[email] [software piracy] [82.38.239.81] (kartoha-soft.com - srul5.com) 0EM Software
TomezNet
IP 82.38.239.81 82-38-239-81.cable.ubr06.shef.blueyonder.co.uk
(at ns2.cableinet.co.uk / telewest.net / telekom.de)
Spamvert:
fly.chesnok-soft.net IP 193.124.8.218
www.chesnok-soft.net IP 193.124.8.218
(at ns4.delfa.ru / delfa.net / ns1.relcom.ru / rtcomm.ru)
ns1.srul5.com IP 221.4.246.3
(SBL47392 / SBL48216 - ROK4932)
(at CNCGROUP-GD / ns1.cnc-gd.net)
Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.168; Sun, 26 Nov 2006
16:12:52 -0800
X-YahooFilteredBulk: 82.38.239.81
X-Originating-IP: [82.38.239.81]
Return-Path: <theado...@lasermedi.com>
Authentication-Results: mta124.mail.re3.yahoo.com from=lasermedi.com;
domainkeys=neutral (no sig)
Received: from 82.38.239.81 (HELO localhost) (82.38.239.81) by
mta124.mail.re3.yahoo.com with SMTP; Sun, 26 Nov 2006 16:12:52 -0800
Message-ID: <000001c711b8$ea8b4980$0100007f@localhost>
From: "Anthony Henderson" <theado...@lasermedi.com>
To: [MUNGED]
Subject: 0EM Software
Date: Mon, 27 Nov 2006 00:12:39 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C711B8.EA8B4980"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1039
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1039
Content-Length: 672
<html><head>
<xmetahttp-equiv=Content-Type content="text/html;
charset=windows-1251">
<xmeta>
<style></style></head>
<xbodybgColor=#ffffff>
<div><font face=Arial color=#0000ff>World leading manufacturers. The
most popular software.</font></div>
<font face=Arial><strong><ul>
<li>MS Windows XP Professional with SP2 - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Photoshop CS2 V 9.0 - <font color=#ff0000>$69.95</font></li>
<li>Microsoft Office XP Professional - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Acrobat 5.0 - <font color=#ff0000>$39.95</font></li>
<li>...................ī...............</li>
<li>More then 300 items</li>
</ul></strong></font>
<div><strong><a target="_blank" rel="nofollow" _
href="http://kartoha-soft.com/" ><font face=Arial>Best price. Good
choice. Visit our Website.</font></a></strong></div>
<xbody></html>
-- END OF SPAM --
See also more spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
See:
IP 82.38.239.81 82-38-239-81.cable.ubr06.shef.blueyonder.co.uk
http://www.moensted.dk/spam/?addr=82.38.239.81
http://cbl.abuseat.org/lookup.cgi?ip=82.38.239.81
http://www.spamhaus.org/query/bl?ip=82.38.239.81
http://tqmcube.com/cgi-bin/rbltqm?ip=82.38.239.81
http://spamcop.net/w3m?action=checkblock&ip=82.38.239.81
Exploitable Server See: http://www.sorbs.net/lookup.shtml?82.38.239.81
More blueyonder.co.uk sightings:
http://groups.google.com/groups/search?q=blueyonder.co.uk+group%3A*abuse&start=0&scoring=d&
inetnum: 82.38.0.0 - 82.38.255.255
netname: TELEWEST-HSD_1-BRADFORD
descr: Telewest HSD Platform
changed: jim.h...@telewest.net
e-mail: capa...@telewest.co.uk
notify: ri...@telewest.net
route: 82.32.0.0/12
descr: Telewest Broadband
descr: UK Broadband ISP
origin: AS5462
notify: ri...@telewest.net
mnt-by: AS5462-MNT
changed: ripe-...@blueyonder.co.uk
ASN: 5462
ASN Name: CABLEINET (Telewest Broadband)
Country (per IP registrar): UK [United Kingdom]
Country IP Range: 82.32.0.0 to 82.47.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=5462
See:
kartoha-soft.com IP 193.124.8.218
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
NS records at nameservers are:
ns1.kartoha-soft.com [221.4.246.3] [TTL=3600]
ns2.kartoha-soft.com [58.83.0.6] [TTL=3600]
kartoha-soft.com has no MX records
http://www.moensted.dk/spam/?addr=193.124.8.218
[2] markets.ru/nik.ru, see http://spews.org/html/S2715.html
193.124.8.218 PTR record: 218.8.arpa.delfa.net
at ns4.delfa.ru / ns1.relcom.ru
More 193.124.8.218 sightings:
http://groups.google.com/groups/search?q=193.124.8.218+group%3A*abuse&qt_s=Search
inetnum: 193.124.8.0 - 193.124.8.255
netname: DELFANET5 (delfa.net)
descr: OOO Company Delfa
descr: St.-Petersburg
descr: Russia
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.net
person: Dmitry V. Davidov
notify: dmi...@delfa.net
route: 193.124.8.0/21
descr: Company Delfa Ltd.
descr: Russia
origin: AS8915
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.eu.net
ASN: 8915
ASN Name: DELFA-AS (ISP OOO Company Delfa Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 193.124.0.0 to 193.125.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8915
More delfa.net sightings:
http://groups.google.com/groups/search?q=delfa.net+group%3A*abuse&start=0&scoring=d&
Let see whois:
Registrar: CAPITAL NETWORKS PTY LTD
Domain name: KARTOHA-SOFT.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM
Domain creaton date: 2006-11-23 17:38:45.0
Domain expiration date: 2007-11-23 22:56:36.0
More kartoha-soft.com sightings:
http://groups.google.com/groups/search?q=kartoha-soft.com+group%3A*abuse&start=0&scoring=d&
See:
ns1.srul5.com IP 221.4.246.3
ns1.srul5.com has no MX records -> srul5.com has no MX records
http://www.moensted.dk/spam/?addr=221.4.246.3
http://www.spamhaus.org/query/bl?ip=221.4.246.3
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47392
221.4.246.3/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:52 GMT | SR02
Leo Kuvayev / BadCow
oemguy.com warez / krugosoft.com/ns1.srul5.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48216
221.4.246.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
13-Nov-2006 02:19 GMT | SR15
Leo Kuvayev / BadCow.
revolver-oem.org etc
13 SBL/ROKSO listings for IPs under the responsibility of cncgroup-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gd
inetnum: 221.4.0.0 - 221.5.127.255
netname: CNCGROUP-GD
route: 221.4.0.0/16
descr: CNC Group GuangDong Network
origin: AS17816
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 17816
ASN Name: CHINA169-GZ (CNCGROUP IP network China169 Guangzhou MAN)
Country (per IP registrar): CN [China]
Country IP Range: 221.0.0.0 to 221.7.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=17816
2 SBL listings for IPs under the responsibility of liquidweb.com
http://www.spamhaus.org/sbl/listings.lasso?isp=liquidweb.com
More srul5.com sightings:
http://groups.google.com/groups/search?q=srul5.com+group%3A*abuse&start=0&scoring=d&
See:
ns2.srul5.com IP 58.83.0.6
http://www.moensted.dk/spam/?addr=58.83.0.6
http://www.spamhaus.org/query/bl?ip=58.83.0.6
inetnum: 58.83.0.0 - 58.83.3.255
netname: yzgzynetwork---cn
descr: Yongzhou City Guangzhiyuan Technology Development Co.,
LTD
descr: Room 201, Hedong Businesstown, Lengshuitan, Yongzhou
City, Hunan Province, China.
country: CN
mnt-routes: MAINT-CNCGROUP-RR
changed: w...@chinanetlink.com
person: Hanbo Wang
nic-hdl: HW542-AP
remarks: please send spam reports to c...@86ad.com AND
bluesky_...@163.com
notify: c...@86ad.com
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 58.82.0.0 to 58.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43899
58.83.0.0/22 is listed on the Spamhaus Block List (SBL)
25-Nov-2006 14:57 GMT | SR15
Yongzhou City Guangzhiyuan Technology Development Co., LTD
21 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47590
58.83.0.6/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:56 GMT | SR02
Kuvayev / BadCow.
"Toronto Pharmacy" / ns2.srul5.com at cncgroup-gd
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3003c4c318fb48d1
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: