue Jun 07 23:59:59 GMT
2005
Domain Last Updated Date:                    Wed Aug 11 12:37:46 GMT
2004

<http://groups.google.com/groups?hl=en&lr=&ie=ISO-8859-1&q=rfedp+thepl...>

Results 1 - 8 of about 30 for rfedp theplanet  

This is Phil Doroff of SPEWS S2134 whether you choose to believe it or
not.  Bernie Peters / nameserver_sp4m_...@erchost.com / Bernie
Robinson / silly_girl1...@yahoo.com and many more aliaes that he uses
are all linked to Doroff / SPEWS S2134 / bitpushers / five-elements /
Reflected.net.  If you were to spend as much time googling as you do
whining you would be able to find this information on your own.

Don't be surprised if it is eventually revealed that SPEWS S2134, the
"isoles" who like to taunt Steve Linford (remember the alias Tony
Montana of Taggs Island), Spamhaus.org (have a look at spamhaus.org.uk
in SPEWS S1106), is involved with DDoS attacks against Spamhaus and
other anti-spam sites.

<http://groups.google.com/groups?q=nameserver_sp4m_...@erchost.com&btnG=Search&hl=en&lr=&ie=ISO-8859-1>

[email] ** We Will Pay Off & Help With Your MORTGAGE! **

[email] <<< *** NUDECELEBRITIES ! ! ! ***

[email] You Qualify For $10,000 to $156,000 Grant / everyone's ...

[email] 14 We Will Pay Off & Help With Your MORTGAGE! / jfojh04. ...

[UPDATE SPEWS S2134] Hello Phil Doroff AKA Bernie Peters

::::  And of particular interest  ::::

Re: SPEWS:THATS NOT FAIR !!!!

<http://groups.google.com/groups?selm=252a0bbf.0407051304.53cf64a8%40p...>

::  <quote>  ::

Still convinced you can't be linked to this activity and still denying
that you know nothing about SPEWS S2134.  But you do, Allen, they are
the reason you are in SPEWS making a fool of yourself.  Are you
another
Dan Ivans fronting for the old isolate.net spam gang?  At least Dan
had enough sense to remain quiet and only speak with MSN's lawyers so
that now he is not a defendant in the MSN vs. isolate.net spam gang.
If you insist on taking a fall for them, it can be arranged.  :)

Lettuce see if you have any history with silly_girl1...@yahoo.com

silly_girl1...@yahoo.com allen delafuente

<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=252a0bbf.0...>

: Now, Allen, why are you being so defensive?
: It makes you appear as if you are still trying to hide
: something.  All anyone wants is the truth.
: Isn't that what you want also, Allen, the truth and to help
: stop spam?  You possess information about the true identity
: of the spammers behind SPEWS S2134 and you
: refuse to share that information.
: That information would help stop SPEWS S2134 from spamming.

Looks like we are back where we started, with proof that this is SPEWS
S2134 and that you hosted and *moved* them between your IP's and IP
blocks.  The more you deny your involvement, the more information you
cause to be posted about SPEWS S2134 and their nefarious activity, and
that must hurt you ways not yet discussed.

The link above is for an article which purposely did not snip your
previous responses so that at a later time, such as this, one
reference could be made to your obtuseness in this matter which proves
your invovlement with SPEWS S2134 and your continuous denying of the
facts.

The article clearly points out that  silly_girl1...@yahoo.com  is in
fact part of your SPEWS S1106 record.

:::: From   http://www.spews.org/html/S1106.html
:::: Domain Name:                     AWESOMEOFFERS.BIZ
:::: Domain ID:                       D6345267-BIZ
:::: Sponsoring Registrar:            TUCOWS INC.
:::: Domain Status:                   ok
:::: Registrant ID:                   TUCT8KMXHWKHBNMC
:::: Registrant Name:                 Bernie Robinson
:::: Registrant Organization:         none
:::: Registrant Address1:             164-12 casyoung road
:::: Registrant City:                 Singapore
:::: Registrant State/Province:       NA
:::: Registrant Postal Code:          249724
:::: Registrant Country:              Singapore
:::: Registrant Country Code:         SG
:::: Registrant Phone Number:         +1.4165551284
:::: Registrant Email:                silly_girl1...@yahoo.com

:::: Name Server:     NS2.CHEAPBPHOSTING.COM
:::: Name Server:     NS1.CHEAPBPHOSTING.COM

You not only are associated with and sound just like stewart and
johnson of SPEWS S1620, you are going down the same trail of denial
and making the same mistakes they made, digging your hole deeper and
deeper and revealing more and more of your employer's operation.
There is a Rule # 3 for a reason.

Now, back to the trojan spamming exploit host.

OrgName:    ThePlanet.com Internet Services, Inc.
OrgID:      TPCM
Address:    1333 North Stemmons Freeway
Address:    Suite 110
City:       Dallas
StateProv:  TX
PostalCode: 75207
Country:    US

NetRange:   69.93.0.0 - 69.93.111.255
CIDR:       69.93.0.0/18, 69.93.64.0/19, 69.93.96.0/20
NetName:    NETBLK-THEPLANET-BLK-9
NetHandle:  NET-69-93-0-0-1
Parent:     NET-69-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.THEPLANET.COM
NameServer: NS2.THEPLANET.COM
Comment:    
RegDate:    2003-11-19
Updated:    2003-11-19

TechHandle: PP46-ARIN
TechName: ...

read more »