Register Of Known Spam Operations (ROKSO) Spam Operation: zombies 199.245.138.0/24 is listed on the SBL as being assigned to, being under the control of, or being otherwise connected with a known spam operation listed on the ROKSO database as: zombies BACONSULTING - BAC2.COM ''zombie'' block [ 208.172.98.13] iar2-loopback.Miami.cw.net 127 ms [ 208.173.90.106] 208.173.90.106 133 ms [199.245.138.254] 199.245.138.254 132 ms _____________________________________ OrgName: BA Consulting OrgID: BACONS Address: 1104, Welch Ave. City: San Jose StateProv: CA PostalCode: 95117 Country: US NetRange: 199.245.138.0 - 199.245.138.255 CIDR: 199.245.138.0/24 NetName: BACONSULTING NetHandle: NET-199-245-138-0-1 Parent: NET-199-0-0-0-0 NetType: Direct Assignment NameServer: NS1.BAC2.COM NameServer: NS2.BAC2.COM Comment: For security or abuse related issues contact abuse@bac2.com RegDate: 1994-05-05 Updated: 2003-07-09 TechHandle: JA70-ARIN TechName: Allison, Jeremy TechPhone: +1-408-985-7048 TechEmail: jeremy@netcom.com OrgTechHandle: JA70-ARIN OrgTechName: Allison, Jeremy OrgTechPhone: +1-408-985-7048 OrgTechEmail: jeremy@netcom.com _____________________________________ Registrant: BA Consulting 1104, Welch Ave. San Jose, CA 95117 US Registrar: DOTSTER Domain Name: BAC2.COM Created on: 09-JUL-03 Expires on: 09-JUL-04 Last Updated on: 11-JUL-03 Administrative, Technical Contact: Allison, Jeremy jeremy@netcom.com BA Consulting 1104, Welch Ave. San Jose, CA 95117 US 1-408-985-7048 Domain servers in listed order: NS1.BAC2.COM NS2.BAC2.COM End of Whois Information __________________________________________ Registrant: Admin, Domain (ZXEBTYAJLD) 217 Fouberts Place Carnaby, London W1F 7QD GB Domain Name: SHAREDOFFERS.COM Administrative Contact, Technical Contact: Admin, Domain (PGWFTGAJLI) honorblackman007@yahoo.com 217 Fouberts Place Carnaby, London W1F 7QD GB +44 (0)2274326314 Record expires on 22-Jun-2004. Record created on 22-Jun-2003. Database last updated on 1-Aug-2003 14:59:43 EDT. Domain servers in listed order: NS1.BAC2.COM 199.245.138.226 NS2.BAC2.COM 199.245.138.227 ___________________________________________________________________ spamvertised domains: 800--pharmacy.biz. 2h2m45s IN A 199.245.138.242 800--pharmacy.biz. 2h2m45s IN NS ns1.bac2.com. ns1.bac2.com. 5h24m IN A 199.245.138.226 (Oct 12th, 2003) 1800patches.com. 4h8m38s IN A 199.245.138.242 1800patches.com. 4h8m38s IN NS ns1.bac2.com. ns1.bac2.com. 2D IN A 199.245.138.226 Where is the real "Jeremy"?

Notes for ARIN Abuse/Security

A listing in the ROKSO database means that this entity has already been terminated by a minimum of 3 Internet networks for serious AUP violations. ROKSO spammers are professional spammers who will use every trick to try to stop you from terminating them. You can not issue "warnings" to ROKSO spammers, they treat warnings as simply opportunities to get even more spam out before the account is gone. To protect your network it is important that you read the ROKSO records of your customer now. See: ROKSO records for zombies

Removal Procedure

As this listing is of part of a known ROKSO spam operation, Spamhaus can not remove this SBL listing if there is any functioning web site, mail server or DNS server still serving the spam operation in 199.245.138.0/24.

To have record SBL9923 (199.245.138.0/24) removed from the SBL, the Abuse/Security representative of ARIN (or the Internet Service Provider responsible for supplying connectivity to 199.245.138.0/24) needs to contact the SBL Team by email (use this link) to explain how the spam problem has been terminated (we need to know exactly how you have terminated the problem). If the spam problem that caused this listing has been verifiably terminated we will normally remove the listing from the SBL without delay.

It is essential that emails to the SBL Team about this SBL listing include this exact ticket information in the Subject: