[email] [software piracy] [12.127.242.158] (plachet-soft.net / srul5.com) Software At Low Pr1ce
TomezNet
IP 12.127.242.158
(at dmtu.mt.ns.els-gms.att.net / francetelecom.com)
Spamvert:
plachet-soft.net IP 193.124.8.218
(at ns4.delfa.ru / delfa.net / ns1.relcom.ru / rtcomm.ru)
Much More the same spammer sightings:
http://groups.google.com/groups/search?q=%22XSALSA%40%22+group%3A*abuse&start=0&scoring=d&
Received at an address harvested from this abuse group.
More info below:
====================
X-Apparently-To: [MUNGED] via 216.252.100.178; Wed, 29 Nov 2006
02:33:55 -0800
X-YahooFilteredBulk: 12.127.242.158
X-Originating-IP: [12.127.242.158]
Return-Path: <mycardmaki...@vaneurope.com>
Authentication-Results: mta262.mail.mud.yahoo.com from=vaneurope.com;
domainkeys=neutral (no sig)
Received: from 12.127.242.158 (HELO localhost) (12.127.242.158) by
mta262.mail.mud.yahoo.com with SMTP; Wed, 29 Nov 2006 02:33:55 -0800
Message-ID: <000001c713a1$e66e5000$0100007f@localhost>
From: "Corey Bryant" <mycardmaki...@vaneurope.com>
To: [MUNGED]
Subject: Software At Low Pr1ce
Date: Wed, 29 Nov 2006 05:33:34 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C713A1.E66E5000"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1039
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1039
Content-Length: 669
<html><head>
<xmetahttp-equiv=Content-Type content="text/html;
charset=windows-1251">
<xmeta>
<style></style></head>
<xbodybgColor=#ffffff>
<div><font face=Arial color=#0000ff>World leading manufacturers. The
most popular software.</font></div>
<font face=Arial><strong><ul>
<li>MS Windows XP Professional with SP2 - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Photoshop CS2 V 9.0 - <font color=#ff0000>$69.95</font></li>
<li>Microsoft Office XP Professional - <font
color=#ff0000>$49.95</font></li>
<li>Adobe Acrobat 5.0 - <font color=#ff0000>$39.95</font></li>
<li>...................ī...............</li>
<li>More then 300 items</li>
</ul></strong></font>
<div><strong><a target="_blank" rel="nofollow" _
href="http://plachet-soft.net/" ><font face=Arial>Best price. Good
choice. Visit our Website.</font></a></strong></div>
<xbody></html>
-- END OF SPAM --
See also more spammer sightings:
http://groups.google.com/groups/search?q=oemguy.com+group%3A*abuse&start=0&scoring=d&
See:
IP 12.127.242.158
http://www.moensted.dk/spam/?addr=12.127.242.158
http://www.spamhaus.org/query/bl?ip=12.127.242.158
http://spamcop.net/w3m?action=checkblock&ip=12.127.242.158
More 12.127.242.158 sightings:
http://groups.google.com/groups/search?q=12.127.242.158+group%3A*abuse&qt_s=Search
AT&T WorldNet Services ATT (NET-12-0-0-0-1)
12.0.0.0 - 12.255.255.255
AT&T Worldnet Services ATTSVI-12-127-0-0 (NET-12-127-0-0-1)
12.127.0.0 - 12.127.255.255
CustName: AT&T Worldnet Services
NetRange: 12.127.0.0 - 12.127.255.255
CIDR: 12.127.0.0/16
NetName: ATTSVI-12-127-0-0
NetHandle: NET-12-127-0-0-1
Parent: NET-12-0-0-0-1
ASN: 7018
ASN Name: ATT-INTERNET4
Country (per IP registrar): US [United States]
Country IP Range: 12.0.0.0 to 13.255.255.255
http://www.cidr-report.org/cgi-bin/as-report?as=7018
11 SBL/ROKSO listings for IPs under the responsibility of att.net
http://www.spamhaus.org/sbl/listings.lasso?isp=att.net
See:
plachet-soft.net IP 193.124.8.218
ns1.srul5.com [221.4.246.3] [TTL=172800] [CN]
ns2.srul5.com [58.83.0.6] [TTL=172800] [CN]
NS records at your nameservers are:
ns1.plachet-soft.net [221.4.246.3] [TTL=3600]
ns2.plachet-soft.net [58.83.0.6] [TTL=3600]
plachet-soft.net has no MX records
http://www.moensted.dk/spam/?addr=193.124.8.218
[2] markets.ru/nik.ru, see http://spews.org/html/S2715.html
193.124.8.218 PTR record: 218.8.arpa.delfa.net
at ns4.delfa.ru / ns1.relcom.ru
More 193.124.8.218 sightings:
http://groups.google.com/groups/search?q=193.124.8.218+group%3A*abuse&qt_s=Search
inetnum: 193.124.8.0 - 193.124.8.255
netname: DELFANET5 (delfa.net)
descr: OOO Company Delfa
descr: St.-Petersburg
descr: Russia
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.net
person: Dmitry V. Davidov
notify: dmi...@delfa.net
route: 193.124.8.0/21
descr: Company Delfa Ltd.
descr: Russia
origin: AS8915
notify: oper...@delfa.net
mnt-by: AS2118-MNT
changed: f...@relcom.eu.net
ASN: 8915
ASN Name: DELFA-AS (ISP OOO Company Delfa Autonomous System)
Country (per IP registrar): RU [Russian Federation]
Country IP Range: 193.124.0.0 to 193.125.255.255
Country fraud profile: High
http://www.cidr-report.org/cgi-bin/as-report?as=8915
More delfa.net sightings:
http://groups.google.com/groups/search?q=delfa.net+group%3A*abuse&start=0&scoring=d&
Let see whois:
Registrar: CAPITAL NETWORKS PTY LTD
Domain name: PLACHET-SOFT.NET
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA[]GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSA...@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM
Domain creaton date: 2006-11-24 21:21:34.0
Domain expiration date: 2007-11-25 02:39:18.0
More plachet-soft.net sightings:
http://groups.google.com/groups/search?q=plachet-soft.net+group%3A*abuse&qt_s=Search
See also more srul5.com sightings:
http://groups.google.com/groups/search?q=srul5.com+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/3b3f73225183f9b8
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/4ed3e253e15b8e30
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: