CastleCops® New Spam Name Servers

Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9736.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Survey

Forum FAQ

Usergroups

Profile

Select FavForums

New Spam Name Servers
Goto page 1, 2, 3, 4, 5 ... 36, 37, 38 Next

All -> FavForums -> Complainterator

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

trobbins

SIRT Handler
Premium Member

Joined: Feb 19, 2007
Posts: 1166
Location: USA

Posted: Thu Sep 06, 2007 3:24 am Post subject: New Spam Name Servers

Two new name servers registered 9/5/2007 Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM Domain: metdns88.com Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM Domain: chongdns88.com

Tromso

Private
Private

Premium Member

Joined: May 25, 2007
Posts: 46

Posted: Thu Sep 06, 2007 5:26 am Post subject:

This spam group originally just used joker.com, then when we had some success they moved nameserver to Beijing Innovative, but kept spam domains on joker.com. Now they seem to be moving nameserver back to joker.com. They do all the wondercum, male enlargement spam usually, registering hundreds of new spam domains a week. Spamgroup uses Registrant names: TOLMEN STAR ENTERPRISES LTD Liquid Ventures Inc, Pump It Productions, Etty Productions Limited, Black Network INC, Health Worldwide Inc, Optin Media Inc Speshilov INC This spam group is believed to be part of the "HerbalKing spam group documented here: http://www.spamtrackers.eu/wiki/index.php?title=Herbal_King#Related_Spams Recent Used Nameservers: chechiewaz67.com chongdns67.com chongdns88.com cowtree.com dnsonhold.com jdns67.com jdns87.com krdns87.com master67.com master87.com met-dns.com metdns88.com 123456789dns.info Older Nameservers: ageborn.com b12dns.com bdns3.com eronggames1.com funfies.com goldfux.com goldfux1.com jdns22.com jjjdns.com krdns1.com masterkeydns.com masterkeydns1.com mfonzone.com rudns55.com strawberrydns.com toasteddns.com I saw recent spam domains redirect to mansterpills.com on chechiewaz67.com which then changed to redirect to manster.info on 123456789dns.info nameserver Joker.com has been doing a bit better I saw them shut down metdns87.com nameserver before I could report it, but they still just go on letting the serial spamming registrant just go on registering new domains. I see them taking action against a sample of the domains I see listed on a nameserver, perhaps they want a spam email for each spam domain.

trobbins

SIRT Handler
Premium Member

Joined: Feb 19, 2007
Posts: 1166
Location: USA

Posted: Thu Sep 06, 2007 5:42 am Post subject:

I forgot to mention the spammed domains I got using those two NS were for Elite Herbal and they did not redirect. I suppose they will be used as landing domains for other spammed domains. BTW: I have been sending full email contents with headers to all registrars. I have been trying an experiment for about a month now. Instead of sending the email contents in an attached txt file, I send a link to a text file on my web server. Two reasons, help alleviate spam filter bounce backs and to monitor if anyone actually looks at them. So far only one registrar actually looked. It was DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM for a Trojan downloader site.

Tromso

Private
Private

Premium Member

Joined: May 25, 2007
Posts: 46

Posted: Thu Sep 06, 2007 6:42 am Post subject:

You must have got some spam under the met-dns.com nameserver. I submitted this list of 120 spam domains on 31st August and tested them on 3rd September with following results. I submitted by email and pasted on joker.com site. I suspect they were acting on individual reports with spams emails rather than the whole list I gave them. I've submitted over 28 reports to joker.com with multiple listings, including 3 registered letters for this spam group. I saw at least 70 new spam domains get added to this nameserver between 31st and 3rd September. The same story with master67.com, chongdns67.com and jdns67.com nameserver. I just feel like I am asking registrars to shut down their biggest customers !

Code:

met-dns.com nameserver Health Worldwide Inc Registrar: BEIJING INNOVATIVE
Tested 3rd Sept 1530 Domain Date/Time Added Registrant
hold,disabled-due-spa#1 dranik.com Wed, 29 Aug 2007 19:02:43 +0000 Speshilov INC Registrar: JOKER.COM
Active #2 drbana.com Wed, 29 Aug 2007 18:59:07 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#3 droegt.com Wed, 29 Aug 2007 19:46:42 +0000 Speshilov INC Registrar: JOKER.COM
Active #4 drogulus.com Wed, 29 Aug 2007 18:53:54 +0000 Speshilov INC Registrar: JOKER.COM
Active #5 droway.com Wed, 29 Aug 2007 19:17:04 +0000 Speshilov INC Registrar: JOKER.COM
Active #6 drugfiar.com Fri, 31 Aug 2007 00:18:10 +0000 Speshilov INC Registrar: JOKER.COM
Active #7 dstripes.com Wed, 29 Aug 2007 18:53:29 +0000 Speshilov INC Registrar: JOKER.COM
Active #8 dtaefree.com Wed, 29 Aug 2007 18:45:21 +0000 Speshilov INC Registrar: JOKER.COM
Active #9 dtosa.com Wed, 29 Aug 2007 18:46:02 +0000 Speshilov INC Registrar: JOKER.COM
Active #10 dudehyip.com Wed, 29 Aug 2007 18:53:41 +0000 Speshilov INC Registrar: JOKER.COM
Active #11 dueiya.com Thu, 30 Aug 2007 23:18:37 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#12 dugmu.com Wed, 29 Aug 2007 18:49:37 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#13 dukangzy.com Wed, 29 Aug 2007 18:57:30 +0000 Speshilov INC Registrar: JOKER.COM
Active #14 dunmuns.com Wed, 29 Aug 2007 19:17:17 +0000 Speshilov INC Registrar: JOKER.COM
Active #15 duskphan.net Wed, 29 Aug 2007 18:45:33 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#16 duyudi.com Wed, 29 Aug 2007 18:56:42 +0000 Speshilov INC Registrar: JOKER.COM
Active #17 dvmesh.com Wed, 29 Aug 2007 19:02:21 +0000 Speshilov INC Registrar: JOKER.COM
Active #18 dwebmax.com Wed, 29 Aug 2007 19:27:33 +0000 Speshilov INC Registrar: JOKER.COM
Active #19 hialang.com Fri, 31 Aug 2007 01:31:00 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#20 hiape.com Fri, 31 Aug 2007 01:41:32 +0000 Speshilov INC Registrar: JOKER.COM
Active #21 highfed.net Fri, 31 Aug 2007 01:55:56 +0000 Speshilov INC Registrar: JOKER.COM
Active #22 hilliys.com Fri, 31 Aug 2007 01:34:09 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#23 hipmine.com Fri, 31 Aug 2007 01:57:59 +0000 Speshilov INC Registrar: JOKER.COM
Active #24 hipsigns.com Fri, 31 Aug 2007 01:26:30 +0000 Speshilov INC Registrar: JOKER.COM
Active #25 hirmat.com Fri, 31 Aug 2007 01:52:10 +0000 Speshilov INC Registrar: JOKER.COM
Active #26 hitsebiz.com Fri, 31 Aug 2007 01:52:53 +0000 Speshilov INC Registrar: JOKER.COM
Active #27 hjhail.com Fri, 31 Aug 2007 01:32:15 +0000 Speshilov INC Registrar: JOKER.COM
Active #28 hjpercor.com Fri, 31 Aug 2007 01:42:16 +0000 Speshilov INC Registrar: JOKER.COM
Active #29 hlaby.com Fri, 31 Aug 2007 01:39:18 +0000 Speshilov INC Registrar: JOKER.COM
Active #30 hndykj.com Fri, 31 Aug 2007 01:52:22 +0000 Speshilov INC Registrar: JOKER.COM
hold,disabled-due-spa#31 hnshny.com Fri, 31 Aug 2007 01:38:36 +0000 Speshilov INC Registrar: JOKER.COM
Active #32 hnxcly.com Fri, 31 Aug 2007 01:32:33 +0000 Speshilov INC Registrar: JOKER.COM
Active #33 hoboyo.com Fri, 31 Aug 2007 01:57:23 +0000 Speshilov INC Registrar: JOKER.COM
Active #34 holidayy.com Fri, 31 Aug 2007 01:29:23 +0000 Speshilov INC Registrar: JOKER.COM
Active #35 honopple.com Fri, 31 Aug 2007 01:56:16 +0000 Speshilov INC Registrar: JOKER.COM
Active #36 hotbdz.com Mon, 27 Aug 2007 07:58:51 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #37 hoteltgp.com Sun, 26 Aug 2007 01:17:12 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #38 hotheelw.com Sun, 26 Aug 2007 03:23:12 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #39 kaluke.com Mon, 27 Aug 2007 10:10:57 +0000 Health Worldwide Inc Registrar: JOKER.COM
Active #40 mammail.com Mon, 27 Aug 2007 09:14:11 +0000 Pump It Productions Registrar: JOKER.COM
Active #41 mamuuko.com Mon, 27 Aug 2007 09:09:23 +0000 Pump It Productions Registrar: JOKER.COM
Active #42 mankine.com Mon, 27 Aug 2007 09:07:22 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#43 maozhiv.com Mon, 27 Aug 2007 09:14:28 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#44 mapkuist.com Mon, 27 Aug 2007 09:07:56 +0000 Pump It Productions Registrar: JOKER.COM
Active #45 maqmicro.com Mon, 27 Aug 2007 09:09:42 +0000 Pump It Productions Registrar: JOKER.COM
Active #46 maquedit.com Tue, 28 Aug 2007 00:08:58 +0000 Pump It Productions Registrar: JOKER.COM
Active #47 maramaru.com Mon, 27 Aug 2007 08:58:39 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#48 maricius.com Mon, 27 Aug 2007 09:24:55 +0000 Pump It Productions Registrar: JOKER.COM
Active #49 marlcon.com Mon, 27 Aug 2007 09:24:26 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#50 masoclub.com Wed, 29 Aug 2007 00:01:29 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#51 matargat.com Mon, 27 Aug 2007 09:06:24 +0000 Pump It Productions Registrar: JOKER.COM
Active #52 mathcefe.com Mon, 27 Aug 2007 09:00:48 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#53 maturmom.com Mon, 27 Aug 2007 09:16:37 +0000 Pump It Productions Registrar: JOKER.COM
Active #54 maximeus.com Mon, 27 Aug 2007 08:58:20 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#55 maximoit.com Mon, 27 Aug 2007 08:59:43 +0000 Pump It Productions Registrar: JOKER.COM
Active #56 mayoeb.com Mon, 27 Aug 2007 09:16:10 +0000 Pump It Productions Registrar: JOKER.COM
Active #57 mazekte.com Mon, 27 Aug 2007 08:58:59 +0000 Pump It Productions Registrar: JOKER.COM
Active #58 mbtradin.com Mon, 27 Aug 2007 09:16:22 +0000 Pump It Productions Registrar: JOKER.COM
hold,disabled-due-spa#59 paydonle.com Sun, 26 Aug 2007 04:22:09 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #60 pbottom.com Sun, 26 Aug 2007 04:20:39 +0000 Liquid Ventures Inc Registrar: JOKER.COM
hold,disabled-due-spa#61 pfcrips.com Wed, 29 Aug 2007 06:14:39 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #62 pfcrips.info Tue, 28 Aug 2007 03:53:36 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #63 phaonica.com Wed, 29 Aug 2007 06:21:29 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #64 phaonica.info Tue, 28 Aug 2007 03:37:02 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
CLIENT HOLD #65 phdrops.info Tue, 28 Aug 2007 03:50:46 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #66 phptonet.com Wed, 29 Aug 2007 06:09:44 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #67 phptonet.info Tue, 28 Aug 2007 03:46:10 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #68 pickdash.info Tue, 28 Aug 2007 03:27:21 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #69 pickdash.net Wed, 29 Aug 2007 06:09:33 +0000 Liquid Ventures Inc Registrar: JOKER.COM
hold,disabled-due-spa#70 picsword.com Wed, 29 Aug 2007 06:18:47 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #71 picsword.info Tue, 28 Aug 2007 03:33:50 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #72 piczvo.com Wed, 29 Aug 2007 17:58:01 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #73 piczvo.info Tue, 28 Aug 2007 05:40:25 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #74 pierric.com Wed, 29 Aug 2007 18:49:51 +0000 Speshilov INC Registrar: JOKER.COM
Active #75 pierric.info Tue, 28 Aug 2007 03:33:10 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #76 pigtun.com Wed, 29 Aug 2007 06:06:55 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #77 pigtun.info Tue, 28 Aug 2007 03:41:07 +0000 Optin Media Inc Registrar: JOKER.COM
Active #78 pilipuig.com Wed, 29 Aug 2007 17:56:41 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #79 pilipuig.info Tue, 28 Aug 2007 04:10:39 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #80 pinester.com Wed, 29 Aug 2007 18:30:23 +0000 Speshilov INC Registrar: JOKER.COM
Active #81 pinester.info Tue, 28 Aug 2007 04:02:35 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
CLIENT HOLD #82 pintpong.info Tue, 28 Aug 2007 04:22:18 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #83 pintpong.net Wed, 29 Aug 2007 06:14:28 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #84 pinzhili.com Wed, 29 Aug 2007 06:59:56 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #85 pinzhili.info Tue, 28 Aug 2007 03:35:18 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #86 piskp.net Wed, 29 Aug 2007 06:16:32 +0000 Liquid Ventures Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
CLIENT HOLD #87 piskp1.info Tue, 28 Aug 2007 03:59:38 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #88 pkcable.com Wed, 29 Aug 2007 06:39:22 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #89 pkcable.info Tue, 28 Aug 2007 04:00:59 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #90 pkgsolar.com Wed, 29 Aug 2007 06:07:48 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #91 pkgsolar.info Tue, 28 Aug 2007 03:24:37 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #92 planetwo.com Wed, 29 Aug 2007 11:44:23 +0000 Liquid Ventures Inc Registrar: JOKER.COM
CLIENT HOLD #93 planetwo.info Tue, 28 Aug 2007 20:08:29 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #94 platchat.com Wed, 29 Aug 2007 06:31:24 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #95 platchat.info Tue, 28 Aug 2007 03:24:48 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #96 playhas.com Wed, 29 Aug 2007 06:05:16 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #97 playhas.info Tue, 28 Aug 2007 05:24:29 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #98 polaice.com Wed, 29 Aug 2007 00:53:11 +0000 Liquid Ventures Inc Registrar: JOKER.COM
Active #99 polaice.info Tue, 28 Aug 2007 04:09:54 +0000 Optin Media Inc Sponsoring Registrar: CSL (d.b.a. Joker.com)
Active #100 wetpusay.com Mon, 27 Aug 2007 04:41:08 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #101 wetpusdy.com Sun, 26 Aug 2007 14:50:45 +0000 Etty Productions Limited Registrar: JOKER.COM
hold,disabled-due-spa#102 wetpuswy.com Sun, 26 Aug 2007 15:16:27 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #103 wfbiz.net Mon, 27 Aug 2007 05:13:21 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #104 whatsnu.net Wed, 29 Aug 2007 02:46:10 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #105 whatsnu.net Sun, 26 Aug 2007 14:49:23 +0000 Etty Productions Limited Registrar: JOKER.COM
hold,disabled-due-spa#106 whizwit.com Tue, 28 Aug 2007 07:59:10 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #107 whtaier.com Sun, 26 Aug 2007 07:42:20 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #108 wigirl.net Sun, 26 Aug 2007 14:51:25 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #109 wiinfo.net Sun, 26 Aug 2007 15:41:36 +0000 Etty Productions Limited Registrar: JOKER.COM
hold,disabled-due-spa#110 wiirmote.com Sun, 26 Aug 2007 07:35:53 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #111 wikeecn.com Sun, 26 Aug 2007 14:53:48 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #112 wiligril.com Mon, 27 Aug 2007 05:57:27 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #113 winidows.com Mon, 27 Aug 2007 03:19:50 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #114 winnone.com Mon, 27 Aug 2007 05:19:13 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #115 wiresjw.com Sun, 26 Aug 2007 14:39:26 +0000 Etty Productions Limited Registrar: JOKER.COM
hold,disabled-due-spa#116 wisols.net Sun, 26 Aug 2007 14:46:13 +0000 Etty Productions Limited Registrar: JOKER.COM
hold,disabled-due-spa#117 wizybiz.com Sun, 26 Aug 2007 14:50:21 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #118 wlissa.com Mon, 27 Aug 2007 01:17:30 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #119 wofrum.com Sun, 26 Aug 2007 17:54:24 +0000 Etty Productions Limited Registrar: JOKER.COM
Active #120 womencon.com Sun, 26 Aug 2007 14:42:25 +0000 Etty Productions Limited Registrar: JOKER.COM

Tromso

Private
Private

Premium Member

Joined: May 25, 2007
Posts: 46

Posted: Thu Sep 06, 2007 7:07 am Post subject:

We already have new nameservers on Beijing Innovative being used for previous still active spam domains: metdns99.com registered by Black Network INC chongdns99.com registered by TOLMEN STAR ENTERPRISES LTD

spamislame

SIRT Handler

Joined: Apr 19, 2006
Posts: 162

Posted: Thu Sep 06, 2007 4:07 pm Post subject:

Tromso wrote:

This spam group originally just used joker.com, then when we had some success they moved nameserver to Beijing Innovative, but kept spam domains on joker.com. Now they seem to be moving nameserver back to joker.com. They do all the wondercum, male enlargement spam usually, registering hundreds of new spam domains a week.

Spamgroup uses Registrant names:

TOLMEN STAR ENTERPRISES LTD
Liquid Ventures Inc,
Pump It Productions,
Etty Productions Limited,
Black Network INC,
Health Worldwide Inc,
Optin Media Inc
Speshilov INC

This spam group is believed to be part of the "HerbalKing spam group

<snip>

As an aside, this is known as the "Sancash" affiliate program, and it's sponsored by a member of the bulkerforum site named "azzy". (Probably others too, but he's the most active promoter of it.)

Quote:

azzy

Joined: 02 Nov 2006
Posts: 49

Posted: Thu Nov 02, 2006 6:58 pm
Post subject: you need sponsor?

Product:

Herbal
Enlargement pills
Very popular adult-toy
Hoodia
Cum pills

35% neg

Payments are every Thursday, preferred payout is Epassporte, if affiliate doesn't have a epassporte card he can get you one, or via Wire.

Private domain available

Here some ex:
hxxp://personalpussy.net/
hxxp://enlarge-xl.com/

pm me with a valid email if you want an account

[urls obviously edited by me]

They added a more broad pharmacy affiliate program in April 2007.

His continued bumping of similar threads indicates that he doesn't care who mails for him, or whether they're compliant or not.

And of course he obviously doesn't care that what he's selling is completely bogus, and in the case of the pharmaceuticals: illegal.

SiL

Tromso

Private
Private

Premium Member

Joined: May 25, 2007
Posts: 46

Posted: Thu Sep 06, 2007 5:05 pm Post subject:

spamislame wrote:

As an aside, this is known as the "Sancash" affiliate program, and it's sponsored by a member of the bulkerforum site named "azzy". (Probably others too, but he's the most active promoter of it.)

Thanks for the info.

I think I've seen them involved with the Discount Pharmacy spam
http://www.spamtrackers.eu/wiki/index.php?title=Discount_Pharmacy

using the same eval(unescape sequences

Discount_Pharmacy/Vincent Chan is responsible for a lot of the .org spam and makes use of Beijing Innovative Linkage Technology for many spam domains.

The spam group I follow seem to use domains on joker.com and switch nameservers between joker.com and BILT recently. They seem well set up on joker.com to quickly change name servers on their mass of joker.com spam domains. joker.com is failing to do a mass deletion of their domain names and just accepts more registrations by exactly the same registrants they have been serially deleting for spam. This has been going on for months with the same registrants.

Nodus

Private
Private

Joined: Jun 14, 2007
Posts: 40

Posted: Tue Sep 11, 2007 1:27 pm Post subject:

Tromso wrote:

Discount_Pharmacy/Vincent Chan is responsible for a lot of the .org spam and makes use of Beijing Innovative Linkage Technology for many spam domains.

BTW Discount Pharmacy seems to be carrying on after a little break with new name servers, too...

ns1.findrealrx.org
ns2.medsprepare.org
ns3.pillsfair.org
ns4.healthwecare.org

Sponsoring Registrar: Beijing Innovative Linkage Technology Ltd.

Perhaps it's old news, but I only discovered it yesterday... Smile

Quote:

The spam group I follow seem to use domains on joker.com and switch nameservers between joker.com and BILT recently.

Oh yes, I had just reviewed a bunch of them in SiteAdvisor while the nameservers were still on joker.com, just to find out it was all wrong information two days later... Very Happy

trobbins

SIRT Handler
Premium Member

Joined: Feb 19, 2007
Posts: 1166
Location: USA

Posted: Sat Sep 15, 2007 6:07 am Post subject:

Registered 9/5 Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN Domain: chongdns88.com Registered 9/7 Registrar: XIN NET TECHNOLOGY CORPORATION Domain: puntunhdefunterun.com

tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2881

Posted: Sun Sep 16, 2007 10:34 pm Post subject:

chongdns88 fell into disuse Sept 8 http://rss.uribl.com/ns/chongdns88_com.html chongdns99 is today's preferred one http://rss.uribl.com/ns/chongdns99_com.html _________________ Recommended - EU Spam Database - Especially the wiki Also Blog and site exposes spammers And Hijacked machines recovery

s0tet

PIRT Handler

Joined: May 21, 2005
Posts: 2737

Posted: Mon Sep 17, 2007 1:13 am Post subject:

Some of these nameservers are listed in recent SIRT reports. Random selection of some: /t200843-SIRT_10296_Elite_Herbal_on_lululing_com_metdns99_com.html /t201365-SIRT_12392_Elite_Herbal_on_boxlesnar_com.html /t200737-SIRT_10053_Elite_Herbal_on_smokstac_com_metdns99_com.html /t200579-SIRT_9658_Elite_Herbal_on_hotwold_com_metdns99_com.html /t200481-SIRT_9341_Elite_Herbal_on_mustoica1_com_chongdns99_com.html

large_enough

Guest
IP: 130.232.*.*

Posted: Tue Sep 18, 2007 5:35 pm Post subject: what to do

Hello! I see you guys know a lot about nameservers and stuff. But what should be done for Beijing Innovative and other funny guys? I sometimes open a spam (I get dozens every day), today I followed a link to a website and whois gave Liquid Ventures Inc. And google gave this forum. It has been going on for years, is there really nothing we can do for chinease spammers? I mean something concretic like finding names and having them killed or something..

s0tet

PIRT Handler

Joined: May 21, 2005
Posts: 2737

Posted: Tue Sep 18, 2007 6:28 pm Post subject:

Hi, Thank you for posting. Believe it or not, progress is being made in bringing down spam-supporting domains purchased with Chinese registrars. Beijing Innovative will suspend domains but it does often take time. There is more work to be done in getting the other Chinese registrars (and other registrars in general) to be more responsive.

efa

Sergeant

Joined: Aug 31, 2007
Posts: 111
Location: Italy

Posted: Tue Sep 18, 2007 11:29 pm Post subject:

my personal name server list. 99% of spamvertized domain to my email, use those name server: Name server Registrar ----------------------------------------------------- ns1.metdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns2.metdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns3.metdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns4.metdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns0.sdgyfer8yioi.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns0.gggfjdjhgghg.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns0.dsjfhgwyutuyu.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns0.ashjdggfgafdg.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns1.chongdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns2.chongdns99.com BEIJING INNOVATIVE LINKAGE TECHNOLOG ns0.nuspharkosa.com XIN NET TECHNOLOGY CORPORATION ns0.kopepharas.com XIN NET TECHNOLOGY CORPORATION ns0.mukopkufude.com XIN NET TECHNOLOGY CORPORATION ns0.pharokufuma.com XIN NET TECHNOLOGY CORPORATION ns0.puntunhdefunterun.com XIN NET TECHNOLOGY CORPORATION ns0.pumationdesun.com XIN NET TECHNOLOGY CORPORATION ns0.priokoliondedsa.com XIN NET TECHNOLOGY CORPORATION ns0.ptrinmasedinca.com XIN NET TECHNOLOGY CORPORATION ns0.contrama.com XIN NET TECHNOLOGY CORPORATION P.S. Beijing Innovative never suspended noone of those name server, and I sended hundred complaints.

trobbins

SIRT Handler
Premium Member

Joined: Feb 19, 2007
Posts: 1166
Location: USA

Posted: Thu Sep 20, 2007 7:18 pm Post subject:

This one was registered yesterday

Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Nameserver: metdns101.com
Registered: 09/19/2007

Code:

Organisation Name.... zi yang hua mao wang luoyouxianzerengongsi
Organisation Address. sichuanziyangchechengxiaoqu1qu2danyuan403
Organisation Address.
Organisation Address. ziyang
Organisation Address. 641300
Organisation Address. SC
Organisation Address. CN

Used for Elite Herbal

	All -> FavForums -> Complainterator	All times are GMT Goto page 1, 2, 3, 4, 5 ... 36, 37, 38 Next
Page 1 of 38

You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 187ppm 0.678s (0.189s) Making cybercriminals unhappy since 2002*