A global spam termination operation launched by CastleCops, the volunteer SIRT Squad is comprised of folks who report spam, investigate spam, and actively work on spam takedown and termination. SIRT is funded by CastleCops. Become a SIRT Squad terminator by reporting spam today!
See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=Canadian_Healthcare
or from China: http://www.spamtrackers.hk/wiki/index.php?title=Canadian_Healthcare
See the McAfee Site Advisor information at http://siteadvisor.com/sites/ayeaunes.com
> ONLINENIC, INC.
REGISTRATION OF THE WEB SITE: ayeaunes.com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold
> BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You
can safely suspend them:
ns1.krdns99.com [60.172.219.14] which is listed in the SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL65572
ns2.krdns99.com [221.230.2.221] which is listed in the SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL64972
ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold
To help expedite the removal of this criminally operated domain name, a Chinese translation of these directions is
available from the CastleCop Wiki:
http://wiki.castlecops.com/Suspending_an_EPP_name_server_domain_Chinese
From the URIBL - you will find these nameservers are not servicing ANY legitimate domains, and can be safely
suspended:
http://rss.uribl.com/ns/krdns99_com.html
ALERT: You are being _tracked_ by the CastleCops Wiki - Bulk Spam Reporting Project:
http://wiki.castlecops.com/Bulk_Spam_Reporting
Please visit the following articles - which will point out domains that have been reported for bulk removals, as well as
successfully suspended domains. Please use the list of suspended domains as examples to correctly suspend this domain
being used as a nameserver:
http://wiki.castlecops.com/BILT_Removals
http://wiki.castlecops.com/BILT_Removals_Archive
> CHINANET-BACKBONE No.31,Jin-rong Street (incl. anti-spam@ns.chinanet.cn.net)
IP ADDRESS OF HOST: 60.172.219.14
The IP address of this criminal site is within your allocated address space.
This IP address is currently linked with the following fraudulent, criminal-operated domains:
ns4.broyaoise.com A 60.172.219.14
ns4.wiuyqican.com A 60.172.219.14
ns4.wiudhkjcs.com A 60.172.219.14
www.mifykate.cn A 60.172.219.14
ACTION: Black-hole the route to this address to prevent further criminal activity
The criminality of these domain names can be verified using the following SiteAdvisor link format,
http://www.siteadvisor.com/lookup/?q=domainname.tld
CRIMINAL EVIDENCE - VIOLATION OF CAN-SPAM LAWS:
Delivered-To: xxx
Received: by 10.86.73.16 with SMTP id v16cs196036fga;
Mon, 30 Jun 2008 15:14:07 -0700 (PDT)
Received: by 10.141.116.16 with SMTP id t16mr2974258rvm.280.1214864046204;
Mon, 30 Jun 2008 15:14:06 -0700 (PDT)
Return-Path: <hesximptnh@peel01.fslife.co.uk>
Received: from mail-in.freeserve.com (247-139.76-83.cust.bluewin.ch [83.76.139.247])
by mx.google.com with ESMTP id c20si7819834rvf.1.2008.06.30.15.13.59;
Mon, 30 Jun 2008 15:14:06 -0700 (PDT)
Received-SPF: neutral (google.com: 83.76.139.247 is neither permitted nor denied by best guess record for domain of
hesximptnh@peel01.fslife.co.uk) client-ip=83.76.139.247;
Authentication-Results: mx.google.com; spf=neutral (google.com: 83.76.139.247 is neither permitted nor denied by best
guess record for domain of hesximptnh@peel01.fslife.co.uk) smtp.mail=hesximptnh@peel01.fslife.co.uk
Message-Id: <48695aad.14b48c0a.2100.2068SMTPIN_ADDED@mx.google.com>
From: "Desmond Gagne"<eewpbfvjx@peel01.fslife.co.uk>
To: <raan85@gmail.com>,
<biggkat@gmail.com>,
<xxx>,
<zacgrace@gmail.com>,
<josh.hoopingarner@gmail.com>
Date: Mon, 30 Jun 2008 15:02:35 -0700
Subject: Most lucrative and effective
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Hey how are things? Still trapped in the Nine to Five?
Well if you have a telephone which we all do and can return some calls
each day we want to hear from you as there is $15OO to $3500 in it for you :)
Give my info line a dial to hear how, its short and sweet but can give you the answers you
have been searching for.
800^275^0473
You may call anytime of day or night. So go ahead just have a listen it certainly is worth it since many receive the
first delivery of dough (1500-3500)
in the first fourty eight hours from starting...its awesome
In the event that the commercial mailer associated with this mailing is found to be a U.S. citizen and linked with
off-shore hosting/registration, and use of hijacked servers, this mailing was sent in violation of many requirements set
forth by the CAN-SPAM Act outlined at the following page:
http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.shtm
> ATTN: CERT Team
You are being copied this report due to the fact that the servers and the ISPs currently providing service to these
criminally-operated domain names are within your jurisdiction.
Please meet with the hosts, and customers associated with the machines behind these IP addresses and ensure that the
machines connected to these IP addresses are cleaned of all malicious contentt. For help, reference the CastleCops
Malware Removal and Prevention article located at the CastleCops Wiki:
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview
Further, enforce the need for hightened Internet Security, and the need for stronger and more secure password phrases to
prevent further malicious abuse from these addresses.
Handler Note: 02 Jul, 2008 23:51:54
ahoier: Generated and sent email spam alert to respective parties.
