[email] Hot young teens one day free trial
in...@oryx.com
valid since 1999, and may never have been valid. Unmunged.
From osvaldo...@attitudes.fr Sat Mar 13 02:01:07 2004
Return-Path: <osvaldo...@attitudes.fr>
X-Original-To: georg...@oryx.com
Received: from aol.com (cliente-217216203205.uBRcoa01.supercable.es [217.216.203.205])
by kalyani.oryx.com (Postfix) with ESMTP
id 6EC6A1BDEB2; Sat, 13 Mar 2004 02:01:02 +0100 (CET)
Message-ID: <GAMNHHIGCMKFJKHEJGKEFF...@attitudes.fr>
From: "Osvaldo Baca" <osvaldo...@attitudes.fr>
To: georg...@oryx.com, mark.pa...@oryx.com,
marsha....@oryx.com, mary.wit...@oryx.com, mv...@oryx.com,
mvo...@oryx.com
Subject: Hot young teens one day free trial
Date: Sat, 13 Mar 2004 17:17:05 +0000
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: base64
SGV5LCANCiAgICBDb21lIGNoZWNrIG91dCB0aGUgeW91bmdlc3QgdGVlbnMg
YXZhaWxhYmxlIG9uIHRoZSBuZXQuLiANClRoZXNlIHRlZW5zIGFyZSBiYXJl
bHkgbGVnYWwhIGFuZCBpdHMgZ290IGEgZnJlZSBvbmUgZGF5IHRyaWFsLi4g
DQpDbGljayBIZXJlIGZvciBhIG9uZSBkYXkgRnJlZSBUcmlhbCAuLi4uDQoN
Cmh0dHA6Ly80b2pidDcycnhuLmJhcmxleW1ha2luZzF0LmNvbS9tYWluLmh0
bWwNCg0KDQpvdXQgdGhpbmdzIHRvbGQgb2Ygc3dlZXR5IG9mIHRoZXNlIG1h
a2Ugc2hvdWxkIHUgIA0K
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>
spam...@nil.nil
Fraudulent claim of security,
"ORDER ON OUR SECURE CREDIT CARD FORM NOW"
as promised by the image at http://tooluniverse.biz/images/join-2x3.jpg
while credit card information is submitted unencrypted
and insecurely to http://tooluniverse.biz/pay/process6.php
---
Spam FROM: lsanca1-ar48-4-46-103-231.lsanca1.dsl-verizon.net [4.46.103.231]
ab...@dsl-verizon.net,postm...@dsl-verizon.net,ab...@verizon.net,
postm...@bizmailsrvcs.net,ab...@genuity.com,hostm...@bizmailsrvcs.net
Spamvertized URL: http://9gnnh92k45.barleymaking1t.com/main.html
at IP address 211.158.15.59 on cqnet.com.cn
pen...@cqnet.com.cn,ab...@cqnet.com.cn,postm...@cqnet.com.cn,
ser...@cqnet.com.cn,ip...@cnnic.net.cn,postm...@cnnic.net.cn,
cnnic...@cnnic.net.cn,z...@cstnet.net.cn
whose order form submits data to the:
Spamvertized JOIN PAGE: http://tooluniverse.biz/join2.php?r=40401003
at IP address 202.99.212.188 on cnc-noc.net (CNCGROUP-SX)/JC-TELECOM-HOST.
sx...@public.ty.sx.cn,hai...@cnc-noc.net,
we...@cnc-noc.net,ab...@cnc-noc.net,postm...@cnc-noc.net,
postm...@ty.sx.cn,h...@public.ty.sx.cn
==========
[DETAILS:]
SPAM FROM: lsanca1-ar48-4-46-103-231.lsanca1.dsl-verizon.net [4.46.103.231]
OrgName: Genuity
OrgID: GNTY
CIDR: 4.0.0.0/8
OrgAbuseEmail: ab...@genuity.com
OrgName: GTE Intelligent Network Services
NetRange: 4.46.0.0 - 4.46.119.255
TechName: Hostmaster, Verizon Online
TechEmail: hostm...@bizmailsrvcs.net
[whois.abuse.net]
ab...@verizon.net (for bizmailsrvcs.net)
postm...@bizmailsrvcs.net (for bizmailsrvcs.net)
ab...@verizon.net (for dsl-verizon.net)
SPAMVERTIZED URL: http://9gnnh92k45.barleymaking1t.com/main.html
'Click Here for a one day Free Trial ....
http://9gnnh92k45.barleymaking1t.com/main.html'
* Connected to 211.158.15.59
Host: 9gnnh92k45.barleymaking1t.com
inetnum: 211.158.0.0 - 211.158.31.255
netname: CQNET
country: CN
e-mail: ip...@cnnic.net.cn
e-mail: pen...@cqnet.com.cn
[whois.abuse.net]
postm...@cqnet.com.cn (for cqnet.com.cn)
ser...@cqnet.com.cn (for cqnet.com.cn)
postm...@cnnic.net.cn (for cnnic.net.cn)
cnnic...@cnnic.net.cn (for cnnic.net.cn) [old]
z...@cstnet.net.cn (for cnnic.net.cn)
This page has a form for "signing up" with action:
[form action="http://tooluniverse.biz/join2.php?r=40401003" method="post"]
submitting data to the actual spamvertized site at its:
SPAMVERTIZED JOIN PAGE: http://tooluniverse.biz/join2.php?r=40401003
The data submitted is:
APPLY_NameOnCard=[victim's name]
&APPLY_Email=[victim's email address]
&password=[victim's chosen password]
&APPLY_CountryId=US
&Site=nm_celebsc1 or nm_celebsc2 (1 day or 1 month option)
&submit=Get Me Instant Access Now
(There is a 'UserName=[vctim's chosen username]'
field on the form which is commented out.
Apparently they assign the UserName now.)
* Connected to 202.99.212.188
Host: tooluniverse.biz
(hmmm ... the time before the the time before the last time
I got spam for this, tooluniverse.biz was going under the
name fashionflair.biz)
-----------------------------------------------
inetnum: 202.99.212.160 - 202.99.212.191
netname: JC-TELECOM-HOST
descr: JINCHENG DXJ XUNI ZHUJI
country: CN
admin-c: LX124-AP sx...@public.ty.sx.cn
BGP ROUTING shows this to be on Autonomous System Number 4837
aut-num: AS4837
as-name: China-Network-Communications-Group
descr: China Network Communications (CNC Group)
admin-c: HF7-CW hai...@cnc-noc.net
tech-c: YW3-CW we...@cnc-noc.net
[whois.abuse.net]
ab...@cnc-noc.net (for cnc-noc.net)
postm...@cnc-noc.net (for cnc-noc.net)
TCPTRACEROUTE to port 80 on 202.99.212.188 shows:
...
23 218.26.128.66 (218.26.128.66) [1]
24 218.26.128.89 (218.26.128.89) [1]
25 202.97.130.69 (202.97.130.69) [2]
26 202.99.212.188 (202.99.212.188) [open]
1: inetnum: 218.26.0.0 - 218.26.255.255
netname: CNCGROUP-SX
e-mail: h...@public.ty.sx.cn
2: inetnum: 202.97.128.0 - 202.97.159.255
netname: CNCGROUP-SX
e-mail: h...@public.ty.sx.cn
[whois.abuse.net]
ab...@cnc-noc.net (for ty.sx.cn)
postm...@ty.sx.cn (for ty.sx.cn)
h...@public.ty.sx.cn (for ty.sx.cn)
-----------------------------------------------
Here one enter's one's credit card number and address,
which as the image at:
http://tooluniverse.biz/images/join-2x3.jpg
is a secure form
"ORDER ON OUR SECURE CREDIT CARD FORM NOW"
but wait ... one's data is submitted unencrypted and
insecurely to http://tooluniverse.biz/pay/process6.php
(the last time it was "process5.php").
Is this porn spammer a liar with fraudulent security?
What a shock.
================
[ORIGINAL SPAM:]
Return-Path: <ejord...@center.partya.ru>
Received: from hotmail.com (lsanca1-ar48-4-46-103-231.lsanca1.dsl-verizon.net [4.46.103.231])
by _my_isp_ (xxx) with ESMTP id i2CLHCFC056928;
Fri, 12 Mar 2004 16:17:14 -0500 (EST)
(envelope-from ejord...@center.partya.ru)
Message-ID: <NGLOGKNNDLNJMKPHMHE...@center.partya.ru>
From: "Phoebe E. Jordan" <ejord...@center.partya.ru>
To: <xxx>
Subject: Hot young teens one day free trial
Date: Sat, 13 Mar 2004 13:32:38 +0000
xxxMIME-Version: 1.0
xxxContent-Type: text/plain
xxxContent-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by _my_isp_ id i2CLHCFC056928
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on _my_isp_
X-Spam-DCC: Misty: _my_isp_ 1170; Body=1 Fuz1=1 Fuz2=1
X-Spam-Report:
* 0.9 BARELY_LEGAL BODY: Possible porn - Barely Legal
* 0.9 FREE_TRIAL BODY: Free Trial
* 2.1 BAYES_90 BODY: Bayesian spam probability is 90 to 99%
* [score: 0.9746]
* 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
* 0.5 FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:' header found
* 1.5 FAKE_HELO_HOTMAIL Host HELO did not match rDNS: hotmail.com
* 1.9 RCVD_IN_NJABL_DIALUP RBL: NJABL: dialup sender did non-local SMTP
* [4.46.103.231 listed in dnsbl.njabl.org]
* 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
* [4.46.103.231 listed in dnsbl.sorbs.net]
* 0.1 RCVD_IN_NJABL RBL: Received via a relay in dnsbl.njabl.org
* [4.46.103.231 listed in dnsbl.njabl.org]
* 0.1 RCVD_IN_RFCI RBL: Sent via a relay in ipwhois.rfc-ignorant.org
* [Inaccurate or missing WHOIS data]
* 1.6 RCVD_IN_DYNABLOCK RBL: Sent directly from dynamic IP address
* [4.46.103.231 listed in dnsbl.sorbs.net]
* 0.1 CLICK_BELOW Asks you to click below
X-Spam-Status: Yes, hits=13.1 required=6.0 tests=BARELY_LEGAL,BAYES_90,
CLICK_BELOW,DATE_IN_FUTURE_12_24,FAKE_HELO_HOTMAIL,
FORGED_HOTMAIL_RCVD,FREE_TRIAL,RCVD_IN_DYNABLOCK,RCVD_IN_NJABL,
RCVD_IN_NJABL_DIALUP,RCVD_IN_RFCI,RCVD_IN_SORBS autolearn=no
version=2.63
X-Spam-Level: *************
X-UIDL: :JG!!=)p!!~ak!!,K#"!
Status: RO
X-Status:
X-Keywords:
X-UID: 9
Hey,
Come check out the youngest teens available on the net..
These teens are barely legal! and its got a free one day trial..
Click Here for a one day Free Trial ....
http://9gnnh92k45.barleymaking1t.com/main.html
u alot Love for of people ever products your me