Spam Bank

Fight Blog Spam

2005-10-15T13:17:00.000-07:00

Look above and click and follow that link to share some stuff about how to fight blog spam. Go also Here and share your ideas. One thing that was funny, is Splog Spot, the search engine drawing its results from spam blogs. Those are some of the worst search results that you can possibly imagine ;)

Anti Spam Software

2005-09-10T11:53:00.000-07:00

Anti Spam Software - Anti spam software for preventing junk and spam email from your inbox.

July '05 Comment Spammers (week 4)

2005-07-24T13:41:00.000-07:00

July's weeks 2 & 3 merged into one. But today, I find a whole new batch so week 4 is born!

Anyone else want to post their spam?

Author : slot machines (IP: 63.165.61.249 , 63.165.61.249)
URL : http://www.casino-results.com/slot-machines.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=63.165.61.249
Author : casino game (IP: 203.166.96.239 , cache5.syd.ops.aspac.uu.net)
URL : http://www.specific-casino.com/casino-game.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=203.166.96.239
Author : pacific poker deposit bonus (IP: 61.95.202.92 , dsl-KK-static-092.202.95.61.touchtelindia.net)
URL : http://www.2002sogwipo.com/pacific-poker.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=61.95.202.92
Author : online craps (IP: 62.81.214.42 , sa628121442.mundivia.es)
URL : http://www.forever-casino.com/online-craps.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=62.81.214.42
Author : craps table (IP: 81.240.255.226 , 81.240.255.226)
URL : http://www.casino-amusement.com/craps-table.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=81.240.255.226
Author : strategy for texas holdem poker (IP: 203.74.175.36 , 203.74.175.36)
URL : http://www.atlantis-asia.com/texas-holdem.html
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=203.74.175.36
forum spam pointing to http://mdptma.directmeds.biz/?wrckdlxwntvylictelzpouanwmi
forum spam pointing to http://vnzsqk.igstatdlydm.info/?vK141g__FA6Lfj_ppipxnbmut
forum spam pointing to http://uggjx.igstatdlydm.info/?GfIZIbaGQfNTquaffteac
eBay phishing pointing to http://218.9.7.188/.../e3b/ whois suggests a Chinese domain.

July '05 Comment Spammers (week 2)

2005-07-08T18:43:00.000-07:00

The last collection of alleged comment spammers got so long that I've started a second edition and we're not even half way through the month!

So, if you have someone posting on your site purely to get links into their own site, and the comments are spammy list their details here!

Netsol, Netsolmail and NetsolHost

2005-07-07T00:44:00.000-07:00

Got another phishing attempt today in the name of Bank of the West

http:// 0046b05.netsolhost.com//bankofthewest/login/index.htm

not much to see for these guys but they're hosted by NETSOLMAIL.COM on 216.168.230.195. Now the IP apparantly has no websites but netsolmail is controlled by NETSOL.COM

The email itself was sent from VYTJRTACEPOHUGQANBRP@hotmail.com - I'm guessing they won't be checking that account in a hurry.

Popular Enterprises

2005-07-05T18:25:00.000-07:00

Somebody out there thinks I'll actually believe there is such a thing as Sky Bank, yeah right, as in pie in the sky. Woops, no, I see there is such a bank. Dodgy name ;)

Back to the post... I got sent a phishing email from them today, asking me to update my security info...

Their link: http://211.72.152.30 /.servlet/SignOnCustTypeRetailNLSEN.htm
The readable link: https://connect.skyfi.com/servlet/SignOn?CustType=Retail&NLS=EN

quite different, but scarily similar.

The cheeky buggers even use a logo from the anti crime site: http://www.publiceyes.org/

I couldn't see anything definitive on that IP for now but it looks like the owner might be planning a Xoops site sometime soon ;)

Spend enough time looking around the system and you'll find the owner's email: simon_pan@p-and-j.com.tw and thew whois info for p-and-j.com.tw

which that takes us back to the USA
Administrator DNS
POPULAR ENTERPRISES, L.L.C. Domain Administration Department
5201 Kingston Pike Suite 6301
Knoxville, TN 37919 US
+1.4075409360

A Google search on the phone number comes up with popularenterprises.com and this forum post: Directi.com Replies to: [media] Pfizer to sue online sellers of fake Viagra.

Popular Enterprises have a basic front page and the links all go to Netster

I found out this about them on The Register...
Popular Enterprises has a history of purchasing expired domain names and directing them to its Netster search site

You'll also find another spam groups list of related domains for popularenterprises. So they are obviously well known.

NB: I've used a live link above so that anyone doing a back link check on them will find us, and our disapproval...

July '05 Alleged Spammers

2005-07-01T12:49:00.000-07:00

If you have the IP Adress of someone who allegedly spammed your website, perhaps the comments section, or your guestbook, then go ahead and add it in the comments section. You might be getting these from your blog, your forum, article comments, who knows.

The great thing is Google, MSN and co will index this blog like any other and when someone is trying to research who a user is this site will come up and they'll see that we weren't happy!

July Referral Spammers

2005-07-01T00:48:00.000-07:00

I don't know if people check their stats logs as often as they check their comments but this post is a place to list the IP addresses of the people spamming your stats. Here's a great article about referral spam, why it happens and what to do about it.

In the meantime, bust them here!

Phishing Emails

2005-06-29T01:41:00.000-07:00

Been getting pesky email spam lately. Especially all those Phishing emails? View the source of the email and post the real info about the spammers here.

An example is this email I got today

To review your account and some or all of the information that Bank of the West used to make its decision to limit your account access, please visit the link below:

http://www.bankofthewest.com/BOW/PP090292753form.htm

If, after reviewing your account information, you seek further clarification regarding your account access, please contact Bank of the West by visiting the Help Center and clicking "Contact Us". We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

But the real url underneath that link was for vds-365144.amen-pro.com/.BOW/PP090292753form.htm

amen-pro.com is registered and hosted in France to

AMEN
12-14 Rond-point Des Champs-elysses
PARIS 75008
FR
+33 892 55 66 77
0892 55 66 77
fax: 01 40 87 76 89

While Bank of the West has more plausible information

Bank of the West
93 First Ave North
Pacheco, CA 94553

The email for amen-pro is @amen.fr and their info is

person: Patrick Chassany
address: AMEN - Agence des MEdias Numeriques
address: 12-14, Rond-Point des Champs Elysees
address: 75008 Paris
address: FRphone: +33 8 92 55 66 77

and don't you just love their logo

Don't let them trick you!

Hilarity from 195.131.110.31

2005-06-26T17:08:00.000-07:00

Just thought I'd check this guy out, picked his IP at random from a comment and Googled off to Rainy Day in Brest. There are about 20 comments on this picture - all from the same IP and with the same format but different names, dates and promoting different sites.

24.15.194.51

2005-06-26T12:31:00.000-07:00

This IP was posted as an alleged spammer in the first comment but if you search Google it's also being used by JD on Re: Seeking investors for development project in PENNSYLVANIA (see the hidden text with his IP) and again on Investor Need for Development where he claims to be from a construction company but has questions about raising the money. Odd.

Was this the complaint, or further activity from JD?

June '05 Alleged Spammers

2005-06-01T03:18:00.000-07:00

If you have the IP Adress of someone who allegedly spammed you, go ahead and add it in the comments section. You might be getting these from your blog, your forum, article comments, who knows.

The great thing is Google, MSN and co will index this blog like any other and when someone is trying to research who a user is this site will come up and they'll see that we weren't happy!

Spam Bank

2005-04-21T00:18:00.000-07:00

If you have the IP Adress of someone who allegedly spammed you, go ahead and add it in the comments section and I will add it to my main post the next time I update my blog. Please add a brief description of what the person has allegedly done. Whenever the blog gets updated (daily) we will remove the comment from public views and have the info posted on this page (in alphabetic or numeric order):

IP Addresses only:

IP # 83.103.230.32

Email Addresses only:

arin_christu@yahoo.fr

IP and email:

IP # 83.103.230.32 arin_christu@yahoo.fr