Analysis of sample spam "Thats what i heard" spamvertizer = vpachka.biz (also received as "In your neighborhood")

Here is the spam message, with its links disabled so nobody will accidentally click and end up in spam hell.

From: Parveen Elledge [parveen.elledge_rt@terrific.com]
Sent: Thursday, October 09, 2003 5:48 PM
To: mavis@canada.com
Subject: Thats what i heard
 

Here is another version of the spam message, only the subject is different, received a couple days later, also with its links disabled so nobody will accidentally click and end up in spam hell.

From: Jamison R. Karibian [jamison.karibiandx@terrific.com]
Sent: Thursday, October 09, 2003 3:08 AM
To: doubled@iwc.net
Subject: In your neighborhood
 

Here is the header from the spam message

Return-Path: <parveen.elledge_rt@terrific.com>(forged to appear to come from terrific.com)
Received: (cpmta 14427 invoked from network); 9 Oct 2003 15:47:35 -0700
Received: from 81.203.157.42 (HELO zlp.com)
by smtp.c009.snv.cp.net (209.228.34.142) with SMTP; 9 Oct 2003 15:47:35 -0700(actually from a trojan program installed on an unwitting users pc at this ip address, one of hundreds of such infected pcs sending a steady stream of spam out)
X-Received: 9 Oct 2003 22:47:35 GMT
Message-ID: <5a3c01c38eb7$2594877e$2f96ff57@lrdnjwc>
From: "Parveen Elledge" <parveen.elledge_rt@terrific.com>
To: mavis@canada.com
Subject: Thats what i heard
Date: Thu, 09 Oct 2003 22:47:35 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_03BD_D13C290E.8843FFAB"

Here we find "whois" the domain which sponsored the spam (vpachka.biz) registered to

Curious, we notice that the contacts for the spam sponsoring domain have their email at tabfor.biz so we do a whois on tabfor.biz

Oh, look, the same email for the contacts of both vpachka.biz registered in Latvia and tabfor.biz registered in Spain.  And both domains have the same name servers at moskva66.biz too.

So now what about those nameservers for both domains, whois moskva66.biz?

The spammers domain of  also listed a third name server at MANGO34EF.BIZ so lets whois that too

Lets recap a minute.  We have four domains, all with the same contact email of admin@tabfor.biz  for admin, billing and technical contact.  We have three different organization names involved, and addresses in Spain and Latvia, but all apparently registered to the same contact person   Interesting to note that the phone number +371.9154123 for the contact person is the same on three out of the four domains, too.  For the fourth domain, the one that is sponsoring the spam, no phone is listed.  Maybe they don't want any calls.  One of the domains lists an actual persons name for the contact name - "Yitzhak Bar Levi Hanon".  Wonder if this is a real name?

Now lets go find out the ip addresses for all these servers

Here we find the ip address for the website sponsoring the spam

10/10/03 00:47:40 dns http://www.vpachka.biz
Mail for www.vpachka.biz is handled by www.vpachka.biz
Canonical name: vpachka.biz
Aliases:
www.vpachka.biz
Addresses:
203.197.204.81

10/09/03 18:23:35 dns http://www.vpachka.biz
Mail for www.vpachka.biz is handled by www.vpachka.biz
Canonical name: vpachka.biz
Aliases:
www.vpachka.biz
Addresses:
218.66.17.135

Well, look at this!  Two lookups above done six hours apart and the site moved in between times!  Coincidence?  Or do they overstay their welcome that quickly?  Remember, these folks are using their own name servers, so they can easily stay on the move if they wish too.  We went back and looked again about 10/10/03 07:30 and found they were back to the original spot.

Now we look to see who owns the two different ip address blocks.  First where the spam sponsoring site was last night 218.66.17.135

inetnum:      218.66.0.0 - 218.67.127.255
netname:      CHINANET-FJ
descr:        CHINANET Fujian province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       CA67-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-FJ
changed:      hostmaster@ns.chinanet.cn.net 20010820
status:       ALLOCATED NON-PORTABLE
source:       APNIC

role:         CHINANETFJ IP ADMIN
address:      7,East Street,Fuzhou,Fujian,PRC
country:      CN
phone:        +86-591-3333169-293
fax-no:       +86-591-3371954
e-mail:       fjnic@fjdcb.fz.fj.cn
trouble:      send spam reports  and abuse reports
trouble:      to abuse@fjdcb.fz.fj.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      FH71-AP
tech-c:       FH71-AP
nic-hdl:      CA67-AP
mnt-by:       MAINT-CHINANET-FJ
changed:      fjnic@fjdcb.fz.fj.cn 20020719
source:       APNIC

person:       Chinanet Hostmaster
address:      No.31 ,jingrong street,beijing
address:      100032
country:      CN
phone:        +86-10-66027112
fax-no:       +86-10-66027334
e-mail:       hostmaster@ns.chinanet.cn.net
e-mail:       anti-spam@ns.chinanet.cn.net
nic-hdl:      CH93-AP
mnt-by:       MAINT-CHINANET
changed:      hostmaster@ns.chinanet.cn.net 20021016
source:       APNIC

Now where the spam sponsoring site was six hours later 203.197.204.81

inetnum:      203.197.0.0 - 203.197.255.255
netname:      VSNL-IN
descr:        Videsh Sanchar Nigam Ltd - India.
descr:        Videsh Sanchar Bhawan, M.G. Road
descr:        Fort, Bombay 400001
country:      IN
admin-c:      IA15-AP
tech-c:       VT43-AP
remarks:      Internet Service Provider
mnt-by:       APNIC-HM
mnt-lower:    MAINT-VSNL-AP
changed:      hostmaster@apnic.net 19980915
changed:      hostmaster@apnic.net 20010608
status:       ALLOCATED PORTABLE
source:       APNIC

person:       IP Administrator
address:      10th Floor, 2 MG Road
address:      Fort Mumbai - 400001
address:      India
country:      IN
phone:        +91-22-2623620
fax-no:       +91-22-2653887
e-mail:       ip-admin@giasbm01.vsnl.net.in
nic-hdl:      IA15-AP
mnt-by:       MAINT-VSNL-AP
changed:      gpsingh@giasbm01.vsnl.net.in 20010605
source:       APNIC

person:       VSNL Tech
address:      10th Floor, 2 MG Road
address:      Fort Mumbai - 400001
address:      India
country:      IN
phone:        +91-22-2623620
fax-no:       +91-22-2653887
e-mail:       ip-tech@giasbm01.vsnl.net.in
nic-hdl:      VT43-AP
mnt-by:       MAINT-VSNL-AP
changed:      gpsingh@giasbm01.vsnl.net.in 20010605
source:       APNIC

Here we find the ip address for the domain contact's email server

10/10/03 00:42:02 dns http://tabfor.biz
Mail for tabfor.biz is handled by www.tabfor.biz
Canonical name: tabfor.biz
Addresses:
64.106.182.80

and who owns that ip address block where the contact for all these domains hosts his mail server?

10/10/03 01:02:44 IP block 64.106.182.80
Trying 64.106.182.80 at ARIN
Trying 64.106.182 at ARIN

OrgName: DataPipe
OrgID: DATAPI-2
Address: 80 River Street, 5th Floor
City: Hoboken
StateProv: NJ
PostalCode: 07030
Country: US

NetRange: 64.106.128.0 - 64.106.255.255
CIDR: 64.106.128.0/17
NetName: DATAPIPE-BLK4
NetHandle: NET-64-106-128-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.DATAPIPE.NET
NameServer: NS2.DATAPIPE.NET
NameServer: NS3.DATAPIPE.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-04-02
Updated: 2003-04-16

OrgTechHandle: DH1029-ARIN
OrgTechName: DataPipe Hostmaster
OrgTechPhone: +1-201-792-1918
OrgTechEmail: hostmaster@datapipe.com

# ARIN WHOIS database, last updated 2003-10-09 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

Wow, now who would have thunk that!  After finding things in Latvia, Spain, China and India suddenly we come to an IP address that is owned by a company in good old New Jersey!

Now we find the ip addresses for the three name servers our spam sponsoring domain contact manages

10/10/03 01:13:11 dns NS1.MOSKVA66.BIZ
Canonical name: NS1.MOSKVA66.biz
Addresses:
218.66.101.152

10/10/03 01:13:45 dns NS2.MOSKVA66.BIZ
Canonical name: NS2.MOSKVA66.biz
Addresses:
218.66.17.135

10/10/03 01:14:53 dns NS2.MANGO34EF.BIZ
Canonical name: NS2.MANGO34EF.biz
Addresses:
203.197.204.84

Tedious work, eh?  Not as tedious as getting thousands of complaints a day about spam terrific.com never sent, and having to write hundreds of requests a day to ISPs so that hijacked users machines on the internet can be blocked from spewing more of it!

Now we look to see who owns these ip address blocks.  The first two of them are familiar, they (218.66.101.152 and 218.66.17.135 are in the same block with the ip address where the spam sponsoring site was briefly found at last night (218.66.17.135)  It was:

inetnum:      218.66.0.0 - 218.67.127.255
netname:      CHINANET-FJ
descr:        CHINANET Fujian province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       CA67-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-FJ
changed:      hostmaster@ns.chinanet.cn.net 20010820
status:       ALLOCATED NON-PORTABLE
source:       APNIC

role:         CHINANETFJ IP ADMIN
address:      7,East Street,Fuzhou,Fujian,PRC
country:      CN
phone:        +86-591-3333169-293
fax-no:       +86-591-3371954
e-mail:       fjnic@fjdcb.fz.fj.cn
trouble:      send spam reports  and abuse reports
trouble:      to abuse@fjdcb.fz.fj.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      FH71-AP
tech-c:       FH71-AP
nic-hdl:      CA67-AP
mnt-by:       MAINT-CHINANET-FJ
changed:      fjnic@fjdcb.fz.fj.cn 20020719
source:       APNIC

person:       Chinanet Hostmaster
address:      No.31 ,jingrong street,beijing
address:      100032
country:      CN
phone:        +86-10-66027112
fax-no:       +86-10-66027334
e-mail:       hostmaster@ns.chinanet.cn.net
e-mail:       anti-spam@ns.chinanet.cn.net
nic-hdl:      CH93-AP
mnt-by:       MAINT-CHINANET
changed:      hostmaster@ns.chinanet.cn.net 20021016
source:       APNIC

The last of the name servers at 203.197.204.84 is also in a familiar block.  It is in the same ip address block with the ip address where the spam sponsoring site was moved to this morning (203.197.204.81)  It was:

inetnum:      203.197.0.0 - 203.197.255.255
netname:      VSNL-IN
descr:        Videsh Sanchar Nigam Ltd - India.
descr:        Videsh Sanchar Bhawan, M.G. Road
descr:        Fort, Bombay 400001
country:      IN
admin-c:      IA15-AP
tech-c:       VT43-AP
remarks:      Internet Service Provider
mnt-by:       APNIC-HM
mnt-lower:    MAINT-VSNL-AP
changed:      hostmaster@apnic.net 19980915
changed:      hostmaster@apnic.net 20010608
status:       ALLOCATED PORTABLE
source:       APNIC

person:       IP Administrator
address:      10th Floor, 2 MG Road
address:      Fort Mumbai - 400001
address:      India
country:      IN
phone:        +91-22-2623620
fax-no:       +91-22-2653887
e-mail:       ip-admin@giasbm01.vsnl.net.in
nic-hdl:      IA15-AP
mnt-by:       MAINT-VSNL-AP
changed:      gpsingh@giasbm01.vsnl.net.in 20010605
source:       APNIC

person:       VSNL Tech
address:      10th Floor, 2 MG Road
address:      Fort Mumbai - 400001
address:      India
country:      IN
phone:        +91-22-2623620
fax-no:       +91-22-2653887
e-mail:       ip-tech@giasbm01.vsnl.net.in
nic-hdl:      VT43-AP
mnt-by:       MAINT-VSNL-AP
changed:      gpsingh@giasbm01.vsnl.net.in 20010605
source:       APNIC