[email] [software piracy] (shalashware.com - oemguy.com) Returning customer
TomezNet
IP 209.191.125.75 web38614.mail.mud.yahoo.com
IP 200.126.200.46 46-200-126-200.fibertel.com.ar
(at DNS1.CVTCI.COM.AR)
Spamvert URL:
http://ca.geocities.com/allard58092wynne84099/
Redirected to:
http://shalashware.com/
More spammer sightings:
http://groups.google.com/groups/search?q=%22%40ETN.ORG%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
OEMGUY.COM [81.177.14.72]
(ROK4932 - SBL39755 / SBL35048) (at rtcomm.ru)
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via via 209.73.179.40; Sun, 02 Apr
2006 21:17:14 -0700
X-Originating-IP: [209.191.125.75]
Return-Path: <rosalinda131...@yahoo.com>
Authentication-Results: mta368.mail.mud.yahoo.com from=yahoo.com;
domainkeys=pass (ok)
Received: from 209.191.125.75 (HELO web38614.mail.mud.yahoo.com)
(209.191.125.75) by mta368.mail.mud.yahoo.com with SMTP; Sun, 02 Apr
2006 21:17:14 -0700
Received: (qmail 54145 invoked by uid 60001); 3 Apr 2006 04:17:04
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024;
d=yahoo.com;
h=Message-ID:Received:Date:From:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=2N8eiQYf7S3nf0OLAAkUMJxHlDsPsGWVHK1um0hdjk/7ebrLduhyGefafbVXhULbu7pFXIqVM1Ii92U1NFkmW9nmUKQk7etqpT+W4rNKn3aMmKKN2qc93Fxz5/lR9fE6TYTXIhdzYEI1jHlY9iVxsM9Dj2M3kB75ZAmbBJeUEBw=
;
Message-ID: <2006040304170...@web38614.mail.mud.yahoo.com>
Received: from [200.126.200.46] by web38614.mail.mud.yahoo.com via
HTTP; Sun, 02 Apr 2006 21:17:04 PDT
Date: Sun, 2 Apr 2006 21:17:04 -0700 (PDT)
From: "Saraann Leoline" <rosalinda131...@yahoo.com>
Yahoo! DomainKeys has confirmed that this message was sent by
yahoo.com. Learn more
Subject: Returning customer
To: xx..xx@xx..xx.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-882987798-1144037824=:53671"
Content-Transfer-Encoding: 8bit
Content-Length: 920
<!-- type = text -->
Loking for quality latest soft at affordable price?<br>
<br>
O E M (Original Equipment Manufacturer) software includes all
essential<br>
components of Retail products excluding support from manufacture.<br>
You will receive installation CDs (or downloads) only (no original
retail packing).<br>
Although O E M software does not come with a box or a manual, it is
the<br>
typical and actual software, no trial or demo versions.<br>
<br>
$29.95 - Microsoft Frontpage 2003<br>
$39.95 - Microsoft Visio 2003 Professional<br>
$39.95 - Microsoft Visio 2003 Professional<br>
$69.95 - Microsoft Office 2003 Professional<br>
$49.95 - Macromedia Dreamweaver 8<br>
</font><br>
<h1><a target="_blank"
href="http://ca.geocities.com/allard58092wynne84099/" >Its easy, just
follow here</a></h1><br>
<br>
confidence in his own future that made his homeward walk almost
cheerful.<br>
taken from among the dishes, he laid the note upon the table under
the<br>
ambitious plans he continued to make for himself. Alone together,
the<br>
<br>
stream.When he got down to the breakfast room the next morning Sue had
gone. By<p>
<hr size=1>How low will we go? Check out Yahoo! Messenger's
low <a target="_blank"
href="http://us.rd.yahoo.com/mail_us/taglines/postman8/*http://us.rd.yahoo.com/evt=39663/*http://voice.yahoo.com"
> PC-to-Phone call rates.
-- END OF SPAM --
See:
IP 209.191.125.75 web38614.mail.mud.yahoo.com
http://www.moensted.dk/spam/?addr=209.191.125.75
More 209.191.125.75 spam sightings:
http://groups.google.com/groups/search?q=209.191.125.75+group%3A*abuse
4 SBL listings for IPs under the responsibility of yahoo.com
http://www.spamhaus.org/sbl/listings.lasso?isp=yahoo.com
See:
IP 200.126.200.46 46-200-126-200.fibertel.com.ar
http://www.moensted.dk/spam/?addr=200.126.200.46
http://www.spamhaus.org/query/bl?ip=200.126.200.46
http://www.spamcop.net/bl.shtml?200.126.200.46
http://www.spamhaus.org/query/bl?ip=200.126.200.46
inetnum: 200.126.192/18
status: allocated
owner: CABLEVISION S.A.
ownerid: AR-CASA10-LACNIC
responsible: Rodolfo Alvarez
ASN: 10318
ASN Name: LACNIC-10318
http://www.cidr-report.org/cgi-bin/as-report?as=10318
28 SBL/ROKSO listings for IPs under the responsibility of
FIBERTEL.COM.AR
http://www.spamhaus.org/sbl/listings.lasso?isp=FIBERTEL.COM.AR
Spamvert URL redirecting source:
<html><head></head><body
onload="javascript:location.href='http://shalashware.com/'">
<!-- following code added by server. PLEASE REMOVE -->
<!-- preceding code added by server. PLEASE REMOVE --></body><!-- text
below generated by server. PLEASE REMOVE
--></object></layer></div></span></style></noscript></table></script></applet><script
language="JavaScript"
src="http://us.i1.yimg.com/us.yimg.com/i/mc/mc.js"></script><script
language="JavaScript"
src="http://geocities.com/js_source/geov2.js"></script><script
language="javascript">geovisit();</script><noscript><img
src="http://visit.webhosting.yahoo.com/visit.gif?ca1144047735"
alt="setstats" border="0" width="1" height="1"></noscript>
<IMG SRC="http://geo.yahoo.com/serv?s=382091075&t=1144047735&f=ca-w83"
ALT=1 WIDTH=1 HEIGHT=1>
See:
shalashware.com
ns1.oemguy.com [81.177.14.72]
ns2.oemguy.com [81.177.14.72]
Registrar: CAPITAL NETWORKS PTY LTD
Domain name: SHALASHWARE.COM
Registrar: PacNames
Domain Registrant: TOTALNIC-127503 (XSALSA[]ETN.ORG)
Alex Rodrigez
Alex Rodrigez
P.O. Box 5009 Pirae TAHITI
Pirae TF 98716
PF
Telephone: +689.435695
Fax: +689.435695
Administrative, Technical Contact: TOTALNIC-127503 (XSA...@ETN.ORG)
Alex Rodrigez
Alex Rodrigez
P.O. Box 5009 Pirae TAHITI
Pirae TF 98716
PF
Telephone: +689.435695
Fax: +689.435695
Name Server: NS1.OEMGUY.COM [81.177.14.72]
Name Server: NS2.OEMGUY.COM [81.177.14.72]
Domain creation date: 2006-02-19 00:17:57.0
Domain expiration date: 2007-02-19 00:55:45.0
http://www.spamhaus.org/query/bl?ip=81.177.14.72
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35048
81.177.14.0/23 is listed on the Spamhaus Block List (SBL)
20-Mar-2006 21:38 GMT | SR04
IN-Telecom Limited: Spammer hosting (escalation)
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL39755
81.177.14.72/32 is listed on the Spamhaus Block List (SBL/ROKSO)
01-Apr-2006 23:47 GMT | SR21
Leo Kuvayev / BadCow
Spammer-Controlled DNS Service
Main Info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Leo%20Kuvayev%20/%20BadCow
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932
20 SBL listings for IPs under the responsibility of rtcomm.ru
http://www.spamhaus.org/sbl/listings.lasso?isp=rtcomm.ru
See also oemguy.com sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/121c1d8eb0a84250
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: