[email] [piracy] (coollinksworld.com) DONT PAY THOUSAND FOR SAME SOFTWARE, WE SELL AT ONLY $15-60 FOR ALL SOFTWARES carefully
TomezNet
IP 58.234.143.15
(at Thrunet / HANANET / hanaro.com)
Spamvert URL:
http://au.geocities.com/hulda47972burnard62941/
Redirected to:
http://147.46.133.109/rx03/
AND next Redirected to:
http://wsevew.coollinksworld.com/
IP 147.46.133.109 rockeng.snu.ac.kr
(at ercc.snu.ac.kr)
Spamvert:
wsevew.coollinksworld.com IP 211.156.249.70
(ROK4932 - SBL29935 / SBL30513 and SBL35034) (at CHINANET-GD / APNIC)
More info below:
====================
X-Apparently-To: xx..xx@xx..xx.com via 206.190.49.53; Mon, 13 Feb 2006
19:51:08 -0800
X-Originating-IP: [58.234.143.15]
Return-Path: <ufsu...@kerrlake.com>
Authentication-Results: mta221.mail.mud.yahoo.com from=kerrlake.com;
domainkeys=fail (bad syntax)
Received: from 58.234.143.15 (HELO 4.79.181.14) (58.234.143.15) by
mta221.mail.mud.yahoo.com with SMTP; Mon, 13 Feb 2006 19:51:08 -0800
Received: from [192.168.1.6] ([58.234.143.15]) by bns.com (Sendmail
8.7.6) with ESMTP (SSL) id IYT72749 for <xx..xx@xx..xx.com>; Mon, 13
Feb 2006 21:51:11 -0600
Message-ID: <224g082h...@bns.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=steps.tying;
d=bns.com;
b=Y2Cnje5RO6LzzdeSM3QzzVAVOTIuFKeOkZCOGJEwEG22iemCGf7uQLf7QSRJjc24jEnZGib4DieCKlgV;
Date: Mon, 13 Feb 2006 21:51:11 -0600
From: "Jenni Lynetta" <ufsu...@kerrlake.com>
User-Agent: Mozilla Thunderbird 1.5 (Windows/2006011)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xx..xx@xx..xx.com
Subject: DONT PAY THOUSAND FOR SAME SOFTWARE, WE SELL AT ONLY $15-60
FOR ALL SOFTWARES carefully
Content-Type: multipart/related;
boundary="------------25577829==.MRA"
Content-Length: 1043
Instant Download Software
We give you LICENSE instantly!
http://au.geocities.com/hulda47972burnard62941/ (Download ur needed
software here - Click Here)
taught or across teach here. is tying latter beautiful evening.
<html><head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=64FF64 size=1>reading tying a reading music purpose. end
allow profession development gym,<br>
music miserable taught drew bought. studied motor whom anything benefit
gym,<br>
nothing very next nothing explain.</font>
<center><table border=5 cellspacing=0 cellpadding=10 width=540
bordercolor=BEFC30>
<tr><td bgcolor=ffffff align=left>
<font size=1 face=arial color=000000><center>
<font size=4 color=2828FF><b>Instant Download Software<br><font
color=D9D900 size=3>We give you LICENSE instantly!<br><font
color=B7B7B7>Fast Respond Customer Support To serve u
Better</font></font></font></b></center><br><font color=000000
size=2>XP Pro SP2, MS Office Pro 2OO3, Creative Suite v2, All Ad0be
softwares, Macromedia and 250 more</font><br><br>
<center>
<a href=http://au.geocities.com/hulda47972burnard62941/
target=_blank><font size=4 color=FF1C1C><u>find <b>Download ur needed
software here</b> love</font></u></a></center></td></tr></table><font
color=64FF64 size=1>music pretty pretty drew you suddenly, sandwich
speaking love suddenly tying. mischievous make bad motor benefit
gym,<br>
taught prison goes leader you taught? explain yours rich she being.
sugar goes already steps reply carefully.<br>
anything find whom sugar steps drew,<br>
supposedto companion goes you servants, side fascinate edge letters
taught being.<br>
</font>
</body></html>
-- END OF SPAM --
See:
IP 58.234.143.15
http://www.moensted.dk/spam/?addr=58.234.143.15
http://cbl.abuseat.org/lookup.cgi?ip=58.234.143.15
http://www.spamhaus.org/query/bl?ip=58.234.143.15
http://korea.services.net/blocked.phtml?addr=58.234.143.15
IPv4 Address : 58.234.128.0-58.234.159.255
Network Name : THRUNET-INFRA-SEOUL16
Connect ISP Name : HANANET
Connect Date : 20051001
Registration Date : 20051019
Organization ID : ORG505617
Org Name : Thrunet Corp.
ASN: 9318
ASN Name: HANARO-AS (HANARO Telecom)
http://www.cidr-report.org/cgi-bin/as-report?as=9318
4 SBL/ROKSO listings for IPs under the responsibility of hanaro.com
http://www.spamhaus.org/sbl/listings.lasso?isp=hanaro.com
See:
IP 147.46.133.109 rockeng.snu.ac.kr
rockeng.snu.ac.kr. has no MX records -> [snu.ac.kr has 1 MX record
smtp.snu.ac.kr (0)]
http://www.moensted.dk/spam/?addr=147.46.133.109
http://korea.services.net/blocked.phtml?addr=147.46.133.109
IPv4 Address : 147.46.0.0-147.46.255.255
Network Name : NET-SNU
Registration Date : 20040625
Organization ID : ORG384075
ASN: 9488
ASN Name: SNU-AS-KR (Seoul National University)
http://www.cidr-report.org/cgi-bin/as-report?as=9488
See:
wsevew.coollinksworld.com IP 211.156.249.70
ns1.yournextload.com A IN 600 222.36.42.123
ns2.yournextload.com A IN 600 219.148.3.162
ns2.yournextload.com [211.156.249.70]
ns1.yournextload.com [221.11.133.56]
[wsevew.coollinksworld.com has 1 MX record 127.0.0.1 (0)]
http://www.moensted.dk/spam/?addr=211.156.249.70
http://www.spamhaus.org/query/bl?ip=211.156.249.70
More 211.156.249.70 sightings:
http://groups.google.com/groups?q=211.156.249.70+group%3A*abuse*
inetnum: 211.156.240.0 - 211.156.255.255
netname: ZhanjiangWantong (wtonline.net)
country: CN
descr: Zhan Jiang Wan Tong Co.,Ltd.
ASN: 4134
ASN Name: CHINANET-BACKBONE (No.31,Jin-rong
Street)
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL29935
211.156.249.0/24 is listed on the Spamhaus Block List (SBL/ROKSO)
03-Feb-2006 03:40 GMT | SR04
Leo Kuvayev / BadCow
bulker.biz @211.156.249.71 / etc
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL30513
211.156.249.70/32 is listed on the Spamhaus Block List (SBL/ROKSO)
27-Nov-2005 06:46 GMT | SR04
Leo Kuvayev / BadCow
discount-system.info ; buyallsofthere.info ; etc
Main Info:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Leo%20Kuvayev%20/%20BadCow
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK4932
24 SBL/ROKSO listings for IPs under the responsibility of chinanet-gd
http://www.spamhaus.org/sbl/listings.lasso?isp=chinanet-gd
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL35034
211.156.240.0/20 is listed on the Spamhaus Block List (SBL)
04-Feb-2006 01:49 GMT | SR04
Spammer hosting: Zhan Jiang Wan Tong Co.,Ltd. (escalation)
22 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
Let see whois:
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
domain: coollinksworld.com
owner: Vladimir Mironov
email: cgiw...@mail.ru
address: Abonetsky yashik 16
city: Moscow
state: --
postal-code: 117525
country: RU
phone: +7095.2349449
admin-c: cgiworks[]mail.ru#0
tech-c: cgiw...@mail.ru#0
billing-c: cgiw...@mail.ru#0
nserver: ns1.yournextload.com 221.11.133.56
nserver: ns2.yournextload.com 211.156.249.70
status: lock
created: 2006-02-16 20:28:31 UTC
modified: 2006-02-16 20:45:26 UTC
expires: 2007-02-16 15:25:56 UTC
source: joker.com live whois service
query-time: 0.014837
db-updated: 2006-02-22 19:14:08
More Vladimir Mironov JOKER.COM spam support sightings:
http://groups.google.com/groups?q=%22Vladimir+Mironov%22+group%3A*abuse*&start=0&scoring=d&
See identical drugs spam formatting with double redirect:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/61a9b650c31d9b83
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: