[SIRT#192806] MaxGain+ on ofieajie.com / dixatern.com

CastleCops -> SIRT Reports

Author: ahoierLocation: USA PostPosted: Wed Jun 25, 2008 6:46 pm    Post subject: [SIRT#192806] MaxGain+ on ofieajie.com / dixatern.com

Spam Alert
 
 Full Report: CastleCops Link/MaxGain_spam192806.html
 
 Consumed following related reports:

[179723] http://www.ofieajie.com/
[192803] http://www.ofieajie.com/testimonials.php
[192804] http://www.ofieajie.com/privacy.php
[192805] http://www.ofieajie.com/order.php
[192807] http://www.ofieajie.com/faq.php
[192808] http://www.ofieajie.com/counter.php
[192809] http://www.ofieajie.com/#top
[192810] http://www.ofieajie.com/#
Changed status to confirmed spam.IP Converted: 221.230.2.221

dword = 3722838749
hex1 = 0xdde602dd
hex2 = 0xdd.0xe6.0x2.0xdd
oct = 0335.0346.02.0335
View CIDR AS4134 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4134

"4134 | CN | apnic | 2002-08-01 | CHINANET-BACKBONE No.31,Jin-rong Street"<br />
Extended information for AS4134:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn
IP Converted: 124.236.241.91

dword = 2095903067
hex1 = 0x7cecf15b
hex2 = 0x7c.0xec.0xf1.0x5b
oct = 0174.0354.0361.0133
View CIDR AS17672 Report: http://www.cidr-report.org/cgi-bin/as-report?as=17672

"17672 | CN | apnic | 2002-11-18 | CHINATELECOM-HE-AS-AP asn for Hebei Provincial Net of CT"<br />
Extended information for AS17672:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn


Criminal Evidence

See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=MaxGain
or from China: http://www.spamtrackers.hk/wiki/index.php?title=MaxGain
See the McAfee Site Advisor information at http://siteadvisor.com/sites/ofieajie.com


> XIN NET TECHNOLOGY CORPORATION / SINO-I.COM
REGISTRATION OF THE WEB SITE: ofieajie.com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold


> XIN NET TECHNOLOGY CORPORATION / SINO-I.COM
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You can safely suspend them:
ns2.dixatern.com 124.236.241.91 124.236.241.91 Blacklisted China http://rss.uribl.com/ns/dixatern_com.html http://www.spamhaus.org/SBL/sbl.lasso?query=SBL65127
ns1.dixatern.com 221.230.2.221 221.230.2.221 Blacklisted China http://rss.uribl.com/ns/dixatern_com.html http://www.spamhaus.org/query/bl?ip=221.230.2.221 | http://www.spamhaus.org/SBL/sbl.lasso?query=SBL64972

ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold


> CHINANET-BACKBONE No.31,Jin-rong Street (incl. abuse@jsinfo.net, abuse@jlonline.com, abuse@public1.ptt.js.cn, spam@jsinfo.net, anti-spam@ns.chinanet.cn.net)
IP ADDRESS OF HOST: 221.230.2.221
The IP address of this criminal site is within your allocated address space.

This IP address is currently linked with the following fraudulent, criminal-operated domains:
www.tanivaca.com A 221.230.2.221
www.lamiucca.com A 221.230.2.221
www.towowida.com A 221.230.2.221
ns2.muciahea.com A 221.230.2.221
www.flaipnea.com A 221.230.2.221
terewofa.com A 221.230.2.221
swinestaga.com A 221.230.2.221
www.swinestaga.com A 221.230.2.221
www.wocemiha.com A 221.230.2.221
e.paeazia.com A 221.230.2.221
www.gripiema.com A 221.230.2.221
mzbi.posirna.com A 221.230.2.221
www.ensokgoa.com A 221.230.2.221
job.teiusaloa.com A 221.230.2.221
ygcoe.teiusaloa.com A 221.230.2.221
pxg.teiusaloa.com A 221.230.2.221
oylzi.teiusaloa.com A 221.230.2.221
bk.teiusaloa.com A 221.230.2.221
fo.teiusaloa.com A 221.230.2.221
so.teiusaloa.com A 221.230.2.221
fyt.teiusaloa.com A 221.230.2.221
mz.teiusaloa.com A 221.230.2.221
www.vigamiqa.com A 221.230.2.221
www.wehasata.com A 221.230.2.221
www.totihota.com A 221.230.2.221
pifirota.com A 221.230.2.221
ns1.heywiotta.com A 221.230.2.221
wyprj.ilkexza.com A 221.230.2.221
tbfm.ilkexza.com A 221.230.2.221
xptbxp.ilkexza.com A 221.230.2.221
icpmq.ilkexza.com A 221.230.2.221
yt.ilkexza.com A 221.230.2.221
www.aevaetib.com A 221.230.2.221
www.franveeac.com A 221.230.2.221
www.qualietac.com A 221.230.2.221
www.cikalkec.com A 221.230.2.221
www.traimmec.com A 221.230.2.221
ns1.faneanic.com A 221.230.2.221
www.danxiesc.com A 221.230.2.221
cerofoned.com A 221.230.2.221
www.cerofoned.com A 221.230.2.221
www.dujuyted.com A 221.230.2.221
oezriyeba.profilemyspacecomdexcfmfusiactionuserid.com A 221.230.2.221
duwbng.profilemyspacecomdexcfmfusiactionuserid.com A 221.230.2.221
ebino.profilemyspacecomdexcfmfusiactionuserid.com A 221.230.2.221
www.cibalibe.com A 221.230.2.221
www.socolace.com A 221.230.2.221
shoezplace.com A 221.230.2.221
valkaece.com A 221.230.2.221
ttsdi.valkaece.com A 221.230.2.221
vryytp.valkaece.com A 221.230.2.221
www.tisigece.com A 221.230.2.221
www.wylenece.com A 221.230.2.221
www.sjfatice.com A 221.230.2.221
www.towadede.com A 221.230.2.221
tidide.com A 221.230.2.221
www.gafipode.com A 221.230.2.221
talnacee.com A 221.230.2.221
ns2.lakenteee.com A 221.230.2.221
www.jimalmee.com A 221.230.2.221
ns1.jmapeanee.com A 221.230.2.221
www.usatenee.com A 221.230.2.221
toritife.com A 221.230.2.221
www.secatyfe.com A 221.230.2.221
www.kaneahe.com A 221.230.2.221
www.butirohe.com A 221.230.2.221
sacatohe.com A 221.230.2.221
posirkaie.com A 221.230.2.221
www.ferailoie.com A 221.230.2.221
timeatie.com A 221.230.2.221
qasisake.com A 221.230.2.221
www.neysoike.com A 221.230.2.221
limtanke.com A 221.230.2.221
poveale.com A 221.230.2.221
tryapiale.com A 221.230.2.221
www.mijjaele.com A 221.230.2.221
www.stiackle.com A 221.230.2.221
ns2.coasterle.com A 221.230.2.221
www.sabeatle.com A 221.230.2.221
www.talumame.com A 221.230.2.221
eiameme.com A 221.230.2.221
sumatome.com A 221.230.2.221
www.hogosume.com A 221.230.2.221
www.tinalyme.com A 221.230.2.221
ealkene.com A 221.230.2.221
areolise.com A 221.230.2.221
phontose.com A 221.230.2.221
quekjate.com A 221.230.2.221
timakate.com A 221.230.2.221
kraiplate.com A 221.230.2.221
bamihowe.com A 221.230.2.221
fesimeg.com A 221.230.2.221
tariconi.com A 221.230.2.221
alnoasri.com A 221.230.2.221
pialketi.com A 221.230.2.221
bliancek.com A 221.230.2.221
trauorank.com A 221.230.2.221
afujihil.com A 221.230.2.221
ticalken.com A 221.230.2.221
qaujcenn.com A 221.230.2.221
mafinon.com A 221.230.2.221
ahsearn.com A 221.230.2.221
foartun.com A 221.230.2.221
neondeso.com A 221.230.2.221
lalanenas.com A 221.230.2.221
daomattes.com A 221.230.2.221
bracruis.com A 221.230.2.221
tonavedos.com A 221.230.2.221
sorasos.com A 221.230.2.221
jusanters.com A 221.230.2.221
limmzenat.com A 221.230.2.221
hereramot.com A 221.230.2.221
tihecoryt.com A 221.230.2.221
dudipary.com A 221.230.2.221
ACTION: Black-hole the route to this address to prevent further criminal activity


> CHINANET-BACKBONE No.31,Jin-rong Street
> CHINATELECOM-HE-AS-AP asn for Hebei Provincial Net of CT (incl. hostmaster@hbtele.com, postmaster@hbtele.com, anti-spam@ns.chinanet.cn.net)
IP ADDRESS OF NAMESERVER: 124.236.241.91
The IP address of this criminal nameserver is within your allocated address space.

This IP address is currently linked with the following fraudulent, criminal-operated domains:
www.lamiucca.com A 124.236.241.91
www.towowida.com A 124.236.241.91
www.flaipnea.com A 124.236.241.91
www.polraha.com A 124.236.241.91
www.wocemiha.com A 124.236.241.91
ireoia.com A 124.236.241.91
www.mizaleka.com A 124.236.241.91
www.vigamiqa.com A 124.236.241.91
www.sidanisa.com A 124.236.241.91
www.wehasata.com A 124.236.241.91
www.totihota.com A 124.236.241.91
www.franveeac.com A 124.236.241.91
www.satteac.com A 124.236.241.91
www.qualietac.com A 124.236.241.91
www.halkteacc.com A 124.236.241.91
www.traimmec.com A 124.236.241.91
vainavec.com A 124.236.241.91
ns2.faneanic.com A 124.236.241.91
www.danxiesc.com A 124.236.241.91
almbabed.com A 124.236.241.91
onlayted.com A 124.236.241.91
www.asmartind.com A 124.236.241.91
posienud.com A 124.236.241.91
soopiwae.com A 124.236.241.91
www.cibalibe.com A 124.236.241.91
www.tiwutibe.com A 124.236.241.91
jisbface.com A 124.236.241.91
www.socolace.com A 124.236.241.91
www.tisigece.com A 124.236.241.91
www.sjfatice.com A 124.236.241.91
www.sewatice.com A 124.236.241.91
www.rabusyce.com A 124.236.241.91
www.towadede.com A 124.236.241.91
www.gafipode.com A 124.236.241.91
ns1.lakenteee.com A 124.236.241.91
beusigee.com A 124.236.241.91
ns2.daleakee.com A 124.236.241.91
www.jimalmee.com A 124.236.241.91
www.usatenee.com A 124.236.241.91
girlafe.com A 124.236.241.91
www.geferofe.com A 124.236.241.91
www.secatyfe.com A 124.236.241.91
www.tarobyge.com A 124.236.241.91
www.kaneahe.com A 124.236.241.91
www.bmrlaihe.com A 124.236.241.91
www.vmaoitphe.com A 124.236.241.91
www.polilyhe.com A 124.236.241.91
www.ferailoie.com A 124.236.241.91
www.lumpstie.com A 124.236.241.91
www.neysoike.com A 124.236.241.91
elkinke.com A 124.236.241.91
www.mijjaele.com A 124.236.241.91
www.lebomele.com A 124.236.241.91
ns2.craipele.com A 124.236.241.91
www.bariqile.com A 124.236.241.91
www.sasavile.com A 124.236.241.91
www.stiackle.com A 124.236.241.91
jaihanle.com A 124.236.241.91
www.rariousle.com A 124.236.241.91
www.sabeatle.com A 124.236.241.91
www.talumame.com A 124.236.241.91
www.tygenime.com A 124.236.241.91
www.rotatome.com A 124.236.241.91
www.hogosume.com A 124.236.241.91
www.tinalyme.com A 124.236.241.91
kacceane.com A 124.236.241.91
www.homasane.com A 124.236.241.91
www.wisodene.com A 124.236.241.91
ealkene.com A 124.236.241.91
www.salonine.com A 124.236.241.91
www.copanone.com A 124.236.241.91
www.sigaripe.com A 124.236.241.91
www.sohidere.com A 124.236.241.91
www.fuwimere.com A 124.236.241.91
www.tydinere.com A 124.236.241.91
zalatye.com A 124.236.241.91
hakaneki.com A 124.236.241.91
presionti.com A 124.236.241.91
daneteyi.com A 124.236.241.91
sakeflij.com A 124.236.241.91
bliancek.com A 124.236.241.91
plenivalk.com A 124.236.241.91
nubouesk.com A 124.236.241.91
waynavel.com A 124.236.241.91
kuhikil.com A 124.236.241.91
hiualkes.com A 124.236.241.91
bracruis.com A 124.236.241.91
dailleks.com A 124.236.241.91
satnills.com A 124.236.241.91
lympeans.com A 124.236.241.91
atranuhgeos.com A 124.236.241.91
aliksujet.com A 124.236.241.91
raohusst.com A 124.236.241.91
oplioeitt.com A 124.236.241.91
elhenesy.com A 124.236.241.91
ACTION: Black-hole the route to this address to prevent further criminal activity


The criminality of these domain names can be verified using the following SiteAdvisor link format, http://www.siteadvisor.com/lookup/?q=domainname.tld


CRIMINAL EVIDENCE - VIOLATION OF CAN-SPAM LAWS:


Delivered-To: xxx
Received: by 10.150.11.15 with SMTP id 15cs98926ybk;
Tue, 27 May 2008 11:54:16 -0700 (PDT)
Received: by 10.86.63.19 with SMTP id l19mr1921063fga.24.1211914454719;
Tue, 27 May 2008 11:54:14 -0700 (PDT)
Return-Path: <aazneket@ingenius.on.ca>
Received: from IGLD-84-229-107-113.inter.net.il (IGLD-80-230-219-166.inter.net.il [80.230.219.166])
by mx.google.com with ESMTP id 3si15809922fge.3.2008.05.27.11.54.13;
Tue, 27 May 2008 11:54:14 -0700 (PDT)
Received-SPF: neutral (google.com: 80.230.219.166 is neither permitted nor denied by domain of aazneket@ingenius.on.ca) client-ip=80.230.219.166;
Authentication-Results: mx.google.com; spf=neutral (google.com: 80.230.219.166 is neither permitted nor denied by domain of aazneket@ingenius.on.ca) smtp.mail=aazneket@ingenius.on.ca
User-Agent: Microsoft-Entourage/12.1.0.080305
Date: Tue, 27 May 2008 20:54:09 +0200
Subject: Find the secret to increasing your mojo
From: fgfgf <aazneket@INGENIUS.ON.CA>
To: "xxx" <xxx>
Message-ID: <E2E8EA0B.2%aazneket@INGENIUS.ON.CA>
Thread-Topic: Find the secret to increasing your mojo
Thread-Index: AcjAO89deRScUPpjTjyMgoRg5gODIg==
Mime-version: 1.0
Content-type: multipart/alternative;
boundary="B_8440683334_57578"

--B_8440683334_57578
Content-type: text/plain;
charset="US-ASCII"
Content-transfer-encoding: 7bit

I just realized my dreams of sex in the city http://www.ofieajie.com/


--B_8440683334_57578
Content-type: text/html;
charset="US-ASCII"
Content-transfer-encoding: quoted-printable

<HTML>
<HEAD>
<TITLE>Find the secret to increasing your mojo</TITLE>
</HEAD>
<BODY>
<FONT SIZE=3D"4"><FONT FACE=3D"Verdana, Arial"><SPAN =
STYLE=3D'font-size:11pt'>I just realized my dreams of sex in the city <a =
href=3D"http://www.ofieajie.com/">http://www.ofieajie.com/</a><BR>
</SPAN></FONT></FONT></FONT>
</BODY>
</HTML>


--B_8440683334_57578--


In the event that the commercial mailer associated with this mailing is found to be a U.S. citizen and linked with off-shore hosting/registration, and use of hijacked servers, this mailing was sent in violation of many requirements set forth by the CAN-SPAM Act outlined at the following page:
http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.shtm


> ATTN: CERT Team
You are being copied this report due to the fact that the servers and the ISPs currently providing service to these criminally-operated domain names are within your jurisdiction.
Please meet with the hosts, and customers associated with the machines behind these IP addresses and ensure that the machines connected to these IP addresses are cleaned of all malicious contentt. For help, reference the CastleCops Malware Removal and Prevention article located at the CastleCops Wiki:
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview

Further, enforce the need for hightened Internet Security, and the need for stronger and more secure password phrases to prevent further malicious abuse from these addresses.
Quote:
http://www.ofieajie.com/index.php



CastleCops -> SIRT Reports

All times are GMT

Page 1 of 1


Powered by phpBB © 2001 phpBB Group