[email] [software piracy] (shalashware.com - oemguy.com) Hi
TomezNet
IP 209.191.125.45 web38414.mail.mud.yahoo.com
IP 88.226.148.218 dsl88-226-38106.ttnet.net.tr
(at ns1.ttnet.net.tr / telekom.gov.tr / turktelekom.com.tr)
Spamvert URL:
http://ca.geocities.com/lind31898orel87684/
Redirected to:
http://shalashware.com/
Spamvert:
shalashware.com IP 194.135.103.24
(SBL35050) (at rtcomm.ru / ns2.serverbox.ru / ns1.relcom.ru)
More spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 209.73.179.38; Tue, 04 Apr 2006
11:55:19 -0700
X-YahooFilteredBulk: 209.191.125.45
X-Originating-IP: [209.191.125.45]
Return-Path: <mendel4993...@yahoo.com>
Authentication-Results: mta125.mail.re4.yahoo.com from=yahoo.com;
domainkeys=pass (ok)
Received: from 209.191.125.45 (HELO web38414.mail.mud.yahoo.com)
(209.191.125.45) by mta125.mail.re4.yahoo.com with SMTP; Tue, 04 Apr
2006 11:55:19 -0700
Received: (qmail 92204 invoked by uid 60001); 4 Apr 2006 17:48:15
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024;
d=yahoo.com;
h=Message-ID:Received:Date:From:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=G7SyV+FWuuVuWrt6ElNmGjuooQynTg25NOxon96CyTMqtpPYlmAaYhAdcbk+/2jeH39bwrXOzZlEpcF1SdmdozTvi+6WxtioXfaHaQLC7nTWD0HEF21UEVZ2G2O5jcat/JlLZAU5KxWiQqbDVgxBkMnE8ZWShf7sueBTqhnEkko=
;
Message-ID: <2006040417481...@web38414.mail.mud.yahoo.com>
Received: from [88.226.148.218] by web38414.mail.mud.yahoo.com via
HTTP; Tue, 04 Apr 2006 10:48:15 PDT
Date: Tue, 4 Apr 2006 10:48:15 -0700 (PDT)
From: "Ava Marysa" <mendel4993...@yahoo.com>
Yahoo! DomainKeys has confirmed that this message was sent by
yahoo.com. Learn more
Subject: Hi
To: xx..xx@xx..xx.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-1084676558-1144172895=:80711"
Content-Transfer-Encoding: 8bit
Content-Length: 910
Microsoft, Adobe software at Super Discounts Packs
O E M (Original Equipment Manufacturer) software includes all essential
components of Retail products excluding support from manufacture.
You will receive installation CDs (or downloads) only (no original
retail packing).
Although O E M software does not come with a box or a manual, it is the
typical and actual software, no trial or demo versions.
$49.95 - Macromedia Dreamweaver 8
$99.95 - Autodesk AutoCAD Electrical 2006
$69.95 - MS Windows 2003 Enterprise Server
$69.95 - Microsoft Office 2003 Professional
$49.95 - MS Windows XP Professional with SP2
Its easy, just follow here
http://ca.geocities.com/lind31898orel87684/
building facing the side street. "Come in and let us have your story.
It
Underwood on country roads but sat, instead, by the bedside of the sick
into his mind came a saying, a sentence, the distorted remembrance of a
him the chance.For this man the frugal, hard working newsboy had
conceived a regard
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
-- END OF SPAM --
See also more sightings:
http://groups.google.com/groups/search?q=%22%40ETN.ORG%22+group%3A*abuse&start=0&scoring=d&
See:
IP 209.191.125.45 web38414.mail.mud.yahoo.com
http://www.moensted.dk/spam/?addr=209.191.125.45
http://www.spamcop.net/bl.shtml?209.191.125.45
More 209.191.125.45 sightings:
http://groups.google.com/groups/search?q=209.191.125.45+group%3A*abuse
NetRange: 209.191.64.0 - 209.191.127.255
CIDR: 209.191.64.0/18
NetName: A-YAHOO-US3
NetHandle: NET-209-191-64-0-1
4 SBL/ROKSO listings for IPs under the responsibility of yahoo.com
http://www.spamhaus.org/sbl/listings.lasso?isp=yahoo.com
See:
IP 88.226.148.218 dsl88-226-38106.ttnet.net.tr
http://www.moensted.dk/spam/?addr=88.226.148.218
inetnum: 88.226.0.0 - 88.226.255.255
netname: TurkTelekom
descr: TT ADSL-alcatel_ulu
country: tr
route: 88.226.128.0/17
descr: TurkTelecom
origin: AS9121
http://www.cidr-report.org/cgi-bin/as-report?as=9121
19 SBL/ROKSO listings for IPs under the responsibility of ttnet.net.tr
http://www.spamhaus.org/sbl/listings.lasso?isp=ttnet.net.tr
See:
shalashware.com IP 194.135.103.24
ns1.shalashware.com A IN 3600 194.135.103.24
ns2.shalashware.com A IN 3600 194.135.103.24
shalashware.com has no MX records
More 194.135.103.24 sightings:
http://groups.google.com/groups/search?q=194.135.103.24+group%3A*abuse
http://www.moensted.dk/spam/?addr=194.135.103.24
http://www.spamhaus.org/query/bl?ip=194.135.103.24
inetnum: 194.135.103.0 - 194.135.103.255
netname: IN-Telecom
descr: IN-Telecom Limited - IT-Service Corporation
descr: http://NODEK.ru - Quality web-hosting, domain
registration
descr: http://ServerBox.ru - Dedicated servers, collocation
descr: http://Domingo.ru - Web-solutions studio
country: RU
route: 194.135.0.0/16
descr: DELEGATED BLOCK
descr: Provider Local Registry
descr: Provider block for EUnet/RELCOM
origin: AS2118
http://www.cidr-report.org/cgi-bin/as-report?as=2118
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35050
194.135.103.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
21-Mar-2006 20:09 GMT | SR04
IN-Telecom Limited: Spammer hosting (escalation)
See also Leo Kuvayev / BadCow:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL39478
20 SBL/ROKSO listings for IPs under the responsibility of rtcomm.ru
http://www.spamhaus.org/sbl/listings.lasso?isp=rtcomm.ru
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/13bf5e7d1aad31f9
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: