Privacy for Spammers & Other Malcontents

Nigerian scams, chain letters, pyramid schemes and anything not auction related.
Post Reply
ionet
Members
Posts: 2156
Joined: Fri Feb 18, 2005 2:33 pm
Location: Hawkes Bay

Privacy for Spammers & Other Malcontents

Post by ionet » Sun Jan 06, 2013 11:54 pm

_



Ever get a Spam email & check the Domain Registrants & other parties via Domain Whois to find the following Outfit
or some other plastered in all Domain Contact fields and the Spammer / Scammer safely hidden behind the wall ?

PrivacyProtect.org


Registrant:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - All Postal Mails Rejected, visit Privacyprotect.org
Nobby Beach
null,QLD 4218
AU
Tel. +45.36946676

Creation Date: xx-xxx-20xx
Expiration Date: xx-xxx-20xx

Domain servers in listed order:
ns1.spammerdomain.com
ns2.spammerdomain.com


Administrative Contact:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - All Postal Mails Rejected, visit Privacyprotect.org
Nobby Beach
null,QLD 4218
AU
Tel. +45.36946676

Technical Contact:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - All Postal Mails Rejected, visit Privacyprotect.org
Nobby Beach
null,QLD 4218
AU
Tel. +45.36946676

Billing Contact:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - All Postal Mails Rejected, visit Privacyprotect.org
Nobby Beach
null,QLD 4218
AU
Tel. +45.36946676

It appears that in the past few months there have been some changes at PrivacyProtect and they
are not good, nor very positive for some web users.


If you are the poor sucker on the end of Spam or other Scam emails from Domains that their Service
is hiding details of the malcontents who registered the name or are doing the spamming - then don't
think the crew operating hiding service are going to want to help out other than to smile sweetly,
tell you to suck the kumara and send you on another wild goose chase after the Domain Registration Service
who probably care as much as PP about their revenue more than their service is being used for
illegal spamming / scamming - that is if any response is forthcoming for the Domain Registrar at all ;-)



Let's see how the Privacy Protect Service offered by privacyprotect.org has improved in just
two months to help stop Spamming & Scamming :



Exhibit A: A Response from Privacyprotect.org in Nov - 2012:


Hello,

Thank you for contacting Privacy Protect.

Looking into your complaint, we have determined that the domain name is in violation of the terms of usage of the Privacy Protect service. We have therefore,

1. disabled the Privacy Protect service for the domain name, such that it now displays the putative contact details of the domain name holder, and
2. notified the sponsoring Registrar about the complaint, who shall act upon the complaint in accordance with their policies.

For any further updates on this matter, you can contact the sponsoring Registrar of the domain name.

We are extremely particular about preventing misuse of our services in any manner. Should you encounter any other such instances, please feel free to notify us immediately.

Regards,
PrivacyProtect.org

Exhibit B: A Response from Privacyprotect.org generated in Jan - 2013:



Hello,

Privacy Protect is just a service enabled on the domain name "XXXXXXXXXXXX.com".

Please note that the issue you brought to our notice needs to be filed with the Registrar of the domain name. Find the registrar's details of the domain name at http://domainwhitepages.com/" onclick="window.open(this.href);return false;

Have a nice day.!!

Regards,
PrivacyProtect.org



Really for an AUSTRALIAN COMPANY operating in an E-World where Spamming & Scamming is on the
increase most may be wondering what they think they are likely to gain from the latest change ? ;-)

Perhaps anyone receiving Spam / Scams should report PP.org to the Australian Authorities
since they are the ones whose contact details appear and by virtue of their non action on complaints
and in hiding the culprits may in some quarters be considered to be implicitely involved in the
Spamming & Scamming activities if not condoning it ? ;-)


Shame on you Privacyprotect.org !!



M


_
Ultimate Auction Security: Kick 'em in the pants & sweep them under the carpet fast before anyone sees & hope they go away.

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: Privacy for Spammers & Other Malcontents

Post by Foggyone » Mon Jan 07, 2013 2:50 am

"Not our problem, mate!

We are busy.

Hey, Wayne, throw another roo on the barbie, and give us a tinny. Tell the sheila to put more suntan lotion on me."
Google, the answer to so many questions!
-----------------------------------------------------

ionet
Members
Posts: 2156
Joined: Fri Feb 18, 2005 2:33 pm
Location: Hawkes Bay

Re: Privacy for Spammers & Other Malcontents

Post by ionet » Wed Jan 16, 2013 3:09 am

_

And even more protection is afforded for Spammers, Scammers and Malcontents on the servers of this
Swedish based Internet Company it would appear:



CRYSTONE

Crystone.com
Crystone.se
Crystone.co.uk

with branches and servers not only in UK, USA, Sweden, but also Germany, Spain, Norway and
probably elsewhere too.

They must be very busy with 300,000 websites onboard, however unfortunately Customer Service
actually acting on and responding on Spammer complaints appears rather hopeless and deficient
if their Servers dont reject and return your Spam complaints back to you and not a dicky bird
seen back for multiple complaints on the following Spam Efforts shot their way to date:



How hard is it for Network Admins in some of these outfits to work out that they are
harbouring Spammers & Scammers who are simply reusing their illgotten & unauthorised
Spam email lists for spamming further domain names on their Networks ? ;-)


Subject: the method that changed my life...

-

Hello,



The method that changed my life - can change yours today!

It's simple, legal and very quick to learn

…and it really works.

I finally found a simple way to generate steady income
that enables me to live a relaxed life.

Now, to show gratitude for my share of luck, I am willing to share it
with you.


The simplest way on the net to create your own

source of income .. is one click away from you.




Click here
http://asdasasdas.com/" onclick="window.open(this.href);return false;

which then morphed into this with 15 further domains being spammed:

Subject: 1 pending message - Life changing info


Hi,

This might be the moment that will change your life…
One hour is all you need, to acquire life changing knowledge!

When I realized how simple this is , it struck me...
Then I understood I found the way to follow my dreams.
Learn now how to create your own source of income working from home.

It's simple, legal and very quick to learn.

Click here
http://secrethavenspa.com/" onclick="window.open(this.href);return false;




To unsubscribe from our mailing list, please click here
http://secrethavenspa.com" onclick="window.open(this.href);return false;


before becoming this for a few more spam sessions:

Subject: home alone mum makes \302\24312,000 in 5 days


Hi

Did you hear about the home alone mum, that banked over £12,000 trading
binary options
from her PC in her kitchen in under a week?

*She had no experience
*She needed no training
*She only wanted a few hundred pounds
*She ended up with a years salary in just 1 week

CLICK HERE TO SEE THE VIDEO
http://wwwhuaisese.com/" onclick="window.open(this.href);return false;

She did all of this with nothing more than a piece of software given to
her for free for beta testing.
Quite possibly the best decision she had ever made.

This software is now available to the public and comes with a free 7 day
trial, so please do yourself a favour and check
this out now before it’s too late.

======>>>>> http://wwwhuaisese.com/" onclick="window.open(this.href);return false;


This is unlike anything that has ever been made available to joe public
before and as its free for the first 7 days of use,
you really have nothing to lose by checking it out RIGHT NOW



======>>>>> http://wwwhuaisese.com/" onclick="window.open(this.href);return false;

before reverting back to the
Subject: Subject: 1 pending message - Life changing info
for some more spamming

and more recently:

Subject: This is revolutionary and really works !


Hello

The method that changed my life - can change yours today!
It's simple, legal and very quick to learn
…and it really works.

I finally found a simple way to generate steady income that enables me
to live a relaxed life.

Now, to show gratitude for my share of luck, I am willing to share it
with you.

The simplest way on the net to create your own
source of income .. is one click away from you.

http://gurucosmos.com/" onclick="window.open(this.href);return false;


To unsubscribe from our mailing list, please click here
http://gurucosmos.com" onclick="window.open(this.href);return false;

New version for 17th Jan:

Subject: Somthing you might want to know


Hi,

Here is some inside info... they don't want you to know.
It is possible to beat the system with the right method!

The most advanced methods, including software that will show you exactly
how it's done.

Just pay attention and follow a few simple rules, and
You will soon be looking at a new source of income.

Click here to learn more
http://thepetvac.com" onclick="window.open(this.href);return false;


The list of Spammed Domain Names all harboured on the "tardy to take any action"
CRYSTONE Group servers grows:

asdasasdas.com
lummf.com
iceevod.com
secrethavenspa.com
jimlerza.com
twvanya.com
qznewtest.com
cashwalks.com
bepillfree.com
iamnotwillsun.com
raygaribay.com
nattvest.com
phendriecou.com
mygetshopasia.com
mysquaread.com
erasecrowsfeet.com
home-mawork.com

minteats.com
cehalverson.com
wwwhuaisese.com
heiguutqwyy.com
nonnee.com
kirahepferbozv.com
zadyron.com
gurucosmos.com
teensjeens.com

thepetvac.com
newcomerszene.com


But wait - one of these is not the same as the others ;-)

All bar one has the following very useful Contact details:

Registrant:
PrivacyProtect.org
Domain Admin ()
ID#10760, PO Box 16
Note - All Postal Mails Rejected, visit Privacyprotect.org
Nobby Beach
null,QLD 4218
AU
Tel. +45.36946676

All appear registered via Domaincontext.com who to their credit are starting
to disconnect the Spammer's domains

As we already have seen privacyprotect.org dont appear to give a continental
past clipping the spammer/scammer's plastic for the privacy

(It remains to be seen how the Australian Spam Authorities may look on this
sort of uncaring 'walk away' conduct and what the PP service is aiding and abbetting)


All of the Spammed Domains are Hosted by various CRYSTONE Servers

All of the domains are being Spamvertised via various CRYSTONE network systems:

Received: from static-83-168-196-236.cust.crystone.se ([83.168.196.236] helo=www2.asdasasdas.com)
Received: from www3.lummf.com ([193.181.30.43])
Received: from http://www.iceevod.com" onclick="window.open(this.href);return false; ([193.182.173.89])
Received: from [192.165.51.199] (helo=www3.secrethavenspa.com)
Received: from http://www.lummf.com" onclick="window.open(this.href);return false; ([192.176.167.105])
Received: from [192.165.196.65] (helo=www.jimlerza.com)
Received: from www3.twvanya.com ([193.182.182.43])
Received: from static-192-165-108-159.cust.crystone.se ([192.165.108.159] helo=www.qznewtest.com)
Received: from http://www.cashwalks.com" onclick="window.open(this.href);return false; ([193.180.237.109])
Received: from [193.183.184.126] (helo=www3.bepillfree.com)
Received: from static-83-168-193-199.cust.crystone.se ([83.168.193.199] helo=www2.iamnotwillsun.com)
Received: from http://www.cashwalks.com" onclick="window.open(this.href);return false; ([193.180.237.109])
Received: from [192.121.178.198] (helo=www3.raygaribay.com)
Received: from static-83-168-207-47.cust.crystone.se ([83.168.207.47] helo=www2.nattvest.com)
Received: from static-193-183-155-118.cust.crystone.se ([193.183.155.118] helo=www2.phendriecou.com)
Received: from static-192-71-230-120.cust.crystone.se ([192.71.230.120] helo=www.mygetshopasia.com)
Received: from www3.mysquaread.com ([192.36.219.128])
Received: from static-83-168-199-166.cust.crystone.se ([83.168.199.166] helo=www2.erasecrowsfeet.com)
Received: from static-193-182-160-141.cust.crystone.se ([193.182.160.141] helo=www.wwwhuaisese.com)
Received: from static-193-234-245-112-cust.crystone.se ([193.234.245.112] helo=www.cehalverson.com)
Received: from www2.minteats.com ([192.121.37.156])
Received: from static-193-234-244-112-cust.crystone.se ([193.234.244.112] helo=www.heiguutqwyy.com)
Received: from static-192-165-108-159.cust.crystone.se ([192.165.108.159] helo=www.qznewtest.com)
Received: from www3.nonnee.com ([193.182.146.43])
Received: from static-193-234-179-146.cust.crystone.se ([193.234.179.146] helo=www.kirahepferbozv.com)
Received: from www2.zadyron.com ([194.68.6.184])
Received: from www2.gurucosmos.com ([192.121.25.155])
Received: from www2.teensjeens.com ([192.165.240.213])
Received: from static-192-36-17-124.cust.crystone.se ([192.36.17.124] helo=www.newcomerszene.com)
Received: from www2.thepetvac.com ([192.165.242.191])

The Structuring of all the Spam messages similarly formatted, all using one Domain Registrar,
all bar one using Privacyprotect.org cloaking and all using CRYSTONE for hosting and to send
UCE Spam messages point to one Spammer or Group of Spammers


So who is this Spammer ?


On the list of Spammed domains, there is one which missed getting Privacy Protect cloaking:

Domain Name: MINTEATS.COM


Domain Name: MINTEATS.COM
Registrar: DOMAINCONTEXT, INC.
Whois Server: whois.domaincontext.com
Referral URL: http://www.domaincontext.com" onclick="window.open(this.href);return false;
Name Server: NS1.MINTEATS.COM
Name Server: NS2.MINTEATS.COM
Status: clientTransferProhibited
Updated Date: 05-sep-2012
Creation Date: 26-aug-2012
Expiration Date: 26-aug-2013



Domain Name: MINTEATS.COM


HERE IS THE SPAMMER:


Registrant:
N/A
Alexei Cioban (alexon@it-lab.md)
str. Decebal, 33
Chisinau
,MD2000
MD
Tel. +373.22521345



Creation Date: 26-Aug-2012
Expiration Date: 26-Aug-2013

Domain servers in listed order:
ns1.minteats.com
ns2.minteats.com


Administrative Contact:
N/A
Alexei Cioban (alexon@it-lab.md)
str. Decebal, 33
Chisinau
,MD2000
MD
Tel. +373.22521345

Technical Contact:
N/A
Alexei Cioban (alexon@it-lab.md)
str. Decebal, 33
Chisinau
,MD2000
MD
Tel. +373.22521345

Billing Contact:
N/A
Alexei Cioban (alexon@it-lab.md)
str. Decebal, 33
Chisinau
,MD2000
MD
Tel. +373.22521345


The Spammers Domain Name:


it-lab.md


Domain name: it-lab.md
Registrant: IT-LAB SISTEM SRL
Created: 2007-05-09
Expiration date: 2013-05-09
Name server: ns.it-lab.md 92.39.48.74
Name server: ns2.it-lab.md 77.89.244.110
DNS update: 2010-09-27 01:03



Server Type:
Apache/2.2.22 (Ubuntu)
IP Address:
79.140.175.114 Reverse-IP | Ping | DNS Lookup | Traceroute
ASN:
AS43870
IP Location:
- Chisinau - Chisinau - Danis Srl
Response Code:
200
Domain Status:
Registered And Active Website

Let's see how long it takes to see disconnection of services in Macedonia to cause a little return discomfort to this spammer ;-)


Shame on you - Crystone for your very poor effort and responses in addressing issues resident on your service

Most professional web providers have efficient online reporting facilities and the better ones act to investigate
complaints promptly.


M


[updated 17 Jan]

_
Ultimate Auction Security: Kick 'em in the pants & sweep them under the carpet fast before anyone sees & hope they go away.

ionet
Members
Posts: 2156
Joined: Fri Feb 18, 2005 2:33 pm
Location: Hawkes Bay

Re: Privacy for Spammers & Other Malcontents

Post by ionet » Sun Mar 24, 2013 5:27 am

_


Our silly little Macedonian Spammer is off again with similar style of Spamming -

PrivacyProtect.org Domain Cloaking

and

Domaincontext.com as domain registrar service

and

Crystone Servers globally used for sending the deeds out and hosting the
Spamvertised Sites:

HERE IS THE SPAMMER:


Registrant:
N/A
Alexei Cioban (alexon@it-lab.md)
str. Decebal, 33
Chisinau
,MD2000
MD
Tel. +373.22521345

Well Sara & Sara N - your past antics still tell us you're up to the same Spamming activities


From Sara
Subject Line: How are you ?


Hey,

Look what I found

Local Mom's Shocking Story

Kisses,
Sarah




To stop receiving these emails: Click Here



and now for the list of further Spammed Domains being used by this Spammer:



kirklund.com
ultrplx.com
jamboori.com
drkinuca.com
azlyr.com
jamesboots.com
teensexpix.com
planetma.com
barkabark.com


All are similar to the MO the following one records:
Domain Whois:

Domain Name: ULTRPLIX.COM
Registrar: DOMAINCONTEXT, INC.
Whois Server: whois.domaincontext.com
Referral URL: http://www.domaincontext.com" onclick="window.open(this.href);return false;
Name Server: NS1.ULTRPLIX.COM
Name Server: NS2.ULTRPLIX.COM
Status: clientTransferProhibited
Updated Date: 05-nov-2012
Creation Date: 30-oct-2012
Expiration Date: 30-oct-2013


Registration Service Provided By: DOMAINCONTEXT INC.

Domain Name: ULTRPLIX.COM

Registration Date: 30-Oct-2012
Expiration Date: 30-Oct-2013

Name Servers:
ns1.ultrplix.com
ns2.ultrplix.com



Registrant Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)

ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Administrative Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Technical Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
ote - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 421


Server Stats:

Server Type:
Apache/2.2.15 (CentOS)
IP Address:
193.234.197.56
Whois Server:
whois.domaincontext.com
ASN:
AS35041 NET-CRYSTONE-STHLM Crystone Autonomous Network Stockholm (registered May 20, 2005)
IP Location:
France - Crystone France

Response Code:
200
Domain Status:
Registered And Active Website

Received From:


Return-path: <bounce@ultrplix.com>
Received: from [193.234.197.56] (helo=www.ultrplix.com)



Even Domaincontext.com Abuse Section seem to be asleep on the job after looking at the
last lot of spammings.

Privacyprotect.org despite their stated 'will act on certain activities cloaking is used to hide
as we saw earlier in effect in email responses to complaints admit they dont want to know
and therefore will do SFA on abuse of cloaked domains being spammed.

Australian Span Reporting Agencies continue to be asleep on the job to what Australian
Service Provider - 'Privacyprotect.org' are blindly allowing to carry on with domains
that - 'they' appear publically as registrant & all the contacts for.

All round a fairly hopeless set of answers from all these outfits and reporting agencies
when jumping on Spam and Spammers is supposed to be the intention if they all havent
forgotten ;-)

Shall we try ringing a few bells & blowing whistles with authorities & others in Macedonia
to see who will be woken up by some loud noises ? ;-)


M



_
Ultimate Auction Security: Kick 'em in the pants & sweep them under the carpet fast before anyone sees & hope they go away.

ionet
Members
Posts: 2156
Joined: Fri Feb 18, 2005 2:33 pm
Location: Hawkes Bay

Re: Privacy for Spammers & Other Malcontents

Post by ionet » Fri Jul 26, 2013 1:50 am

_


Our Low Life Macedonian Spammer hiding behind PrivacyProtect.org
services & using Domaincontext.com Domain Registration service
is still alive & well:

Date: Wed, 24 Jul 2013 15:16:16 -0400
From: "Tom" <tom@earnigsip.com>
Reply-To: tom@earnigsip.com
Subject: Fwd: Your Username and Password


Your account has been activated.
You can start right here.
-------------------------------------------------------------------------------------------------------------------------
You'll thank me for forwarding this message to you...I just had to share it...
It's an amazing software. You won't believe what it does.

Cheers,

Tom Hardly



SPAMMER'S URL: http://www.earnigsip.com/" onclick="window.open(this.href);return false;


From: "Tom" <tom@handmadeshopp.com>
Reply-To: tom@handmadeshopp.com
Subject: Fwd: Your Username and Password

Your account has been activated.
You can start right here.
-------------------------------------------------------------------------------------------------------------------------
You'll thank me for forwarding this message to you...I just had to share it...
It's an amazing software. You won't believe what it does.

Cheers,

Tom Hardly


SPAMMER'S URL: http://www.handmadeshopp.com/" onclick="window.open(this.href);return false;

From: "Alice" <alice@potcommit.com>
Reply-To: alice@potcommit.com
Subject: Re OMG ... This Amazing


Did you see this woman?! She is incredible!

Single mother saves family!!!

Yours,

Alice


SPAMMER'S URL: http://www.potcommit.com/" onclick="window.open(this.href);return false;

SPAMMER'S URL: http://www.rawchase.com/" onclick="window.open(this.href);return false;

SPAMMER'S URL: http://www.fromgascony.com/" onclick="window.open(this.href);return false;



Our little friends Alice & Tom are really aliases of the Macedonian Spammer Alexei Cioban
trying more of his spamming antics ;-)



M


_
Ultimate Auction Security: Kick 'em in the pants & sweep them under the carpet fast before anyone sees & hope they go away.

Post Reply

Who is online

Users browsing this forum: Bing [Bot] and 1 guest