Scammers for 7/05

Barnu Rapatska / TotalPharmacy / WELCOME! Cheating House Wife Services / Date Lonely Wives
discountRxweb.com - Order Cialis Online and Save! lt;Secured Billing - Discreetly Shipped / How To Be A Red Hot Persuasion Wizard... In 20 Days Or Less!
DRUGS DIRECT: CHEAPEST DRUGS ON THE NET
EXTRA-TIME - last 5-10 times longer!
Score = 60 

This as a criminal gang of scammers. One uses web bugs and tagged URLs. Opening his spam with HTML & images enabled lets him know that your email address is valid. Following the links does too. Controls his own name servers. Sends from open proxies on trojaned computers. Changes domain name for redirecting pathes at least once a day. Fake whois data. Uses throwaway URLs that redirect to a URL that tracks your email address and the affiliate ID then redircts to the pay off URL. 

A second set of scammers links directly to the pay off URLs without redirects with just an "affiliate ID" on the URL. These URLs last for several days instead of just one or two like the redirecters.
 
Fake names: Miles Smith, Harry Gourley, Louis Phillipe, DAVID PATTERSON, Mush hashor, Radbergas, Olegas, Helmut Fischer, CHAS BUSHNELL, Bob Cooper, Barnu Rapatska, zopa cathlina, Stacey Gerstien, WebLove, Vadim Gablian, HomeViz, mathew barberstantonly, base advertising jump inc, lifetime, James Sweet, vashumat, James corona, mike mC Garythomason, bishopletsy trierson

Fake emails: whois77000@yahoo.com, whois77001@yahoo.com, louisludek@yahoo.com, dav999@coolgoose.com, olegas2003@spam.lv, helfischer1975@yahoo.com, chas@blazemail.com, bcooper@allsaintsfan.com, barnu@barnurapatska.com, support@emarketingdeals.com, admin@chillblow.com, infohelpteam@yahoo.com, admin@wifesmile.com, abbie@fusemail.com, joker2newdomains@yahoo.com, nameserver2004@yahoo.com
======================
Affiliate IDs:
Badboy
bonsay
got
okok
ronn
====================

balladries.com
Spammer controlled nameserver
Alias:
 Foundation Men On Line 
 leimomi01@tom.com 
Name Servers:: 
 ns1.balladries.com 
 ns2.balladries.com
chorally.com
IP: 211.147.228.108
celebsexposed.net
Host: 221.11.133.10
Name : Barnu Rapatska 
Email : webmaster@emarketingdeals.com ::Name Servers:: 
ns1.dns-passthrough.com 
ns2.dns-passthrough.com 
ns3.dns-passthrough.com 
ns4.dns-passthrough.com 
commodious.net
IP: 221.11.133.66
Reporting addresses:
abuse@cnc-noc.net
Alias:
 Miles Smith 
 whois77001@yahoo.com 
Fax : 
Name Servers:: 
 ns1.balladries.com 
 ns2.balladries.com
coolsites1.com
Contact:: 
Name : Barnu 
Email : barnu@barnurapatska.com 
Address : Snemovni 3 
Zipcode : 118 24 
Nation : CZ 
Tel : +420257174252 
Fax : 
::Name Servers:: 
ns1.anwoo.com 
ns1.mynameserver.ca 
ns1.bomofo.com 
ns1.epoboy.com
dns-base2.com
dns-click2.com
Name : Barnu Rapatska 
Email : support@emarketingdeals.com 
Address : Snemovni 3 
Zipcode : 118 24 
Nation : CZ 
Tel : +420257174252 
Fax : 
::Name Servers:: 
ns5.dns-setup.com 
ns6.dns-setup.com 
ns7.dns-setup.com 
ns8.dns-setup.com 

dns-html.com
Name servers
Alias: 
 HECTOR RUIZ 
 hector9090@yahoo.com 
Name servers: 
 ns1.dns-html.com 222.122.65.5 
 ns2.dns-html.com 221.7.209.87 
 ns3.dns-html.com 222.122.52.121 
 ns4.dns-html.com 222.223.135.28
dns-html2.com
Redirecter
dns-html2.com
owner: HECTOR RUIZ 
email: hector9090@yahoo.com 
nserver: ns1.dns-html.com 222.122.65.5 
nserver: ns2.dns-html.com 219.254.32.75 
nserver: ns3.dns-html.com 202.73.247.22 
nserver: ns4.dns-html.com 202.64.76.189 

dns-passthrough.com
URL redirecter & name servers
Host: 221.11.133.10
Reporting addresses:
abuse@cnc-noc.net
owner: CHAS BUSHNELL 
organization: CHAS 
email: chas@blazemail.com
nserver: ns1.dns-passthrough.com 218.7.112.244 
nserver: ns2.dns-passthrough.com 202.73.255.22 
nserver: ns3.dns-passthrough.com 221.11.133.12 
nserver: ns4.dns-passthrough.com 221.210.2.152 

dns-passthrough2.com
owner: CHAS BUSHNELL 
email: chas@blazemail.com 
ns1.dns-passthrough.com
ns2.dns-passthrough.com
ns3.dns-passthrough.com
ns4.dns-passthrough.com

DNS-FORWARD.COM
 Name servers

dns-forward2.com
 URL redirecter
dns-redir2.com
dns-redir2.com
URL redirecter
IP: 202.67.217.124
Reporting addresses: abuse@hknet.com
Alias:
 HECTOR RUIZ
 hector9090@yahoo.com
Name Servers: 
 ns1.dns-redir.com 
 ns2.dns-redir.com 
 ns3.dns-redir.com 
 ns4.dns-redir.com
dns-redirects.com
dns-redirects2.com
URL redirecter
IP: 218.7.120.82
Reporting addresses:
abuse@chinanet.cn.net 
abuse@cnc-noc.net
Name: CHAS 
email: CHAS@blazemail.com 
Name Servers 
ns1.dns-redirects.com 
222.122.65.5 
ns2.dns-redirects.com 
221.10.254.191 
ns3.dns-redirects.com 
221.11.133.12 
ns4.dns-redirects.com
221.210.2.152 

downloaditforfree.net
Host: 221.11.133.10
Reporting addresses:
abuse@cnc-noc.net
Name : Charles Messer 
Email : messer@draac.com 
Address : 416 W 8th St 
Zipcode : 31833 
Nation : US 
Tel : +1.7066439924 
Fax : 
::Name Servers:: 
ns1.anwoo.com 
ns1.mynameserver.ca 
ns1.bomofo.com 
ns1.epoboy.com

dumfounds.com
IP: 221.11.133.66
Reporting addresses:
abuse@cnc-noc.net
Alias:  
 Foundation Men On Line 
 domainsupport@sent.com 
Name Servers:: 
 ns1.balladries.com 
 ns2.balladries.com
emarketingdeals.com / Barnu Rapatska
210.245.151.117
Reporting addresses:
abuse@telstra.net, 
abuse@newworldtel.com

freehostedpages.net
Host: 221.11.133.11
Reporting addresses:
abuse@cnc-noc.net
Contact:: 
Name : Barnu Rapatska 
Email : webmaster@emarketingdeals.com ::Name Servers:: 
ns1.anwoo.com 
ns1.mynameserver.ca 
ns1.bomofo.com 
ns1.epoboy.com
hostfreesites3.com
IP: 202.181.244.22
Reporting addresses:
kyeung@hkcix.com
Alias: 
 DAVID PATTERSON   
 dav999@coolgoose.com) 
Name Servers: 
 ns1.dns-html.com 
 ns2.dns-html.com 
 ns3.dns-html.com 
 ns4.dns-html.com
hotcelebsnaked1.com
Host: 218.7.120.81
Reporting addresses:
abuse@chinanet.cn.net, abuse@cnc-noc.net
Name : Barnu Rapatska 
Email : support@emarketingdeals.com 
::Name Servers:: 
ns1.dns-passthrough.com 
ns2.dns-passthrough.com 
ns3.dns-passthrough.com 
ns4.dns-passthrough.com 
hotcheapsites.com
Web site host
IP: 202.73.247.20
Whois:
Name: missing
Email: missing
Phone: missing
Address: missing
Country: missing
NS1.DNS-REDIRECTS.COM 
NS2.DNS-REDIRECTS.COM
NS3.DNS-REDIRECTS.COM
NS4.DNS-REDIRECTS.COM

hotfreesites2.com
Web site host
Host: 222.122.65.3
Reporting addresses:
abuse@kornet.net
Contact: : 
Name: Barnu Rapatska 
Email: webmaster@emarketingdeals.com
Name Servers: : 
  ns1.dns-passthrough.com
  ns2.dns-passthrough.com
  ns3.dns-passthrough.com
  ns4.dns-passthrough.com
bulwarking.com
confuting.com
Alias:
 Jeffrey Metzinger 
 leimomi01@tom.com 
Name Servers:
 ns1.unheeded.net 
 ns2.unheeded.net
curdle.net
IP: 211.147.228.93
cordoned.net
IP: 211.147.228.93
Alias: 
 Foundation Men On Line 
 leimomi01@tom.com 
Name Servers:
 ns1.streph.net 
 ns2.streph.net 
degradedly
IP: 211.147.228.108
depletive.com
drizzlier.com
IP: 211.147.228.93
dusked.biz
ecomomics.net
endosonic.com
friggings.net
furbelows.net
genuinely.net
gossipy.net
gravesides.com
howsoever.net
hurtfully.com
hybridisms.com
impactions.net
katchemack.net
lipase.net
IP: 61.235.117.167
IP: 211.147.228.93
Reporting addresses:
postmaster@chinatietong.com, 
crnet_mgr@chinatietong.com, 
crnet_tec@chinatietong.com
Alias: 
 Foundation Men On Line 
 leimomi01@tom.com 
::Name Servers: 
ns1.obstructed.net 
ns2.obstructed.net
liverymen.com/
medianly.com
IP: 211.147.228.93
Alias:
 Foundation Men On Line 
 leimomi01@tom.com 
Name Servers:
 ns1.streph.net 211.147.228.93 
 ns2.streph.net 211.147.228.94
partied.net
IP: 211.147.228.93
IP: 211.147.228.102
noxiously.net
obstructed.net
IP: 221.10.201.138
Reporting addresses:
abuse@chinanet.cn.net
Alias: 
 Foundation Men On Line 
 leimomi01@tom.com 
::Name Servers: 
ns1.obstructed.net 
ns2.obstructed.net
osseously.net
IP: 221.11.133.66 (cnc-noc.net)
ossifies.com
IP: 221.11.133.66 (cnc-noc.net)
IP: 221.11.133.65
pockmarked.com
IP: 221.11.133.66
Reporting addresses:
abuse@cnc-noc.net
Alias:
 Harry Gourley 
 whois77000@yahoo.com 
Fax : 
Name Servers:: 
 ns1.balladries.com 
 ns2.balladries.com
remeasures.net
reattain.com
IP: 221.10.201.138
Reporting addresses:
abuse@chinanet.cn.net
 Foundation Men On Line 
 leimomi01@tom.com 
Name Servers:: 
 ns1.obstructed.net 
 ns2.obstructed.net
revetments.net
smilingly.net
IP: 211.147.228.93
Reporting addresses:
ct-abuse@abuse.sprint.net, abuse@gzidc.com
Alias: 
 Foundation Men On Line 
 leimomi01@tom.com 
Name Servers:
 ns1.streph.net 
 ns2.streph.net 
snorter.net
soddenness.net
uncapping.net
IP: 221.11.133.66 (cnc-noc.net)
Alias: 
 Louis Phillipe 
 louisludek@yahoo.com 
Name Servers:: 
 ns1.balladries.com 
 ns2.balladries.com
unpardoned.net
visagraph.net
zigzagging.net
======================
http://ryomadf.com/Lu24ahzswYpajQHRRzRxQu9CT/
http://dns-html2.com/ryomadf.com/Lu24ahzswYpajQHRRzRxQu9CT/
IP: 210.22.50.103 
- Redirects to 
http://smilingly.net/cs/?Badboy
=======
http://vanaltenads.com/hRQX8VQpU0l4UNTukEMfihe38/
http://dns-html2.com/vanaltenads.com/hRQX8VQpU0l4UNTukEMfihe38/
IP: 221.11.134.15
Report to: abuse@cnc-noc.net
========
http://gertibn.com/PXh13gqTphsIjcj516YSaaPCs/
http://dns-html2.com/gertibn.com/PXh13gqTphsIjcj516YSaaPCs/
Rotating IPs
IP: 222.223.135.27 (chinanet)
IP: 210.22.50.103
Report to: postmaster@china-netcom.com, cnc-abuse@abuse.sprint.net
- Redirects to: 
http://smilingly.net/len/?Badboy
=========
http://nouetds.com/uILOWbEBpSed4Scy79VblGhx0/
http://dns-html2.com/nouetds.com/uILOWbEBpSed4Scy79VblGhx0/
IP: 221.11.134.15 (cnc-noc.net)
IP: 210.22.50.103 (china-netcom.com) 
=================
http://abaids.net/1H0UETgtmXf4iww3Kvaerzr2Y/
http://dns-html2.com/abaids.net/1H0UETgtmXf4iww3Kvaerzr2Y/
IP: 221.11.134.15 (cnc-noc.net)
IP: 210.22.50.103 (china-netcom.com) 
=========
Throwaway domains:
abaids.net
alagastaer.com
bardwellty.net
beaglety.com
boduognatdg.net
borrellyqw.net 221.11.133.51 (chinanet)
canalettods.com
canovaew.net
comnouetds.com
criswickfg.com
cronkiteas.com
edisonacv.net 220.202.248.55 (chinanet)
gertibn.com
nitardyer.net
renisd.com (220.202.248.55 210.22.50.103)
rentarowe.net
ryomadf.com
swannbc.net
vanaltenads.com



CD TRADING CARDS (CDTD)
Score = 17
No URL. Pump and dump stock scam sent via open proxies on hijacked computers. Started with plain text email but now sends base 64 encoded with microscopic text that I can't read. May be two different scammers
============
Related scams:
Pop3 Media Corp.
Eldorado Exploration
CD TRADING CARDS (CDTD)
Nomad International Inc.
Gulf Biomedical Corp
Crystal Graphite Corporation
Martin Nutraceuticals, Inc.
Northeast Development Corporation (NSC)
Eldorado Exploration Inc. (Pink Sheets: EDEX)
EXPLOSIVE PICK FOR OUR MEMBERS
The Daily Stock Barometer
Emerging Growth 0pportunity
Investor Alert Newsletter
Rx Processing Corp.
China World Trade Corporation



Health Suite, Popularsoftware, Software Now, CDCheap, Online Pharmacy, "Carol Brisbine", Pharma Shop, / Max Length 3 / WECHEAPHOSTING.COM / THATSCHEAPHOSTING.COM / CaesarBucks
~*Julie's Webcam*~ / ~*~ College Girl Webcams ~*~
Fake names: Marjorie Lobos, Vicky Ralph, Steve Cross, Kim Young; Roger Stevens, Jonathan Roving, Xiaoyu ZHU, OKA DOKEN, Chengzhong XU, Eva Paterson, Tom Rogers, Stevens Media
Fake emails: marjorielobos@argentina.com, RALPHDOMAIN@YAHOO.COM, cross.steven@gmail.com, KimYoung188@lycos.com, rogerstevens0@netscape.net, jonathanroving16@netscape.net, GREG12023@YAHOO.COM, r3gyg3l@hotmail.com, kenokado@yahoo.com, dabteae@hotmail.com, jackson_kriner@yahoo.com, vortexmedia@hotmail.com, danielthurgood0@netscape.net
Score = 11
===============
Software Now
http://bigvenus.info/ 
IP: 219.148.2.37 (chinanet)
===========
http://smokeethebear.com/co25/
IP: 210.22.50.93
Report to: postmaster@china-netcom.com, cnc-abuse@abuse.sprint.net
=============
http://redir.internet.com/rss/click/jlzmk.edgravewas.com/
63.236.73.159
Report to: abuse@qwest.net
- Redirects to:
Health Suite
http://edgravewas.com/
IP: 221.7.209.74
Reporting addresses:
abuse@chinanet.cn.net
=============
http://stankfinger.com/co25/
http://www.stankfinger.com/ju18/
IP: 210.22.50.93 (china-netcom.com) 
IP: 221.5.250.92
Report To: abuse@chinanet.cn.net
==================
Software Now
http://bigdeath.info/ 
IP:  211.147.228.100 (chinanet)
====================
http://www.schnazzyboot.com/ju18/
Rotating IPs
Rotating Ips
IP: 210.22.50.93 postmaster@china-netcom.com, cnc-abuse@abuse.sprint.net
IP: 221.7.209.75 (chinanet)
IP: 63.105.204.171 (abuse@mci.com)
IP: 211.156.249.72 (liyang@21cn.com)
=========================
Other domains:
5lessthanless.com
aolkeywerdz.com
baba-rajni.com
baba-song.com
babababedesidesi.com
babaganoushx.com
babamoviesong.com
bigaaron.info
bigdeath.info
bigtimemango.com
bobzqz.info
bringmoretolife.com 
bubxtx.info
buttermagma.info
com2morethanmore.com
correctspeling.com
drivena.info
edgravewas.com
famousloaves.com
finallyseven.com
fivesandpennies.com
foursamurais.com
goodagainnow.com
inallyseven.com
jeffersondarcy.com
kellykapowski.com
ladytoysite.info
marswebsite.com
md20.com
misterteepee.com
popkatown.com
polarizational.com
pullpushstop.com
punanipunch.com
schnazzyboot.com
securequickmeds.com
seemsfine.info
smokeethebear.com
stankfinger.com
tatankarules.com
ucanttouchfist.com
youbuysoft.info
zazxux.info



BestWatches4U- Rolex, Tag, Louis Vuitton & More
Perfect HGH
Real owner is known felon Bill Waggoner
Fake names: Mikki Red, Bill Forester, Ivan Solvok
Fake emails: maininfoset@yahoo.com, TaggsIsland@hotmail.com, ivan@mail3ms.com
Score = 10
=================
TheWatchesOnCanalStreet- Rolex, Tag, Louis Vuitton & More
http://replicaz4time.net/ 
IP: 194.126.188.202
No valid reporting address
Upstream provider: 217.239.39.58
Reporting addresses:
abuse@t-ipnet.de
=========
TheWatchesOnCanalStreet- Rolex, Tag, Louis Vuitton & More
http://time4aswissreplica.net/ 
Alias: 
 Bill Forester 
 TaggsIsland@hotmail.com 
Domain servers: 
 ns1.dnstracker10.com 
 ns2.dnstracker10.com 
 ns1.m0ntana.com 
 ns2.m0ntana.com
IP: 194.126.188.202 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
=============
http://www.genuinereplicawatchez.org
IP: 194.126.188.106 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
============
http://bestwatchez.org
IP: 194.126.189.106 (No valid reporting address) 
IP: 194.126.189.6 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
===========
BestWatches4U- Rolex, Tag, Louis Vuitton & More
http://www.bestwatchez.net
IP: 194.126.189.106 (No valid reporting address) 
IP: 194.126.189.6 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
Alias: 
 Bill Forester
 TaggsIsland@hotmail.com 
Name Servers:
 NS1.DNSTRACKER10.COM 
 NS2.DNSTRACKER10.COM 
 NS1.M0NTANA.COM 
 NS2.M0NTANA.COM
Domain servers in listed order: 
 ns1.samantha10.com 
 ns1.magellan25.com 
 ns2.samantha10.com 
 ns2.magellan25.com 
============
Other domains
1stbuyrolex.com
aabby.info
bestwatchez.net
bestwatchez.org
chooseyourwatch4u.com
chooseyourwatch4u.net
lovelywatches4u.net
perfectwatch4u.com
replicas4me.net
swisstime4us.com
thewatchesoncanalstreet.net
time4aswissreplica.net
timepiecesgalore4u.net
ultimatetimepiece4u.net
watchesrus4u.net



2005   Digital Cable Filters
Illegal cable descrambler & bodywrap scammer
Names: Ron Proctor, Antonio Cabo
Emails: inetbiz4you@yahoo.com, 1dnszone@gmail.com
Score = 6
==============
fitnessdot.com
Alias:
 Ron Proctor
 inetbiz4you@yahoo.com
Name Servers: 
 ns1.superdns4u.info 
 ns2.superdns4u.info
====================================
http://loseweightsystems.com
IP: 221.11.134.18
Report to: abuse@cnc-noc.net
Alias:
 Ron Proctor
 inetbiz4you@yahoo.com
- redirects to
http://www.fitnessdot.com/bw/
==========================================
Other domains:
1click4store.com
1clickagency.info
1clickadvisor.info
1clickextra.info
1clickgallery.info
1clickgreat.info
1clicklimited.info
1clicksource.info
1clickspot.info
1clicksystem.com
1clickcomplete.com
1dnszone.com
1stop4webstore.com
1stoptown.info
1stopnetz.info
1stoptime.info
1stopcentral.info
click2myshop.com
click2out.com
click4planet.info
click4system.info
corporationa.com
dropfatnews.com
fitnessdot.com
grouploseweight.com
incdropfat.com
loseweightsystems.com
theweightlossbiz.com
theweightlossfirm.com
tooldropfat.com
ns1.webzconnection.info
weightlossfirm.com
yourfitnessonline.com
yourhealthoffice.com
yourhealthsearch.com



Professional Tabs / GENERIC Viagra SHOP
Uses a URL tag to identify the "affiliate" and possibly your email address and always uses a frame named "ES001". Used to be mostly warez but now is usually illegal drugs with an occasionally a bank phishing scam. Uses a diffrent fake ID to register every domain and creates at least three domains per day. Uses rotating IPs. 

Controls these name servers:
 alladin.aicstrungcb.biz 
 ginny.aicstrungcb.biz
Name Servers:
 GAMMA.SOLODIZEKL.COM 
 BETA.SOLODIZEKL.COM

Fake names: Vladislav Ivanov, Jeff Westbury, James Harris, Mahmutov, Ibragim; Constance Edwards, Ivan Levco, James Harris, Michael Gulko
Fake emails: vlodyslav_ivanov@yahoo.com, hostserviceuse@yahoo.com, ibragimemail@yahoo.com, leimomi01@tom.com, ibragimmahmutovv@yahoo.com, edwards@mail333.com, styka4i@altern.org,  edwards@mail333.com, wexpo@altern.org 
Score = 7
==============
http://erxexpress.info/ES001/
IP: 210.22.50.89
Reporting addresses:
postmaster@china-netcom.com, cnc-abuse@abuse.sprint.net
=============
http://oughtniknk.biz/ES001/
IP: 194.126.190.16 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
==============
http://barwaldgakg.info/ES001/
IP: 221.7.209.72
Reporting addresses:
abuse@chinanet.cn.net
========
GENERIC Viagra SHOP
http://uparmlgblh.info/ES001/
IP: 194.126.190.16 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
=========
GENERIC Viagra SHOP
http://audiogramkb.info/ES001/ 
IP: 210.22.50.89 (china-netcom.com)
=================
http://samplizer.info/ES001/ 
IP: 221.7.209.72 (chinanet.cn.net)
=====================
http://citipilcent.info/ES001/
IP: 221.7.209.72
Reporting addresses:
abuse@chinanet.cn.net
====================================
Other domains:
agnosislk.com
audiogramkb.info
barwaldgakg.info
bogtrotterik.com 
citipilcent.info
crestikson.info 
donmehme.com 
edgercc.info
erxexpress.info
feotxiumk.com
goodingdn.com
haetndhaet9.com
hangworthyla.com
hindererdk.com
hitchiclah.com
honeyedlyfm.com
implesa.info
lesalive.info
noelhheil.com
oughtniknk.biz
pipkingm.com 
prebendaryhh.com
rhythmfl.com
risalafe.com
rxwholezale.info 
salometerkl.com 
samplizer.info
saveonpillz.info 
sererih.com 
skulkered.com
uparmlgblh.info
verizemont.info
vilapirosen.info 
visional72d3.com 
wjncnbfj.com

See previous pages for many more domains



welcome to Premium Replicas - Great gift Ideas! Online Store
http://responewatch.com/ 
IP: 221.10.224.162 (cnc-noc.net)
Alias: 
 gan su 
 watcherd@163.com 
Name servers:
 ns1.name2006.com 
 ns0.name2006.com



ES001 spammer / OEM CD / Replikabazaar / Viagra 
Malena Management spam gang
Fake Names: Alejandro Quesada, EDWIN VILLAPANDO
Fake Emails: Alex913@indiatimes.com, malena525@indiatimes.com
Score = 3
===================
http://shepardscape.net/astral/nokadvanc/
IP: 81.222.59.35
Alias: 
Zhongyuan CHEN Zhongyuan CHEN 
Malena525@indiatimes.com 
Nameservers: 
 ns1.powhey.net 
 ns2.powhey.net 
=========
http://cupamaranth.biz/astral/nokadvanc/
http://indoranch.net/astral/cooright/
http://lotaselect.info/astral/accescom/
IP: 200.108.172.5
No valid report address
Upstream provider: 64.116.160.18
Reporting addresses:
abuse@mci.com
================================
Other domains
akeeuncle.info
bulgursquid.net
crapbroth.com
cupamaranth.biz
hyaenastir.com
indoranch.net
lipariscurry.biz
lotaselect.info
psophiastable.net
shepardscape.net
steeringgiblet.com
tongancrunchies.info
tortricidpeel.net



MyCanadianPharmacy - your best source for cheap medications
"Canadian" yet it is hosted in Korea and the whois says it is in Czechoslovakia

MyCanadianPharmacy - your best source for cheap medications

http://www.onlinepills4u.info/
IP: 222.122.65.52 (kornet.net)
Alias: 
 Karel Maly 
 karelmaly1@yahoo.com 
Name Servers:
 NS2.MEDZ24.INFO 
 NS1.MEDZ24.INFO 
 NS1.CHEEPMEDZ.INFO 
 NS2.CHEEPMEDZ.INFO



Crazy Surprise - Bringing you the Vibrating Ring
http://www8.crazysurprise.com
IP: 202.73.247.131
Report to: wmma@hkabc.net
Alias:
 Frank Conners 
 frankconners@hushmail.com
nservers:
 ns1.loadserver.net 202.73.247.131 
 ns2.loadserver.net 202.73.247.252 



The American Refinancing Specialists - The American Refinance Mortgage Specialist
Fake names: jeff jackson, Keith Pearce  
Fake emails: feffjackson12345@yahoo.com, kpearce37@yahoo.com
Score = 1
=================================
The American Refinance Mortgage Specialist
http://mt-12-34.com/aim.asp
IP: 221.10.201.177 (chinanet.cn.net)
==============
Other domains:
1-m-n.com
1ndeed.com
c0meh3re.com
cr3at3.net
dr3am1er.com
h1gher.net
mort-today.net 
now-and-forever.net
ok-mrg-now.net
tra1ns.com



Online Casino scam
Score = 5
1-877-806-6810 extention:57



Score = 4
======
http://home-re-financing.com/rem.php
http://lowerpayments4u.com
xzmak.com
Alias: 
 American Financial 
 Ronald Hentington  
 americanfinancial2005@yahoo.co.uk
Name Servers: 
 ns1.xzmak.com 
 ns2.xzmak.com 
 ns3.xzmak.com 
 ns4.xzmak.com 
 ns6.xzmak.com
============
http://www.kxxjn.com/i/lzqvaw5kzxgvynzrl3h6zw9izzdj
http://www.ndbhw.com/i/lzqvaw5kzxgvynzrl2kzcdm3agdmani
IP: 194.126.188.20 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
Alias: 
 Hentington, Ronald 
 americanfinancial2005@yahoo.co.uk 
Domain servers: 
 NS1.XZMAK.COM 66.249.21.139 
 NS2.XZMAK.COM 66.249.21.139 
 NS3.XZMAK.COM 66.249.21.139 
 NS4.XZMAK.COM 66.249.21.139 
 NS5.XZMAK.COM 66.249.21.139 
 NS6.XZMAK.COM 65.182.143.7
==============
http://www.yourvalueloan.com/i/lzivaw5kzxgvynzrl2rsy2zuz2w
IP: 194.126.188.20 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
==============
Other domains
home-re-financing.com
kxxjn.com
lowerpayments4u.com
ndbhw.com
prefered-loans.net
xzmak.com
yourvalueloan.com



cialis soft tabs
http://onlinepharmacyshop.info/ct/ 
IP: 213.135.80.39
Report to: postmaster@masspost.ru




Click 4 golf -for all your coupons and golf course
Score = 3
http://click4golf.com/aspx/public/ 
http://www.c4g.com/aspx/public/
Host: 69.56.214.22
Report Spam to:
abuse@theplanet.com



Coastal Promo
CATV Filters - Buy 2 Get Shipping Free!!
Score = 5
I haven't gotten a lot from this scammer but a lot of people visiting this page are looking for info on him so I looked up some more on him. He uses frames to mask coastalpromo.net wich you can report to Network Solutions who registered him and provides his name servers..
===========
http://piaclick.info
IP: 64.74.96.243
To: abuse@internap.com
Uses frames to mask src = http://coastalpromo.net/debt 
IP: 205.178.145.65
Reporting addresses:
mark.salerno@inquent.com
===============
http://catv-filter.net
IP: 64.74.96.243
Reporting addresses:
abuse@internap.com
===========
http://xfburn.info
IP: 64.74.96.243 (changes)
Reporting addresses:
abuse@internap.com
- Uses frames to mask
http://sc00.com/advantage/2 (Coastal Promo)
IP: 205.178.145.65
Reporting addresses:
mark.salerno@inquent.com
=================
http://ez-shoppin.com
IP: 63.251.83.56
Reporting addresses:
abuse@internap.com
Name Servers: 
 dns1.name-services.com (69.25.142.1)
 dns2.name-services.com 
 dns3.name-services.com 
 dns4.name-services.com 
 dns5.name-services.com 
Report name servers to: paul.stahura@enom.com
==============
http://ez-shoppin.net
IP: 63.251.83.56
Reporting addresses:
abuse@internap.com
Name Servers: 
 ns1.xzdns.biz 
 ns3.mail18.biz
============
Uses frames to mask http://www.coastalpromo.net/hpf/
IP: 205.178.145.65
Reporting addresses:
mark.salerno@inquent.com
Domain servers in listed order: 
 NS33.WORLDNIC.COM 216.168.228.19 
 NS34.WORLDNIC.COM 216.168.225.164
Report name servers to: abuse@netsol.com
===============
Fat Burner Extreme! Big Discounts on The Best Weight loss Diet Pills
http://slimfat.info
IP: 69.25.142.3
Reporting addresses:
abuse@internap.com
For http://slimfat.info
frame src="http://www.coastalpromo.net/xfb
http://www.coastalpromo.net/xfb
IP: 205.178.145.65
Reporting addresses:
mark.salerno@inquent.com
Domain servers in listed order: 
 NS33.WORLDNIC.COM 216.168.228.19 
 NS34.WORLDNIC.COM 216.168.225.164
For 216.168.228.19
Reporting addresses: abuse@netsol.com
======
http://s-t-o-p.info
IP: 63.251.83.56
Reporting addresses:
abuse@internap.com
frame src="http://coastalpromo.net/remove/"
IP: 205.178.145.65
Reporting addresses:
mark.salerno@inquent.com
======
Name Servers for slimfat.info & s-t-o-p.info
DNS1.NAME-SERVICES.COM 
DNS2.NAME-SERVICES.COM 
DNS3.NAME-SERVICES.COM 
DNS4.NAME-SERVICES.COM 
DNS5.NAME-SERVICES.COM
IP: 212.118.243.118
Reporting addresses:
abuse@internap.com



60 Second Mortgage Quote Form
Fake names: Pat Lieberman, Jerry Goodman
Fake emails: patlieberman@yandex.ru, jerrygoodman@yandex.ru
Score = 3
============
Affiliate IDs:
id=jrwriter
id=lt
id=lt1
id=lt2
id=lt3
id=wai
refid=lix
refid=mal
refid=ph420
==================
60 Second Mortgage Quote Form
http://123refinancing.net/2/index/
IP: 194.126.188.20
60 Second Mortgage Quote Form
http://ezloans123.net
IP: 202.73.247.253
Reporting addresses:
wmma@hkabc.net
================================================
Other domains: 
12mtgnow.com
24x7-quotes.com
cheaplenders.net
droppedr8z.com
e-home-loanz.net
easy-lending.com
fasterdaz.com
fastlenders.net
freedom-financial.net
funding-internet.com
funding-talk.com
goodwayz.com
h0mel0an.net
instant-approval.net
jnixsa.com
kajsidd.com
kdnix.net
kenxsd.net
kniudx.net
lend-one.net
lending-blocksx.com
lending-tresm.com
lendingdsz.com
lendinxsz.net
lendisx.net
lendix.net
libertyeloan.com
m0rt1.com
max-loans.com
maximum-loans.net
me0rt.com
morntix-star.net
mort-lowsz.net
mort-your.com
mortgage-ebrokers.com
mortgage-lowsz.net
mortgage-tower.com
mortszx.com
motyd.net
mrldss.com
mrlend123.com
mrratenow.com
nidbchx.com
nowratez.com
point-financial.com
premium-mort.com
premium-mortgages.com
r8tdrop.com
r8tesdrop.com
re-finances.com
ref1nowz.net
simple-financing.net
simplified-loans.net
yourmort.com



Score = 3
MALE VIRILITY
http://www.sjhqyk.info/
IP: 194.126.189.7
No valid reporting address
Upstream provider: 217.239.39.58
Reporting addresses:
abuse@t-ipnet.de
Alias:
 Solo Selio 
 homersimpsonbody@yahoo.com 
Name Servers:
 NS2.XPEDIADNS.COM 
 NS1.XPEDIADNS.COM 
 NS1.DNSTRACKER10.COM 
 NS2.DNSTRACKER10.COM
=============
Hoodia Maximum Strength
http://rtswkv.info/index.php
IP: 194.126.189.7
No valid reporting address
Upstream provider: 217.239.39.58
Reporting addresses:
abuse@t-ipnet.de
Alias:
 Solo Selio 
 homersimpsonbody@yahoo.com 
Name Server:NS2.XPEDIADNS.COM 
Name Server:NS1.XPEDIADNS.COM 
Name Server:NS1.DNSTRACKER10.COM 
Name Server:NS2.DNSTRACKER10.COM
=============
Mass Marketing
http://www.targtraffic.com
IP: 211.89.113.140
Reporting addresses:
heq@chinabtn.com
Alias:
 mmpprogram@hotpop.com 
Domain servers:
 NS1.XPEDIADNS.COM 
 NS2.XPEDIADNS.COM 
 NS1.DNSTRACKER10.COM 
 NS2.DNSTRACKER10.COM



DHG Penis Enlargement Pill
http://allitemsvaluable.com/d/ 
IP: 210.51.2.150
Report to: 
cncsummary@special.abuse.net, postmaster@china-netcom.com. cnc-abuse@abuse.sprint.net, tech-group@china-netcom.com



Get rich quick scam
888-676-4491 



www.discountc.com | Discount Cigarette Newtork
http://123cigs4less1.com/ 
IP: 200.166.166.60
Alias: 
 BrasilVip Produções 
 Bernardo Lucas 
 agenceexplicite@hotmail.com 
nservers:
 ns1.123cigs4less1.com 200.166.166.62 
 ns2.123cigs4less1.com 200.166.166.62 



Home loan refinance, mortgage rates -- Lenders are standing by
Score = 2
http://homeloankey.com/ 
IP: 194.126.189.15 (No valid reporting address) 
Up stream provider: 217.239.39.58 
Reporting addresses: 
abuse@t-ipnet.de
Alias: 
 random rong 
 yangyan1976@hotmail.com 
Name servers:
Primary DNS:
 ns01.rateratelow.com 194.126.189.15 
 ns02.rateratelow.com 194.126.189.16



Buy Viagra - Buy Viagra Online, Generic Viagra/Cialis, Buy Cialis, Propecia & Levitra.
http://www.viagra-place.com/
Forum spammer
Alias: 
 Mizrahi, Tamir
 jonytrip@yahoo.com 
Domain servers in listed order: 
NS1.IPOWERWEB.NET 64.70.61.130 
NS1.IPOWERDNS.COM 66.235.217.202
Host Name
host-207-248-240-119.block.alestra.net.mx 
IP Address 207.248.240.119
Real location
 Country: Mexico
 Region: Chihuahua
 City: Ciudad Juarez



Score = 4
http://vcez.meandumeds.net
IP: 221.11.134.24
Reporting adress: abuse@cnc-noc.net
=============
http://xyeh.org..lsvo.meandumeds.com#gtxju.%2enet
Percent unescape: http://xyeh.org..lsvo.meandumeds.com#gtxju..net
URL fixed:
http://meandumeds.com
IP: 221.11.134.24
Reporting addresses:
abuse@cnc-noc.net
Alias:
 Don James 
 superhawk1@gmail.com 
Name Servers:: 
 ns1.dnsm.net 
 ns2.dnsm.net



bi-dating
http://www.bi-dating.us
Report To: abuse@pccwbtn.net, postmaster@globalcompass.com, abuse@globalcompass.com



Mortgage-Partners Financial Services Inc.
http://www.mpfscorp.com
IP: 208.57.136.3
Alias: 
 Mortgage-Partners Financial Services 
 pal4al@msn.com 
Domain servers: 
 NS15.WORLDNIC.COM 216.168.228.10 
 NS16.WORLDNIC.COM 216.168.225.146 



Score = 2
http://2005clearance.com/monthly/
Sent from chinanet
Rotating IPs
IP: 217.128.198.30 (abuse@wanadoo.fr)
IP: 211.35.229.132 (kornet.net)
Alias: 
 Casper, Scott
 scasperbiz@hotmail.com 
Domain servers: 
 NSA8.SPX-DNS.NET 80.76.48.240 
 NSA7.SPX-DNS.NET 202.30.175.243



Sarasota, Lakewood Ranch, Real Estate - Jim Soda
http://jimsoda.com/ 
IP: 198.173.231.156
Reporting addresses:
abuse@verio.net
Alias: 
 Jim Soda 
 jimsoda@prudentialpalmsrealty.com 
 jndsoda@aol.com 
Domain servers: 
 ns19a.nameservers.net. 
 ns19b.nameservers.net.
========
http://www.profilesarasota.com
IP: 64.202.165.28
Report to: abuse@godaddy.com
Alias: 
 buck, Jeff 
 admin@profilesarasota.com 
Technical Contact: 
 hostmaster@earthlink.net 
Domain servers:
 NS1.SECURESERVER.NET 
 NS2.SECURESERVER.NET
===========
removejim@removejim.sarasotaprofile.com
IP: 128.241.53.85
Reporting addresses:
abuse@verio.net



www.Drop4Rent.Us
http://www.drop4rent.us/eng/
IP: 216.180.241.188
abuse@gnax.net
Alias:
 GEORGE WILLIS 
 svt@udmail.com 
Name Servers:
 NS1.UDHOST.NET 
 NS2.UDHOST.NET



Gallo Select Pre Owned/Over 30 Used Trucks & Suvs
http://lsf3155.com
IP: 64.202.166.207 (abuse@godaddy.com)



looking for love : AN ONLINE DATING COMMUNITY BRINGING PEOPLE TOGETHER

http://www.looking-for-love.us
IP: 69.61.23.70
Report To: abuse@pccwbtn.net, postmaster@globalcompass.com, abuse@globalcompass.com



VP-RX Virility Pills Natural Male Enhancement Pills
http://www.siebaymedical.com
Alias: 
 A & R Builders & Co. 
 Alin Rcheie 
 archeie@yahoo.com 
Domain servers: 
 NS1.CALIFORNIA.NET 216.131.95.20 
 NS1.OAKWEB.COM 216.131.94.5
IP: 216.131.117.162
Report To: abuse@reliablehosting.com



http://www.DJBOBCAT.COM
IP: 205.178.145.65
Report to: mark.salerno@inquent.com



ISP Directory - Find ISPS - ISP Search - ISP Providers
http://www.cheap56k.com/ 
IP: 64.251.31.240
Reporting addresses:
abuse@infolink.com, abuse@gblx.net



HQ Management S.A.
http://210.77.194.22:8081/careers.html
IP: 210.77.194.22
Report to: qujq@jnnc.com, xj@jnnc.com, dongyan@cnnic.cn

2/05
3/05
4/05
5/05
6/05
7/05
8/05
9/05
9/10