SUCCESS!

Boo-yah! Down another one goes... I found a registrar who's actually taking
action against one of our spammers.

Here's the message from InterCosmos.com:
Thanks for the information. We have put the domain tecmnsd.info on
registrar-hold. So the domain will stop resolving.
Donny

I sent them back a message, telling them about the spammer having other
URLs registered through them, 5 of them, so I may just get this spammer
shut down wholesale.

Here's hoping, anyway.

Thank you.  Registrar action can be another effective way to pressure
the spammers.

news:laaQc.459$of6.157@newssvr29.news.prodigy.com...

My mistake, only two of the spammer's 5 domains were registered with
InterCosmos.com, but they're gone now... all Registrars should be as
responsive as InterCosmos.com. That's damned impressive. Now we wait for
the DNS changes to propagate, and they'll be off the air.

So, we should see:
http://www.tecmnsd.info/ES001/

http://www.mdnfdkk.info/OE017/

going away.

What's funny is that even though the domains are on Registrar hold, meaning
that DNS won't resolve for them anymore, my DNS server's still got the
required information to hit them with SpamVampire. So, nobody can visit,
except for me. And I'm visiting a lot. And I'm not allowing my DNS server
to update that DNS record, so I'll be able to continue hitting them for as
long as that server is serving those websites, even if DNS won't point
anyone else to them.

I've got to be hell on the poor spammers... nobody can visit their websites
except the one they don't want to have visit under any circumstances... too
much fun. But, it's all part of striking fear into the hearts of spammers
everywhere. If I can become world-famous in spammer circles as someone to
avoid, I'll have accomplished my goal.

news:lPaQc.471$sx6.383@newssvr29.news.prodigy.com...

That's the Russian Spam Gang.

Intercosmos is DirectNIC. How did you contact them? What did you tell them?

How about going after the nameserver for lots of them- LIONSTAM.BIZ?

news:mDbQc.4499$Mg1.2542@bignews4.bellsouth.net...

Yep, that's the Russian Spam Gang... I've been hammering the living hell
out of their websites with my SpamVampire
(http://www.hillscapital.com/an­tispam/index.htm feel free to grab the
source code and set up your own).

?

I sent the LART to a...@intercosmos.com, with a note at the top that they
were the registrar, and that they should check the registration information
for the site, and terminate it if it was found that the registration
information was invalid.

Tried that... the email address obtained by doing a dig on Lionstam.biz
bounces.

news:GdcQc.494$g57.177@newssvr29.news.prodigy.com...

Hooo-BOY, we're going after these scumbags in a big way! I just got another
spam from them on a new domain they'd registered with InterCosmos. It's
already down...

http://ndffzzy.hksdhdj.info/ES­001/?affiliate_id=234170&campa­ign_id=404

Man, when Donny at InterCosmos decides to bork a site, he doesn't mess
around.

#begin  Ale...@invalid.domain.exe (or was it Alexis.com)
 message <mDbQc.4499$Mg1.2...@bignews4.­bellsouth.net> reply:

<SNIP>

 have several such replies from Intercosmos, when CC:ing DirectNIC on spams.
But in all other cases I get their standard "we are just a Registrar, contact
ISPs" answer. No idea what triggers that "lucky" reply.

Dolphin.

--
 URL: http://www.DolphinWave.org
Mail: on the web page (no spam)
 ICQ: 6615461

He didn't happen to give you his last name did he?

Jeff

Have Donny take a look at:

http://groups.google.com/group­s?&scoring=d&q=%22%2FOE017%2F%­22
http://groups.google.com/group­s?&scoring=d&q=%22%2FES001%2F%­22

He'll find plenty more...

Sample:

KLCBHGF.BIZ

klcbhgf.biz
IP Addresses:   61.128.198.12
IP Country:     CHINA
Reverse IP Lookup:      IP hosts 25 domains

Hosting Company Name:  
ICANN Registrar:        INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM
Creation Date:  Jul 7 2004
Expiry Date:    Jul 6 2005

61.128.198.12 - IP hosts 25 Total Domains ...
Showing 1 - 25 out of 25

        Domain Name
1       AEAMDGI.INFO.
2       BDEAHCHA.INFO.
3       BHGNCGE.INFO.
4       BJCKKBFF.INFO.
5       CAIBGJC.BIZ.
6       CBIDABJ.INFO.
7       CKLIBCDN.INFO.
8       ENLDLID.INFO.
9       FDGFDBI.BIZ.
10      FKMJECB.INFO.
11      FMLAECCJ.BIZ.
12      GHCCLCCC.BIZ.
13      IHJJFJDF.INFO.
14      INCBGGC.INFO.
15      JJGLCLLJ.INFO.
16      KFJLFJKA.BIZ.
17      KIHGGCF.INFO.
18      KJFDMJE.INFO.
19      KLCBHGF.BIZ.
20      LDDEKFAN.INFO.
21      MFCALEL.BIZ.
22      MHCNJCNN.INFO.
23      MKJFKBE.INFO.
24      MMHLIFID.BIZ.
25      NFKIIJL.INFO.

or

http://www.polarbeach.com/topi­cs/0704-Directnic.htm
http://www.polarbeach.com/topi­cs/0604-Directnic.htm

Jeff

Thanks, I forgot they are back up.

Many of those on that list that I gave for IP 61.128.198.12 are
registered at namebay.com.  It appears that BUENOCARTO.INFO has 27
domain names registered, all associated with this spam group.

BUENOCARTO.INFO doesn't appear on Polarbeach because it doesn't resolve
and they apparently only used it to sign up the other spam domains.
Here is the info:

[Note: using the whois.namebay.com server reveals the actual registrar
while whois.afilias.info does not]

contacting server whois.namebay.com

Domain Name : BUENOCARTO.INFO
Created On : 2004-07-01
Expiration Date : 2005-07-01
Status : ACTIVE
Registrant Name : Valery Binanaka
Registrant Street1 : Bolshoy Kamenniy Most 21, 14
Registrant City : Moscow
Registrant State/Province  : RU
Registrant Postal Code : 132423
Registrant Country : RU
Admin Handle : VB38284
Admin Name : Valery Binanaka
Admin Street1 : Bolshoy Kamenniy Most 21, 14
Admin City : Moscow
Admin State/Province : RU
Admin Postal Code : 132423
Admin Country : RU
Admin Phone : +7.6490189
Admin Email : valerybinan...@mail.ru
Tech Handle : VB38284
Tech Name : Valery Binanaka
Tech Street1 : Bolshoy Kamenniy Most 21, 14
Tech City : Moscow
Tech State/Province : RU
Tech Postal Code : 132423
Tech Country : RU
Tech Phone : +7.6490189
Tech Email : valerybinan...@mail.ru
Billing Handle : VB38284
Billing Name : Valery Binanaka
Billing Street1 : Bolshoy Kamenniy Most 21, 14
Billing City : Moscow
Billing State/Province : RU
Billing Postal Code : 132423
Billing Country : RU
Billing Phone : +7.6490189
Billing Email : valerybinan...@mail.ru
Name Server : FIRST.BUENOCARTO.INFO
Name Server : SECOND.BUENOCARTO.INFO
Name Server : THIRD.BUENOCARTO.INFO
Name Server : ADDON.BUENOCARTO.INFO
Registrar Name : NAMEBAY
Registrar WebSite : http://www.namebay.com

FIRST.BUENOCARTO.INFO = 221.143.42.209 / HANARO
SECOND.BUENOCARTO.INFO = 221.139.2.84 / HANARO
THIRD.BUENOCARTO.INFO = 61.128.198.10 / CHINANET-CQ
ADDON.BUENOCARTO.INFO = 219.146.151.49 / CHINATELECOM-sd

Total Domains Trend - BUENOCARTO.INFO

Weeks      Total Domains        
08/02/04        27      
07/26/04        27      
07/19/04        27      
07/12/04        19      

[snip]

Forgot:

221.143.42.209 - IP hosts 16 Total Domains ...
Showing 1 - 16 out of 16

        Domain Name
1       AGBBALIE.INFO.
2       ALDICIJH.INFO.
3       CNHDCDAI.INFO.
4       GCABMEBM.INFO.
5       JGANMNBJ.BIZ.
6       JMKGGCGJ.INFO.
7       KEJNBFGI.BIZ.
8       KFDLAMJL.INFO.
9       LINGELAL.BIZ.
10      LJLHHDJN.INFO.
11      LNBJIHCN.INFO.
12      MAGCNMKG.BIZ.
13      NLHJBIGK.INFO.
14      OEM101.BIZ.
15      SOFTARIUM.INFO.
16      SOFTCDS.BIZ.

221.139.2.84 - IP hosts 4 Total Domains ...
Showing 1 - 4 out of 4

        Domain Name
1       JLBLBIB.INFO.
2       LEMCHFJ.INFO.
3       LJMBJHD.INFO.
4       MLKCNCL.INFO.

219.146.151.49 - IP hosts 21 Total Domains ...
Showing 1 - 21 out of 21

        Domain Name
1       ACLBKCDC.INFO.
2       AFFILIATESERVICE.BIZ.
3       BDCNGLJJ.BIZ.
4       BEAUTY-ANGEL.BIZ.
5       BEAUTY-ANGEL.NET.
6       CGNACMG.INFO.
7       CHEAPESTSOFT.BIZ.
8       ETERNAL-BEAUTY.BIZ.
9       ETERNAL-BEAUTY.NET.
10      FIFCAIJN.INFO.
11      HELPALOT.BIZ.
12      IFBCCCH.INFO.
13      ILDLIGG.BIZ.
14      KJMBKCK.BIZ.
15      OUTSPOKENTEENPORN.BIZ.
16      OUTSPOKENTEENPORN.NET.
17      SOFTWORKX.BIZ.
18      TEENME.BIZ.
19      TGFIND.NET.
20      THESNAKEKING.BIZ.
21      TINYAMERICA.BIZ.

In news.admin.net-abuse.email - article <10h2v3jgbdgo434
@corp.supernews.com>, on Wed, 04 Aug 2004 17:18:16 -0700, glgxg
says...

...
[snip]

What else shows up on the following IP,

Canonical name: sfi.propylene3479pi11s.us
Addresses:
  221.143.42.37

it and it's name servers seem to be tied via a...@sanita77.biz

Domain Name:                                 PROPYLENE3479PI11S.US
Domain ID:                                   D6497094-US
Sponsoring Registrar:                        ENOM, INC.
Domain Status:                               ok
Registrant ID:                               613D6E481933A837
Registrant Name:                             tiiri konkretno
Registrant Organization:                     Uno More
Registrant Address1:                         Briezha 5-6
Registrant City:                             Riga
Registrant State/Province:                   Riga
Registrant Postal Code:                      LV 1021
Registrant Country:                          Latvia
Registrant Country Code:                     LV
Name Server:                                 NS3.AIRMARAMBA.BIZ
Name Server:                                 NS2.AUDI56SEW.BIZ
Created by Registrar:                        ENOM, INC.
Domain Registration Date:                    Mon Aug 02 07:44:46 GMT
2004

#begin  g...@mfire.invalid.com.exe (or was it glgxg.com)
 message <10h2upkl937d...@corp.supernew­s.com> reply:

<SNIP>

<SNIP>

It actually does, just the encoded way (no idea why they do it like that):

$ jwhois BUENOCARTO.INFO
[Querying whois.afilias.info]
[whois.afilias.info]
<...>
Domain ID:D6033888-LRMS
Domain Name:BUENOCARTO.INFO
Created On:01-Jul-2004 16:04:15 UTC
Last Updated On:02-Jul-2004 07:00:33 UTC
Expiration Date:01-Jul-2005 16:04:15 UTC
Sponsoring Registrar:R123-LRMS <== Note
<...>

http://www.afilias.info/whois_­search/sponsoring_registrars

<QUOTE>
R123-LRMS       Namebay cuitasse[AT]namebay.com
</QUOTE>

Ah... thanks for that!  I went nuts trying to figure that out before
finally stumbling on namebay directly.

Re: SUCCESS!

Re: SUCCESS!

And another one down, and another one down, another one bites the dust.
Hey, spammy, we're gonna get you, too. Another one bites the dust!

bjbmdbe.info is now dead. Another Russian Spam Gang domain gone... and this
one, they didn't even get a chance to send any spam for. InterCosmos is
killing them off preemptively now. I've got them searching through their
records for the email addresses the Russian Spam Gang has used to register
other domains, and they're killing any off that were registered with those
email addresses.

This is too much fun... 4 spammer domains killed off (and possibly quite a
few more once they find them) in two days... the Russian Spam Gang has got
to be wondering what's going on.

People, if you want to help kill off an egregious spammer in a vicious,
brutal bloodletting, then I urge you to contact InterCosmos with any
Russian Spam Gang spam you've gotten, and to set up your own SpamVampire
(http://www.hillscapital.com/an­tispam/index.htm grab the source code) and
hit them as hard as you can for the domains they didn't register through
InterCosmos.

We've got a chance right now to kill off a major spam ring that's been
sending out hundreds of millions of spams, for mortgages, fake viagra,
penis enlargement, and pirated software.

I wouldn't get quite so excited... you are talking about INTERCOSMOS
MEDIA GROUP, INC. after all.

BTW:

http://groups.google.com/group­s?&scoring=d&q=KLCBHGF.BIZ

Now on:

08/05/04 18:39:43 dns KLCBHGF.BIZ
Canonical name: KLCBHGF.BIZ
Addresses:
  201.3.240.226

Checking server [whois.neulevel.biz]
Results:
Domain Name:                                 KLCBHGF.BIZ
Domain ID:                                   D7323980-BIZ
Sponsoring Registrar:                        INTERCOSMOS MEDIA GROUP,
INC. D.B.A. DIRECTNIC.COM
Domain Status:                               ok

reading URL KLCBHGF.BIZ
contacting host klcbhgf.biz [201.3.240.226] on port 80

HTTP/1.1 200 OK
Date: Fri, 06 Aug 2004 00:35:53 GMT
Server: Apache/1.3.31 (Unix) PHP/4.3.7 mod_accel/1.0.31 mod_ssl/2.8.18
OpenSSL/0.9.7d
X-Powered-By: PHP/4.3.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

201.3.240.226 - IP hosts 11 Total Domains ...
Showing 1 - 11 out of 11

        Domain Name
1       ALEBDCD.INFO. <== INTERCOSMOS
2       AMLGJLBC.BIZ. <== NameBay
3       CIMCAHH.BIZ. <== NameBay
4       DMBLMIFF.INFO. <== NameBay
5       EDJIHJEM.INFO. <== NameBay
6       FJLLDAF.INFO. <== NameBay
7       FMMBHGN.BIZ. <== NameBay
8       GINCBDC.INFO. <== NameBay
9       HBEBLBN.BIZ. <== INTERCOSMOS
10      LDEBHBE.INFO. <== INTERCOSMOS
11      MBHCACD.INFO. <== NameBay

news:10h5pmeso20qe7d@corp.supernews.com...

OK, now how do I do that? How do I get a server to give up all the domains
it's hosting? Teach me, please.

http://whois.webhosting.info/2­01.3.240.226

Just be advised that it's a snapshot type database lookup, so it can
have a time lag. You need to look up the individual names for
verification via other standard tools.