[email] [LowestMortgageQuotes] (courseresponses.com - hirrupyes.com) Pending Security Check
TomezNet
IP 200.233.231.66 200-233-231-066.xd-dynamic.ctbcnetsuper.com.br
(at nsb.ctbctelecom.com.BR / ctbctelecom.net.br)
open proxy -- 1155042525 (Tue Aug 8 15:08:45 2006)
http://njabl.org/cgi-bin/lookup.cgi?query=200.233.231.66
Spamvert:
SecurityCheck.courseresponses.com IP 222.122.149.99
wwww.courseresponses.com IP 222.122.149.99
(SBL45236) (at kornet.net / ns2.nasmedia.co.kr)
ns1.hirrupyes.com IP 211.156.254.115
(at WANTONGNET - wantong.net.cn / wtonline.net)
Web: LowestMortgageQuotes Š 2006
More LowestMortgageQuotes sightings:
http://groups.google.com/groups/search?q=LowestMortgageQuotes+group%3A*abuse
Forged Logos:
TRUSTE
VeriSign
More info below:
====================
X-SID-PRA: StaciL...@webtv.net
X-SID-Result: Fail
X-Message-Info: txF49lGdW43vgbPr6SR9Qul/VNm4WeZzHFiAjd6tj3g=
Received: from tomts48-srv.bellnexxia.net ([209.226.175.192]) by
bay0-pamc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Tue, 8 Aug 2006 06:08:14 -0700
Received: from xx..xx..xx.net ([207.58.1....])
by toip6.bellnexxia.net with ESMTP; 08 Aug 2006 09:07:54 -0400
Received: (qmail 23679 invoked by uid 110); 8 Aug 2006 09:07:52 -0400
Delivered-To: xx..xx@xx..xx.com
Received: (qmail 23645 invoked from network); 8 Aug 2006 09:07:51 -0400
Received: from 200-233-231-066.xd-dynamic.ctbcnetsuper.com.br (HELO
4FD3A158) (200.233.231.66)
by xx..xx..xx.net with SMTP; 8 Aug 2006 09:07:51 -0400
Received: (qmail 11776 invoked from network); Tue, 08 Aug 2006 09:05:31
-0500
Received: from unknown (myadmin.webtv.net) (192.168.0.76) by
prod-admin-025.webtv.net with SMTP; Tue, 08 Aug 2006 09:05:31 -0500
Received: (qmail 3983 invoked by uid 10001); Tue, 08 Aug 2006 09:05:31
-0500
Date: Tue, 08 Aug 2006 09:05:31 -0500
Message-ID: <060014446565...@myadmin.webtv.net>
To: xx..xx@xx..xx.com
From: "Mccracken & Lovett Mortgage Brokers" <StaciL...@webtv.net>
Sender: StaciL...@webtv.net
Reply-to: StaciL...@webtv.net
Subject: Pending Security Check
Return-Path: Irw...@prodigy.net
X-OriginalArrivalTime: 08 Aug 2006 13:08:14.0616 (UTC)
FILETIME=[B52A3180:01C6BAEB]
Current Status:
Approval Application-----Crew0188JAL
Status:
----Application Form -----COMPLETED
----Background Check -----COMPLETED
----Approval Process -----COMPLETED
----Amount Approval-------$20,000 - $170,000 --PENDING
----Security Check -----INCOMPLETE --Due Date -Friday, August 11th
You application form has been looked over and everything
looks good.
The company we have choosen for your M0RTGAGE REF1NANCE
wants you to verify your information again for security
purposes.
We are sorry about this inconvience but promise you it is
worth your time.
Verify Form:
http://SecurityCheck.courseresponses.com
Cheers
Staci Lindsay
Account Supervisor
Mccracken & Lovett Mortgage Brokers
-- END OF SPAM --
See:
IP 200.233.231.66 200-233-231-066.xd-dynamic.ctbcnetsuper.com.br
http://www.moensted.dk/spam/?addr=200.233.231.66
http://www.spamhaus.org/query/bl?ip=200.233.231.66
http://spamcop.net/w3m?action=checkblock&ip=200.233.231.66
http://dsbl.org/listing?200.233.231.66
inetnum: 200.233.224/20
aut-num: AS16735
abuse-c: CST87
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: 025.759.572/0165-07
route: 200.232.0.0/13
descr: RNP - commercial providers
origin: AS1916
mnt-by: RNP-MAINT-MCI
changed: alg...@pop-rj.rnp.br
ASN: 16735
ASN Name: LACNIC-16735
Country IP Range: 200.128.0.0 to 200.255.255.255
http://www.cidr-report.org/cgi-bin/as-report?as= 16735
3 SBL/ROKSO listings for IPs under the responsibility of
ctbctelecom.net.br
http://www.spamhaus.org/sbl/listings.lasso?isp=ctbctelecom.net.br
See:
SecurityCheck.courseresponses.com IP 222.122.149.99
SecurityCheck.courseresponses.com is really courseresponses.com
dns1.courseresponses.com []
dns2.courseresponses.com []
ns1.hirrupyes.com [211.156.254.115]
ns2.hirrupyes.com [222.122.149.99]
SecurityCheck.courseresponses.com has no MX records ->
courseresponses.com has no MX records
http://www.moensted.dk/spam/?addr=222.122.149.99
http://korea.services.net/blocked.phtml?addr=222.122.149.99
http://www.spamhaus.org/query/bl?ip=222.122.149.99
More 222.122.149.99 sightings:
http://groups.google.com/groups/search?q=222.122.149.99+group%3A*abuse
Org Name : Korea Telecom
Service Name : KORNET
route: 222.122.0.0/16
descr: Korea Telecom, Seoul, Korea
origin: AS4766
mnt-by: MAINT-AS4766
changed: chs...@soback.kornet.net
ASN: 4766
ASN Name: KIXS-AS-KR (Korea Telecom)
Country IP Range: 222.122.0.0 to 222.122.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4766
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45236
222.122.149.99/32 is listed on the Spamhaus Block List (SBL)
06-Aug-2006 00:25 GMT | SR23
Spam webhosting - busyjoints.com etc
19 SBL listings for IPs under the responsibility of kornet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=kornet.net
Let see whois:
No match for "COURSERESPONSES.COM"
More courseresponses.com sightings:
http://groups.google.com/groups/search?q=courseresponses.com+group%3A*abuse
See:
ns1.hirrupyes.com IP 211.156.254.115
ns1.hirrupyes.com has no MX records -> hirrupyes.com has no MX records
http://www.moensted.dk/spam/?addr=211.156.254.115
inetnum: 211.156.240.0 - 211.156.255.255
netname: ZhanjiangWantong
country: CN
descr: Zhan Jiang Wan Tong Co.,Ltd.
route: 211.156.240.0/20
descr: CNC Group Guangdong Network User
origin: AS4837
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country IP Range: 211.144.0.0 to 211.159.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
1 SBL listings for IPs under the responsibility of wantong.net.cn
http://www.spamhaus.org/sbl/listings.lasso?isp=wantong.net.cn
Let see whois:
Registrar: ENOM, INC.
Registration Service Provided By: NameCheap.com
Contact: sup...@NameCheap.com
Visit: http://www.namecheap.com/
Domain name: hirrupyes.com
Registrant Contact:
PrivateDomainRegistrations
Gary Reed (publicdomains[]hushmail.com)
+1.6047678695
Fax: +1.5555555555
150-3495 Cambie Street
Vancouver, BC V5Z 4R3
CA
Administrative Contact:
PrivateDomainRegistrations
Gary Reed (public...@hushmail.com)
+1.6047678695
Fax: +1.5555555555
150-3495 Cambie Street
Vancouver, BC V5Z 4R3
CA
Technical Contact:
PrivateDomainRegistrations
Gary Reed (public...@hushmail.com)
+1.6047678695
Fax: +1.5555555555
150-3495 Cambie Street
Vancouver, BC V5Z 4R3
CA
Status: Locked
Name Servers:
ns1.hirrupyes.com
ns2.hirrupyes.com
Creation date: 04 Aug 2006 06:58:47
Expiration date: 04 Aug 2007 06:58:47
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/278d8d71afa31b4e
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/44df3202c82e23ed
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: