http://www.spamcop.net/sc?id=z1997663001z2...317019b8a5e687z

It would seem that ISTANBUL-TELEKOM, who oversees 79.135.167.51 could be a black hat.



... but istanbultelecom.net was registered this year, through a registrar in China?

http://whois.domaintools.com/istanbultelecom.net



.. seems to me someone is operating a ... all of the reporting addresses bounce and it's been a hosting IP for 'dating' websites.

I agree looks like istanbultelecom.net is totally useless. Probably become owned by forces other than good.
inetnum: 79.135.167.0 - 79.135.167.255
netname: ISTANBUL-TELEKOM


But you could try this:
Information related to '79.135.160.0/19AS44097'

route: 79.135.160.0/19
descr: Sistemnet Telecom
origin: AS44097
mnt-by: Sistem-Net-MNT
changed: connectivity @ sistemnet.co.uk
source: RIPE

I believe bizcn.com is associated with our old adversary 厦门华商盛世网络有限公司 - "Xiamen Chinese businessman prosperous times network Limited company" according to BabelFish's translator. otherwise "Xiamen Chinese Entrepreneur Spirit Network Ltd." - a trifle hard to tell since registrars.cnnic.cn is taking a rest at the moment however http://www.bizcn.com/news?module=newsdetail&newsid=6834 seems to make it all quite clear .

Anyway, the Xiamen group is clealy abetting a phishing operation and goodness knows what else, has been doing so with no apparent check or hindrance for quite some time. It is hard to imagine that an activity of such scale, duration, visibility and clear criminality is unknown to either the provincial or the PRC governments - which, if so, might make cybercrime a real (actual or defacto) instrument of the policies of those august bodies. Which requires a darker shade than black for the hat description of bizcn.com and its stablemates. Welcome to the Asian century, longnoses. Yeah, yeah, "conspiracy theory", but ...

I'm seeing a *heck* of a proportion of my reports going to these people (websites, also for email drop boxes if I ever got around to sending reports about those). Guess their hat colour is of the darker kind too (else they're wondering why everybody hates them). Registrant "Non-UK Corporation", Sistemnet Telekom of Istanbul, registrar TUCOWS Inc.