Analysis of sample spam
spamvertizer = what.downmoon.info
Tue, 11 Nov 2003 22:28:29 +0000
"Need some action. ghdeafdpcnxzmdyae"

Overview - Innocent Bystander terrific.com Damaged by Spammers
Back to Terrific.com
Analysis of sample spam for the "pharaohmeds.biz" site.  First of the 2004 spam, we can count on more to follow later.  "Got ` Xan+a+x ` :P:ntermin - V1@Gra ' So|m|a ` Va.l.ium More available. H4Bme8Fv "
Analysis of sample spams for the "Tabfor.biz" Collection of Crap - brought to you from the jerks that have many sites now just blocking the entire set of .biz domains as useless.  All these spamvertizers are registered to the same old tabfor.biz and spamvertize pills and medicine - we hope the FDA and the FTC catch up with them soon.

We see from reading NANAE that these domains are the work of Eddy Marin. Ones he recently registered that we haven't seen the spams for yet are:
adosaus.biz casinosaustrai.biz casinosaustraia.biz derosausa.biz dildosaustralia.biz eosaus.biz extraosaus.biz fosaus.biz gasthofgosausee.biz goosaus.biz gosauschmied.biz gosausee.biz hyperosaus.biz interosaus.biz iosaus.biz magliosausage.biz malosaustralia.biz mimosausa.biz myosaus.biz osaus.biz osaus1.biz osausant.biz osausarium.biz osauscentral.biz osaused.biz osausent.biz osausing.biz osausion.biz osausland.biz osausnet.biz osauss.biz osausweb.biz overosaus.biz porcelanosausa.biz preosaus.biz proosaust.biz realosaust.biz sabatinosausage.biz suposaust.biz symosaust.biz techosaust.biz theosaust.biz transosaust.biz vamosausa.biz vosaus.biz

Analysis of sample spams from spamvertizers registered to "Frerrics Domains SL" (probably not their real name, I wouldn't put my real name on it, would you?).  Typically some flavor of "Online Cheating Wives".

As a result of this web site we are hearing from other domain owners who have also been subjected to having their domain names forged into spam messages from these people.  A partial list of some of the other spamvertizing domains registered to the Frerrics Domains gang includes: easy-loans-now.info fast-loans-now.info freewebtoken.info money-trees.info refi-today.info save-hundreds.info

In most cases, the spamvertizer has registered both a .biz and a .info version of the same domain name.
Analysis of sample spam spamvertizer = net-click.net.ph ( Inovasion / FT International ) "I know all that"  (also received as "Did you lose my ICQ?" & "Do you remember me ?") Insurance Crap
Analysis of sample spam spamvertizer = 1pills4less.biz "Meet me tomorrow" Make your penis bigger pills, although you'll never be as big a dick as the "Edward Davidson" who is the false name this site is registered to.
A collection of spams from a spamvertizer promising pills that will make your dick bigger.  Hosted in Brazil.

Spammer also has registered YOURPUBLICDNS.BIZ and runs own DNS servers, one hosted in Brazil and one with servepath.com in California.
Analysis of sample spam spamvertizer = stuffedgrapes.net Tue, 21 Oct 2003 "Why not ask me. tywdip7hxkihk17iio3jgail1m"
Analysis of sample spam spamvertizer = rizonthebiz.biz Fri, 24 Oct 2003 "saw ya online tdogrvbtiffwlbgx"  (also received as "Why not ask me. mjnibicnvpdebdjkq"
Analysis of sample spam spamvertizer = downmoon.info Tue, 11 Nov 2003 "Need some action. ghdeafdpcnxzmdyae" believed to be from the same jerks who brought us rizonthebiz.biz
A domain registrant of RTH, Inc does a lot of spamming to seemingly random addresses (meaning children may easily receive these) pushing free access to pornography.  Nothing is free, and we can bet there is at least some spyware or trojans being installed on the machines or users foolish enough to click the link.  Domains registered to them include goldfingerrock.biz, smackonthewall.biz, DNS4PROVIDERS.COM, DNS4PROVIDERS.NET, CONTINENTALHOSTING.COM, INDUSTRIALMEDS.COM, CORPTOPIA.COM, FAKINBACON.COM, & PANAMERICANHOSTING.COM

spamvertizer = goldfingerrock.biz Sat, 25 Oct 2003 "this is what you wanted naibbvcpnslkquhvjxlbqhi"
spamvertizer = smackonthewall.biz Sat, 25 Oct 2003 "is this you zzmtxahudeyicddsdtdcolvwmm"
spamvertizer = rodotee.biz Sun, 26 Oct 2003 "Get in this way. xvieybdbjnxudtyjfdl"

 

Here is the spam message, with its links disabled so nobody will accidentally click and end up in spam hell.

From: Maroun Karim [marounkarimrh@terrific.com]
Sent: Tuesday, November 11, 2003 4:28 PM
To: beasley1607@excite.com; beav1269@excite.com
Subject: Need some action. ghdeafdpcnxzmdyae
Take control of your relationships.
Find amazing women online that are looking
for one night stands and discrete encounters. Yea, there are 1000's of them


They are right here (linked to spamhttp://what.downmoon.info/pfrnd1/ -Ed.)

kfbuodbksvppslojibbedunwtqxyqvvvqwbbcnvwcmpvvnzxhndjxmsbtenxndvdqld
serhpgdlezgisdaybmmtnesclyomtgcucrpgoamzhshgyqlbkrwxruyidyxrqqntdscgrisdjb
hmojpgdshwnsgdkoqcfljolipezlkcjkxqmiunebezykzvqxukcdqumikoggadtmjc
jgonwmdvbjtyrdpkhatqdrryrakucpgzhszzlgjiakwcyhpgbgvuzzibgfagodsfmdyuubnghsgo

Here is the header from the spam message

Received: from localhost (localhost [127.0.0.1])
by tesla.bluemarble.net (Postfix) with ESMTP
id C3D2E6311A; Tue, 11 Nov 2003 17:36:34 -0500 (EST)
Received: from tesla.bluemarble.net ([127.0.0.1])
by localhost (tesla.bluemarble.net [127.0.0.1:10024]) (amavisd-new)
with ESMTP id 00239-06; Tue, 11 Nov 2003 17:36:31 -0500 (EST)
Received: from naharai.com (dhcp-66-244-80-5.smithvilledsl.net [66.244.80.5])
by tesla.bluemarble.net (Postfix) with ESMTP
id 30C4163193; Tue, 11 Nov 2003 17:28:33 -0500 (EST)
Message-ID: <3bd501c3a8a3$cc38b31d$78153b63@tgcnjvd>
From: "Maroun Karim" <marounkarimrh@terrific.com>
To: beasley1607@excite.com, beav1269@excite.com
Subject: Need some action. ghdeafdpcnxzmdyae
Date: Tue, 11 Nov 2003 22:28:29 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0807_CECE9AF7.8E60743C"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Virus-Scanned: by amavisd-new

really from 66.244.80.5 dhcp-66-244-80-5.smithvilledsl.net

Here we find "whois" the domain which sponsored the spam (what.downmoon.info) registered to

Domain ID:  D2949198-LRMS
Domain Name:  DOWNMOON.INFO
Created On:  03-Nov-2003 17:37:07 UTC
Expiration Date:  03-Nov-2004 17:37:07 UTC
Sponsoring Registrar:  CSL Computer Service Langenbach GmbH dba joker.com (R161-LRMS)
Status:  ACTIVE
Status:  OK
Registrant ID:  C3876623-LRMS
Registrant Name:  Domain Reg
Registrant Organization:  DPL
Registrant Street1:  17 Cal Ave
Registrant City:  Belize City
Registrant Postal Code:  5412x
Registrant Country:  BZ
Registrant Phone:  +999.9999999
Registrant FAX:  +999.9999999
Registrant Email:  datapoint5@ureach.com
Admin ID:  C3876614-LRMS
Admin Name:  Domain Reg
Admin Organization:  dpl
Admin Street1:  17 cal st
Admin City:  Belize City
Admin Postal Code:  5412x
Admin Country:  BZ
Admin Phone:  +999.9999999
Admin Email:  datapoint5@ureach.com
Billing ID:  C3876615-LRMS
Billing Name:  Domain Reg
Billing Organization:  dpl
Billing Street1:  17 Cal St
Billing City:  Belize City
Billing Postal Code:  5412x
Billing Country:  BZ
Billing Phone:  +999.9999999
Billing Email:  datapoint5@ureach.com
Tech ID:  C3876613-LRMS
Tech Name:  Domain Reg
Tech Organization:  dpl
Tech Street1:  17 Cal St
Tech City:  Belize City
Tech Postal Code:  5412x
Tech Country:  BZ
Tech Phone:  +999.9999999
Tech Email:  datapoint5@ureach.com
Name Server:  NS1.2RACELINE.BIZ
Name Server:  NS1.RAM-SYSTEMS.INFO
Name Server:  NS2.2RACELINE.BIZ
Name Server:  NS2.RAM-SYSTEMS.INFO

This registration is substantially similar to the registration for the spamvertizing site rizonthebiz.biz - same email contact addresses, same "Domain Reg" for the names, same bogus +999.9999999 phone numbers.  See the report on rizonthebiz.biz here.

Now what IP is the spamvertizer at right now.

11/11/03 23:33:51 dns what.downmoon.info
Canonical name: what.downmoon.info
Addresses:
217.23.38.162

And who has the IP block for the spamvertizer registered?

inetnum:      217.23.32.0 - 217.23.47.255
netname:      JO-ACCESSME-20001005
descr:        Provider Local Registry
descr:        LB PS EG
country:      JO
admin-c:      AN539-RIPE
tech-c:       AN539-RIPE
tech-c:       NF515-RIPE
status:       ALLOCATED PA
mnt-by:       RIPE-NCC-HM-MNT
mnt-lower:    ACCESSME-MNT
mnt-routes:   ACCESSME-MNT
changed:      hostmaster@ripe.net 20001005
changed:      hostmaster@ripe.net 20010823
changed:      hostmaster@ripe.net 20020419
changed:      hostmaster@ripe.net 20020423
source:       RIPE

person:       Amer Nimry
address:      P.O.Box 941136
address:      Amman 11194 Jordan
phone:        +962-6-5699990
fax-no:       +962-6-5691999
e-mail:       amer.nimry@accessme.com
nic-hdl:      AN539-RIPE
notify:       amer.nimry@accessme.com
changed:      amer.nimry@accessme.com 20010710
source:       RIPE

person:       Nasser Farhan
address:      P.O.Box 941136
address:      Amman 11194 Jordan
phone:        +962-6-5699990
fax-no:       +962-6-5691999
e-mail:       nasser.farhan@accessme.com
nic-hdl:      NF515-RIPE
notify:       nasser.farhan@accessme.com
changed:      amer.nimry@accessme.com 20010710
source:       RIPE

We feel certain that this site is brought to us by the same jerks that are or were running rizonthebiz.biz 

This page last updated 01/24/2004 02:37:22 PM -0600