Spam my blog and I report your site to Google for banning. You've been warned!
« FTC stock response | Main | Update on spamming related stuff since last night »
January 19, 2005
New spam run. Different IP number
There's a new spam run under way right now. New domain with subdomains.
The details look very similar to before, but the IP number of one domain I checked was different:
219.150.118.16
This one is in China.
inetnum: 219.150.112.0 - 219.150.255.255
netname: CHINATELECOM-ha
descr: CHINANET henan province network
They do have a separate e-mail address for spam. Not the regular abuse one, though. It's differently named, probably to keep the spam down.
Yep, same outfit. These subdomains also have those termination pages:
Example:
----------
This entire database is currently in closing order - Due to miss-proper use of the hosting account
ACCOUNT TERMINATED !
----------
Hmmm, I tried a number of the old URL's pointing for Verio's box. The box is still up, but so far I haven't been able to find even one URL that doesn't have a 301 permanently moved to some other host?
Allthough some of the spammed domains still are on that box, Fidelityfunding has been moved to that same Chinese IP number.
Posted by Ann at January 19, 2005 12:44 AM
Trackback Pings
TrackBack URL for this entry:
http://www.annelisabeth.com/blog/mt-tb.cgi/118
Comments
Yes... online-deals-4u dot info also points to the same IP:
Domain ID:D6528908-LRMS
Domain Name:ONLINE-DEALS-4U.INFO
Created On:28-Sep-2004 01:31:13 UTC
Last Updated On:29-Oct-2004 20:21:31 UTC
Expiration Date:28-Sep-2005 01:31:13 UTC
Sponsoring Registrar:R245-LRMS
Status:CLIENT LOCK
Status:OK
Registrant ID:C6716231-LRMS
Registrant Name:Angie Ashanti
Registrant Organization:Angie Ashanti
Registrant Street1:Weatherwood Ln
Registrant Street2:11
Registrant City:Aurora
Registrant State/Province:Illinois
Registrant Postal Code:72377
Registrant Country:US
Registrant Phone:+1.8433260401
Registrant Email:contact11@support-24x7.biz
Admin ID:C6716231-LRMS
Admin Name:Angie Ashanti
Admin Organization:Angie Ashanti
Admin Street1:Weatherwood Ln
Admin Street2:11
Admin City:Aurora
Admin State/Province:Illinois
Admin Postal Code:72377
Admin Country:US
Admin Phone:+1.8433260401
Admin Email:contact11@support-24x7.biz
Billing ID:C6716231-LRMS
Billing Name:Angie Ashanti
Billing Organization:Angie Ashanti
Billing Street1:Weatherwood Ln
Billing Street2:11
Billing City:Aurora
Billing State/Province:Illinois
Billing Postal Code:72377
Billing Country:US
Billing Phone:+1.8433260401
Billing Email:contact11@support-24x7.biz
Tech ID:C6716231-LRMS
Tech Name:Angie Ashanti
Tech Organization:Angie Ashanti
Tech Street1:Weatherwood Ln
Tech Street2:11
Tech City:Aurora
Tech State/Province:Illinois
Tech Postal Code:72377
Tech Country:US
Tech Phone:+1.8433260401
Tech Email:contact11@support-24x7.biz
Name Server:NS0.DNS2005.NET
Name Server:NS1.DNS2005.NET
Again, support-24x7.biz points to:
217.70.178.17
217.70.180.17
Domain Name: SUPPORT-24X7.BIZ
Domain ID: D7437648-BIZ
Sponsoring Registrar: GANDI SARL
Sponsoring Registrar IANA ID: 81
Domain Status: ok
Registrant ID: O-854424-GANDI
Registrant Name: Ron Miles
Registrant Organization: Phentermine Deals
Registrant Address1: P.O.box 710
Registrant City: St John's, English Harbour
Registrant Postal Code: 2003
Registrant Country: Antigua and Barbuda
Registrant Country Code: AG
Registrant Phone Number: +268.4606129
Registrant Email: 99f8210a45bbd8f39062cf022ba867b7-856213@owner.gandi.net
Administrative Contact ID: RM957-GANDI
Administrative Contact Name: Ron Miles
Administrative Contact Organization: Phentermine Deals
Administrative Contact Address1: P.O.box 713
Administrative Contact City: St John's, English Harbour
Administrative Contact Postal Code: 2003
Administrative Contact Country: Antigua and Barbuda
Administrative Contact Country Code: AG
Administrative Contact Phone Number: +268.4606129
Administrative Contact Email: dea8e5907adc69b07c4df20c207e1894-rm957@contact.gandi.net
Billing Contact ID: AR41-GANDI
Billing Contact Name: CONTACT NOT AUTHORITATIVE see http://www.gandi.net/whois
Billing Contact Organization: Gandi SARL
Billing Contact Address1: 38 rue Notre-Dame de Nazareth
Billing Contact City: Paris
Billing Contact Postal Code: 75003
Billing Contact Country: France
Billing Contact Country Code: FR
Billing Contact Email: support@gandi.net
Technical Contact ID: AR41-GANDI
Technical Contact Name: CONTACT NOT AUTHORITATIVE see http://www.gandi.net/whois
Technical Contact Organization: Gandi SARL
Technical Contact Address1: 38 rue Notre-Dame de Nazareth
Technical Contact City: Paris
Technical Contact Postal Code: 75003
Technical Contact Country: France
Technical Contact Country Code: FR
Technical Contact Email: support@gandi.net
Name Server: FULL1.GANDI.NET
Name Server: FULL2.GANDI.NET
Created by Registrar: GANDI SARL
Last Updated by Registrar: GANDI SARL
Domain Registration Date: Tue Jul 27 06:48:49 GMT 2004
Domain Expiration Date: Tue Jul 26 23:59:59 GMT 2005
Domain Last Updated Date: Thu Aug 26 15:05:55 GMT 2004
And interestingly the nameservers of online-deals-4u dot info, dns2005.net, also has the same info:
domain: DNS2005.NET
owner-address: Phentermine Deals
owner-address: P.O.box 710
owner-address: 2003
owner-address: St John's, English Harbour
owner-address: Antigua and Barbuda
owner-phone: +268.4606129
owner-e-mail: 99f8210a45bbd8f39062cf022ba867b7-856213@owner.gandi.net
admin-c: RM957-GANDI
tech-c: AR41-GANDI
bill-c: RM957-GANDI
nserver: ns0.dns2005.net 64.234.220.141
nserver: ns1.dns2005.net 64.234.220.141
reg_created: 2004-10-12 10:20:26
expires: 2005-10-12 10:20:26
created: 2004-10-12 16:20:24
changed: 2004-10-12 16:42:24
person: Ron Miles
nic-hdl: RM957-GANDI
address: Phentermine Deals
address: P.O.box 713
address: 2003
address: St John's, English Harbour
address: Antigua and Barbuda
phone: +268.4606129
e-mail: dea8e5907adc69b07c4df20c207e1894-rm957@contact.gandi.net
lastupdated: 2004-11-29 01:08:27
person: GANDI Auto Register 4.1
nic-hdl: AR41-GANDI
address: GANDI
address: 38 rue Notre-Dame de Nazareth
address: F-75003
address: Paris
address: France
phone: N/A
e-mail: support@gandi.net
And the DNS records show shetef dot com again.
Posted by: ady at January 19, 2005 01:55 AM