[email] [software piracy] [84.144.69.231] (chesnok-soft.net - srul5.com) Need S0ftware?
TomezNet
IP 84.144.69.231 p549045E7.dip.t-dialin.net
(at dns51.t-ipnet.de / dns01.btx.dtag.de / telekom.de)
Spamvert:
fly.chesnok-soft.net IP 193.124.8.218
www.chesnok-soft.net IP 193.124.8.218
(at ns4.delfa.ru / delfa.net / ns1.relcom.ru / rtcomm.ru)
ns1.srul5.com IP 221.4.246.3
(SBL47392 / SBL48216 - ROK4932)
(at CNCGROUP-GD / ns1.cnc-gd.net)
Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.182; Sun, 26 Nov 2006
03:56:25 -0800
X-YahooFilteredBulk: 84.144.69.231
X-Originating-IP: [84.144.69.231]
Return-Path: <skran...@reefreef.com>
Authentication-Results: mta497.mail.mud.yahoo.com from=reefreef.com;
domainkeys=neutral (no sig)
Received: from 84.144.69.231 (HELO localhost) (84.144.69.231) by
mta497.mail.mud.yahoo.com with SMTP; Sun, 26 Nov 2006 03:56:25 -0800
Message-ID: <000001c71151$c1839e00$0100007f@localhost>
From: "Troy Sanchez" <skran...@reefreef.com>
To: [MUNGED]
Subject: Need S0ftware?
Date: Sun, 26 Nov 2006 12:56:06 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C71151.C1839E00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1039
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1039
Content-Length: 675
<html><head>
<xmetahttp-equiv=Content-Type content="text/html;
charset=windows-1251">
<xmeta>
<style></style></head>
<xbodybgColor=#ffffff>
<div><font face=Arial color=#0000ff>World leading manufacturers. The
most popular software.</font></div>
<font face=Arial><strong><ul>
<li>MS Windows XP Professional with SP2 - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Photoshop CS2 V 9.0 - <font color=#ff0000>$69.95</font></li>
<li>Microsoft Office XP Professional - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Acrobat 5.0 - <font color=#ff0000>$39.95</font></li>
<li>...................ī...............</li>
<li>More then 300 items</li>
</ul></strong></font>
<div><strong><a target="_blank" rel="nofollow" _
href="http://fly.chesnok-soft.net/" ><font face=Arial>Best price. Good
choice. Visit our Website.</font></a></strong></div>
<xbody></html>
-- END OF SPAM --
See also more spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
See:
IP 84.144.69.231 p549045E7.dip.t-dialin.net
http://www.moensted.dk/spam/?addr=84.144.69.231
http://cbl.abuseat.org/lookup.cgi?ip=84.144.69.231
http://www.spamhaus.org/query/bl?ip=84.144.69.231
http://tqmcube.com/cgi-bin/rbltqm?ip=84.144.69.231
More t-dialin.net sightings:
http://groups.google.com/groups?q=t-dialin.net+group%3A*abuse&start=0&scoring=d&
inetnum: 84.136.0.0 - 84.191.255.255
netname: DTAG-DIAL20
descr: Deutsche Telekom AG (telekom.de)
route: 84.128.0.0/10
descr: Deutsche Telekom AG, Internet service provider
origin: AS3320
member-of: AS3320:RS-PA-TELEKOM
mnt-by: DTAG-RR
changed: b...@nic.dtag.de
ASN: 3320
ASN Name: DTAG (Deutsche Telekom AG)
Country (per IP registrar): DE [Germany]
Country IP Range: 84.128.0.0 to 84.191.255.25
http://www.cidr-report.org/cgi-bin/as-report?as=3320
abuse[]telekom.de is listed in rfc-ignorant.org database
4 SBL/ROKSO listings for IPs under the responsibility of telekom.de
http://www.spamhaus.org/sbl/listings.lasso?isp=telekom.de
abuse[]dtag.de is listed in rfc-ignorant.org database
4 SBL/ROKSO listings for IPs under the responsibility of dtag.de
http://www.spamhaus.org/sbl/listings.lasso?isp=dtag.de
See:
fly.chesnok-soft.net IP 193.124.8.218
www.chesnok-soft.net A 193.124.8.218
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
NS records at nameservers are:
ns1.chesnok-soft.net [221.4.246.3] [TTL=3600]
ns2.chesnok-soft.net [58.83.0.6] [TTL=3600]
fly.chesnok-soft.net has no MX records -> chesnok-soft.net has no MX
records
http://www.moensted.dk/spam/?addr=193.124.8.218
[2] markets.ru/nik.ru, see http://spews.org/html/S2715.html
193.124.8.218 PTR record: 218.8.arpa.delfa.net
at ns4.delfa.ru / ns1.relcom.ru
More 193.124.8.218 sightings:
http://groups.google.com/groups/search?q=193.124.8.218+group%3A*abuse&qt_s=Search
inetnum: 193.124.8.0 - 193.124.8.255
netname: DELFANET5 (delfa.net)
descr: OOO Company Delfa
descr: St.-Petersburg
descr: Russia
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.net
person: Dmitry V. Davidov
notify: dmi...@delfa.net
route: 193.124.8.0/21
descr: Company Delfa Ltd.
descr: Russia
origin: AS8915
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.eu.net
ASN: 8915
ASN Name: DELFA-AS (ISP OOO Company Delfa Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 193.124.0.0 to 193.125.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8915
More delfa.net sightings:
http://groups.google.com/groups/search?q=delfa.net+group%3A*abuse&start=0&scoring=d&
Let see whois:
Registrar: CAPITAL NETWORKS PTY LTD
Domain name: CHESNOK-SOFT.NET
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA[]GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM
Domain creaton date: 2006-11-23 17:36:01.0
Domain expiration date: 2007-11-23 22:53:52.0
More chesnok-oem.com sightings:
http://groups.google.com/groups/search?q=chesnok-oem.com+group%3A*abuse&start=0&scoring=d&
See:
ns1.srul5.com IP 221.4.246.3
ns1.srul5.com has no MX records -> srul5.com has no MX records
http://www.moensted.dk/spam/?addr=221.4.246.3
http://www.spamhaus.org/query/bl?ip=221.4.246.3
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47392
221.4.246.3/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:52 GMT | SR02
Leo Kuvayev / BadCow
oemguy.com warez / krugosoft.com/ns1.srul5.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL48216
221.4.246.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
13-Nov-2006 02:19 GMT | SR15
Leo Kuvayev / BadCow.
revolver-oem.org etc
13 SBL/ROKSO listings for IPs under the responsibility of cncgroup-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gd
inetnum: 221.4.0.0 - 221.5.127.255
netname: CNCGROUP-GD
route: 221.4.0.0/16
descr: CNC Group GuangDong Network
origin: AS17816
mnt-by: MAINT-AS4837
changed: I...@cnc-noc.net
ASN: 17816
ASN Name: CHINA169-GZ (CNCGROUP IP network China169 Guangzhou MAN)
Country (per IP registrar): CN [China]
Country IP Range: 221.0.0.0 to 221.7.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=17816
2 SBL listings for IPs under the responsibility of liquidweb.com
http://www.spamhaus.org/sbl/listings.lasso?isp=liquidweb.com
More srul5.com sightings:
http://groups.google.com/groups/search?q=srul5.com+group%3A*abuse&start=0&scoring=d&
See:
ns2.srul5.com IP 58.83.0.6
http://www.moensted.dk/spam/?addr=58.83.0.6
http://www.spamhaus.org/query/bl?ip=58.83.0.6
inetnum: 58.83.0.0 - 58.83.3.255
netname: yzgzynetwork---cn
descr: Yongzhou City Guangzhiyuan Technology Development Co.,
LTD
descr: Room 201, Hedong Businesstown, Lengshuitan, Yongzhou
City, Hunan Province, China.
country: CN
mnt-routes: MAINT-CNCGROUP-RR
changed: w...@chinanetlink.com
person: Hanbo Wang
nic-hdl: HW542-AP
remarks: please send spam reports to c...@86ad.com AND
bluesky_...@163.com
notify: c...@86ad.com
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong Street)
Country (per IP registrar): CN [China]
Country IP Range: 58.82.0.0 to 58.83.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4134
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL43899
58.83.0.0/22 is listed on the Spamhaus Block List (SBL)
25-Nov-2006 14:57 GMT | SR15
Yongzhou City Guangzhiyuan Technology Development Co., LTD
21 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL47590
58.83.0.6/32 is listed on the Spamhaus Block List (SBL/ROKSO)
19-Nov-2006 21:56 GMT | SR02
Kuvayev / BadCow.
"Toronto Pharmacy" / ns2.srul5.com at cncgroup-gd
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3003c4c318fb48d1
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: