Jump to content

They just don't care :(


Annibal
 Share

Recommended Posts

Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down.

Have a look at my collection:

hXXp://eforclass.org:8088/cg/

hXXp://formoree.org:8088/cg/

hXXp://morepher.org:8088/cg/

hXXp://theefors.org:8088/cg/

hXXp://breakerclip.org:8088/cg/

hXXp://aaahgh.org

hXXp://medspro.org

hXXp://instantrx.org

hXXp://rxmap.org

hXXp://rxbrands.org

hXXp://rx24.org

hXXp://rxuwant.org

hXXp://rxuniverse.org

hXXp://rx321.org

There are company in US, Mexico, France...No one made something.

Is quite sad, so what? i have to give up?

Link to comment
Share on other sites

Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down.

...

There are company in US, Mexico, France...No one made something.

Is quite sad, so what? i have to give up?

SpamCop's BL works "as advertized" by blocking serial offenders using the same IP addresses. This doesn't do much in the case of those spammers who hop around botnets for their sending and it takes no direct action against 'blackhat' hosts of spamvertized websites and it is, unfortunately, quite ineffectual against those sites that are, themselves hosted on botnets.

An approach - the only real approach - in those cases is to complain to the registrars of spam domains. See the discussion at Complainterator V5 Announcement, Automated complaints to registrars, noting that there are successive releases after V5, as you go through the topic and the latest version of that tool is available through the links given. TerryNZ stepped through the manual equivalent of the function in a post in 'BotNet scenario'

Link to comment
Share on other sites

Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down.

There are company in US, Mexico, France...No one made something.

Is quite sad, so what? i have to give up?

If you want the websites to be shutdown, I suggest you forward your spam to knujon (www.knujon.com) instead of spamcop. Spamcop's focus is not shutting down the spammy websites, while knujon's focus is just that. I am having positive results with them. My spam has not reduced to zero, but the numbers have definitely dwindled down since I started reporting to them.

raju

Link to comment
Share on other sites

Why your complaints to "one" ISP doesn't result in "the" web page being shut down .....

06/03/07 00:24:46 dns aaahgh.org

Canonical name: aaahgh.org

Addresses:

71.130.204.142

84.60.6.152

217.211.55.49

218.255.192.106

221.126.148.233

24.152.128.81

65.24.187.23

66.177.73.244

67.173.173.182

69.156.106.97

The basic / infamous rotating DNS mode, where the actual site 'location' changes every few minutes to another compromised computer somewhere else in the world. See all the other world-wide discussions about BotNets, idiot users that don't secure their systems, ISPs that refuse to cut off these idiot users, etc. etc. etc. ..... Also see TerryNZ's post about his Complainerator tool in the Suggested Tools and Applications Forum section.

06/03/07 00:26:56 dns medspro.org

Canonical name: medspro.org

Addresses:

81.93.17.122

Trace medspro.org (81.93.17.122) ...

06/03/07 00:27:26 dns instantrx.org

Canonical name: instantrx.org

Addresses:

81.93.17.122

Trace instantrx.org (81.93.17.122) ...

06/03/07 00:28:21 dns rxmap.org

Canonical name: rxmap.org

Addresses:

81.93.17.122

Trace rxmap.org (81.93.17.122) ...

06/03/07 00:28:58 dns rxbrands.org

Canonical name: rxbrands.org

Addresses:

81.93.17.122

Trace rxbrands.org (81.93.17.122) ...

Fetching http://rxbrands.org/ ...

Content-Location: http://rxbrands.org/Default.htm

<title>Welcome</title>

<scri_pt LANGUAGE="java scri_pt">

<!--

ev al(un esca pe("\x76\x61\x72\x25\x32\ <edited and snipped>

Bottom line here, a passle of sites all 'located' at the same server, all 'web-pages' being re-directs to somewhere else ....

Bottom line, an ISP that apparently does not pay attention to things ... or that folks are not directly complaining to about this crap .....

whois -h whois.ripe.net 81.93.17.122 ...

inetnum: 81.93.0.0 - 81.93.31.255

org: ORG-OS2-RIPE

netname: FR-ORNIS-20020805

descr: ORNIS S.A.

country: FR

admin-c: JML8-RIPE

tech-c: SM492-RIPE

status: ALLOCATED PA

mnt-by: RIPE-NCC-HM-MNT

mnt-lower: ORNIS-MNT

mnt-routes: ORNIS-MNT

source: RIPE # Filtered

organisation: ORG-OS2-RIPE

org-name: ORNIS S.A.

org-type: LIR

address: Energy Park 5, 130 Bd de Verdun

address: 92400

address: Courbevoie

address: France

phone: +33 1 56 37 73 73

fax-no: +33 1 56 37 73 00

e-mail: lir[at]ornis.com

admin-c: DL6381-RIPE

admin-c: SM492-RIPE

mnt-ref: ORNIS-MNT

mnt-ref: RIPE-NCC-HM-MNT

mnt-by: RIPE-NCC-HM-MNT

source: RIPE # Filtered

person: Jean-Marie Labeyrie

address: ORNIS

address: Energy Park 5,

address: 130 Bd de Verdun

address: 92400 Courbevoie, France

phone: +33 1 56 37 73 73

fax-no: +33 1 56 37 73 00

e-mail: noc[at]ornis.net

nic-hdl: JML8-RIPE

source: RIPE # Filtered

mnt-by: ORNIS-MNT

person: Sylvain Mouly

address: ORNIS

address: Energy Park 5,

address: 130 Bd de Verdun

address: 92400 Courbevoie, France

phone: +33 1 56 37 73 73

fax-no: +33 1 56 37 73 00

e-mail: sylvain.mouly[at]ornis.com

nic-hdl: SM492-RIPE

source: RIPE # Filtered

mnt-by: ORNIS-MNT

% Information related to '81.93.0.0/19AS8399'

route: 81.93.0.0/19

descr: ORNIS S.A

origin: AS8399

source: RIPE # Filtered

mnt-by: ORNIS-MNT

There's data if you want to follow up on some of those repeat/continuous offenders ....

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...