Spam Alert
 
 Full Report: /VPXL_spam194596.html
 
 Changed status to confirmed spam.IP Converted: 124.236.241.91

dword = 2095903067
hex1 = 0x7cecf15b
hex2 = 0x7c.0xec.0xf1.0x5b
oct = 0174.0354.0361.0133
View CIDR AS4134 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4134

"4134 | CN | apnic | 2002-08-01 | CHINANET-BACKBONE No.31,Jin-rong Street"<br />
Extended information for AS4134:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn
View CIDR AS17672 Report: http://www.cidr-report.org/cgi-bin/as-report?as=17672

"17672 | CN | apnic | 2002-11-18 | CHINATELECOM-HE-AS-AP asn for Hebei Provincial Net of CT"<br />
Extended information for AS17672:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn


Criminal Evidence

See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=VPXL
or from China: http://www.spamtrackers.hk/wiki/index.php?title=VPXL
See the McAfee Site Advisor information at http://siteadvisor.com/sites/trayienas.com


> HICHINA WEB SOLUTIONS (HONG KONG) LIMITED
REGISTRATION OF THE WEB SITE: trayienas.com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold

You are being tracked within the CastleCops Wiki - Bulk Spam Reporting Project:
http://wiki.castlecops.com/Bulk_Spam_Reporting

You will find your registrar files, pending suspensions, and suspended domains are filed here.
http://wiki.castlecops.com/HICHINA_Pending
http://wiki.castlecops.com/HICHINA_Suspended

Please use the suspended domains as examples in suspending this, and all future spam domains registered by your registrar.


> BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You can safely suspend them:
ns1.metdns2008.com 221.230.2.221 http://rss.uribl.com/ns/metdns2008_com.html http://www.spamhaus.org/SBL/sbl.lasso?query=SBL64972
ns2.metdns2008.com 124.236.241.91 http://rss.uribl.com/ns/metdns2008_com.html http://www.spamhaus.org/SBL/sbl.lasso?query=SBL65127

ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold

Your registrar is being "tracked" by the CastleCops Wiki - Bulk Spam Reporting Project:
http://wiki.castlecops.com/Bulk_Spam_Reporting

You will find your registrars related files (documenting illegal domains, referenced in bulk commercial e-mail) within the following pages:
http://wiki.castlecops.com/BILT_Removals
http://wiki.castlecops.com/BILT_Removals_Archive

Please browse those pages, and use those suspended domains as examples to suspend this, and all future spam domains operating as nameservers.
Setting clientHold is not enough to terminate them.

A Chinese translation of these directions is available from the CastleCop Wiki:
http://wiki.castlecops.com/Suspending_an_EPP_name_server_domain_Chinese


> CHINANET-BACKBONE No.31,Jin-rong Street
> CHINATELECOM-HE-AS-AP asn for Hebei Provincial Net of CT (incl. hostmaster@hbtele.com, postmaster@hbtele.com, anti-spam@ns.chinanet.cn.net)
IP ADDRESS OF HOST: 124.236.241.91
The IP address of this criminal site is within your allocated address space.

This IP address is currently linked with the following fraudulent, criminal-operated domains:
ns2.metdns2008.com A 124.236.241.91
www.bealinfea.com A 124.236.241.91
www.braunclea.com A 124.236.241.91
www.kliasenea.com A 124.236.241.91
ireoia.com A 124.236.241.91
www.lanbgelka.com A 124.236.241.91
www.nbeakela.com A 124.236.241.91
www.sidanisa.com A 124.236.241.91
www.cosstrya.com A 124.236.241.91
www.slizaecc.com A 124.236.241.91
www.stralacec.com A 124.236.241.91
www.traimmec.com A 124.236.241.91
www.plaatenec.com A 124.236.241.91
vainavec.com A 124.236.241.91
www.platealic.com A 124.236.241.91
ns2.faneanic.com A 124.236.241.91
www.bveyanic.com A 124.236.241.91
www.caltihenc.com A 124.236.241.91
www.brijeinc.com A 124.236.241.91
www.bmeaoinc.com A 124.236.241.91
almbabed.com A 124.236.241.91
www.tryeaind.com A 124.236.241.91
www.asmartind.com A 124.236.241.91
posienud.com A 124.236.241.91
www.traipplae.com A 124.236.241.91
www.micalnae.com A 124.236.241.91
www.cibalibe.com A 124.236.241.91
www.tryaiube.com A 124.236.241.91
jisbface.com A 124.236.241.91
www.socolace.com A 124.236.241.91
www.trihuace.com A 124.236.241.91
www.tisigece.com A 124.236.241.91
www.sjfatice.com A 124.236.241.91
www.sewatice.com A 124.236.241.91
www.rabusyce.com A 124.236.241.91
www.towadede.com A 124.236.241.91
www.gafipode.com A 124.236.241.91
www.oguanlcee.com A 124.236.241.91
ns1.lakenteee.com A 124.236.241.91
beusigee.com A 124.236.241.91
ns2.daleakee.com A 124.236.241.91
www.qeaiukee.com A 124.236.241.91
www.jimalmee.com A 124.236.241.91
www.geferofe.com A 124.236.241.91
www.secatyfe.com A 124.236.241.91
www.polilyhe.com A 124.236.241.91
ferailoie.com A 124.236.241.91
www.ferailoie.com A 124.236.241.91
neysoike.com A 124.236.241.91
www.neysoike.com A 124.236.241.91
www.diafeale.com A 124.236.241.91
www.mijjaele.com A 124.236.241.91
www.lebomele.com A 124.236.241.91
ns2.craipele.com A 124.236.241.91
www.kimapalle.com A 124.236.241.91
jaihanle.com A 124.236.241.91
www.rariousle.com A 124.236.241.91
www.talumame.com A 124.236.241.91
www.nailacme.com A 124.236.241.91
www.tygenime.com A 124.236.241.91
www.hogosume.com A 124.236.241.91
www.tinalyme.com A 124.236.241.91
www.wisodene.com A 124.236.241.91
ealkene.com A 124.236.241.91
www.staillene.com A 124.236.241.91
www.salonine.com A 124.236.241.91
www.sigaripe.com A 124.236.241.91
www.sohidere.com A 124.236.241.91
www.fuwimere.com A 124.236.241.91
www.tydinere.com A 124.236.241.91
www.cisatere.com A 124.236.241.91
ns2.fissaure.com A 124.236.241.91
www.sibonase.com A 124.236.241.91
www.tiderase.com A 124.236.241.91
www.homotase.com A 124.236.241.91
www.tasidese.com A 124.236.241.91
www.borinese.com A 124.236.241.91
www.sitatose.com A 124.236.241.91
www.vakouetse.com A 124.236.241.91
www.byiuhbate.com A 124.236.241.91
www.apcomeate.com A 124.236.241.91
www.guoaihate.com A 124.236.241.91
www.tonohate.com A 124.236.241.91
www.disaltete.com A 124.236.241.91
www.bosanite.com A 124.236.241.91
hakaneki.com A 124.236.241.91
presionti.com A 124.236.241.91
sakeflij.com A 124.236.241.91
bliancek.com A 124.236.241.91
plenivalk.com A 124.236.241.91
nubouesk.com A 124.236.241.91
dimliesdo.com A 124.236.241.91
horuyuner.com A 124.236.241.91
shruyees.com A 124.236.241.91
mclieiues.com A 124.236.241.91
bracruis.com A 124.236.241.91
satnills.com A 124.236.241.91
lympeans.com A 124.236.241.91
atranuhgeos.com A 124.236.241.91
aliksujet.com A 124.236.241.91
oplioeitt.com A 124.236.241.91
relagchiv.com A 124.236.241.91
elhenesy.com A 124.236.241.91
ACTION: Black-hole the route to this address to prevent further criminal activity

The criminality of these domain names can be verified using the following SiteAdvisor link format, http://www.siteadvisor.com/lookup/?q=domainname.tld


CRIMINAL EVIDENCE - VIOLATION OF CAN-SPAM LAWS:

Delivered-To: xxx
Received: by 10.150.156.15 with SMTP id d15cs171457ybe;
Mon, 30 Jun 2008 07:49:38 -0700 (PDT)
Received: by 10.100.250.12 with SMTP id x12mr4115247anh.93.1214837377793;
Mon, 30 Jun 2008 07:49:37 -0700 (PDT)
Return-Path: <spacerai_1959@420-lawyer.com>
Received: from 189-72-107-71.jvece702.e.brasiltelecom.net.br (189-72-107-71.jvece702.e.brasiltelecom.net.br [189.72.107.71])
by mx.google.com with ESMTP id m71si5237480rnd.16.2008.06.30.07.49.36;
Mon, 30 Jun 2008 07:49:37 -0700 (PDT)
Received-SPF: neutral (google.com: 189.72.107.71 is neither permitted nor denied by domain of spacerai_1959@420-lawyer.com) client-ip=189.72.107.71;
Authentication-Results: mx.google.com; spf=neutral (google.com: 189.72.107.71 is neither permitted nor denied by domain of spacerai_1959@420-lawyer.com) smtp.mail=spacerai_1959@420-lawyer.com
To: xxx
Subject: Your security has been compromised
From: Ieong <spacerai_1959@420-lawyer.com>
Content-Type: text/plain; format=flowed; delsp=yes; charset=koi8-r
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Date: Mon, 30 Jun 2008 11:57:01 -0300
Message-ID: <hv.nwjxzcjwtoksea@49_micro>
User-Agent: Opera Mail/9.50 (Win32)

Your gun is set to get bigger and bigger
http://www.trayienas.com/

--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/


In the event that the commercial mailer associated with this mailing is found to be a U.S. citizen and linked with off-shore hosting/registration, and use of hijacked servers, this mailing was sent in violation of many requirements set forth by the CAN-SPAM Act outlined at the following page:
http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.shtm


> ATTN: CERT Team
You are being copied this report due to the fact that the servers and the ISPs currently providing service to these criminally-operated domain names are within your jurisdiction.
Please meet with the hosts, and customers associated with the machines behind these IP addresses and ensure that the machines connected to these IP addresses are cleaned of all malicious contentt. For help, reference the CastleCops Malware Removal and Prevention article located at the CastleCops Wiki:
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview

Further, enforce the need for hightened Internet Security, and the need for stronger and more secure password phrases to prevent further malicious abuse from these addresses.

Arrival-Date: Mon, 30 Jun 2008 18:29:36 +0000 (UTC)

Final-Recipient: rfc822; postmaster@hbtele.com
Action: failed
Status: 5.1.1
Remote-MTA: dns; ksg.hbtele.com
Diagnostic-Code: smtp; 550 5.1.1 <postmaster@hbtele.com>: Recipient address
rejected: undeliverable address: host 219.148.62.207[219.148.62.207] said:
550 <postmaster:hbtele>, No such user. (in reply to RCPT TO command)

Final-Recipient: rfc822; abuse@DNS.COM.CN
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.DNS.COM.CN
Diagnostic-Code: smtp; 550 Does not like recipient,your mail is rejected!

Final-Recipient: rfc822; cnreg@dns.com.cn
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.DNS.COM.CN
Diagnostic-Code: smtp; 550 Does not like recipient,your mail is rejected!

Final-Recipient: rfc822; huyan@dns.com.cn
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.DNS.COM.CN
Diagnostic-Code: smtp; 550 Does not like recipient,your mail is rejected!

Arrival-Date: Mon, 30 Jun 2008 18:29:36 +0000 (UTC)

Final-Recipient: rfc822; regadm@hichina.com
Action: failed
Status: 5.0.0
Remote-MTA: dns; mxrelay.hichina.com
Diagnostic-Code: smtp; 553 This target address is not our MX service client.

--52286299ED92.1214852723/cc1.gs.oarci.net
Content-Description: Undelivered Message
Content-Type: message/rfc822

hmm...the hichina address was as per the complainterator contacts file.

Is that an error on my/our end....or their end?

Is there any other alternate contacts?

I believe I BCL'ed DNS.COM.CN the report link for this instance.

You can check whois for hichina.com for alternative addresses.