Spam Alert
 
 Full Report: /dating_site_spam185140.html
 
 IP Converted: 220.214.94.104

dword = 3705036392
hex1 = 0xdcd65e68
hex2 = 0xdc.0xd6.0x5e.0x68
oct = 0334.0326.0136.0150
View CIDR AS4732 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4732

"4732 | JP | apnic | 1995-08-30 | DION KDDI CORPORATION"<br />
Extended information for AS4732:
State/Province:
Country: jp
Responsible Domain: kddi.com
Abuse Email: abuse@dion.ne.jp
View CIDR AS2516 Report: http://www.cidr-report.org/cgi-bin/as-report?as=2516

"2516 | JP | apnic | 2002-04-05 | KDDI KDDI CORPORATION"<br />
Extended information for AS2516:
State/Province:
Country: jp
Responsible Domain: kddi.com
Abuse Email: abuse@dion.ne.jp
Changed status to confirmed spam.Criminal Evidence

See the McAfee Site Advisor information at http://siteadvisor.com/sites/ypo22.com which points out that this domain is advertised in unsolicited spam e-mail. Reviewers of the SiteAdvisor community have also posted spam samples distributed by this commercial spam e-mailer.


> ENOM, INC. (legal@enom.com,abuse@enom.com,support.desk@enom.com)
REGISTRATION OF THE WEB SITE: ypo22.com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold


> YESNIC CO. LTD. (abuse@yesnic.com,dmanager@yesnic.com,info@yesnic.com)
> TUCOWS INC. (abuse@abuse.tucows.com,banterwebhelp1@tucows.com)
> DOMAIN 21 (domain21@maplearts.net)
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You can safely suspend them:
ddns.volbon.net | 210.249.60.67 | Japan
ddns.voldon.com | 121.1.252.81 | Japan

These nameserver addresses have been cross-referenced with the following domains also in use in unsolicited spam mail use, and the use of hijacked malware-infected hosts:
ns.ia66.com A 121.1.252.81
ddns.voldon.com A 121.1.252.81

ns.wi84.com A 210.249.60.67
ddns.volbon.net A 210.249.60.67

ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold


> KDDI KDDI CORPORATION
IP ADDRESS OF HOST: 220.214.94.104
The IP address of this criminal site is within your allocated address space.

ACTION: Black-hole the route to this address to prevent further criminal activity


> Japan CERT
The IP addresses being used by these criminal domain names land within your jurisdiction
ACTION: Please take time to clean up this network of all infections, ensure all software and operating system software is updated, and all passwords are changed to be more secure to thwart further infections behind this network.


The criminality of these domain names can be verified using the following SiteAdvisor link format, http://www.siteadvisor.com/lookup/?q=domainname.tld



CRIMINAL EVIDENCE: VIOLATION OF CAN-SPAM LAWS

Delivered-To: xxx
Received: by 10.150.11.15 with SMTP id 15cs8444ybk;
Mon, 26 May 2008 04:25:45 -0700 (PDT)
Received: by 10.70.111.2 with SMTP id j2mr6357677wxc.86.1211801145185;
Mon, 26 May 2008 04:25:45 -0700 (PDT)
Return-Path: <0pjsbjqeldqz7@yahoo.com>
Received: from gmail.com ([218.60.72.66])
by mx.google.com with ESMTP id h10si6632857wxd.2.2008.05.26.04.25.41;
Mon, 26 May 2008 04:25:45 -0700 (PDT)
Received-SPF: neutral (google.com: 218.60.72.66 is neither permitted nor denied by domain of 0pjsbjqeldqz7@yahoo.com) client-ip=218.60.72.66;
Authentication-Results: mx.google.com; spf=neutral (google.com: 218.60.72.66 is neither permitted nor denied by domain of 0pjsbjqeldqz7@yahoo.com) smtp.mail=0pjsbjqeldqz7@yahoo.com
Message-Id: <483a9e39.0a86460a.2558.ffffbc1cSMTPIN_ADDED@mx.google.com>
Reply-To: =?ISO-2022-JP?B?GyRCJWolKxsoQg==?= <0pjsbjqeldqz7@yahoo.com>
From: =?ISO-2022-JP?B?GyRCJWolKxsoQg==?= <0pjsbjqeldqz7@yahoo.com>
To: <xxx@gmail.com>
Subject: =?ISO-2022-JP?B?GyRCRD5FRSEmRD4lYSRHGyhC?=
Date: Mon, 26 May 2008 20:25:29 +09:00
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-2022-jp"
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Nomal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138

GyRCISEoLig7KCw0MEE0TDVOQSROPVAycSQkJTUlJCVIKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsIX4hfhsoQg0KGyRCKCMoQCglKCMoISghKCQhISEhISEoLigsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgvGyhCDQobJEIoOygwISEhQyFAIT8hQyEhIiEoLCg0ISFCKCUiJV0hd0Q+OVRKWCFaNDBBNEw1TkEhWyEhKDIoLCIhISEoLig7GyhCDQobJEIhISEhISEoJighKCEoJSEhISEhISgxKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKDAhISEhKCMoQCglGyhCDQobJEIoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKCwoLCgsKDsoMBsoQg0KDQoNChskQiEhISEhISU7JVUlbCEmJV4lOCVhTngwJiEmMHskX00nIUQhIyUzJTMkRzgrJEQkMSRoJCYheRsoQg0KDQoNChskQiEhISEhISIjPXdALSROSn0kLEBRNktFKiEqISkbKEINChskQiEhISEhISExITEhMSExITEhMSExITEhMSExITEbKEINChskQiEhISEhISVhITwlayROJGQkajxoJGokLExMRV0kQCRIJCQkJj13QC0kLBsoQg0KGyRCISEhISEhQFE2S0UqJEtEPiUiJUkhJkQ+RUUkcjhyNDkkNyRoJCYkSCQkJCYlMyVfJWUlSyVGJSMkRyQ5ISMbKEINCg0KGyRCISEhISEhISEhISEhISEiJyImIiciJiInGyhCDQoNChskQiEhISEhIRsoQmh0dHA6Ly95cG8yMi5jb20vbXNzLw0KDQoNChskQiEhISEhISIjPGo0ViQsM10kKyRpJDokOSQwJEckLSRrISobKEINChskQiEhISEhISExITEhMSExITEhMSExITEhMSExITEhMRsoQg0KGyRCISEhISEhRD4lIiVJISZEPkVFJHI4cjQ5JDkkayRLJE8yPDUtJE4kKyRpRn4kahsoQg0KGyRCISEhISEhJVclbSVVJSMhPCVrJHI6bkAuJDckRiQvJEAkNSQkGyhCDQoNChskQiEhISEhISEhISEhISEhIiciJiInIiYiJxsoQg0KGyRCISEhISEhGyhCaHR0cDovL3lwbzIyLmNvbS9tc3MvDQoNCg0KGyRCISEhISEhIiMyPyRHJGI8K00zJEAkKyRpM1okNyQkInYbKEINChskQiEhISEhISExITEhMSExITEhMSExITEhMSExITEhMRsoQg0KGyRCISEhISEhRD4lIiVJISYjVCNFI0w4cjQ5ISZBdzx1Py4hJjJoQXwxXE13JGJMNU5BISobKEINChskQiEhISEhITtXJCZCOEosM1okNyRzJEckLyRAJDUkJCEqGyhCDQoNChskQiEhISEhISEhISEhISEhIiciJiInIiYiJxsoQg0KDQobJEIhISEhISEbKEJodHRwOi8veXBvMjIuY29tL21zcy8NCg0KDQobJEIhISEhISEiIzE/MUQkT0lhREwkTjRrNkgkQCQrJGkwQj80InYbKEINChskQiEhISEhISExITEhMSExITEhMSExITEhMSExITEhMSExITEhMRsoQg0KGyRCISEhISEhJDMkTiU1JSQlSCRPSWFETCRONGs2SCQsMT8xRCQ3JEYkJCReJDkhIxsoQg0KGyRCISEhISEhSVRANUBBNWFFeSEiMGxAWiQiJGokXiQ7JHMhKhsoQg0KDQobJEIhISEhISEhISEhISEhISInIiYiJyImIicbKEINCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoxOBskQjpQTCRLfiROSn0kZDY9TCMkTiRKJCRKfSEiR1s/LkRkO18kTxsoQg0Kbm9uZWVkQHJlamVjdC55cG8yMi5jb20NChskQj1oTX0kSzt+NFYkLCQrJCskaz5sOWckLCQ0JDYkJCReJDkhIyQ0Tjs+NTI8JDUkJCEjGyhCDQo=


Second instance:
Delivered-To: xxx@gmail.com
Received: by 10.151.45.9 with SMTP id x9cs101194ybj;
Sat, 10 May 2008 05:01:36 -0700 (PDT)
Received: by 10.210.111.4 with SMTP id j4mr5337498ebc.59.1210420895388;
Sat, 10 May 2008 05:01:35 -0700 (PDT)
Return-Path: <wyptwja2h@yahoo.com>
Received: from gmail.com ([218.60.74.108])
by mx.google.com with ESMTP id 2si10045786nfv.5.2008.05.10.05.01.33;
Sat, 10 May 2008 05:01:35 -0700 (PDT)
Received-SPF: neutral (google.com: 218.60.74.108 is neither permitted
nor denied by domain of wyptwja2h@yahoo.com) client-ip=218.60.74.108;
Authentication-Results: mx.google.com; spf=neutral (google.com:
218.60.74.108 is neither permitted nor denied by domain of
wyptwja2h@yahoo.com) smtp.mail=wyptwja2h@yahoo.com
Message-Id: <48258e9f.0216300a.5fb2.6216SMTPIN_ADDED@mx.google.com>
Reply-To: =?ISO-2022-JP?B?GyRCMEtGIyEhOHcwbBsoQg==?= <wyptwja2h@yahoo.com>
From: =?ISO-2022-JP?B?GyRCMEtGIyEhOHcwbBsoQg==?= <wyptwja2h@yahoo.com>
To: <xxx@gmail.com>
Subject: =?ISO-2022-JP?B?GyRCJDRMNTo7QkEkRyFBIUEkOSJ2GyhC?=
Date: Sat, 10 May 2008 21:01:19 +09:00
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-2022-jp"
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Nomal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138

GyRCQTRBMyVhITwlaz1QTWgkSiQvJEYlNCVhJXMlTRsoQjxtKF9fKW0+DQobJEJNJ0MjJCw1Lkp9JE47djUkJEtGfiRDJD8kaSQ3JC8kRiEmISYhJiEmISYbKEINChskQkhgO2FKZz04JDckRiRrJF8kPyQkJEAkKyRpJSIlPyVDJS8kNyRGJF8kRhsoQiheXy0pLRskQiF5GyhCDQobJEJMPkEwJE8hIT8/RmBIfiRBJGMkcyEhGyhCDQobJEJHLyRPGyhCIDI5GyRCOlAhISEhJEAkaCJ2GyhCDQpodHRwOi8veXBvMjIuY29tL21zcy8NCg0KGyRCOGUhIkI+JEskYkhgO2EkLE1fJDckJCRDJEY7UiQsNW8kayQrJGkhIjojRVk5ZyUzJXMkNyRoJCYkTSJ2InYbKEINCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNChskQiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLiIuIi4iLhsoQg0KMTgbJEI6UEwkS34kTkp9JGQ2PUwjJE4kSiQkSn0hIkdbPy5EZDtfJE8bKEINCm5vbmVlZEByZWplY3QueXBvMjIuY29tDQobJEI9aE19JEs7fjRWJCwkKyQrJGs+bDlnJCwkNCQ2JCQkXiQ5ISMkNE47PjUyPCQ1JCQhIxsoQg0KDQo=

CAN-SPAM Law states that:

Commercial mailers are not to abuse open relays to send their mail.
Commercial mailers are to offer AND honor opt-out requests - there has been many attempts to opt-out of this spam without any action taken.
Commercial mailers are NOT to munge or otherwise forge the headers of spam e-mail to mask their identity.
Commercial mailers are to offer a physical address at which the mailer can be contacted via postal mail.


This commercial mailer breaks a multitude of these rules set by CAN-SPAM Laws.IP Converted: 121.1.252.81

dword = 2030173265
hex1 = 0x7901fc51
hex2 = 0x79.0x1.0xfc.0x51
oct = 0171.01.0374.0121
View CIDR AS4685 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4685

"4685 | JP | apnic | 1995-08-30 | ASAHI-NET Asahi Net"<br />
Extended information for AS4685:
State/Province:
Country: jp
Responsible Domain: asahi-net.or.jp
Abuse Email: postmaster@asahi-net.or.jp
IP Converted: 210.249.60.67

dword = 3539549251
hex1 = 0xd2f93c43
hex2 = 0xd2.0xf9.0x3c.0x43
oct = 0322.0371.074.0103
View CIDR AS4732 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4732

"4732 | JP | apnic | 1995-08-30 | DION KDDI CORPORATION"<br />
Extended information for AS4732:
State/Province:
Country: jp
Responsible Domain: kddi.com
Abuse Email: abuse@dion.ne.jp

Reporting-MTA: dns; cc1.gs.oarci.net
X-Postfix-Queue-ID: 5E47C299ECF1
X-Postfix-Sender: rfc822; spamsquad@castlecops.com
Arrival-Date: Tue, 10 Jun 2008 00:10:54 +0000 (UTC)

Final-Recipient: rfc822; cfc@cyberpolice.jp
Action: failed
Status: 5.4.4
Diagnostic-Code: X-Postfix; Host or domain name not found. Name service error
for name=cyberpolice.jp type=A: Host found but no data record of requested
type

Final-Recipient: rfc822; risk@enom.com
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.enom.com
Diagnostic-Code: smtp; 550 No such user (risk@enom.com)