Spammers using RIPE DB again ?
I got a couple of these today, to hostmaster@knowledge.com and hostmaster@knowtion.net. The only place I *think* these are commonly used are my RIPE DB records. Anyone else got spam like this that may be traced back to abuse of the RIPE DB ? If not there, other places I should look to alerting ? -- Peter Return-path: <help@internetdrive.com> Envelope-to: hostmaster@knowledge.com Delivery-date: Thu, 23 Oct 2003 14:07:41 +0100 Received: from exim by mailstore-1.mail.knowledge.com with spam-scanned (Exim 3.36 #1) id 1ACfBQ-0008T1-00 for hostmaster@knowledge.com; Thu, 23 Oct 2003 14:07:41 +0100 Received: from [195.174.147.143] (helo=abn147-143.interaktif.net.tr) by mailstore-1.mail.knowledge.com with smtp (Exim 3.36 #1) id 1ACfBN-0001q8-00 for hostmaster@knowledge.com; Thu, 23 Oct 2003 14:07:19 +0100 Received: from [19.129.99.202] by abn147-143.interaktif.net.tr; Thu, 23 Oct 2003 10:59:18 -0300 Message-ID: <2$08-38qd-wa78w84$ten53l@488ap9c> From: "Dot EU" <help@internetdrive.com> Reply-To: "Dot EU" <help@internetdrive.com> To: hostmaster@knowledge.com Subject: Domain Newsletter - Oct 22 Date: Thu, 23 Oct 03 10:59:18 GMT X-Mailer: Microsoft Outlook Express 5.00.2615.200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="6BCB1CE1A456E.4372E" X-Priority: 3 X-MSMail-Priority: Normal X-Spam-Status: No, hits=2.3 required=5.0 tests=FORGED_MUA_OUTLOOK,MISSING_MIMEOLE version=2.55 X-Spam-Level: ** X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) --6BCB1CE1A456E.4372E Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable -------------- Domain Name News October 21st 2003 -------------- The European Union has approved the launch of .eu domain names, which are expected to go live in late 2003 or early 2004. We are now accepting orders for the new .eu domains. http://www.registereu.com See our web site for contact information. Do not reply to this email - the address is not monitored. --6BCB1CE1A456E.4372E--
Hi Peter, Peter Galbavy <peter.galbavy@knowtion.net> wrote:
I got a couple of these today, to hostmaster@knowledge.com and hostmaster@knowtion.net. The only place I *think* these are commonly used are my RIPE DB records. Anyone else got spam like this that may be traced back to abuse of the RIPE DB ?
If not there, other places I should look to alerting ?
Both addresses appear in your domain registration records for those domains. Regards, -- leo vegoda RIPE NCC Registration Services Manager
leo vegoda wrote:
Both addresses appear in your domain registration records for those domains.
Good point, I was not actually aware that the knowledge.com domain had it's own domain in it. Too later now. All my domain crap should be knowtion.net only... The main reason I thought RIPE DB was that they appear to be targetting .eu potentials :-( Peter
--On Thursday, October 23, 2003 15:05:19 +0100 Peter Galbavy <peter.galbavy@knowtion.net> wrote:
I got a couple of these today, to hostmaster@knowledge.com and hostmaster@knowtion.net. The only place I *think* these are commonly used are my RIPE DB records. Anyone else got spam like this that may be traced back to abuse of the RIPE DB ? If not there, other places I should look to alerting ?
Cambridgeshire police maybe? He has been arrested a few times in the past few weeks. The guy who runs the domain registering company, given as the link in the body of the message has already been arrested a few times by the police. He is a known spammer (also a known scammer in the words of the police) and various other things. I have been complaining about him to Trading Standards for about 2.5 years now, in conjunction with another guy, whose web site will give you more details - www.ninet.co.uk Generally, the 'from' addresses are not the spammers.. Peter Francis-Mcrae (the spammer) is the one responsible and he is basically using the domain names of those people who have complained against him, or he does not like. Anyway - www.ninet.co.uk will gove you some info.. and just typing in things like 'francis-macrae' into google will brin up loads of information. Regards Denesh
-- Peter
Return-path: <help@internetdrive.com> Envelope-to: hostmaster@knowledge.com Delivery-date: Thu, 23 Oct 2003 14:07:41 +0100 Received: from exim by mailstore-1.mail.knowledge.com with spam-scanned (Exim 3.36 #1) id 1ACfBQ-0008T1-00 for hostmaster@knowledge.com; Thu, 23 Oct 2003 14:07:41 +0100 Received: from [195.174.147.143] (helo=abn147-143.interaktif.net.tr) by mailstore-1.mail.knowledge.com with smtp (Exim 3.36 #1) id 1ACfBN-0001q8-00 for hostmaster@knowledge.com; Thu, 23 Oct 2003 14:07:19 +0100 Received: from [19.129.99.202] by abn147-143.interaktif.net.tr; Thu, 23 Oct 2003 10:59:18 -0300 Message-ID: <2$08-38qd-wa78w84$ten53l@488ap9c> From: "Dot EU" <help@internetdrive.com> Reply-To: "Dot EU" <help@internetdrive.com> To: hostmaster@knowledge.com Subject: Domain Newsletter - Oct 22 Date: Thu, 23 Oct 03 10:59:18 GMT X-Mailer: Microsoft Outlook Express 5.00.2615.200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="6BCB1CE1A456E.4372E" X-Priority: 3 X-MSMail-Priority: Normal X-Spam-Status: No, hits=2.3 required=5.0 tests=FORGED_MUA_OUTLOOK,MISSING_MIMEOLE version=2.55 X-Spam-Level: ** X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
--6BCB1CE1A456E.4372E Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable
-------------- Domain Name News October 21st 2003 --------------
The European Union has approved the launch of .eu domain names, which are expected to go live in late 2003 or early 2004.
We are now accepting orders for the new .eu domains.
See our web site for contact information. Do not reply to this email - the address is not monitored.
--6BCB1CE1A456E.4372E--
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On torsdag, okt 23, 2003, at 16:05 Europe/Stockholm, Peter Galbavy wrote:
I got a couple of these today, to hostmaster@knowledge.com and hostmaster@knowtion.net. The only place I *think* these are commonly used are my RIPE DB records. Anyone else got spam like this that may be traced back to abuse of the RIPE DB ?
If not there, other places I should look to alerting ?
From dig on your domains : knowledge.com. 4H IN SOA ns-0.registry.knowtion.net. hostmaster.knowtion.net. ( 2001090802 ; serial 1H ; refresh 30M ; retry 1W ; expiry 4H ) ; minimum - - kurtis - -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBP5gECqarNKXTPFCVEQL9AQCgnOKBNqVHJqj+ihzwgX63M1+Vy00AoJ5G R/EpGwLNzKeEzOsuoYvsm4uJ =yTWJ -----END PGP SIGNATURE-----
participants (4)
-
Denesh Bhabuta -
Kurt Erik Lindqvist -
leo vegoda -
Peter Galbavy