[email] [counterfeit] [74.204.134.48] (ovablero.com / finodns.com) What about a road trip? All the guys are in!
TomezNet
IP 74.204.134.48
(at parasun.com / charter.com)
Spamvert:
www.ovablero.com IP 210.14.128.120
(SBL56347 / SBL58246) (at APNIC / ZBYD / zbydoffice.com.cn)
Redirected to:
http://ovablero.com/rp/
counterfeit watches spam with sender identity and headers forgery.
Title: Diamond Watches (a.k.a Diamond Replicas)
More spammer sightings:
http://groups.google.com/groups/search?q=%22Diamond+Watches%22+group%3A*abuse&start=0&scoring=d&
More info below:
====================
X-SID-PRA: [MUNGED]
X-Message-Info: 6sSXyD95QpVVYN6X2x4b71IOJmZpi8rTUz+8bXKZAmLRXg/
e3YaJq8GrSR0CdaQqL32ZO5kVs3md5tFgoDIxEQ==
Received: from tomts1-srv.bellnexxia.net ([209.226.175.113]) by bay0-
pamc1-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sat, 1 Sep 2007 16:53:18 -0700
Received: from [MUNGED]
by toip22.srvr.bell.ca with ESMTP; 01 Sep 2007 19:53:10 -0400
Received: (qmail 3394 invoked by uid 110); 1 Sep 2007 18:35:10 -0400
Delivered-To: [MUNGED]
Received: (qmail 3378 invoked from network); 1 Sep 2007 18:35:10 -0400
Received: from unknown (HELO meveran-oqf2zij) (74.204.134.48)
by [MUNGED] with SMTP; 1 Sep 2007 18:35:10 -0400
Return-path: <[MUNGED]>
X-Original-To: [MUNGED]
Delivered-To: [MUNGED]
Received: from [74.204.134.48] (port=13517 helo=74.204.134.48)
by [MUNGED] with ESMTP id 05876608537
for <[MUNGED]>; Sat, 01 Sep 2007 17:31:37 --600 (EET)
From: [MUNGED]
To: [MUNGED]
Subject: What about a road trip? All the guys are in!
Date: Sat, 01 Sep 2007 17:31:37 --600 (EET)
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: O10oiy8O10W3MVi070nGDG2On6C7BP==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Message-ID: <989e01c7ecbd$01c7ecbd$3086cc4a@[MUNGED]>
Status:
X-OriginalArrivalTime: 01 Sep 2007 23:53:18.0230 (UTC)
FILETIME=[4501C360:01C7ECF3]
Do you have a special date coming up?
Maybe a wedding, anniversary or the birthday of your 15 year-old
daughter...
These are the perfect times to give them themost unforgettable gift of
all: JEWELS and WATCHES.
http://www.ovablero.com
Nothing says "I love you" better than a 2 thousand dollar watch, BUT
you will not pay that much.
Because there is a handmade replica place just for you, all widely-
known brands and models.
For girlfriends, boyfriends, husbands and wives.
With our promotion you can even get one for your mother-in-law!
GET THE PROMOTION YOU'VE BEEN WAITING FOR! http://www.ovablero.com
Have a nice Day!
-- END OF SPAM --
SEE sender identity and headers forgery by spammer spoofing our
domain.
See:
IP 74.204.134.48
http://www.moensted.dk/spam/?addr=74.204.134.48
http://spamcop.net/w3m?action=checkblock&ip=74.204.134.48
OrgName: Allegiance Communications, LLC
OrgID: BMGL-2
NetRange: 74.204.128.0 - 74.204.159.255
CIDR: 74.204.128.0/19
NetName: ALLEGIANCECOMMUNICATIONSLLC
NetHandle: NET-74-204-128-0-1
Parent: NET-74-0-0-0-0
NetType: Direct Allocation
postmaster and abuse[]libertypr.com are listed in rfc-ignorant.org
database
route: 74.204.128.0/20
descr: CHTR-IL-Public
origin: AS19444
mnt-by: CHARTER-MNT
changed: danny...@chartercom.com
AS Name: CHARTER-NET-HKY-NC - Charter Communications
http://www.cidr-report.org/cgi-bin/as-report?as=20115
17 SBL/ROKSO listings for IPs under the responsibility of charter.com
http://www.spamhaus.org/sbl/listings.lasso?isp=charter.com
Spamvert URL:
http://www.ovablero.com/
HTTP/1.1 302 Found
Date: Sun, 02 Sep 2007 17:48:18 GMT
Server: Apache/2.2.4 (FreeBSD) mod_ssl/2.2.4 OpenSSL/0.9.7e-p1 DAV/2
PHP/5.2.3 with Suhosin-Patch
X-Powered-By: PHP/5.2.3
Location: http://ovablero.com/rp/index.php?mid=10016&fid=PoWjfKskwsLFjsFlsjfe
Content-Length: 0
Connection: close
Content-Type: text/html
Redirected to:
http://ovablero.com/rp/index.php
See:
ovablero.com IP 210.14.128.120
(Spammer OLD IP 124.254.2.231, 58.83.12.6, 124.254.2.230)
ns1.finodns.com [58.83.12.6] [TTL=172800] [CN]
ns2.finodns.com [210.14.128.120] [TTL=172800] [CN]
NS records at nameservers are:
dns1.ovablero.com [no glue provided] [TTL=60]
dns2.ovablero.com [no glue provided] [TTL=60]
OLD:
ns1.modadns.com [58.83.12.6] [TTL=172800] [CN]
ns2.modadns.com [210.14.128.120] [TTL=172800] [CN] (OLD IP
124.254.2.231)
SOA record [TTL=2048] is:
Primary nameserver: ns1.myserver.com.
Hostmaster E-mail address: hostm...@ovablero.com
Serial #: 1188294464 (OLD 1186864237, 1184480567)
ovablero.com has no MX records
www.ovablero.com CNAME ovablero.com [TTL=60]
http://www.moensted.dk/spam/?addr=210.14.128.120
http://www.spamhaus.org/query/bl?ip=210.14.128.120
SEE Also:
hostnames sharing ip with a-records
ns2.modadns.com
ns2.finodns.com
sustfasc.com
fotechno.com
lendust.com
croctam.com
nocttam.com
domains using this as nameserver
modadns.com(as ns2.modadns.com)
thtechno.com(as ns2.modadns.com)
votechno.com(as ns2.modadns.com)
disrich.com(as ns2.modadns.com)
fotechno.com(as ns2.modadns.com)
lendust.com(as ns2.modadns.com)
croctam.com(as ns2.modadns.com)
sustfasc.com(as ns2.finodns.com)
domains sharing nameservers
modadns.com
thtechno.com
votechno.com
disrich.com
fotechno.com
lendust.com
croctam.com
sustfasc.com
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL56347
210.14.128.0/19 is listed on the Spamhaus Block List (SBL)
07-Jul-2007 00:04 GMT | SR02
ZBYD Technology Co.,Ltd
No response to multiple SBL listings. No response from upstream
CNCGROUP-BJ. Hosting many ROKSO and botnet spam gang's websites and
nameservers.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL58246
210.14.128.120/32 is listed on the Spamhaus Block List (SBL)
30-Aug-2007 02:22 GMT | SR02
bulletproof spam hosting at ZBYD Technology Co.,Ltd
Same bulletproof spam hosting as:
SBL57875 202.142.21.18/32
SBL56425 58.83.12.6/32
Also see:
SBL56347 210.14.128.0/19
9 SBL/ROKSO listings for IPs under the responsibility of cncgroup-bj
http://www.spamhaus.org/sbl/listings.lasso?isp=cncgroup-bj
23 SBL/ROKSO listings for IPs under the responsibility of APNIC
http://www.spamhaus.org/sbl/listings.lasso?isp=APNIC
inetnum: 210.14.128.0 - 210.14.159.255
netname: ZBYD
descr: ZBYD Technology Co.,Ltd
descr: 15A build , xiyongle road ,shijingshan district ,Beijing
country: CN
person: Zheyuan Wang
nic-hdl: ZW620-AP
e-mail: wan...@zbydoffice.com.cn
person: Zhengping Wang
address: Computer Center
address: Tongji University
address: No. 1239 Siping Road
address: Shanghai(200092)
address: P.R.China
phone: +0086 21 502 5080 ext 2845
fax-no: +0086 21 502 8965
e-mail: w...@tju.ihep.ac.cn
nic-hdl: ZW2-CN
notify: address-allo...@cernic.net
changed: sz...@cernic.net
person: Lei An
nic-hdl: LA100-AP
e-mail: al...@zbydoffice.com.cn
mntner: MAINT-CN-ZBN
descr: ZBN
descr: No.499 Weilai Road,Zhengzhou, Henan
country: CN
admin-c: JZ2-CN
tech-c: LD1-CN
upd-to: liz...@vip.zzcatv.com.cn
person: Jianzhong Zhu
nic-hdl: JZ2-CN
e-mail: zhujia...@vip.zzcatv.com.cn
person: Liang Dong
nic-hdl: LD1-CN
e-mail: lian...@vip.zzcatv.com.cn
changed: ip...@cnnic.cn
changed: ip...@cnnic.net.cn
postmaster and abuse[]zbydoffice.com.cn are listed in rfc-ignorant.org
database
AS Name: BJ-GUANGHUAN-AP Beijing Guanghuan Xinwang Digital
http://www.cidr-report.org/cgi-bin/as-report?as=23844
Let see whois:
Checking server [whois.enom.com] => who else?
Registration Service Provided By: NameCheap.com
Contact: sup...@NameCheap.com
Domain name: ovablero.com
Registrant Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsia2007[]pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Administrative Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsi...@pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Technical Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsi...@pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Status: Locked
Name Servers:
ns1.finodns.com
ns2.finodns.com
Creation date: 27 Aug 2007 01:29:09
Expiration date: 27 Aug 2008 01:29:09
More ovablero.com sightings:
http://groups.google.com/groups/search?q=ovablero.com+group%3A*abuse&start=0&scoring=d&
See also more registrant falsia2007[]pop.com.br sightings:
http://groups.google.com/groups/search?q=%22falsia2007%22+group%3A*abuse&qt_s=Search
See also more NameCheap.com spam support sightings:
http://groups.google.com/groups/search?q=NameCheap.com+group%3A*abuse&start=0&scoring=d&
See:
ns1.finodns.com IP 58.83.12.6
ns1.finodns.com has no MX records -> finodns.com has no MX records
http://www.moensted.dk/spam/?addr=58.83.12.6
http://www.spamhaus.org/query/bl?ip=58.83.12.6
More 58.83.12.6 sightings:
http://groups.google.com/groups/search?q=58.83.12.6+group%3A*abuse&qt_s=Search
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51900
58.83.0.0/16 is listed on the Spamhaus Block List (SBL)
27-Apr-2007 08:03 GMT | SR02
tianjian / hylink-cn / bluesky
58.83.0.0/22 and 58.83.4.0/22 are known to be operated by spammers. It
appears the entire /16 is part of the same operation. B-class networks
registered to Hotmail addresses are not reliable.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53280
58.83.12.0/22 is listed on the Spamhaus Block List (SBL)
11-Jul-2007 02:28 GMT | SR02
csallnetlink-cn / BLUESKY
BLUESKY provides bulletproof spam hosting and does not reply to spam
reports or SBL listings.
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL56425
58.83.12.6/32 is listed on the Spamhaus Block List (SBL)
30-Aug-2007 02:12 GMT | SR02
bulletproof DNS and HTTP
28 SBL/ROKSO listings for IPs under the responsibility of bluesky
http://www.spamhaus.org/sbl/listings.lasso?isp=bluesky
SEE Also on the same IP:
58.83.12.6 A disrich.com
58.83.12.6 A ns1.finodns.com
58.83.12.6 A ns1.modadns.com
58.83.12.6 A remtam.com
58.83.12.6 A thtechno.com
58.83.12.6 A votechno.com
hostnames sharing ip with a-records
remtam.com
ns1.modadns.com
thtechno.com
votechno.com
disrich.com
domains using this as nameserver
modadns.com(as ns1.modadns.com)
thtechno.com(as ns1.modadns.com)
votechno.com(as ns1.modadns.com)
disrich.com(as ns1.modadns.com)
fotechno.com(as ns1.modadns.com)
lendust.com(as ns1.modadns.com)
croctam.com(as ns1.modadns.com)
sustfasc.com
ovablero.com
inetnum: 58.83.12.0 - 58.83.15.255
netname: csallnetlink-cn
descr: changsha allnetlink development co.,LTD
country: CN
remarks: w...@allnetlink.com.cn
person: yongcheng wang
nic-hdl: YW811-AP
e-mail: wan...@allnetlink.com.cn
address: changsha allnetlink co., LTD
person: ada chen
nic-hdl: AC893-AP
changed: BLUESKY...@163.COM
Prefix: 58.83.12.0/22
Prefix Name: error
AS: 18118
AS Name: CITICNET AP CITIC Networks Management Co ,Ltd 6 XINYUANNANLU
BEIJING
http://www.cidr-report.org/cgi-bin/as-report?as=18118
Let see whois.enom.com] => who else?
Registration Service Provided By: NameCheap.com
Contact: sup...@NameCheap.com
Domain name: finodns.com
Registrant Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsia2007[]pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Administrative Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsi...@pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Technical Contact:
Mikron Informatica Ltda
Rodolfo Jesus (falsi...@pop.com.br)
+55.632241143
Fax: +55.632241143
R Duque de Caxias 121
Ararauna, RJ 88362
BR
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 10 Aug 2007 21:29:58
Expiration date: 10 Aug 2008 21:29:58
More finodns.com sightings:
http://groups.google.com/groups/search?q=finodns.com+group%3A*abuse&qt_s=Search
See also more eNom spam support sightings:
http://groups.google.com/groups/search?q=eNom+group%3A*abuse&start=0&scoring=d&
Read more:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/5a8790add0f1e2ba
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/667d6d9fa0ca0234
And:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/ea6d4422abca1055
Cheers, Tomez
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see: