Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] RE: Dear _MY_EMAIL_ADDRESS_ 72% Savings ...3 Days Only

7 views

Skip to first unread message

spam...@nil.nil

unread,

Jul 3, 2008, 8:47:47 AM7/3/08

SPAM: RE: Dear _MY_EMAIL_ADDRESS_ 72% Savings ...3 Days Only

Illegal sale of prescription drugs without prescription
webcom...@ora.fda.gov
---
The sites have recently removed four items,
BCAA Mass Creatine Pure
GlutaPower Loxitane
and added eighteen,
Alesse Ampicillin
Artane Aygestin
Carisoprodol Cialis Super Active
Clozaril Duetact
Glyset Home Cholesterol Test
Indinavir Januvia
Midamor Orlistat
Precose Soma
Xenical Zofran
and then added one more,
Florinef
---

Spam FROM: bzq-219-113-72.static.bezeqint.net [62.219.113.72]
ab...@bezeqint.net,postm...@bezeqint.net

This is the modern form of email advertising consisting
of a modification of an original mailer's content.
Be Green! Save Electrons! It is recycled mail with the
original content used to foil anti-spam filters.
At the least it is a copyright violation ((C)2008 Microsoft).

Spam CONTENT: Microsoft Featured Offer email promotion
ab...@microsoft.com,ad...@microsoft.com,
ab...@msadcenter.msn.com,postm...@msadcenter.msn.com,
ab...@msn.com,ad...@msn.com

The original URLs have been modified to the:

Many of the support email address domains have been "lost"
(there are no nameserver records in the root servers) though
one can find resolutions of the MX records (the mail servers)
pointing to IP address 194.135.105.153 on relcom.{ru,net} which
is open on port 25. However, as one has to know the old nameservers
in order to find this mail server, I will pass on it this time.

The support site at canadianmeds-support.com has also been
"lost" (though, again, one can get a resolution if one knows
the nameservers to query) but we do have one site with
nameservers listed in the root servers, canadian-pharmacy-support.info,
*HOWEVER* its entries seem to have been removed from the Canadian
Pharmacy nameservers, ns[1-5].adverdomain.com, *BUT* it is up at
three of the IP addresses of the nameservers themselves, 59.37.31.66,
79.135.167.58 and 89.187.48.14, along with a few nearby IP addresses.

This spam operation keeps registering and losing domains.
It keeps finding registrars who are willing (at least for
a time) to service its domains. Currently we have:

REGISTRAR (spamvertized web hosts): hichina.com
The spamvertized web hosts have domains
mightprocess.com wellcontinue.com brotherjust.com
teethfive.com facecontain.com
all of which are serviced by hichina.com.
Hopefully the spammer will not find them so accommodating
as he found/finds xinnet.
ab...@hichina.com,xia...@hichina.com,postm...@hichina.com,
sup...@hichina.com,ad...@hichina.com

REGISTRAR (spamvertized web hosts: nameservers): Beijing Innovative Linkage Technology Ltd. DBA DNS.COM.CN
The nameserver domain, nicepeopleworld.com, is serviced by
Beijing Innovative Linkage Technology Ltd. DBA DNS.COM.CN
Hopefully the spammer will not find dns.com.cn so accommodating as he
found xinnet.
postm...@dns.com.cn,ad...@dns.com.cn,sup...@dns.com.cn,le...@dns.com.cn,
secu...@dns.com.cn,he...@dns.com.cn,li...@dns.com.cn,
in...@dns.com.cn,ab...@dns.com.cn,n...@dns.com.cn,n...@dns.com.cn,
ro...@dns.com.cn

REGISTRAR: BACKEND SUPPORT: Media Group, Inc. (directnic.com)
The support domain, canadian-pharmacy-support.info, is serviced
by Intercosmos Media Group, Inc. (directnic.com)
b...@i-55.com,ab...@directnic.com,ab...@datasync.com,
hostm...@directnic.com,mbru...@zipa.com

REGISTRAR: BACKEND SUPPORT (nameservers): xinnet
The nameservers for the backend support are ns{1,2,3,4,5}.adverdomain.com,
serviced by
paycenter.com.cn,xinnet.cn,xinnet.com,xinnetdns.com
li...@xinnet.com,postm...@xinnet.com,ad...@xinnet.com,sup...@xinnet.com,
le...@xinnet.com,secu...@xinnet.com,he...@xinnet.com,in...@xinnet.com,
ab...@xinnet.com,n...@xinnet.com,n...@xinnet.com,ro...@xinnet.com,he...@xinnet.com
postm...@paycenter.com.cn,ad...@paycenter.com.cn,sup...@paycenter.com.cn,
le...@paycenter.com.cn,secu...@paycenter.com.cn,he...@paycenter.com.cn,
in...@paycenter.com.cn,ab...@paycenter.com.cn,n...@paycenter.com.cn,
n...@paycenter.com.cn,ro...@paycenter.com.cn,he...@paycenter.com.cn,
postm...@xinnet.cn,ad...@xinnet.cn,sup...@xinnet.cn,
le...@xinnet.cn,secu...@xinnet.cn,he...@xinnet.cn,
in...@xinnet.cn,ab...@xinnet.cn,n...@xinnet.cn,
n...@xinnet.cn,ro...@xinnet.cn,he...@xinnet.cn,
postm...@xinnetdns.com,ad...@xinnetdns.com,sup...@xinnetdns.com,
le...@xinnetdns.com,secu...@xinnetdns.com,he...@xinnetdns.com,
in...@xinnetdns.com,ab...@xinnetdns.com,n...@xinnetdns.com,
n...@xinnetdns.com,ro...@xinnetdns.com,he...@xinnetdns.com

==========
[DETAILS:]

SPAM FROM: bzq-219-113-72.static.bezeqint.net [62.219.113.72]
Which a variation on my email address as the envelope
sender and forged my email address as the "From:" address.

inetnum: 62.219.110.0 - 62.219.155.255
netname: ADSL-CONNECTION-FIXIP
country: IL
remarks: ab...@bezeqint.net
e-mail: hostm...@bezeqint.net

SPAM CONTENT: Microsoft email promotion

Often when I get spam with msadcenter material, the Microsoft
content is encapsulated within [style],[/style] tags and
invisible, leaving only another spammer's content. This time
the Microsoft material itself is shown.

Surely this is Microsoft, as we have:
Microsoft's text content,
'You are receiving this e-mail because you subscribed to MSN Featured Offers.'
'please click the "Unsubscribe" link below. This will not unsubscribe you from
e-mail communications'
along with their copyright notice and links to their option to
stop receiving "this MSN Featured Offers e-mail" (Unsubscribe),
to sign up for more email offers (More Newsletters) and to view
their privacy policy (Privacy)
Š2008 Microsoft | Unsubscribe | More Newsletters | Privacy
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052
along with their web bug, (Naughty, **NAUGHTY!!!**, Microsoft!),
[img src="http://tracking.msadcenter.msn.com/npg.gif?o=1" width=0 height=0]

Well, Microsoft's content has been replaced by

[a href="http://www.wellcontinue.com" target="_blank"]
[img src="http://www.mightprocess.com/3.gif" border=0 alt="Click Here!"][/a]

and Microsoft seems to have outsourced their subscription service
and privacy policy hosting to:

[a href="http://www.brotherjust.com" target="_blank"]Unsubscribe[/a]
[a href="http://www.teethfive.com" target="_blank"]More Newsletters[/a]
[a href="http://www.facecontain.com" target="_blank"]Privacy[/a]

- unless someone has taken their work and done what? Changed the
content and target URLs? No, Microsoft would not allow people to
send out their own copyrighted material without approving the changes.

SPAM CONTENT [image]: http://www.mightprocess.com/3.gif
SPAMVERTIZED URL: http://www.wellcontinue.com
SPAMVERTIZED URL: http://www.brotherjust.com
SPAMVERTIZED URL: http://www.teethfive.com
SPAMVERTIZED URL: http://www.facecontain.com

============================================================
For the host:
"www.mightprocess.com"

NAMESERVERS listed in the root servers for mightprocess.com:
------------------------------------------------------------
mightprocess.com NS ns1.nicepeopleworld.com
mightprocess.com NS ns2.nicepeopleworld.com
mightprocess.com NS ns3.nicepeopleworld.com
mightprocess.com NS ns4.nicepeopleworld.com
ns1.nicepeopleworld.com A 222.186.67.179
ns2.nicepeopleworld.com A 209.200.164.3
ns3.nicepeopleworld.com A 222.186.13.80
ns4.nicepeopleworld.com A 209.200.165.3

[extract from dig]
------------------
dig @209.200.164.3
www.mightprocess.com
A +noqu +noadd +noau +norec
;; flags: qr <-- NON-AUTHORITATIVE

dig @209.200.165.3
www.mightprocess.com
A +noqu +noadd +noau +norec
;; flags: qr <-- NON-AUTHORITATIVE

dig @222.186.13.80
www.mightprocess.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.mightprocess.com A 60.12.105.93

dig @222.186.67.179
www.mightprocess.com
A +noqu +noadd +noau +norec
;; flags: qr aa <-- AUTHORITATIVE and NON-RECURSIVE
www.mightprocess.com A 60.12.105.93
============================================================
The same for each.

The last time I got spam for this site (under other hostnames)
it was up at
59.63.157.80
211.33.54.139 211.33.54.143
218.61.18.139
222.186.12.235
222.186.13.80
so let me check those IP addresses as well as the IP addresses
listed for the nameservers and IP addresses nearby (often this
spammer has his site up at nearby addresses which may later be
used).

I find the site up only at IP addresses 60.12.105.93 and 60.12.105.94
as shown by (I also checked the image host hostname):

* Connected to 60.12.105.93
GET / HTTP/1.1
Host: www.mightprocess.com