CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Complainterator Version 21.6 MAY 22, 2008
Goto page 1, 2, 3, 4  Next
 
Post new topic   Reply to topic       All -> FavForums -> Complainterator [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Blue Security Premium

PostPosted: Fri Apr 04, 2008 8:34 am    Post subject: Complainterator Version 21.6 MAY 22, 2008
Reply with quote

At http://complainterator.com please find the full package for version 21.6 dated May 22, 2008.

21.6 accommodates Xin Net and Beijing Innovative who have used null addresses 4.4.4.1, 4.4.4.2, 4.4.4.3 for name servers

21.5 fixed a problem with .mobi domains

21.4 fixed a problem where lookups failed for domains on .kg (their whois server is faulty)

21.3 has updates to Registrar name server protection, contact addresses, and left/right mouse handling, and also support for the Minefield browser

21.2 has an improved message trailer to report incorrect mail addresses, updates to the contact list, and updates to the registrar DNS protection list.


New in version 21.0 was an in-built table of the top 100 registrar's name server domain names. Previous versions would generate a request to the registrar to remove their own name servers, and users were required to detect these and not send them.

With this version, the likelihood of generating invalid requests is greatly reduced. No more will you see requests to Yahoo, or Google etc. to remove their own servers. You will just see a quick pop-up message informing you that the server detected was either already shut down, or belongs to a registrar, and no message will be generated.

Users are still expected to view the generated message before sending, and also to add additional evidence, such as



Last edited by tembow on Thu May 22, 2008 9:56 am, edited 7 times in total
Back to top
View users profile Send private message Visit posters website AIM Address
pwillener

SRT Trainee
SRT Trainee
Premium Member

Joined: Apr 17, 2006
Posts: 1839
Location: Japan
Premium

PostPosted: Fri Apr 04, 2008 9:38 am    Post subject:
Reply with quote

Thanks! Cool

P.S. can you change the subject line from '20.1' to '21.0' ?

Back to top
View users profile Send private message Visit posters website
Krivoi

Sergeant
Sergeant


Joined: Mar 03, 2008
Posts: 90


PostPosted: Fri Apr 04, 2008 9:06 pm    Post subject:
Reply with quote

Yes - thanks. Smile

The new feature is helpful to DNS novices like me - nonetheless I'll continue to do my best not to request self-termination.

Back to top
View users profile Send private message
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Blue Security Premium

PostPosted: Fri Apr 04, 2008 9:08 pm    Post subject:
Reply with quote

Forgive my typo's - the subject line is now changed to version 21.0

Back to top
View users profile Send private message Visit posters website AIM Address
Krivoi

Sergeant
Sergeant


Joined: Mar 03, 2008
Posts: 90


PostPosted: Sun Apr 06, 2008 7:49 pm    Post subject:
Reply with quote

All working nicely, Tembow. I'm putting this here as it doesn't merit a thread of its own:

I Complainerated phqrmacyrxworld.info, and v21 correctly generates a report for Godaddy and brings up its new "already reported/name server" message to avoid reporting the registrar's own name server. The following encouraging-looking dnsstuff status report appears:

"Domain ID:D24328045-LRMS
Domain Name:PHQRMACYRXWORLD.INFO
Created On:02-Apr-2008 12:30:15 UTC
Last Updated On:02-Apr-2008 12:30:32 UTC
Expiration Date:02-Apr-2009 12:30:15 UTC
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:GODA-045764324"

together with what look like genuine registrant details. I clicked on the link (first time ever!) and it is still live Crying or Very sad ; so I got to pay my first ever visit to a Canadian Health site.

Is this an example of an incomplete removal? If so, are there simple instructions we can send to the name registrar on how to finish off the job?

During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise.

Thanks again.

Back to top
View users profile Send private message
trobbins

SIRT Handler
Premium Member

Joined: Feb 19, 2007
Posts: 1187
Location: USA
Premium

PostPosted: Sun Apr 06, 2008 8:43 pm    Post subject:
Reply with quote

Krivoi wrote:
During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise.

Simple, PHQRMACYRXWORLD.INFO redirects to www1.bjakerturn.com/e/ch/?&pid=_2917

You can report both as "Canadian Health&Care Mall"

Back to top
View users profile Send private message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2895

Premium

PostPosted: Sun Apr 06, 2008 8:49 pm    Post subject:
Reply with quote

Krivoi wrote:
During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise.


bjakerturn.com is the target domain. That is the one the spammers want to keep alive as long as possible. If they only spammed it by its own domain name, spam filters would quickly recognize it and block any message that contained it. (That filtering strategy blocks a lot of our reports from reaching registrars that use spam filters on their abuse email boxes. Evil or Very Mad )

So they register other "throwaway" domain names that they will use for a day or two and replace. You may say, "But now that ICANN is eliminating the 3-day grace period to give up a domain and get your money back, won't spammers stop doing that?" In this case, it doesn't matter. They aren't using their own money anyway.

See the names in the registrations for those sites? In the case of the Yambo/Bulker.biz brands (My Canadian Pharmacy, International Legal Rx Medication, Canadian Health&Care Mall, VIP Pharmacy ("Viagra+Cialis" or "Viagra Professional Tabs"), Men+Health, and US Drugs,) those are the names/addresses/phone numbers of real people, and they probably have had the domains charged to their real credit/debit cards. You can usually call them up and let them know to check billing statements and bank statements so they can get the accounts cancelled and maybe get the domains suspended. Usually the only fake data are the email addresses, though the spammers are often sloppy with the phone numbers. There is a list at http://spamtrackers.eu/wiki/index.php?title=Fake_yambo_whois of some of the domains that have confirmed fake registration data. Obviously, all of them do, but some registrars won't assume that and won't bother to confirm it for themselves even though required to.

You would think registrars would always suspend domains if they have to refund the money and pay a chargeback fee, but some are unclear on the concept. They figure it's more trouble than it is worth and let the domain remain alive. Meanwhile, the spammers continue to register domains with these clueless registrars, while other registrars that quickly suspend fraudulent domains will stop getting stuck with new fake charges as the spammers learn to avoid them.

As far as the domain status, you need to look at the traversal. It's more up to date, and it shows you if the nameservers have been changed and the domain parked, or if it is completely suspended ("no a record"). All those "clientWhateverProhibited's" can be placed by registrars who want to prevent changes being made without going through them, but if it freezes the site in its active status, that's not even an attempt at a shutdown.

Back to top
View users profile Send private message
Krivoi

Sergeant
Sergeant


Joined: Mar 03, 2008
Posts: 90


PostPosted: Sun Apr 06, 2008 9:11 pm    Post subject:
Reply with quote

trobbins wrote:

Simple, PHQRMACYRXWORLD.INFO redirects to www1.bjakerturn.com/e/ch/?&pid=_2917

You can report both as "Canadian Health&Care Mall"
Thanks - consider it done!

Quote:
bjakerturn.com is the target domain. That is the one the spammers want to keep alive as long as possible.


Wow, AlphaCentauri, I am beginning to get it!

I also like the idea of contacting the payer direct, and in any case in the meantime you can count on my anti-spam group to keep hammering away every way we can.

I see now that one of the 4 name servers had a .ru ending instead of the usual ones.

Back to top
View users profile Send private message
ahoier

SIRT Handler


Joined: Jan 14, 2006
Posts: 1118
Location: USA

PostPosted: Mon Apr 07, 2008 5:04 am    Post subject:
Reply with quote

Yea, there's been an increase in russian-registrar-use....likely because of the hammer that is beginning to fall ontop of XIN Net.....? Who knows...

But obviously, new registrar, means new rules, terms, conditions, etc....the spammers have found the hole (Russia is fairly lax on EVERYTHING from what I've seen.....they even sell rootkits on the streets so I hear....?) - so it's gonna take a lot to beat down these russian sites.

Look at the spam from all angles:

1_ malware (innocent users unknowingly infected by the malware that is running these webservers, nameservers, mail servers, etc...)
2_ botnets - well, I guess that coincides with the 1st...?
3_ fraud/identity theft (new site registrantions are likely registered using the financial details of past "customers"....? though I don't know if this can be backed-up...? Good possibility though).
4_ counterfeiting - Viagra, etc. - msot of the pharmaceuticals, jewelery, etc. is counterfeit, illegal to be selling (if the buyer even receives the item(s) they purchase), and most display fake certifications on their sites.
5_ fake logos/branding (many sites contain BBB logos which are fake, some show fake VeriSign or HackerSafe logos which are fake, these companies have abuse forms that can be filed through as well, to get them on the ball too).

Let 'em spam, it only makes the digital paper trail longer Wink

Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger MSN Messenger
pwillener

SRT Trainee
SRT Trainee
Premium Member

Joined: Apr 17, 2006
Posts: 1839
Location: Japan
Premium

PostPosted: Mon Apr 07, 2008 5:54 am    Post subject:
Reply with quote

Complainterator 21.0 still sometimes mixes up header and message body information; example

Quote:
To: cnreg@dns.com.cn; huyan@dns.com.cn
Cc: spam@ccert.edu.cn
Subject: Removal request: b546ec5a89.com


DIRECT INFORMATION PVT LTD DBA PUBLICDOMAINREGISTRY.COM
Dear Registrar

This is a request for you to remove the spamvertized illegal domain makebucks.biz

EVIDENCE

From this link, you can see that your company is the registrar for the site
> http://who.is/whois-net/ip-address/makebucks.biz/

ACTION

Removal instructions for 'spammed domains' are in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice (for China)

Once removed with that method, this Complaint Generator tool will create no more requests on this domain.

Thank you for your efforts to reduce spam and to keep criminals from abusing your terms of service.

-----
This message was generated by the Complainterator - www.complainterator.com
-----


Environment: Windows XP Pro SP2, Outlook 2003 SP3 (Exchange Server)

It may have to do with a message (NDR for the sino-i.com address) arriving during message composition. This has the effect of temporarily slowing down Outlook. Could this somehow confuse the Complainterator?

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Blue Security Premium

PostPosted: Mon Apr 07, 2008 9:56 pm    Post subject:
Reply with quote

What is in thecomplainterator \Archive folder for b546ec5a89.com

Back to top
View users profile Send private message Visit posters website AIM Address
pwillener

SRT Trainee
SRT Trainee
Premium Member

Joined: Apr 17, 2006
Posts: 1839
Location: Japan
Premium

PostPosted: Tue Apr 08, 2008 2:33 am    Post subject:
Reply with quote

makebucks.biz wrote:
To: abuse@publicdomainregistry.com
cc:
Subject: Removal request: makebucks.biz
DIRECT INFORMATION PVT LTD DBA PUBLICDOMAINREGISTRY.COM
Dear Registrar

This is a request for you to remove the spamvertized illegal domain makebucks.biz

EVIDENCE

From this link, you can see that your company is the registrar for the site
> http://who.is/whois-net/ip-address/makebucks.biz/

ACTION

Removal instructions for 'spammed domains' are in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice (for China)

Once removed with that method, this Complaint Generator tool will create no more requests on this domain.

Thank you for your efforts to reduce spam and to keep criminals from abusing your terms of service.

-----
This message was generated by the Complainterator - www.complainterator.com
-----

b546ec5a89.com wrote:
To: cnreg@dns.com.cn,huyan@dns.com.cn
cc: spam@ccert.edu.cn
Subject: Removal request: b546ec5a89.com
BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Dear Registrar

This is a request for you to remove the domain b546ec5a89.com
and to remove its name server Address record ns7.b546ec5a89.com [75.131.71.44], ns6.b546ec5a89.com [98.196.196.236], ns3.b546ec5a89.com [71.226.169.104], ns5.b546ec5a89.com [75.131.71.44], and ns2.b546ec5a89.com [74.73.233.121]

EVIDENCE

From this link, you can see that it is used as a name server for a spammed site
> http://www.dnsstuff.com/tools/traversal.ch?domain=makebucks.biz&type=a&token=complainterator&src=complainterator

From this link, you can see that your company is the name server's registrar
> http://who.is/whois-net/ip-address/b546ec5a89.com/

ACTION

Use the removal instructions for name servers in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice (for China)

Once removed in that manner, this Complaint Generator tool will generate no more requests on this domain.

Thank you for your efforts to reduce spam and to keep criminals from abusing your terms of service.

-----
This message was generated by the Complainterator - www.complainterator.com
-----

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Blue Security Premium

PostPosted: Tue Apr 08, 2008 3:53 am    Post subject:
Reply with quote

The generated messages are OK, but the process of puting them into the email got interrupted, so that between posting the address and the body, the Outlook application lost focus.

I have not experienced this, so I will need to see if it is possible to avoid it.

Back to top
View users profile Send private message Visit posters website AIM Address
pwillener

SRT Trainee
SRT Trainee
Premium Member

Joined: Apr 17, 2006
Posts: 1839
Location: Japan
Premium

PostPosted: Tue Apr 08, 2008 5:04 am    Post subject:
Reply with quote

Maybe I am the only one to experience this. My Outlook - connected to an Exchange Server, located at the other side of the planet - has a tendency to hang for a short while (just seconds) when it communicates with the server.

I usually notice the incorrect headers and correct them manually (or run the domain one more time). Maybe there is really nothing you can do on the Complainterator side.

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Blue Security Premium

PostPosted: Tue Apr 08, 2008 7:43 am    Post subject: Just the exe zipped
Reply with quote

Unzip this and put it into the existing folder, replacing complainterator.exe
See if that fixes the Outlook problem

obsolete version removed
See http://complainterator.com download



Last edited by tembow on Mon May 12, 2008 9:19 pm, edited 2 times in total
Back to top
View users profile Send private message Visit posters website AIM Address
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Complainterator All times are GMT
Goto page 1, 2, 3, 4  Next
Page 1 of 4

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer