[email] [mortgage - InstantQuotes] [58.9.183.236] (rocknfgddrolls.com - twoeggdns.com) February Statement Thu, 01 Feb 2007 13:15:25 -0700
TomezNet
IP 58.9.183.236 ppp-58.9.183.236.revip2.asianet.co.th
(at clarinet.asianet.co.th / trueinternet.co.th)
Possible Open Proxy (pxychain)
Spamvert:
rocknfgddrolls.com IP 211.99.31.26
(SBL50251) (at ns.fibrlink.net)
More "InstantQuotes" mortgage spammer sightings:
http://groups.google.com/groups/search?q=InstantQuotes+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: February Report <Freid...@leonlai.net>
X-Message-Info: txF49lGdW404fnIt6U5+0lLON210YLdlM5Nvz/I+uqE=
Received: from tomts1-srv.bellnexxia.net ([209.226.175.113]) by bay0-
pamc1-f1.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Thu, 1 Feb 2007 12:23:05 -0800
Received: from [MUNGED]
by toip20.srvr.bell.ca with ESMTP; 01 Feb 2007 15:22:29 -0500
Received: (qmail 24078 invoked by uid 110); 1 Feb 2007 15:22:29 -0500
Delivered-To: [MUNGED]
Received: (qmail 24064 invoked from network); 1 Feb 2007 15:22:28
-0500
Received: from ppp-58.9.183.236.revip2.asianet.co.th (58.9.183.236)
by [MUNGED] with SMTP; 1 Feb 2007 15:22:28 -0500
Date: Thu, 01 Feb 2007 15:22:25 -0500
From: "February Report" <Freid...@leonlai.net>
Message-ID: <10104.chicagoan@astrophysicist>
To: [MUNGED]
Subject: February Statement Thu, 01 Feb 2007 13:15:25 -0700
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Return-Path: FaithM...@malaysia.net
X-OriginalArrivalTime: 01 Feb 2007 20:23:05.0864 (UTC)
FILETIME=[C7E07080:01C7463E]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
</HEAD>
<BODY bgColor=#ffffff>
<BR>Hello,<BR><BR>
You have been chosen to participate in an invitation only limited time
event!<BR>
Are you currently paying over 3% for your mortgage?<BR>
STOP!<BR>
We can help you lower that today!<BR>
Answer only a few questions and we can give you an approval in under
30 seconds it's that simple!<BR><BR>
<a href="http://rocknfgddrolls.com">http://rocknfgddrolls.com</
a><BR><BR>
And stop fighting for lenders let them fight for you! Make them work
for your business by giving you the lowest rates around!<BR>
230,000 loans are available for only 340/month!<BR>
WE'RE PRACTICALLY GIVING AWAY MONEY!<BR><BR>
Think your credit is too bad to get a deal like this?<BR>
THINK AGAIN!<BR>
We will have you saving your money in no time!<BR>
Are you ready to save your money?<BR><BR>
<a href="http://rocknfgddrolls.com">http://rocknfgddrolls.com</
a><BR><BR>
Regards,<BR>
Freida Dowdy
</BODY>
</HTML>
-- END OF SPAM --
Any connections to (?):
e-instantquotes.com IP 61.145.116.185
See:
IP 58.9.183.236 ppp-58.9.183.236.revip2.asianet.co.th
http://www.moensted.dk/spam/?addr=58.9.183.236
http://cbl.abuseat.org/lookup.cgi?ip=58.9.183.236
http://www.spamhaus.org/query/bl?ip=58.9.183.236
http://www.apews.org/?page=test&C=1200&ip=58.9.183.236
inetnum: 58.9.0.0 - 58.9.255.255
netname: TRUENET
descr: ADSL HuaweiBB TrueLocal Infrastructure True internet
Co., Ltd.
mnt-by: MAINT-AP-TRUEINTERNET
changed: ipa...@trueinternet.co.th
trouble: ab...@trueinternet.co.th => ???
abuse[]trueinternet.co.th is listed in rfc-ignorant.org database
postmaster and abuse[]asianet.co.th are listed in rfc-ignorant.org
database
route: 58.9.128.0/18
descr: ASIAINFO-TH New IP
origin: AS7470
mnt-by: MAINT-AS7470
changed: regi...@asianet.co.th
ASN: 7470
ASN Name: ASIAINFO-AS-AP (ASIA INFONET Co.,Ltd.)
Country (per IP registrar): TH [Thailand]
Country IP Range: 58.8.0.0 to 58.11.255.255
Country fraud profile: High
City (per outside source): Bangkok, Krung Thep Mahanakhon
http://www.cidr-report.org/cgi-bin/as-report?as=7470
1 SBL listings for IPs under the responsibility of trueinternet.co.th
http://www.spamhaus.org/sbl/listings.lasso?isp=trueinternet.co.th
16 SBL/ROKSO listings for IPs under the responsibility of
asianet.co.th
http://www.spamhaus.org/sbl/listings.lasso?isp=asianet.co.th
See:
rocknfgddrolls.com IP 211.99.31.26
ns1.twoeggdns.com [121.31.56.8] [TTL=172800] [CN]
ns2.twoeggdns.com [211.99.31.26] [TTL=172800] [CN]
SOA record [TTL=2048] is:
Primary nameserver: dns1.rocknfgddrolls.com
Hostmaster E-mail address: hostmaster.rocknfgddrolls.com
Serial #: 1170369726
rocknfgddrolls.com has no MX records
http://www.moensted.dk/spam/?addr=211.99.31.26
http://www.spamhaus.org/query/bl?ip=211.99.31.26
http://www.spamsources.fabel.dk/ip/211.99.31.26
Escalated Listing (Spam or Spam Support) See: http://www.sorbs.net/
lookup.shtml?211.99.31.26
inetnum: 211.99.0.0 - 211.99.31.255
netname: FibrLINK
mnt-by: MAINT-CNNIC-AP
changed: ip...@cnnic.net.cn
e-mail: shengju...@fibrlink.net
e-mail: jie....@fibrlink.com
changed: she...@cnnic.cn
mnt-by: MAINT-NEW
changed: wei....@fibrlink.com
whois, postmaster and abuse[]fibrlink.com are listed in rfc-
ignorant.org database
route: 211.99.0.0/19
descr: Beijing FibrLINK Networks Co., LTD.
origin: AS9814
notify: neta...@fibrlink.com
mnt-by: MAINT-AS9814
mnt-by: MAINT-CNNIC-AP
changed: ip...@cnnic.net.cn
ASN: 9814
ASN Name: FibrLINK (Beijing FibrLINK Networks Co.,Ltd.)
Country (per IP registrar): CN [China]
Country IP Range: 211.96.0.0 to 211.103.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=9814
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50251
211.99.31.26/32 is listed on the Spamhaus Block List (SBL)
01-Feb-2007 09:18 GMT | SR20
"InstantQuotes" mortgage spammer
8 SBL/ROKSO listings for IPs under the responsibility of fibrlink.com
http://www.spamhaus.org/sbl/listings.lasso?isp=fibrlink.com
Let see whois:
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET
Domain Name: rocknfgddrolls.com
Registrant Contact
Name: Gary Reed
Address: 3495 Cambie street 150
Vancouver, BC V5Z 4R3
CA
Email Address: garyr[]coldmail.ca
Phone Number: (604)767-8695
Administrative Contact
Name: Gary Reed
Address: 3495 Cambie street 150
Vancouver, BC V5Z 4R3
CA
Email Address: ga...@coldmail.ca
Phone Number: (604)767-8695
Technical Contact
Name: Gary Reed
Address: 3495 Cambie street 150
Vancouver, BC V5Z 4R3
CA
Email Address: ga...@coldmail.ca
Phone Number: (604)767-8695
Record Created on........ 2007-01-30 11:33:36.711
Expire on................ 2008-01-30 11:44:00.000
Domain servers in listed order:
ns1.twoeggdns.com
ns2.twoeggdns.com
More rocknfgddrolls.com sightings:
http://groups.google.com/groups/search?q=rocknfgddrolls.com+group%3A*abuse
See:
ns1.twoeggdns.com IP 121.31.56.8
ns1.twoeggdns.com has no MX records -> twoeggdns.com has no MX records
http://www.moensted.dk/spam/?addr=121.31.56.8
http://www.spamhaus.org/query/bl?ip=121.31.56.8
More 121.31.56.8 sightings:
http://groups.google.com/groups/search?q=121.31.56.8+group%3A*abuse
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50718
121.31.56.8/32 is listed on the Spamhaus Block List (SBL)
02-Feb-2007 05:23 GMT | SR02
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL50719
121.31.56.0/24 is listed on the Spamhaus Block List (SBL)
02-Feb-2007 05:28 GMT | SR02
dirty block
This /24 network hosts way too many spammers...is someone getting paid
"under the table"?
8 SBL/ROKSO listings for IPs under the responsibility of cncgroup-gx
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-gx
inetnum: 121.31.0.0 - 121.31.255.255
netname: CNCGROUP-GX
descr: CNC Group Guangxi province network
descr: China Network Communications Group Corporation
route: 121.31.0.0/16
descr: CNC Group CHINA169 Guangxi Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: ab...@cnc-noc.net => ???
whois, postmaster and abuse[]cnc-noc.net are listed in rfc-
ignorant.org database
Country IP Range: 121.16.0.0 to 121.31.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=4837
Let see whois:
Registrar: ACE OF DOMAINS, INC
Domain Name: TWOEGGDNS.COM
Registrant [1656]:
gary reed garyr[]coldmail.ca
3495 Cambie Street 150
vancouver BC
V5Z 4R3
CA
Administrative Contact [1656]:
gary reed ga...@coldmail.ca
3495 Cambie Street 150
vancouver BC
V5Z 4R3
CA
Phone: +1.6047678695
Billing Contact [1656]:
gary reed ga...@coldmail.ca
3495 Cambie Street 150
vancouver BC
V5Z 4R3
CA
Phone: +1.6047678695
Technical Contact [1656]:
gary reed ga...@coldmail.ca
3495 Cambie Street 150
vancouver BC
V5Z 4R3
CA
Phone: +1.6047678695
Domain servers in listed order:
NS1.DNSGOLDONE.COM
NS2.DNSGOLDONE.COM
Record created on: 2007-01-27 13:22:17.0
Database last updated on: 2007-01-30 08:06:09.633
Domain Expires on: 2008-01-27 13:22:22.0
More twoeggdns.com sightings:
http://groups.google.com/groups/search?q=twoeggdns.com+group%3A*abuse
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/2cd9acd75c32de1f
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: