[email] [software piracy] [86.212.54.202] (dir.kartoha-soft.com / srul5.com) Corel Draw
TomezNet
IP 86.212.54.202 ATuileries-153-1-91-202.w86-212.abo.wanadoo.fr
(at ns2.wanadoo.fr / francetelecom.com)
Spamvert:
kartoha-soft.com IP 58.83.0.6 (OLD IP 193.124.8.218)
dir.kartoha-soft.com IP 58.83.0.6 (OLD IP 193.124.8.218)
(SBL43899 - SBL47590) (now at cncgroup-gd / APNIC)
Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.174; Mon, 27 Nov 2006
12:59:08 -0800
X-YahooFilteredBulk: 86.212.54.202
X-Originating-IP: [86.212.54.202]
Return-Path: <shinj...@marysden.com>
Authentication-Results: mta101.mail.re4.yahoo.com from=marysden.com;
domainkeys=neutral (no sig)
Received: from 86.212.54.202 (HELO localhost) (86.212.54.202) by
mta101.mail.re4.yahoo.com with SMTP; Mon, 27 Nov 2006 12:59:08 -0800
Message-ID: <000001c71266$a5255580$0100007f@localhost>
From: "Evan Brown" <shinj...@marysden.com>
To: [MUNGED]
Subject: Corel Draw
Date: Mon, 27 Nov 2006 21:58:33 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C71266.A5255580"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1039
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1039
Content-Length: 677
<html><head>
<xmetahttp-equiv=Content-Type content="text/html;
charset=windows-1251">
<xmeta>
<style></style></head>
<xbodybgColor=#ffffff>
<div><font face=Arial color=#0000ff>World leading manufacturers. The
most popular software.</font></div>
<font face=Arial><strong><ul>
<li>MS Windows XP Professional with SP2 - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Photoshop CS2 V 9.0 - <font color=#ff0000>$69.95</font></li>
<li>Microsoft Office XP Professional - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Acrobat 5.0 - <font color=#ff0000>$39.95</font></li>
<li>...................ī...............</li>
<li>More then 300 items</li>
</ul></strong></font>
<div><strong><a target="_blank" rel="nofollow" _
href="http://dir.kartoha-soft.com/" ><font face=Arial>Best price. Good
choice. Visit our Website.</font></a></strong></div>
<xbody></html>
-- END OF SPAM --
See also more spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
See:
IP 86.212.54.202 ATuileries-153-1-91-202.w86-212.abo.wanadoo.fr
http://www.moensted.dk/spam/?addr=86.212.54.202
More wanadoo.fr sightings:
http://groups.google.com/groups/search?q=wanadoo.fr+group%3A*abuse&start=0&scoring=d&
postmaster and abuse[]wanadoo.fr are listed in rfc-ignorant.org
database
abuse[]francetelecom.com is listed in rfc-ignorant.org database
inetnum: 86.212.54.0 - 86.212.54.255
netname: IP2000-ADSL-BAS
descr: BSTUI153 Tuileries Bloc 1
country: FR
remarks: postm...@wanadoo.fr
role: Wanadoo France Technical Role
address: FRANCE TELECOM/SCR
route: 86.208.0.0/13
descr: France Telecom
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestio...@francetelecom.com
ASN: 3215
ASN Name: AS3215 (France Telecom Transpac)
Country (per IP registrar): FR [France]
Country IP Range: 86.192.0.0 to 86.255.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=3215
6 SBL listings for IPs under the responsibility of wanadoo.fr
http://www.spamhaus.org/sbl/listings.lasso?isp=wanadoo.fr
1 SBL listings for IPs under the responsibility of francetelecom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=francetelecom.com
See:
kartoha-soft.com IP 58.83.0.6 (OLD IP 193.124.8.218)
dir.kartoha-soft.com IP 58.83.0.6 (OLD IP 193.124.8.218)
ns1.kartoha-soft.com A IN 3600 221.4.246.3
ns2.kartoha-soft.com A IN 3600 58.83.0.6
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
OLD
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
NS records at nameservers are:
ns1.kartoha-soft.com [221.4.246.3] [TTL=3600]
ns2.kartoha-soft.com [58.83.0.6] [TTL=3600]
dir.kartoha-soft.com has no MX records -> kartoha-soft.com has no MX
records
http://www.moensted.dk/spam/?addr=58.83.0.6
http://www.spamhaus.org/query/bl?ip=58.83.0.6
More 58.83.0.6 sightings:
http://groups.google.com/groups/search?q=58.83.0.6+group%3A*abuse&start=0&scoring=d&
inetnum: 58.83.0.0 - 58.83.3.255
netname: yzgzynetwork---cn
descr: Yongzhou City Guangzhiyuan Technology Development Co.,
LTD
descr: Room 201, Hedong Businesstown, Lengshuitan, Yongzhou
City, Hunan Province, China.
country: CN
mnt-routes: MAINT-CNCGROUP-RR
changed: w...@chinanetlink.com
changed: bluesky...@163.com
person: Hanbo Wang
nic-hdl: HW542-AP
e-mail: c...@86ad.com
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 58.82.0.0 to 58.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43899
58.83.0.0/22 is listed on the Spamhaus Block List (SBL)
25-Nov-2006 14:57 GMT | SR15
Yongzhou City Guangzhiyuan Technology Development Co., LTD
21 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47590
58.83.0.6/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:56 GMT | SR02
Kuvayev / BadCow.
"Toronto Pharmacy" / ns2.srul5.com
13 SBL/ROKSO listings for IPs under the responsibility of cncgroup-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gd
More kartoha-soft.com sightings:
http://groups.google.com/groups/search?q=kartoha-soft.com+group%3A*abuse&start=0&scoring=d&
See More srul5.com sightings:
http://groups.google.com/groups/search?q=srul5.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/4ed3e253e15b8e30
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/689adef85a0ee063
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: