Here are some more fresh spammer URL's to report:
ceyanfk.cn
bacydfhh.cn
www.danceraise.com
legacyback.com
rodriguezqan81.chat.ru
feedproxy.google.com/~r/CraigslistBolognaAllJobsSearch/~3/nlnRHliBpBY/
pearwatches.cn
rigojeb.cn
Still getting lots of spam for
awakehim.com and now danceraise.com
-- high value targets
domains already down:
hqasqwe1.me.uk
cegixbj.cn
ersd12wh.eu
doneswim.com
hanging by a thread:
pharmsstockmeant.com -- look at these nameservers:
ns3.whichdaring.com [59.63.157.207] 211.20.210.74 237ms
ns1.coolexcite.com [61.61.61.61] (Blackhole)
ns2.coolexcite.com [61.61.61.61] (Blackhole)
ns4.whichdaring.com [211.20.210.74] Timeout
And as for the whichdaring.com, anyone think this is a valid whois?
Domain Name.......... whichdaring.com
Creation Date........ 2009-08-03 03:30:42
Registration Date.... 2009-08-03 03:30:42
Expiry Date.......... 2010-08-03 03:30:42
Organisation Name.... Cheng sixixa
Organisation Address. Nan guang qu chong qing lu bai huo da lou B1 lou
Organisation Address.
Organisation Address. Nanguanqu
Organisation Address. 130025
Organisation Address. BJ
Organisation Address. CN
Admin Name........... Chengsixixa
Admin Address........ Nan guang qu chong qing lu bai huo da lou B1 lou
Admin Address........
Admin Address........ Nanguanqu
Admin Address........ 130025
Admin Address........ BJ
Admin Address........ CN
Admin Email.......... chengyudanyuaner@163.com
Admin Phone.......... +86.4315685301-0
Admin Fax............ +86.4315685301
Tech Name............ zeng xiwu
Tech Address......... wanbaodadao
Tech Address.........
Tech Address......... Changsha
Tech Address......... 410000
Tech Address......... HN
Tech Address......... CN
Tech Email........... agent19535@agent.dns.com.cn
Tech Phone........... +86.7312259236
Tech Fax............. +86.7312259236
Bill Name............ zeng xiwu
Bill Address......... wanbaodadao
Bill Address.........
Bill Address......... Changsha
Bill Address......... 410000
Bill Address......... HN
Bill Address......... CN
Bill Email........... agent19535@agent.dns.com.cn
Bill Phone........... +86.7312259236
Bill Fax............. +86.7312259236
Name Server.......... ns4.whichdaring.com
Name Server.......... ns3.whichdaring.com
Wednesday, November 4, 2009
Continued recognition of our anti-spam efforts
As of the current time we're back off line due to continued DDoS. We're definitely getting lots of attention from spammers. You rock, folks! We're small but get the job done.
Here are some domains to report while you're waiting. There are phishing sites, scam pharmacies, "replica" sites, etc. You know what to do :)
http://feedproxy.google.com/~r/Cr454rAndBear45utaii/~3/91kzfjex8tI/
http://pharmsstockmeant.com/?said=MED-22-3
http://rolexll.com
http://www.rxcomputing.cn
http://d55ad0.cegixbj.cn/
http://www.ifleads.com
http://www.facebook.com.hqasqwe1.me.uk/globaldirectory/LoginFacebook.php
http://ripuvat.cn
http://9ZTWIR.ittjbity.cn
http://PNQ.ittjasos.cn
http://awakehim.com
http://crowduntil.com
http://www.rxunimplemented.cn
Post a comment and let us know how you've made out with these.
Here are some domains to report while you're waiting. There are phishing sites, scam pharmacies, "replica" sites, etc. You know what to do :)
http://feedproxy.google.com/~r/Cr454rAndBear45utaii/~3/91kzfjex8tI/
http://pharmsstockmeant.com/?said=MED-22-3
http://rolexll.com
http://www.rxcomputing.cn
http://d55ad0.cegixbj.cn/
http://www.ifleads.com
http://www.facebook.com.hqasqwe1.me.uk/globaldirectory/LoginFacebook.php
http://ripuvat.cn
http://9ZTWIR.ittjbity.cn
http://PNQ.ittjasos.cn
http://awakehim.com
http://crowduntil.com
http://www.rxunimplemented.cn
Post a comment and let us know how you've made out with these.
Tuesday, November 3, 2009
Difficulty accessing the forum?
The forum is up and running normally. There has been continued attack activity, but most has been blocked. Our hosting service, Servint, has done an outstanding job blocking a lot of the traffic before it even hits our server. The remainder has not been enough of an issue to slow anything down.
If you are still unable to access the forum, your IP address may have been included in a block of troublesome addresses. Let us know, so we can try to troubleshoot the problem. You can reply to the administrative email address for the forum (the one where your forum notifications come from). Or you can post it as a comment to this blog.
If you are still unable to access the forum, your IP address may have been included in a block of troublesome addresses. Let us know, so we can try to troubleshoot the problem. You can reply to the administrative email address for the forum (the one where your forum notifications come from). Or you can post it as a comment to this blog.
Sunday, November 1, 2009
Continued DDoS attacks on InboxRevenge.com
The DDoS attack from yesterday continues. Blocking a few troublesome IPs brought the traffic down to a level that was not a serious inconvenience, so the site came back on line this morning. You can expect it to go up and down or be slow intermittently for now. The server will be up at times even during a heavy attack to collect IP addresses of attacking bots for evidence.
If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies.
If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies.
Good news -- DDoS attacks not over
Members may have noticed another recent outage for several hours. It was another confirmed DDoS, via a method called "syn flood." In the past, these sorts of attacks have gone on for weeks. We just roll with it.
Why is it good news? It lets us know our efforts are worthwhile, because making internet crime less profitable is exactly what we're trying to accomplish. If we weren't making criminals want to attack us, we'd have to wonder what we were doing wrong. We never expect to achieve the amazing level of spammer ire that Blue Security suffered in it's famous 2006 attack, but then we aren't planning to try to keep the site on line during the attacks. We just fall back to the alternate methods of spreading information. If our attackers would like to try to simultaneously take down Google, Microsoft, Twitter, Wordpress, and all the other sites we've established a presence on, they'll get themselves a lot more law enforcement attention than they're currently planning on.
Comments are open for this blog, though they have to be approved by a moderator. And if you have a comment that seems to merit its own "thread," we can repaste it as a blog post that can get its own comments.
Remember that SiL also has his two blogs, which also accept moderated comments:
http://ikillspammers.blogspot.com/
http://spamitmustfall.blogspot.com/
And we have our other sites for announcements:
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
As always, the best response to retaliation is to continue to do the reporting you were doing before -- but to do more of it.
Why is it good news? It lets us know our efforts are worthwhile, because making internet crime less profitable is exactly what we're trying to accomplish. If we weren't making criminals want to attack us, we'd have to wonder what we were doing wrong. We never expect to achieve the amazing level of spammer ire that Blue Security suffered in it's famous 2006 attack, but then we aren't planning to try to keep the site on line during the attacks. We just fall back to the alternate methods of spreading information. If our attackers would like to try to simultaneously take down Google, Microsoft, Twitter, Wordpress, and all the other sites we've established a presence on, they'll get themselves a lot more law enforcement attention than they're currently planning on.
Comments are open for this blog, though they have to be approved by a moderator. And if you have a comment that seems to merit its own "thread," we can repaste it as a blog post that can get its own comments.
Remember that SiL also has his two blogs, which also accept moderated comments:
http://ikillspammers.blogspot.com/
http://spamitmustfall.blogspot.com/
And we have our other sites for announcements:
http://twitter.com/inboxrevenge
http://inboxrevenge.wordpress.com/
http://inboxrevenge.webs.com/
http://spamtrackers.org
http://inboxrevenge.spaces.live.com/
As always, the best response to retaliation is to continue to do the reporting you were doing before -- but to do more of it.
Friday, October 30, 2009
InboxRevenge forum is back up
Apologies for the forum being unavailable a few days. The DDoS has subsided for now. Our policy is to just go off line as needed rather than to expend energy fighting such attacks.
Our time is much better spent continuing to investigate and report the internet criminals behind your spam and all the illegal activity that goes with it. Notifications on blogs like this one are part of the layers of redundancy we've set up to make it possible to continue our usual activities when the forum is unavailable. If anything, having the effectiveness of our activities acknowledged by spammers has been a shot in the arm to motivate our members, who primarily are busy professionals doing this as a volunteer effort outside of their usual jobs.
The forum thread for more information about this DDoS is at
http://ksforum.inboxrevenge.com/viewtopic.php?f=1&p=42237#p42237
Our time is much better spent continuing to investigate and report the internet criminals behind your spam and all the illegal activity that goes with it. Notifications on blogs like this one are part of the layers of redundancy we've set up to make it possible to continue our usual activities when the forum is unavailable. If anything, having the effectiveness of our activities acknowledged by spammers has been a shot in the arm to motivate our members, who primarily are busy professionals doing this as a volunteer effort outside of their usual jobs.
The forum thread for more information about this DDoS is at
http://ksforum.inboxrevenge.com/viewtopic.php?f=1&p=42237#p42237
Wednesday, October 28, 2009
Google Feedproxy Abuse
Well, just as the Yahoo Groups Spam becomes less overwhelming, along comes a new abuse: feedproxy.google.com URLs that redirect to the following Canadian Pharmacy domains:
pharmsstockmeant.com
caringbread.com
As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam.
The site has nothing to do with Canada. The phone number they list, +1(650)452-6975, has a Texas area code but is a voice-over-internet number which connects to an overseas operator -- if it gets answered at all. The address listed on their sites belongs to a legitimate Canadian pharmacists' organization that denies any relationship to CPh. Why doesn't that organization make them stop? Because CPh sites are part of an affiliate program run by criminals in Russia, out of reach of Canadian or US law enforcement.
The pills they sell are counterfeit generic versions of drugs that aren't legally available in generic version. A drug can't be sold generically until its patent has expired -- but again, they're out of reach of law enforcement.
CPh markets them like some late night infomercial for Ginzu Knives, throwing in free tabs of their counterfeit "Viagra" with every order -- even when that would be a potentially fatal combination. So either people are dying or the drugs are completely fake. Clearly no pharmacist has had any input into the operation, either way. And they're out of reach of law enforcement
It's extremely stupid to give the operators of CPh your name, address, phone number, and/or credit card number. It's extremely stupid to wait however long they tell you to wait for delivery, allowing the time limit to file a complaint with your credit card company to expire. And it's even more stupid to swallow pills of unknown makeup from an unknown country made under unknown conditions of sanitation, should anything actually show up in your mailbox.
That, and the fact that smuggling drugs is a federal crime. And you're not out of reach of law enforcement.
There's more information on the spamwiki:
http://spamtrackers.eu/wiki/index.php/Canadian_Pharmacy
pharmsstockmeant.com
caringbread.com
As InboxRevenge.com members know well, "Canadian Pharmacy" (CPh) is a scam.
The site has nothing to do with Canada. The phone number they list, +1(650)452-6975, has a Texas area code but is a voice-over-internet number which connects to an overseas operator -- if it gets answered at all. The address listed on their sites belongs to a legitimate Canadian pharmacists' organization that denies any relationship to CPh. Why doesn't that organization make them stop? Because CPh sites are part of an affiliate program run by criminals in Russia, out of reach of Canadian or US law enforcement.
The pills they sell are counterfeit generic versions of drugs that aren't legally available in generic version. A drug can't be sold generically until its patent has expired -- but again, they're out of reach of law enforcement.
CPh markets them like some late night infomercial for Ginzu Knives, throwing in free tabs of their counterfeit "Viagra" with every order -- even when that would be a potentially fatal combination. So either people are dying or the drugs are completely fake. Clearly no pharmacist has had any input into the operation, either way. And they're out of reach of law enforcement
It's extremely stupid to give the operators of CPh your name, address, phone number, and/or credit card number. It's extremely stupid to wait however long they tell you to wait for delivery, allowing the time limit to file a complaint with your credit card company to expire. And it's even more stupid to swallow pills of unknown makeup from an unknown country made under unknown conditions of sanitation, should anything actually show up in your mailbox.
That, and the fact that smuggling drugs is a federal crime. And you're not out of reach of law enforcement.
There's more information on the spamwiki:
http://spamtrackers.eu/wiki/index.php/Canadian_Pharmacy
Subscribe to:
Posts (Atom)