[email] [software piracy] [90.0.115.18] (elektroeri.com - laga-soft.com) Autodesk 2008
TomezNet
IP 90.0.115.18 amontpellier-157-1-132-18.w90-0.abo.wanadoo.fr
(at orange.fr / internetplus.fr)
Spamvert:
elektroeri.com IP 58.83.12.66
(SBL51900 - SBL53280 - SBL53240 - SBL53345) (at BLUESKY / csallnetlink-
cn)
ns1.laga-soft.com IP 195.114.16.1
(SBL51155 - SBL54564) (at RIPE / micronnet.net)
Title: Downloadable Software
See More the same spammer Downloadable Software (DS) sightings:
http://groups.google.com/groups/search?q=%22Downloadable+Software+(DS)%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: Mable Larkin <pcar...@xn--tb0a61bs89c.com>
X-Message-Info:
txF49lGdW423DAPQaiknsc7mZgoqtltBCSNyuRj9YBDdRPpR3qgzBcrQBSV6YPVg
Received: from tomts21-srv.bellnexxia.net ([209.226.175.183]) by bay0-
pamc1-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Tue, 10 Jul 2007 14:26:10 -0700
Received: from [MUNGED]
by toip24.srvr.bell.ca with ESMTP; 10 Jul 2007 17:26:02 -0400
Received: (qmail 22476 invoked by uid 110); 10 Jul 2007 17:26:01 -0400
Delivered-To: [MUNGED]
Received: (qmail 22408 invoked from network); 10 Jul 2007 17:26:01
-0400
Received: from amontpellier-157-1-132-18.w90-0.abo.wanadoo.fr
(90.0.115.18)
by [MUNGED] with SMTP; 10 Jul 2007 17:26:01 -0400
Received: from [90.0.115.18] by m-g2.dns.com.cn; Tue, 10 Jul 2007
21:26:13 -0100
Message-ID: <01c7c338$f173ee00$1273005a@pcarmich>
From: "Mable Larkin" <pcar...@xn--tb0a61bs89c.com>
To: <[MUNGED]>
Subject: Autodesk 2008
Date: Tue, 10 Jul 2007 21:26:13 -0100
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-2";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2670
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
Return-Path: pcar...@xn--tb0a61bs89c.com
X-OriginalArrivalTime: 10 Jul 2007 21:26:10.0226 (UTC)
FILETIME=[EF368120:01C7C338]
Save $1049.05 ADOBE CREATIVE 2 $149
http://elektroeri.com
-- END OF SPAM --
See:
IP 90.0.115.18 amontpellier-157-1-132-18.w90-0.abo.wanadoo.fr
http://www.moensted.dk/spam/?addr=90.0.115.18
http://www.spamhaus.org/query/bl?ip=90.0.115.18
http://www.spamhaus.org/pbl/query/PBL114993
http://www.apews.org/?page=test&C=130&E=214892&ip=90.0.115.18
More wanadoo.fr sightings:
http://groups.google.com/groups/search?q=wanadoo.fr+group%3A*abuse&start=0&scoring=d&
inetnum: 90.0.115.0 - 90.0.115.255
netname: IP2000-ADSL-BAS
descr: BSMON157 Montpellier Bloc 1
country: FR
remarks: postm...@wanadoo.fr AND ab...@wanadoo.fr => ???
postmaster and abuse[]wanadoo.fr are listed in rfc-ignorant.org
database
abuse[]francetelecom.com is listed in rfc-ignorant.org database
route: 90.0.0.0/11
descr: France Telecom
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestio...@francetelecom.com
Prefix: 90.0.0.0/16
Prefix Name: error
AS: 3215
AS Name: AS3215 France Telecom Orange Domestic IP Backbone
http://www.cidr-report.org/cgi-bin/as-report?as=3215
11 SBL/ROKSO listings for IPs under the responsibility of
francetelecom.com
http://www.spamhaus.org/sbl/listings.lasso?isp=francetelecom.com
See:
elektroeri.com IP 58.83.12.66
ns1.laga-soft.com [195.114.16.1] [TTL=172800] [RU]
ns2.laga-soft.com [58.83.12.66] [TTL=172800] [CN]
NS records at nameservers are:
ns1.elektroeri.com [58.83.12.66] [TTL=3600]
ns2.elektroeri.com [58.83.12.66] [TTL=3600]
SOA record [TTL=2560] is:
Primary nameserver: ns1.elektroeri.com
Hostmaster E-mail address: hostm...@elektroeri.com
Serial #: 1184051710
1 MX record is:
10 mail.elektroeri.com [TTL=3600] IP=172.31.32.250 [TTL=3600] [*I]
http://www.moensted.dk/spam/?addr=58.83.12.66
http://www.spamhaus.org/query/bl?ip=58.83.12.66
inetnum: 58.83.12.0 - 58.83.15.255
netname: csallnetlink-cn
descr: changsha allnetlink development co.,LTD
country: CN
remarks: w...@allnetlink.com.cn
person: yongcheng wang
nic-hdl: YW811-AP
e-mail: wan...@allnetlink.com.cn
address: changsha allnetlink co., LTD
person: ada chen
nic-hdl: AC893-AP
changed: BLUESKY...@163.COM
Aliases:
vo-oem.com
ns2.laga-soft.com
Prefix: 58.83.12.0/22
Prefix Name: error
AS: 18118
AS Name: CITICNET AP CITIC Networks Management Co ,Ltd 6 XINYUANNANLU
BEIJING
http://www.cidr-report.org/cgi-bin/as-report?as=18118
23 domains sharing mailservers with elektroeri.com
adresmmo.com
bestoemsoft.net
eksoftod.com
eslitiluu.com
flodiny.com
flshey.com
heropopotamus.com
ktotodoljen.com
laga-soft.com
leoemch.com
menaaloooh.com
neholnasdak.com
nemudnasdak.com
oem-os.com
psihsofta.com
razdeltruda.com
rmclspa.com
rmdirod.com
tiprideshh.com
vo-oem.com
vottakie.com
vstrrrech.com
znausmotr.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51900
58.83.0.0/16 is listed on the Spamhaus Block List (SBL)
27-Apr-2007 08:03 GMT | SR02
tianjian / hylink-cn / bluesky
58.83.0.0/22 and 58.83.4.0/22 are known to be operated by spammers. It
appears the entire /16 is part of the same operation. B-class networks
registered to Hotmail addresses are not reliable.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53240
58.83.12.66/32 is listed on the Spamhaus Block List (SBL/ROKSO)
27-Jun-2007 23:14 GMT | SR04
Leo Kuvayev / BadCow.
ns1.laga-soft.com @58.83.12.66
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53345
58.83.12.66/31 is listed on the Spamhaus Block List (SBL)
09-Apr-2007 04:48 GMT | SR02
bulletproof hosting / hylink-cn
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53280
58.83.12.0/22 is listed on the Spamhaus Block List (SBL)
07-Apr-2007 10:32 GMT | SR02
csallnetlink-cn / BLUESKY
BLUESKY provides bulletproof spam hosting and does not reply to spam
reports or SBL listings.
21 SBL/ROKSO listings for IPs under the responsibility of bluesky
http://www.spamhaus.org/sbl/listings.lasso?isp=bluesky
Let see whois:
Domain name: elektroeri.com
Registrant Contact:
Alex Rodrigez domains[]preved.cd
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi
Administrative Contact:
Alex Rodrigez dom...@preved.cd
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi
Technical Contact:
Alex Rodrigez dom...@preved.cd
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi
Billing Contact:
Alex Rodrigez dom...@preved.cd
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi
DNS:
ns1.laga-soft.com
ns2.laga-soft.com
Created: 2007-07-06
Expires: 2008-07-06
See:
ns1.laga-soft.com IP 195.114.16.1
ns1.laga-soft.com has no MX records -> laga-soft.com has no MX records
http://www.moensted.dk/spam/?addr=195.114.16.1
http://www.spamhaus.org/query/bl?ip=195.114.16.1
http://cbl.abuseat.org/lookup.cgi?ip=195.114.16.1
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51155
195.114.16.0/23 is listed on the Spamhaus Block List (SBL/ROKSO)
05-Jul-2007 14:10 GMT | SR04
Russian Business Network / rbnnetwork.ru / iframe cash
Yet another part of Russian Business Network / iframe cash gang.
See: SBL23048, SBL51562
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL54564
195.114.16.1/32 is listed on the Spamhaus Block List (SBL/ROKSO)
27-Jun-2007 23:13 GMT | SR04
Leo Kuvayev / BadCow.
laga-soft.comm etc
54 SBL/ROKSO listings for IPs under the responsibility of RIPE
http://www.spamhaus.org/sbl/listings.lasso?isp=RIPE
inetnum: 195.114.16.0 - 195.114.17.255
netname: MICRONNET-NET
descr: Micronnet LTD network
country: RU
organisation: ORG-MICR1-RIPE
org-name: Micronnet LTD
org-type: OTHER
address: Reshetnikova str. HSE 9
address: 197119 St. Petersburg , Russia
e-mail: in...@micronnet.net
phone: +78127853699
postmaster and abuse[]micronnet.net are listed in rfc-ignorant.org
database
route: 195.114.16.0/23
descr: Micronnet LTD
origin: AS41187
mnt-by: MICRONNET-MNT
changed: hostm...@ripe.net
http://www.cidr-report.org/cgi-bin/as-report?as=41187
See Aliases on the same IP:
ns1.ktotodoljen.com
ns2.tiprideshh.com
ns2.vo-oem.com
heropopotamus.com
tiprideshh.com
ns1.vstrrrech.com
ktotodoljen.com
rmclspa.com
ns2.flshey.com
ns2.heropopotamus.com
rmdirod.com
adresmmo.com
ns1.laga-soft.com
nemudnasdak.com
ns1.adresmmo.com
vottakie.com
ns2.vstrrrech.com
bestoemsoft.net
vstrrrech.com
ns2.rmdirod.com
ns1.vottakie.com
oem-os.com
ns1.oem-os.com
*.nemudnasdak.com
ns2.nemudnasdak.com
leoemch.com
*.vo-oem.com
ns2.adresmmo.com
ns2.bestoemsoft.net
ns1.bestoemsoft.net
ns1.sobaka-soft.com
ns1.tiprideshh.com
ns1.rmclspa.com
ns1.heropopotamus.com
ns2.ktotodoljen.com
ns1.flshey.com
ns2.oem-os.com
ns2.vottakie.com
ns2.rmclspa.com
ns1.rmdirod.com
Let see whois.dns.com.cn:
Domain Name.......... laga-soft.com
Creation Date........ 2007-02-24 02:20:42
Registration Date.... 2007-02-24 02:20:42
Expiry Date.......... 2008-02-24 02:20:42
Organisation Name.... zhong fei
Organisation Address. jiang xi nan change
Organisation Address.
Organisation Address. nan chang
Organisation Address. 321000
Organisation Address. JX
Organisation Address. CN
Admin Name........... zhong fei
Admin Address........ jiang xi nan change
Admin Address........
Admin Address........ nan chang
Admin Address........ 321000
Admin Address........ JX
Admin Address........ CN
Admin Email.......... admin[]canadian-rxx.net
Admin Phone.......... +86.79132100023
Admin Fax............ +86.79132100023
Tech Name............ zhong fei
Tech Address......... jiang xi nan change
Tech Address.........
Tech Address......... nan chang
Tech Address......... 321000
Tech Address......... JX
Tech Address......... CN
Tech Email........... ad...@canadian-rxx.net
Tech Phone........... +86.79132100023
Tech Fax............. +86.79132100023
Bill Name............ zhong fei
Bill Address......... jiang xi nan change
Bill Address.........
Bill Address......... nan chang
Bill Address......... 321000
Bill Address......... JX
Bill Address......... CN
Bill Email........... ad...@canadian-rxx.net
Bill Phone........... +86.79132100023
Bill Fax............. +86.79132100023
Name Server.......... ns2.laga-soft.com
Name Server.......... ns1.laga-soft.com
See also more laga-soft.com sightings:
http://groups.google.com/groups/search?q=laga-soft.com+group%3A*abuse&qt_s=Search
Let see whois from Registrant data:
canadian-rxx.net IP 60.191.112.76 => SBL55408
[canadian-rxx.net has 1 MX record mail.canadian-rxx.net (10)]
ns1.patill.info [67.99.176.30 (NO GLUE)] [US]
ns1.penunmaimed.com [201.231.109.16] [TTL=172800] [AR]
ns2.abdominoscopygos.com [85.136.20.235] [TTL=172800] [ES]
ns2.tantrarure.com [213.242.15.61] [TTL=172800] [RU]
Checking server [whois.dns.com.cn]
Results:
Domain Name.......... canadian-rxx.net
Creation Date........ 2007-02-13 15:22:25
Registration Date.... 2007-02-13 15:22:25
Expiry Date.......... 2008-02-13 15:22:25
Organisation Name.... peng fei
Organisation Address. guang zhou
Organisation Address.
Organisation Address. guang zhou
Organisation Address. 321000
Organisation Address. GD
Organisation Address. CN
Admin Name........... peng fei
Admin Address........ guang zhou
Admin Address........
Admin Address........ guang zhou
Admin Address........ 321000
Admin Address........ GD
Admin Address........ CN
Admin Email.......... admin[]canadian-rxx.net
Admin Phone.......... +86.2032100020
Admin Fax............ +86.2032100020
Tech Name............ peng fei
Tech Address......... guang zhou
Tech Address.........
Tech Address......... guang zhou
Tech Address......... 321000
Tech Address......... GD
Tech Address......... CN
Tech Email........... ad...@canadian-rxx.net
Tech Phone........... +86.2032100020
Tech Fax............. +86.2032100020
Bill Name............ peng fei
Bill Address......... guang zhou
Bill Address.........
Bill Address......... guang zhou
Bill Address......... 321000
Bill Address......... GD
Bill Address......... CN
Bill Email........... ad...@canadian-rxx.net
Bill Phone........... +86.2032100020
Bill Fax............. +86.2032100020
Name Server.......... ns2.tantrarure.com
Name Server.......... ns1.patill.info
Name Server.......... ns2.abdominoscopygos.com
Name Server.......... ns1.penunmaimed.com
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/a86795aad80ff18f
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/d4ec058f23e668e1
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: