[email] [botnet] [counterfeit] [190.137.107.142] (ebgerry.com / aotheholiday.com / sopcie.net / 428kay.com / hopens.com) k Rep|icaWATCH - Rep|icaRolexWatches, BuyRep|icaWatches with FREE Warranty. iok 0st8vmd36
TomezNet
IP 190.137.107.142 host142.190-137-107.telecom.net.ar
(at telecom.com.ar)
Spamvert:
rapcv.ebgerry.com => botnet
rapcv.ebgerry.com Resolved to ebgerry.com to 59.27.249.68 to
59.149.37.46 to 69.211.18.5 to 71.132.80.201 to 76.14.9.153 to
89.156.119.228 to 98.227.5.125
Redirected to:
http://sopcie.net
sopcie.net IP 211.118.190.7
(at bora.net - Korea)
sopcie.net IP 121.88.4.25
(SBL59292) (at cnm.co.kr - Korea)
Title: SwissWatchesDirect- Rolex, Breitling, Tag & More
More spammer recent sightings:
http://groups.google.com/groups/search?q=%22Over+1360+Models+to+choose+from%22+group%3A*abuse*&qt_s=Search
Much More info below:
==================X-SID-PRA: ethan.p...@iland.net
X-Message-Info:
6sSXyD95QpXPD07j6vNAXMaoezp9ojRLBin4qmHkZ5CheDSOhOfNJh3KMxeO1NDVfOj4BUlsVDqFl02P6HUi3g=Received: from tomts42-srv.bellnexxia.net ([209.226.175.99]) by bay0-
pamc1-f4.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sat, 15 Mar 2008 19:42:23 -0700
Received: from toip15.srvr.bell.ca ([67.69.240.17])
by toip28.srvr.bell.ca with ESMTP; 15 Mar 2008 22:42:17 -0400
Received: from [MUNGED]
by toip15.srvr.bell.ca with ESMTP; 15 Mar 2008 22:42:16 -0400
Received: (qmail 19950 invoked by uid 110); 15 Mar 2008 22:42:15 -0400
Delivered-To: [MUNGED]
Received: (qmail 19909 invoked from network); 15 Mar 2008 22:42:14
-0400
Received: from host142.190-137-107.telecom.net.ar (HELO luafxczn)
(190.137.107.142)
by [MUNGED] with SMTP; 15 Mar 2008 22:42:14 -0400
Sender: <ethan.p...@iland.net>
Date: Sat, 15 Mar 2008 19:02:44 -0700
Reply-To: "Ethan Phipps" <ethan.p...@iland.net>
X-Sender: <ethan.p...@iland.net>
Subject: k Rep|icaWATCH - Rep|icaRolexWatches, BuyRep|
icaWatches with FREE Warranty. iok 0st8vmd36
From: "Ethan Phipps" <ethan.p...@iland.net>
In-Reply-To: <dc7901c88557$4688d2aa$65d460ed@bhjnqj2>
Message-ID: <1205632...@iland.net>
To: <[MUNGED]>
Bcc: <[MUNGED]>, <[MUNGED]>, <[MUNGED]>, <[MUNGED]>, <[MUNGED]>,
<[MUNGED]>, <[MUNGED]>, <[MUNGED]>, <[MUNGED]>, <[MUNGED]>,
<[MUNGED]>, <[MUNGED]>
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: 8bit
Return-Path: ethan.p...@iland.net
X-OriginalArrivalTime: 16 Mar 2008 02:42:23.0190 (UTC)
FILETIME=[5CD6CF60:01C8870F]
** We add 100 Latest Arrival 2008 models Watches **
/// Safe & guaranteed shopping \\\
/// Inquiries answered in 24 hours \\\
/// Over 1360 Models to choose from \\\
Swiss QualityReplica
Many World famous LUXURY BRANDS
Free 1 year Warranty on all Watches
gglkpz 8xfmk2 0ngnj kcg
-- END OF SPAM --
Also More spammer sightings:
http://groups.google.com/groups/search?q=%22Diamond+Watches%22+group%3A*abuse&start=0&scoring=d&
This spammer is always sending multiple emails to unknown users (Cc: /
Bcc:), from forged senders that are their actual targets, relying on
MTA to bounce the mail to the forged sender, with original body
trying
to create backscatter spam.
Spammer old listings SBL52081, SBL54224, SBL54249
See:
IP 190.137.107.142 host142.190-137-107.telecom.net.ar
http://www.moensted.dk/spam/?addr=190.137.107.142
http://www.spamhaus.org/query/bl?ip=190.137.107.142
http://cbl.abuseat.org/lookup.cgi?ip=190.137.107.142
More telecom.net.ar sightings:
http://groups.google.com/groups/search?q=telecom.net.ar+group%3A*abuse&start=0&scoring=d&
inetnum: 190.137.104/22
status: reallocated
owner: Apolo -Gold-Telecom-Per
ownerid: AR-APGO-LACNIC
responsible: Aseguramiento de Datos
address: Dorrego, 2520, piso 3°
address: 1425 - Capital Federal -
country: AR
nic-hdl: ADA
person: Administrador Abuse
e-mail: ab...@TA.TELECOM.COM.AR
AS Name: Telecom Argentina S.A.
http://www.cidr-report.org/cgi-bin/as-report?as=7303
10 SBL/ROKSO listings for IPs under the responsibility of
telecom.com.ar
http://www.spamhaus.org/sbl/listings.lasso?isp=telecom.com.ar
Spamvert URL:
http://rapcv.ebgerry.com
HTTP/1.1 302 Found
Date: Sun, 16 Mar 2008 05:07:54 GMT
Server: Apache/2.0.59 (FreeBSD) PHP/4.4.4 with Suhosin-Patch
X-Powered-By: PHP/4.4.4
Location: http://sopcie.net
Content-Length: 0
Connection: close
Content-Type: text/html
Redirected to:
http://sopcie.net
See Spamvert:
rapcv.ebgerry.com => botnet
rapcv.ebgerry.com Resolved to ebgerry.com to 59.27.249.68 to
59.149.37.46 to 69.211.18.5 to 71.132.80.201 to 76.14.9.153 to
89.156.119.228 to 98.227.5.125
rapcv.ebgerry.com has no MX records
ebgerry.com has no MX records
59.27.249.68 no PTR at kornet.net
59.149.37.46 = 059149037046.ctinets.com
69.211.18.5 = adsl-69-211-18-5.dsl.chcgil.ameritech.net
71.132.80.201 = adsl-71-132-80-201.dsl.sntc01.pacbell.net
76.14.9.153 = 76-14-9-153.sf-cable.astound.net
89.156.119.228 = 089156119228.chello.fr
98.227.5.125 no PTR at Comcast
Name Servers:
ns3.aotheholiday.com IP 68.227.102.147
ns2.aotheholiday.com IP 68.111.134.159
ns1.aotheholiday.com IP 76.226.209.50
ns4.aotheholiday.com IP 74.57.183.171
Let see whois.dns.com.cn:
Domain Name.......... ebgerry.com
Creation Date........ 2008-03-05 10:33:47
Registration Date.... 2008-03-05 10:33:47
Expiry Date.......... 2009-03-05 10:33:47
Organisation Name.... Wang Miaomiao
Organisation Address. CD
Organisation Address.
Organisation Address. Chengdu
Organisation Address. 610000
Organisation Address. SC
Organisation Address. CN
Admin Name........... Wang Miaomiao
Admin Address........ CD
Admin Address........
Admin Address........ Chengdu
Admin Address........ 610000
Admin Address........ SC
Admin Address........ CN
Admin Email.......... 13076885500[]yahoo.com
Admin Phone.......... +86.13076885500
Admin Fax............ +86.13076885500
Tech Name............ Wang Miaomiao
Tech Address......... CD
Tech Address.........
Tech Address......... Chengdu
Tech Address......... 610000
Tech Address......... SC
Tech Address......... CN
Tech Email........... 13076...@yahoo.com
Tech Phone........... +86.13076885500
Tech Fax............. +86.13076885500
Bill Name............ Wang Miaomiao
Bill Address......... CD
Bill Address.........
Bill Address......... Chengdu
Bill Address......... 610000
Bill Address......... SC
Bill Address......... CN
Bill Email........... 13076...@yahoo.com
Bill Phone........... +86.13076885500
Bill Fax............. +86.13076885500
Name Server.......... ns3.aotheholiday.com
Name Server.......... ns2.aotheholiday.com
Name Server.......... ns1.aotheholiday.com
Name Server.......... ns4.aotheholiday.com
SEE Also:
hostnames sharing ip with a-records
059149105240.ctinets.com
c-71-57-139-234.hsd1.fl.comcast.net
cflastmonth.com
cmconfidence.com
diturn.com
mrlong22.com
oocommitment.com
qjaskedif.com
vhresidual.com
hostnames sharing ip indirectly via cnames
*.cmconfidence.com
*.diturn.com
*.mrlong22.com
*.sdwasin.com
*.vhresidual.com
bvw.vgisstill.com
rhe.diturn.com
spammer.cmconfidence.com
spammer.diturn.com
spammer.mrlong22.com
spammer.vgisstill.com
spammer.vhresidual.com
txbs.osfilmsand.com
See:
ns3.aotheholiday.com IP 68.227.102.147
ns3.aotheholiday.com IP 71.137.168.212
ns2.aotheholiday.com IP 68.111.134.159
ns2.aotheholiday.com IP 80.98.147.153
ns1.aotheholiday.com IP 76.226.209.50
ns1.aotheholiday.com IP 195.210.225.171
ns4.aotheholiday.com IP 74.57.183.171
ns4.aotheholiday.com IP 12.214.247.160
aotheholiday.com has no MX records
68.227.102.147 = ip68-227-102-147.ok.ok.cox.net
71.137.168.212 = ppp-71-137-168-212.dsl.irvnca.pacbell.net
68.111.134.159 = ip68-111-134-159.sd.sd.cox.net
80.98.147.153 = catv-50629399.catv.broadband.hu
76.226.209.50 = YOUR-4DACD0EA75 at AT&T / PPPox se5.sfldmi
195.210.225.171 = bsn-210-225-171.dial-up.dsl.siol.net
74.57.183.171 = modemcable171.183-57-74.mc.videotron.ca
12.214.247.160 = 12-214-247-160.client.mchsi.com / AT&T / Mediacom
Let see whois.dns.com.cn:
Domain Name.......... aotheholiday.com
Creation Date........ 2007-11-27 09:56:48
Registration Date.... 2007-11-27 09:56:48
Expiry Date.......... 2008-11-27 09:56:48
Organisation Name.... Ma Linlin
Organisation Address. Beijing
Organisation Address.
Organisation Address. Beijing
Organisation Address. 210001
Organisation Address. BJ
Organisation Address. CN
Admin Name........... Ma Linlin
Admin Address........ Beijing
Admin Address........
Admin Address........ Beijing
Admin Address........ 210001
Admin Address........ BJ
Admin Address........ CN
Admin Email.......... dfeeexxdf[]163.com
Admin Phone.......... +86.13076885511
Admin Fax............ +86.13076885511
Tech Name............ Ma Linlin
Tech Address......... Beijing
Tech Address.........
Tech Address......... Beijing
Tech Address......... 210001
Tech Address......... BJ
Tech Address......... CN
Tech Email........... dfee...@163.com
Tech Phone........... +86.13076885511
Tech Fax............. +86.13076885511
Bill Name............ Ma Linlin
Bill Address......... Beijing
Bill Address.........
Bill Address......... Beijing
Bill Address......... 210001
Bill Address......... BJ
Bill Address......... CN
Bill Email........... dfee...@163.com
Bill Phone........... +86.13076885511
Bill Fax............. +86.13076885511
Name Server.......... ns2.aotheholiday.com
Name Server.......... ns1.aotheholiday.com
Name Server.......... ns3.aotheholiday.com
Name Server.......... ns4.aotheholiday.com
More aotheholiday.com sightings:
http://groups.google.com/groups/search?q=aotheholiday.com+group%3A*abuse*&qt_s=Search
See:
sopcie.net IP 211.118.190.7
sopcie.net IP 121.88.4.25
ns1.428kay.com IP 116.199.136.238
ns2.428kay.com IP 116.199.128.11
sopcie.net has no MX records
http://moensted.dk/spam/?addr=211.118.190.7
Blocked http://www.spamsources.fabel.dk/ip/211.118.190.7
Blocked due to spam, see http://korea.services.net/blocked.phtml?addr!1.118.190.7
inetnum: 211.118.0.0 - 211.118.255.255
netname: BORANET-NET-211-118
descr: DACOM Corp.
Org Name : LG DACOM Corporation
Service Name : BORANET
Name : IP Administrator
Phone : +82-2-2089-7755
E-Mail : shki...@chol.com
Name : IP ADMIN
Phone : +82-2-2089-7755
E-mail : dka...@bora.net
Name : Network Abuse
Phone : +82-2-2089-0101
E-mail : secu...@bora.net
E-mail : ip...@nic.bora.net
route: 211.118.0.0/15
descr: contact n...@bora.net if necessary
contact whc...@bora.net if necessary
origin: AS3786
mnt-by: MAINT-AS3786
changed: ysj...@bora.net
changed: yunc...@bora.net
AS Name: LGDACOM LG DACOM Corporation
http://www.cidr-report.org/cgi-bin/as-report?as=3786
6 SBL/ROKSO listings for IPs under the responsibility of bora.net
http://www.spamhaus.org/sbl/listings.lasso?isp=bora.net
See:
sopcie.net IP 121.88.4.25
http://moensted.dk/spam/?addr=121.88.4.25
http://www.spamhaus.org/query/bl?ip=121.88.4.25
IPv4 Address : 121.88.4.0-121.88.7.255
Network Name : KuRo
Connect ISP Name : CNM
Registration Date : 20061221
Organization ID : ORG806312
Org Name : KuRO TV
Address : Guro-dong Guro-gu Seoul
E-Mail : n...@cnm.co.kr
route: 121.88.4.0/24
descr: Proxy-Registered Route Object by LG Dacom(AS3786)
origin: AS38098
remarks: This route object is for a LG Dacom's customer route
remarks: which is being exported under this origin AS.
remarks:
remarks: This route object was automatically created to prevent
remarks: some LG Dacom peer from rejecting this route because
remarks: they may create their filter based on Route Registry DB.
notify: n...@bora.net
mnt-by: MAINT-AS3786
changed: yunc...@bora.net
AS Name: KUROCATV-AS-KR KUROCATVSYSTEM Co,.Ltd.
http://www.cidr-report.org/cgi-bin/as-report?as=38098
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL59292
121.88.4.25/32 is listed on the Spamhaus Block List (SBL)
03-Oct-2007 23:27 GMT | SR02
7 SBL/ROKSO listings for IPs under the responsibility of cnm.co.kr
http://www.spamhaus.org/sbl/listings.lasso?isp=cnm.co.kr
Let see whois.internet.bs:
Domain Name: SOPCIE.NET
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.HOPENS.COM IP 58.253.71.79
Name Server: NS2.HOPENS.COM IP 221.122.64.14
Name Server: NS3.HOPENS.COM IP 116.199.135.168
Name Server: NS4.HOPENS.COM IP 116.199.139.5
Status: clientTransferProhibited
Updated Date: 04-mar-2008
Creation Date: 30-aug-2007
Expiration Date: 30-aug-2008
See:
ns1.428kay.com IP 116.199.136.238 at Newspeed SBL56563
ns1.428kay.com IP 116.199.136.29 at Newspeed SBL56563
ns2.428kay.com IP 116.199.128.11 at Newspeed SBL56563
ns1.428kay.com has no MX records -> 428kay.com has no MX records
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL56563
116.199.128.0/19 is listed on the Spamhaus Block List (SBL)
31-Jan-2008 21:45 GMT | SR12
henzhen Newspeed - spammer hosting (escalation)
Hosting western criminal spammers in their network.
Routed via AS18118 = CITICNET-AP CITIC Networks Management Co.,Ltd.
inetnum: 116.199.135.0 - 116.199.138.255
netname: Newspeed
descr: Shenzhen Newspeed Science and technology Development
Limited company
descr: Shenzhen Mt. Nanshan area Nanhai main road Jinhun
building B2612
country: CN
person: Yang Li
e-mail: Tiet...@k65.net
e-mail: QY...@126.com
person: Yongchen Wang
e-mail: g...@21cn.com
route: 116.199.136.0/23
descr: CNC Group CHINA169 Hunan Province Network
descr: Addresses from CNNIC(Newspeed)
AND:
inetnum: 116.199.128.0 - 116.199.159.255
netname: Newspeed
27 SBL/ROKSO listings for IPs under the responsibility of newspeed
http://www.spamhaus.org/sbl/listings.lasso?isp=newspeed
Let see whois.dns.com.cn:
Domain Name.......... 428kay.com
Creation Date........ 2007-10-10 03:34:27
Registration Date.... 2007-10-10 03:34:27
Expiry Date.......... 2008-10-10 03:34:27
Organisation Name.... cao fei
Organisation Address. xi an
Organisation Address.
Organisation Address. Xian
Organisation Address. 329002
Organisation Address. SN
Organisation Address. CN
Admin Name........... cao fei
Admin Address........ xi an
Admin Address........
Admin Address........ Xian
Admin Address........ 329002
Admin Address........ SN
Admin Address........ CN
Admin Email.......... cncliup[]21cn.com
Admin Phone.......... +86.2938933343
Admin Fax............ +86.2938933343
Tech Name............ cao fei
Tech Address......... xi an
Tech Address.........
Tech Address......... Xian
Tech Address......... 329002
Tech Address......... SN
Tech Address......... CN
Tech Email........... cnc...@21cn.com
Tech Phone........... +86.2938933343
Tech Fax............. +86.2938933343
Bill Name............ cao fei
Bill Address......... xi an
Bill Address.........
Bill Address......... Xian
Bill Address......... 329002
Bill Address......... SN
Bill Address......... CN
Bill Email........... cnc...@21cn.com
Bill Phone........... +86.2938933343
Bill Fax............. +86.2938933343
Name Server.......... ns2.428kay.com
Name Server.......... ns1.428kay.com
See Also Name Server:
NS1.HOPENS.COM IP 58.253.71.79
NS2.HOPENS.COM IP 221.122.64.14
NS3.HOPENS.COM IP 116.199.135.168
NS4.HOPENS.COM IP 116.199.139.5
Let see whois.paycenter.com.cn:
Domain Name:hopens.com
Registrant:
liu haijun
wu han
321099
Administrative Contact:
liuhaijun
liu haijun
wu han
wu han Hubei 321099
CN
tel: 273 2129092
fax: 273 2129092
cncliup[]21cn.com
Technical Contact:
liuhaijun
liu haijun
wu han
wu han Hubei 321099
CN
tel: 2129092
fax: 2129092
cnc...@21cn.com
Billing Contact:
liuhaijun
liu haijun
wu han
wu han Hubei 321099
CN
tel: 2129092
fax: 2129092
cnc...@21cn.com
Registration Date: 2008-02-29
Update Date: 2008-02-29
Expiration Date: 2009-02-28
Primary DNS: ns1.hopens.com 116.199.138.24
Secondary DNS: ns2.hopens.com 221.122.64.14
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/8e90e6e72da1385f
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d50ae08e4a6aa2c3
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and unverified
unless stated otherwise by the moderators. All opinions expressed above are
considered the opinions of the original poster, not the moderators or their
respective employers. For a copy of the guidelines to this group, see:
http://www.killfile.org/~tskirvin/nana/