[email] [software piracy] [222.100.139.204] (chesnok-oem.com / srul5.com) Photoshop, Windows, Office
TomezNet
IP 222.100.139.204
(at rev2.kornet.net)
Spamvert:
chesnok-oem.com IP 193.124.8.218
(at ns4.delfa.ru / delfa.net / ns1.relcom.ru / rtcomm.ru)
ns1.srul5.com IP 221.4.246.3
(SBL47392 / SBL48216 - ROK4932)
(at CNCGROUP-GD / ns1.cnc-gd.net)
Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.176; Thu, 23 Nov 2006
18:39:42 -0800
X-YahooFilteredBulk: 222.100.139.204
X-Originating-IP: [222.100.139.204]
Return-Path: <bangkok--...@palmcoastcondo.com>
Authentication-Results: mta378.mail.re4.yahoo.com
from=palmcoastcondo.com; domainkeys=neutral (no sig)
Received: from 222.100.139.204 (HELO localhost) (222.100.139.204) by
mta378.mail.re4.yahoo.com with SMTP; Thu, 23 Nov 2006 18:39:42 -0800
Message-ID: <000001c70f71$ec170080$0100007f@localhost>
From: "Cody Rodriguez" <bangkok--...@palmcoastcondo.com>
To: [MUNGED]
Subject: Photoshop, Windows, Office
Date: Fri, 24 Nov 2006 11:39:41 +0900
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C70F71.EC170080"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1039
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1039
Content-Length: 673
<div id=yiv518336778><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
Transitional//EN">
<html><head>
<xmetahttp-equiv=Content-Type content="text/html;
charset=windows-1251">
<xmeta>
<style></style></head>
<xbodybgColor=#ffffff>
<div><font face=Arial color=#0000ff>World leading manufacturers. The
most popular software.</font></div>
<font face=Arial><strong><ul>
<li>MS Windows XP Professional with SP2 - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Photoshop CS2 V 9.0 - <font color=#ff0000>$69.95</font></li>
<li>Microsoft Office XP Professional - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Acrobat 5.0 - <font color=#ff0000>$39.95</font></li>
<li>...................ī...............</li>
<li>More then 300 items</li>
</ul></strong></font>
<div><strong><a target="_blank" rel="nofollow" _
href="http://chesnok-oem.com/" ><font face=Arial>Best price. Good
choice. Visit our Website.</font></a></strong></div>
<xbody></html>
</div>
-- END OF SPAM --
See also more spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
See:
IP 222.100.139.204
http://www.moensted.dk/spam/?addr=222.100.139.204
http://cbl.abuseat.org/lookup.cgi?ip=222.100.139.204
http://www.spamhaus.org/query/bl?ip=222.100.139.204
http://spamcop.net/w3m?action=checkblock&ip=222.100.139.204
NOT Removable!
http://tqmcube.com/cgi-bin/rbltqm?ip=222.100.139.204
http://www.spambag.org/cgi-bin/spambag?mailfrom=kornet
http://korea.services.net/blocked.phtml?addr=222.100.139.204
More kornet sightings:
http://groups.google.com/groups/search?q=kornet+group%3A*abuse&start=0&scoring=d&
abuse[]kornet.net is listed in rfc-ignorant.org database
IPv4 Address : 222.100.139.0-222.100.139.255
Network Name : KORNET-INFRA000001
Organization ID : ORG1600
Org Name : Korea Telecom
E-Mail : i...@krnic.kornet.net
route: 222.96.0.0/12
descr: KORnet Powered BY Korea Telecom
origin: AS4766
mnt-by: MAINT-AS4766
changed: chinny7...@kornet.net
ASN: 4766
ASN Name: KIXS-AS-KR (Korea Telecom)
Country (per IP registrar): KR [Korea-KR]
Country IP Range: 222.96.0.0 to 222.111.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4766
23 SBL/ROKSO listings for IPs under the responsibility of kornet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=kornet.net
See:
www.chesnok-oem.com IP 193.124.8.218
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
NS records at nameservers are:
ns1.chesnok-oem.com [221.4.246.3] [TTL=3600]
ns2.chesnok-oem.com [58.83.0.6] [TTL=3600]
chesnok-oem.com has no MX records
http://www.moensted.dk/spam/?addr=193.124.8.218
[2] markets.ru/nik.ru, see http://spews.org/html/S2715.html
193.124.8.218 PTR record: 218.8.arpa.delfa.net
at ns4.delfa.ru / ns1.relcom.ru
More delfa.net sightings:
http://groups.google.com/groups/search?q=delfa.net+group%3A*abuse&start=0&scoring=d&
inetnum: 193.124.8.0 - 193.124.8.255
netname: DELFANET5 (delfa.net)
descr: OOO Company Delfa
descr: St.-Petersburg
descr: Russia
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.net
person: Dmitry V. Davidov
notify: dmi...@delfa.net
route: 193.124.8.0/21
descr: Company Delfa Ltd.
descr: Russia
origin: AS8915
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.eu.net
ASN: 8915
ASN Name: DELFA-AS (ISP OOO Company Delfa Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 193.124.0.0 to 193.125.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8915
Let see whois:
Domain name: CHESNOK-OEM.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA[]GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.SRUL5.COM [221.4.246.3]
Name Server: NS2.SRUL5.COM [58.83.0.6]
Domain creaton date: 2006-11-23 17:33:00.0
Domain expiration date: 2007-11-23 22:50:51.0
More chesnok-oem.com sightings:
http://groups.google.com/groups/search?q=chesnok-oem.com+group%3A*abuse&start=0&scoring=d&
See:
ns1.srul5.com IP 221.4.246.3
ns1.srul5.com has no MX records -> srul5.com has no MX records
http://www.moensted.dk/spam/?addr=221.4.246.3
http://www.spamhaus.org/query/bl?ip=221.4.246.3
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47392
221.4.246.3/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:52 GMT | SR02
Leo Kuvayev / BadCow
oemguy.com warez / krugosoft.com/ns1.srul5.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48216
221.4.246.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
13-Nov-2006 02:19 GMT | SR15
Leo Kuvayev / BadCow.
revolver-oem.org etc
13 SBL/ROKSO listings for IPs under the responsibility of cncgroup-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gd
inetnum: 221.4.0.0 - 221.5.127.255
netname: CNCGROUP-GD
route: 221.4.0.0/16
descr: CNC Group GuangDong Network
origin: AS17816
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 17816
ASN Name: CHINA169-GZ (CNCGROUP IP network China169 Guangzhou MAN)
Country (per IP registrar): CN [China]
Country IP Range: 221.0.0.0 to 221.7.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=17816
2 SBL listings for IPs under the responsibility of liquidweb.com
http://www.spamhaus.org/sbl/listings.lasso?isp=liquidweb.com
Let see whois:
Registrar: CAPITAL NETWORKS PTY LTD
PacNames WHOIS Server Version 1.1.0
Domain name: SRUL5.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA[]GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM
Domain creaton date: 2006-04-15 22:27:02.0
Domain expiration date: 2007-04-15 23:02:02.0
More srul5.com sightings:
http://groups.google.com/groups/search?q=srul5.com+group%3A*abuse&start=0&scoring=d&
See:
ns2.srul5.com IP 58.83.0.6
http://www.moensted.dk/spam/?addr=58.83.0.6
http://www.spamhaus.org/query/bl?ip=58.83.0.6
inetnum: 58.83.0.0 - 58.83.3.255
netname: yzgzynetwork---cn
descr: Yongzhou City Guangzhiyuan Technology Development Co.,
LTD
descr: Room 201, Hedong Businesstown, Lengshuitan, Yongzhou
City, Hunan Province, China.
country: CN
mnt-routes: MAINT-CNCGROUP-RR
changed: w...@chinanetlink.com
person: Hanbo Wang
nic-hdl: HW542-AP
remarks: please send spam reports to c...@86ad.com AND
bluesky_...@163.com
notify: c...@86ad.com
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 58.82.0.0 to 58.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43899
58.83.0.0/22 is listed on the Spamhaus Block List (SBL)
25-Nov-2006 14:57 GMT | SR15
Yongzhou City Guangzhiyuan Technology Development Co., LTD
21 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47590
58.83.0.6/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:56 GMT | SR02
Kuvayev / BadCow.
"Toronto Pharmacy" / ns2.srul5.com at cncgroup-gd
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/593664ca2e8ad5d5
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/065bcd2382b8ae42
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: