VoyForums
[ Show ]
Support VoyForums
[ Shrink ]
VoyForums Announcement: Programming and providing support for this service has been a labor of love since 1997. We are one of the few services online who values our users' privacy, and have never sold your information. We have even fought hard to defend your privacy in legal cases; however, we've done it with almost no financial support -- paying out of pocket to continue providing the service. Due to the issues imposed on us by advertisers, we also stopped hosting most ads on the forums many years ago. We hope you appreciate our efforts.

Show your support by donating any amount. (Note: We are still technically a for-profit company, so your contribution is not tax-deductible.) PayPal Acct: Feedback:

Donate to VoyForums (PayPal):

[ Login ] [ Contact Forum Admin ] [ Main index ] [ Post a new message ] [ Search | Check update time | Archives: 1, [2], 3, 4 ]

[ Next Thread | Previous Thread | Next Message | Previous Message ]

Date Posted: 09:59:23 08/28/04 Sat
Author: Repost
Subject: OEM software scam

Recurring OEM software pirate seems to be getting connection/dns via Peer1

65.39.204.38 = [ server.myhostnet.net ]

OrgName: Peer 1 Network Inc.
OrgID: PER1
Address: 2100 - 555 W. Hastings St.
City: Vancouver
StateProv: BC
PostalCode: V6B-4N5
Country: CA
NetRange: 65.39.128.0 - 65.39.255.255

Search results for: 65.39.204.38
Peer 1 Network Inc. PEER1-BLK-06 (NET-65-39-128-0-1)
65.39.128.0 - 65.39.255.255
RUSKO.US PEER1-RUSKO-08 (NET-65-39-204-32-1)
65.39.204.32 - 65.39.204.47

NCF seems to strip most of the headers before forwarding to their webmail
server. How reliable would the 1093671974-8563@excite.com value be?

While the spamvertized urls vary slightly my connection log always shows
a PEER1 RUSKO IP
Details: Connection: oem-sale.info(65.39.204.38): http(80)
among the spammer's main/chinanet IPs, such as
Details: Connection: proggy.info(61.128.198.39): http(80)


>Return-path
>Received from spamassassin-daemon.saruman.ncf.ca by saruman.ncf.ca (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) id <0I350009ZA42XM@saruman.ncf.ca> for bo774@ims-ms-daemon; Sat, 28 Aug 2004 03:00:04 -0400 (EDT)
>Received from freenet.carleton.ca ([200.13.187.210]) by saruman.ncf.ca (iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003)) with SMTP id <0I3500EAHA2EC4@saruman.ncf.ca> for bo774@ims-ms-daemon (ORCPT bo774@freenet.carleton.ca); Sat, 28 Aug 2004 02:59:10 -0400 (EDT)
>Date Sat, 28 Aug 2004 05:46:14 +0000 (GMT)
>From Doug
>Subject Save HUGE $$$ on software!
>Sender la1wson9@hotmail.com
>To bd549@freenet.carleton.ca
>Message-id <1093671974-8563@excite.com>
>Content-type text/plain
>X-Spam-Checker-Version SpamAssassin 2.63 (2004-01-11) on gw.ncf.ca
>X-Spam-Level
>X-Spam-Status No, hits=0.0 required=1.0 tests=CASHCASHCASH autolearn=no version=2.63
>Original-recipient rfc822;bo774@freenet.carleton.ca
>Incredible DEALS on SOFTWARE you NEED!
>Free Delivery on 10% MORE OFF on orders over $200!
>
>Check it out!!
>http://proggy.info/index.php?s=7555
>
>$120 Quickbooks 2004
>$80 Windows XP Professional
>$60 Norton Antivirus 2004 Professional
>$90 Adobe Photoshop 7.0
>$80 Windows 2000 Professional
>$200 MS Windows Server 2003 Enterprise
>$120 Microsoft Office 2003 Professional
>$90 Adobe Pagemaker 7.0
>Save $410 on Adobe Photoshop!
>
>Save your company thousands of dollars when it needs software!
>
>That promotion just got closer...
>
>Check it out!!
>http://proggy.info/index.php?s=7555
>
>
>kleenex ccccccquest fountain hello1 deutsch charlott olivier
>toronto bullmarcus olivier memory
>cyrano vanilla oatmeal
>
>REMOV3:
>http://theyknowit.info/soft/chair.php

[ Next Thread | Previous Thread | Next Message | Previous Message ]
[ Contact Forum Admin ]

Forum timezone: GMT-8
VF Version: 3.00b, ConfDB:
Before posting please read our privacy policy.
VoyForums(tm) is a Free Service from Voyager Info-Systems.
Copyright © 1998-2019 Voyager Info-Systems. All Rights Reserved.