Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] [software piracy] [213.145.115.51] (jopa-s-oem.com / srul5.com - PacNames) Microsoft 0ffice 2OO7 & Adobe Acrobat 8 Pro 79$ at Wade's amazingsoft

0 views

Skip to first unread message

TomezNet

unread,

Jan 3, 2007, 7:00:42 PM1/3/07

Received From:
IP 213.145.115.51 115-51.city-lan.org
(at ns.itdnet.net / Pazardjik.com)

Spamvert:
jopa-s-oem.com IP 222.122.180.189
(SBL49519 - ROK6138 Polyakov) (at rev2.kornet.net)

See Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&

Received at an address harvested from this abuse group.

More info below:
====================

X-Apparently-To: [MUNGED] via 216.252.100.176; Wed, 03 Jan 2007
12:52:51 -0800
X-YahooFilteredBulk: 213.145.115.51
X-Originating-IP: [213.145.115.51]
Return-Path: <precom...@sealingasphalt.com>
Authentication-Results: mta478.mail.mud.yahoo.com from=;
domainkeys=neutral (no sig)
Received: from 213.145.115.51 (HELO localhost) (213.145.115.51) by
mta478.mail.mud.yahoo.com with SMTP; Wed, 03 Jan 2007 12:52:51 -0800
Message-ID: <000001c72f79$1a2c2f00$0100007f@localhost>
From: "Christophe Gonzalez" <precom...@sealingasphalt.com>
To: [MUNGED]
Subject: Microsoft 0ffice 2OO7 & Adobe Acrobat 8 Pro 79$ at Wade's
amazingsoft
Date: сряда, 03 Януари 2007 22:53:53 +0200
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: MICR0S0FT Outlook, Build 10.0.3416
Importance: Normal
X-MimeOLE: Produced By MICR0S0FT MimeOLE V6.00.2800.150
Content-Length: 2560

<pre><tt><!--

-->All Titles 0n Sale for Holidays.

Microsoft 0ffice 2OO7 79$
Adobe Acrobat 8 PR0 79$
Windows XP PR0 +SP2 49$
Adobe Premiere 2.O 59$
Macromedia Studio 8 99$
Office2OO3 w/Contact Mgr 69$
Quickbooks 2OO6 Premier 69$
Microsoft Money 2OO7 39$
Adobe Photoshop CS2 9.O 69$
Autodesk Autocad 2OO7 129$
Corel Grafix Suite X3 59$
Adobe Creative Suite CS2 149$
Adobe Illustrator CS2 59$
Microsoft Office XP PR0 49$
Macromedia Dreamweaver 8 49$
McAfee Internet Sec. 7 29$
Norton Antivirus Corp. 29$

Mac Specials:
Adobe Acrobat PR0 7 69$
Adobe After Effects 49$
Adobe Creative Suite 2 Premium 149$
Ableton Live 5.0.1 49$
Adobe Photoshop CS 49$

<a href="http://ase.jopa-s-oem.com/-software-for-mac-.php"
target=_blank >http://ase.jopa-s-oem.com/-software-for-mac-.php</a>

Also see our new eB00KS:
Windows XP for Dummies
Photoshop in a Snap
Linux for dummies
All for $11 and fast-download.

See more titles: Microsoft-Mac soft-Adobe

-=New Releases=-

Microsoft 0ffice 2OO7 Enterprise
Normal Price: $899.00
0ur 0ffer: $79.95
U-save: $819.95 (89%)
Availability: Pay-and-download instantly.

SalesRank: #1
Average Customer Review: *****
(based on 32201 reviews)

Adobe Acrobat 8.O PR0
Normal Price: $449.00
0ur 0ffer: $79.95
U-save: $369.05 (80%)
Availability: Available for INSTANT-download.

Top-ten-ranked item.
Average Customer Review: *****
(based on 99071 reviews)

Macromedia Studio 8
Normal Price: $999.00
0ur 0ffer: $99.95
U-save: $899.05 (90%)
Availability: Can be downloaded-INSTANTLY.

Best choice for professional.
Average Customer Review: *****
(based on 42524 reviews)

LPD, LPD will refuse them.
currentFreeBSD> . You should also be sure to read ``Staying cur-
You will normally see two lines for each file system that has quotas
% dd if=boot.flp of=disk_device
The rule action could be to drop the packet, to forward the packet, or
18.2.6.3. Donating Internet access
not have a math co-processor, and you need the best accu-
networking, either the SMC SMC9332DST 10/100MB or Intel EtherExpress
reflect what the port is. This usually means ${PKGNAME} minus the
Reported by: Greg Lehey groglemis.de
How does the Ports collection work?
devices, refer to the appropriate section of the LINT kernel
2. This, in turn, triggers the following action in /etc/rc.i386:
is the host name from which the job was submitted
written from. Whenever a DMA channel is active, the contents of that
a "block" size of 8k (though it may do fragments of smaller sizes).
For example, if a SLIP user ID were Shelmerg, Shelmerg's entry in
Wangtek 6200
If your provider allocates you a static IP address then use this in
Parallel interfaces are sometimes known as ``Centronics''
When set to "1", the UART transmitter
is because most modem vendors and 16550-clone makers use the Microsoft
can immediately print characters sent to them, the program lptest is
computers from IBM and other vendors continued to use the INS8250 or
Data transfer rate is XXX
bamboo|ps|PS|S|panasonic|Panasonic KX-P4455 PostScript v51.4:\
and a base IO address 100h. The IO address for Each port is +8
EXB-85058SQANXR1 05B0" "type 1 removable SCSI 2"
This drives quirks are known and pre-compiled into the scsi tape
See also:
o D-Link DE-530
#
gives a login: message at an initial speed and watches the characters
This cache is able to keep the tape streaming in almost any
When set to "1", the output of the UART
src-sbin: /usr/src/sbin single user system binaries
/dev/rst0.ctl -s 600 -c "4 0 0 0 0 0" (alternatively, fetch a copy of
after a call. FreeBSD avoids sending commands to the modem or
12.2. Setting up kernel PPP
______________________________________________________________________
denotes the sequence in which the patches will be applied -- these are
principal, and this is a Kerberos default; that a
data using the CPU.
share a clock with one another, or that the sender provide a strobe or
been reported when using ``Amanda''
richc.isdn.bcm.tmc.edu 9845-03452-90255
o Recognizer and handler for ed.c (mostly done).
us to here, really.
And of course
system check this out.
other hosts also running LPD (or are compatible with LPD). This
After the machine is fully installed, you simply need to add the
source.
o It can account for printer usage.
o It controls access to attached printers and printers attached to
Even though the kernel may support communication along a serial or
7.6.2.4. Header Pages on PostScript Printers
easily understood installation process. Your feedback on this
There is nothing that stops you from using differential stuff with
first, then send the print job.
This directory can also contain other miscellaneous files that are
from your system.
</tt></pre>

-- END OF SPAM --

See also more spammer OEM Software sightings:
http://groups.google.com/groups/search?q=%22OEM+Software%22+group%3A*abuse&start=0&scoring=d&

See:
IP 209.30.97.226 209-30-97-226.ded.swbell.net

More city-lan.org sightings:
http://groups.google.com/groups/search?q=city-lan.org+group%3A*abuse&start=0&scoring=d&

http://www.moensted.dk/spam/?addr=209.30.97.226
http://www.spamhaus.org/query/bl?ip=209.30.97.226
http://cbl.abuseat.org/lookup.cgi?ip=209.30.97.226
Exploitable Server See: http://www.sorbs.net/lookup.shtml?209.30.97.226

More itdnet.net sightings:
http://groups.google.com/groups/search?q=itdnet.net+group%3A*abuse&start=0&scoring=d&

inetnum: 213.145.115.0 - 213.145.115.255
netname: PAZARDJIK-COM
descr: Pazardjik.com

person: Marian Popov
address: 12 Todor Hristovich Str., 4400 Pazardjik, Bulgaria
phone: +359 88 388733
e-mail: ma...@pazardjik.com
nic-hdl: MP3009-RIPE
changed: n...@ITDNet.net

abuse[]itdnet.net is listed in rfc-ignorant.org database
abuse[]city-lan.org is listed in rfc-ignorant.org database

route: 213.0.0.0/8
descr: SES Americom Customer Prefix
origin: AS11908
remarks: SES Americom Customer Prefix
notify: nmcsu...@ses-americom.com
mnt-by: SESAMERICOM-MNT
changed: john....@ses-americom.com
ASN: 9070
ASN Name: ITD (ITD Network Bulgarian ISP)
Country (per IP registrar): BG [Bulgaria]
Country IP Range: 213.145.96.0 to 213.145.127.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=9070

See:
ase.jopa-s-oem.com IP 222.122.180.189
ns1.jopa-s-oem.com A IN 3600 222.122.180.189
ns2.jopa-s-oem.com A IN 3600 121.31.56.28

ns1.srul5.com [222.122.180.189] [TTL=172800] [KR]
ns2.srul5.com [121.31.56.28] [TTL=172800] [CN]

ase.jopa-s-oem.com has no MX records -> jopa-s-oem.com has no MX
records

NS records at nameservers are:
ns1.jopa-s-oem.com [222.122.180.189] [TTL=3600]
ns2.jopa-s-oem.com [121.31.56.28] [TTL=3600]

SOA record [TTL=2560] is:
Primary nameserver: ns1.jopa-s-oem.com.
Hostmaster E-mail address: hostm...@jopa-s-oem.com.
Serial #: 1167773620

http://www.moensted.dk/spam/?addr=222.122.180.189
http://www.spambag.org/cgi-bin/spambag?mailfrom=kornet
Escalated Listing (Spam or Spam Support) See:
http://www.sorbs.net/lookup.shtml?222.122.180.189
http://korea.services.net/blocked.phtml?addr=222.122.180.189

http://www.spamhaus.org/query/bl?ip=222.122.180.189

No PTR records exist for 222.122.180.189 at rev2.kornet.net

Org Name : Korea Telecom
Service Name : KORNET
Name : IP Administrator
Phone : +82-2-3674-5708
E-Mail : i...@krnic.kornet.net
Name : Network Abuse
Phone : +82-2-100-0000
E-mail : ab...@kornet.net => ???!!!

SEE So Much More kornet sightings (over 48,700):
http://groups.google.com/groups/search?q=kornet+group%3A*abuse&start=0&scoring=d&

route: 222.122.0.0/16
descr: Korea Telecom, Seoul, Korea
origin: AS4766
mnt-by: MAINT-AS4766
changed: chs...@soback.kornet.net
ASN: 4766
ASN Name: KIXS-AS-KR (Korea Telecom)
Country (per IP registrar): KR [Korea-KR]
Country IP Range: 222.122.0.0 to 222.122.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4766

More 222.122.180.189 sightings:
http://groups.google.com/groups/search?q=222.122.180.189+group%3A*abuse&qt_s=Search

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL49519
222.122.180.189/32 is listed on the Spamhaus Block List (SBL/ROKSO)

03-Jan-2007 16:27 GMT | SR04

Alex Blood / Alexander Mosh / AlekseyB / Alex Polyakov.
Multiple spammer domains (hacked Fedora server?)

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK6138

23 SBL/ROKSO listings for IPs under the responsibility of kornet.net
http://www.spamhaus.org/sbl/listings.lasso?isp=kornet.net

Let see whois:
Registrar: CAPITAL NETWORKS PTY LTD

Constant spammer suppoert by PacNames sightings:
http://groups.google.com/groups/search?q=PacNames+group%3A*abuse&start=0&scoring=d&

Domain name: KUNIL-OEM.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/

Registrant hiding behind PacNames => shieldedwhois.com

Domain name: JOPA-S-OEM.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/

Domain Registrant: (Private Contact)
(pws.fa378...@shieldedwhois.com)
Shielded Whois
Shielded WHOIS
PO Box 2076
Arvada CO 80001
US

Telephone: +1.5016348793
Fax:

Administrative, Technical Contact: (Private Contact)
(pws.fa378...@shieldedwhois.com)
Shielded Whois
Shielded WHOIS
PO Box 2076
Arvada CO 80001
US

Telephone: +1.5016348793
Fax:

Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM

Domain creaton date: 2007-01-02 01:35:21.0
Domain expiration date: 2008-01-02 06:49:56.0

More kunil-oem.com sightings:
http://groups.google.com/groups/search?q=jopa-s-oem.com+group%3A*abuse&qt_s=Search

Cheers, Tomez

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

0 new messages