Jump to content
Sign in to follow this  
priruss

Who Is "niemiec[at]aflmc.ssc.af.mil" And Why Is (S)he The Reporting Address For So Many Spammy Domains?

Recommended Posts

tippingthescalesinyourflavor.com

myfastsaleclick.com

ourpossibilitiesareendlesss.com

everythinghereischeaper.com

areyoureadyformassivesavings.com

And many many more. spam complaints to these entities go to the titled email address and subsequently straight into the bit bucket. Is this a spam gang who just registered a bunch of dot coms with some poor schlub's email address?

Share this post


Link to post
Share on other sites

tippingthescalesinyourflavor.com

myfastsaleclick.com

ourpossibilitiesareendlesss.com

everythinghereischeaper.com

areyoureadyformassivesavings.com

And many many more. spam complaints to these entities go to the titled email address and subsequently straight into the bit bucket. Is this a spam gang who just registered a bunch of dot coms with some poor schlub's email address?

Clue "us" in by supplying a SpamCop tracking URL or an IP or two

Share this post


Link to post
Share on other sites

Share this post


Link to post
Share on other sites
...spam complaints to these entities go to the titled email address and subsequently straight into the bit bucket. Is this a spam gang who just registered a bunch of dot coms with some poor schlub's email address?
Not QUITE that simple, SpamCop always finds a formal abuse record, or else declares "no master" - look at the parses (there will be a test later :P the double marks question "What is a SpamCop Tracking URL??). You will see the abuse address comes from the ARIN database:

# The following results may also be obtained via:

# http://whois.arin.net/rest/nets;q=157.231.100.50?showDetails=true&showARIN=false&ext=netref2

NetRange: 157.231.0.0 - 157.231.255.255

CIDR: 157.231.0.0/16

OriginAS:

NetName: HDS0

NetHandle: NET-157-231-0-0-1

Parent: NET-157-0-0-0-0

NetType: Direct Assignment

RegDate: 1992-01-31

Updated: 1992-01-31

...

OrgAbuseHandle: GN45-ARIN

OrgAbuseName: Niemiec, Greg

OrgAbusePhone: +1-205-416-4581

OrgAbuseEmail: niemiec[at]aflmc.ssc.af.mil

OrgAbuseRef: http://whois.arin.net/rest/poc/GN45-ARIN

OrgAbuseHandle: BE222-ARIN

OrgAbuseName: Entwistle, Bruce

OrgAbusePhone: +1-866-454-8385

OrgAbuseEmail: bruce_entwistle[at]hdsc.com

OrgAbuseRef: http://whois.arin.net/rest/poc/BE222-ARIN

...

Doesn't look like either address is presently a valid, deliverable one. Looks like this piece of netspace is quite firmly in the grip of the bad guys.

Share this post


Link to post
Share on other sites

OrgAbusePhone: +1-205-416-4581

OrgAbuseEmail: niemiec[at]aflmc.ssc.af.mil

OrgAbuseRef: http://whois.arin.net/rest/poc/GN45-ARIN

OrgAbuseHandle: BE222-ARIN

OrgAbuseName: Entwistle, Bruce

OrgAbusePhone: +1-866-454-8385

OrgAbuseEmail: bruce_entwistle[at]hdsc.com

OrgAbuseRef: http://whois.arin.net/rest/poc/BE222-ARIN

...

Doesn't look like either address is presently a valid, deliverable one. Looks like this piece of netspace is quite firmly in the grip of the bad guys.

Refreshed SpamCops cache

Pay to add manually add "spam[at]uce.gov"

Share this post


Link to post
Share on other sites

Refreshed SpamCops cache

Pay to add manually add "spam[at]uce.gov"

Gladly. Consider it my thanks for the assist.

Share this post


Link to post
Share on other sites

Currently a traceroute from Canada and HongKong goes through Hostwinds.com. I'm going to LART them to see if they will do anything.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×