|
Donation/Premium |
|
 |
|
|
|
|
|
|
|
 |
 |
| View previous topic :: View next topic |
| Author |
Message |
tembow
Blue Angel Premium Member
 Joined: Oct 10, 2005 Posts: 2945
|
Posted: Fri Apr 04, 2008 8:34 am Post subject: Complainterator Version 21.6 MAY 22, 2008 |
|
|
At http://complainterator.com please find the full package for version 21.6 dated May 22, 2008.
21.6 accommodates Xin Net and Beijing Innovative who have used null addresses 4.4.4.1, 4.4.4.2, 4.4.4.3 for name servers
21.5 fixed a problem with .mobi domains
21.4 fixed a problem where lookups failed for domains on .kg (their whois server is faulty)
21.3 has updates to Registrar name server protection, contact addresses, and left/right mouse handling, and also support for the Minefield browser
21.2 has an improved message trailer to report incorrect mail addresses, updates to the contact list, and updates to the registrar DNS protection list.
New in version 21.0 was an in-built table of the top 100 registrar's name server domain names. Previous versions would generate a request to the registrar to remove their own name servers, and users were required to detect these and not send them.
With this version, the likelihood of generating invalid requests is greatly reduced. No more will you see requests to Yahoo, or Google etc. to remove their own servers. You will just see a quick pop-up message informing you that the server detected was either already shut down, or belongs to a registrar, and no message will be generated.
Users are still expected to view the generated message before sending, and also to add additional evidence, such as
Last edited by tembow on Thu May 22, 2008 9:56 am, edited 7 times in total |
|
| Back to top |
|
 |
pwillener
SRT Trainee
 Premium Member
 Joined: Apr 17, 2006 Posts: 1839 Location: Japan
|
Posted: Fri Apr 04, 2008 9:38 am Post subject: |
|
|
Thanks!
P.S. can you change the subject line from '20.1' to '21.0' ?
|
|
| Back to top |
|
 |
Krivoi
Sergeant

 Joined: Mar 03, 2008 Posts: 90
|
Posted: Fri Apr 04, 2008 9:06 pm Post subject: |
|
|
Yes - thanks.
The new feature is helpful to DNS novices like me - nonetheless I'll continue to do my best not to request self-termination.
|
|
| Back to top |
|
 |
tembow
Blue Angel Premium Member
 Joined: Oct 10, 2005 Posts: 2945
|
Posted: Fri Apr 04, 2008 9:08 pm Post subject: |
|
|
Forgive my typo's - the subject line is now changed to version 21.0
|
|
| Back to top |
|
 |
Krivoi
Sergeant

 Joined: Mar 03, 2008 Posts: 90
|
Posted: Sun Apr 06, 2008 7:49 pm Post subject: |
|
|
All working nicely, Tembow. I'm putting this here as it doesn't merit a thread of its own:
I Complainerated phqrmacyrxworld.info, and v21 correctly generates a report for Godaddy and brings up its new "already reported/name server" message to avoid reporting the registrar's own name server. The following encouraging-looking dnsstuff status report appears:
"Domain ID:D24328045-LRMS
Domain Name:PHQRMACYRXWORLD.INFO
Created On:02-Apr-2008 12:30:15 UTC
Last Updated On:02-Apr-2008 12:30:32 UTC
Expiration Date:02-Apr-2009 12:30:15 UTC
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:GODA-045764324"
together with what look like genuine registrant details. I clicked on the link (first time ever!) and it is still live ; so I got to pay my first ever visit to a Canadian Health site.
Is this an example of an incomplete removal? If so, are there simple instructions we can send to the name registrar on how to finish off the job?
During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise.
Thanks again.
|
|
| Back to top |
|
 |
trobbins
SIRT Handler Premium Member
 Joined: Feb 19, 2007 Posts: 1187 Location: USA
|
Posted: Sun Apr 06, 2008 8:43 pm Post subject: |
|
|
| Krivoi wrote: | | During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise. |
Simple, PHQRMACYRXWORLD.INFO redirects to www1.bjakerturn.com/e/ch/?&pid=_2917
You can report both as "Canadian Health&Care Mall"
|
|
| Back to top |
|
 |
AlphaCentauri
SIRT Handler Premium Member
 Joined: Nov 20, 2003 Posts: 2895
|
Posted: Sun Apr 06, 2008 8:49 pm Post subject: |
|
|
| Krivoi wrote: | | During connection I noticed the message "waiting for www1.bjakerturn.com". Running that through Complainterator yields interesting results. Please could someone confirm and advise. |
bjakerturn.com is the target domain. That is the one the spammers want to keep alive as long as possible. If they only spammed it by its own domain name, spam filters would quickly recognize it and block any message that contained it. (That filtering strategy blocks a lot of our reports from reaching registrars that use spam filters on their abuse email boxes. )
So they register other "throwaway" domain names that they will use for a day or two and replace. You may say, "But now that ICANN is eliminating the 3-day grace period to give up a domain and get your money back, won't spammers stop doing that?" In this case, it doesn't matter. They aren't using their own money anyway.
See the names in the registrations for those sites? In the case of the Yambo/Bulker.biz brands (My Canadian Pharmacy, International Legal Rx Medication, Canadian Health&Care Mall, VIP Pharmacy ("Viagra+Cialis" or "Viagra Professional Tabs"), Men+Health, and US Drugs,) those are the names/addresses/phone numbers of real people, and they probably have had the domains charged to their real credit/debit cards. You can usually call them up and let them know to check billing statements and bank statements so they can get the accounts cancelled and maybe get the domains suspended. Usually the only fake data are the email addresses, though the spammers are often sloppy with the phone numbers. There is a list at http://spamtrackers.eu/wiki/index.php?title=Fake_yambo_whois of some of the domains that have confirmed fake registration data. Obviously, all of them do, but some registrars won't assume that and won't bother to confirm it for themselves even though required to.
You would think registrars would always suspend domains if they have to refund the money and pay a chargeback fee, but some are unclear on the concept. They figure it's more trouble than it is worth and let the domain remain alive. Meanwhile, the spammers continue to register domains with these clueless registrars, while other registrars that quickly suspend fraudulent domains will stop getting stuck with new fake charges as the spammers learn to avoid them.
As far as the domain status, you need to look at the traversal. It's more up to date, and it shows you if the nameservers have been changed and the domain parked, or if it is completely suspended ("no a record"). All those "clientWhateverProhibited's" can be placed by registrars who want to prevent changes being made without going through them, but if it freezes the site in its active status, that's not even an attempt at a shutdown.
|
|
| Back to top |
|
 |
Krivoi
Sergeant

 Joined: Mar 03, 2008 Posts: 90
|
Posted: Sun Apr 06, 2008 9:11 pm Post subject: |
|
|
| trobbins wrote: |
Simple, PHQRMACYRXWORLD.INFO redirects to www1.bjakerturn.com/e/ch/?&pid=_2917
You can report both as "Canadian Health&Care Mall" | Thanks - consider it done!
| Quote: | | bjakerturn.com is the target domain. That is the one the spammers want to keep alive as long as possible. |
Wow, AlphaCentauri, I am beginning to get it!
I also like the idea of contacting the payer direct, and in any case in the meantime you can count on my anti-spam group to keep hammering away every way we can.
I see now that one of the 4 name servers had a .ru ending instead of the usual ones.
|
|
| Back to top |
|
 |
ahoier
SIRT Handler
 Joined: Jan 14, 2006 Posts: 1118 Location: USA
|
Posted: Mon Apr 07, 2008 5:04 am Post subject: |
|
|
Yea, there's been an increase in russian-registrar-use....likely because of the hammer that is beginning to fall ontop of XIN Net.....? Who knows...
But obviously, new registrar, means new rules, terms, conditions, etc....the spammers have found the hole (Russia is fairly lax on EVERYTHING from what I've seen.....they even sell rootkits on the streets so I hear....?) - so it's gonna take a lot to beat down these russian sites.
Look at the spam from all angles:
1_ malware (innocent users unknowingly infected by the malware that is running these webservers, nameservers, mail servers, etc...)
2_ botnets - well, I guess that coincides with the 1st...?
3_ fraud/identity theft (new site registrantions are likely registered using the financial details of past "customers"....? though I don't know if this can be backed-up...? Good possibility though).
4_ counterfeiting - Viagra, etc. - msot of the pharmaceuticals, jewelery, etc. is counterfeit, illegal to be selling (if the buyer even receives the item(s) they purchase), and most display fake certifications on their sites.
5_ fake logos/branding (many sites contain BBB logos which are fake, some show fake VeriSign or HackerSafe logos which are fake, these companies have abuse forms that can be filed through as well, to get them on the ball too).
Let 'em spam, it only makes the digital paper trail longer 
|
|
| Back to top |
|
 |
pwillener
SRT Trainee
 Premium Member
 Joined: Apr 17, 2006 Posts: 1839 Location: Japan
|
Posted: Mon Apr 07, 2008 5:54 am Post subject: |
|
|
Complainterator 21.0 still sometimes mixes up header and message body information; example
Environment: Windows XP Pro SP2, Outlook 2003 SP3 (Exchange Server)
It may have to do with a message (NDR for the sino-i.com address) arriving during message composition. This has the effect of temporarily slowing down Outlook. Could this somehow confuse the Complainterator?
|
|
| Back to top |
|
 |
tembow
Blue Angel Premium Member
 Joined: Oct 10, 2005 Posts: 2945
|
Posted: Mon Apr 07, 2008 9:56 pm Post subject: |
|
|
What is in thecomplainterator \Archive folder for b546ec5a89.com
|
|
| Back to top |
|
 |
pwillener
SRT Trainee
 Premium Member
 Joined: Apr 17, 2006 Posts: 1839 Location: Japan
|
Posted: Tue Apr 08, 2008 2:33 am Post subject: |
|
|
|
|
| Back to top |
|
 |
tembow
Blue Angel Premium Member
 Joined: Oct 10, 2005 Posts: 2945
|
Posted: Tue Apr 08, 2008 3:53 am Post subject: |
|
|
The generated messages are OK, but the process of puting them into the email got interrupted, so that between posting the address and the body, the Outlook application lost focus.
I have not experienced this, so I will need to see if it is possible to avoid it.
|
|
| Back to top |
|
 |
pwillener
SRT Trainee
 Premium Member
 Joined: Apr 17, 2006 Posts: 1839 Location: Japan
|
Posted: Tue Apr 08, 2008 5:04 am Post subject: |
|
|
Maybe I am the only one to experience this. My Outlook - connected to an Exchange Server, located at the other side of the planet - has a tendency to hang for a short while (just seconds) when it communicates with the server.
I usually notice the incorrect headers and correct them manually (or run the domain one more time). Maybe there is really nothing you can do on the Complainterator side.
|
|
| Back to top |
|
 |
tembow
Blue Angel Premium Member
 Joined: Oct 10, 2005 Posts: 2945
|
Posted: Tue Apr 08, 2008 7:43 am Post subject: Just the exe zipped |
|
|
Unzip this and put it into the existing folder, replacing complainterator.exe
See if that fixes the Outlook problem
obsolete version removed
See http://complainterator.com download
Last edited by tembow on Mon May 12, 2008 9:19 pm, edited 2 times in total |
|
| Back to top |
|
 |
|
|
|
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum
|
Powered by phpBB © 2001 phpBB Group
|