ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
Big Sky Services / Corespace

Evidence Menu:

Big Sky Services / Corespace Index


Country: United States of America
State: NV
A large operation to acquire IP addresses for spammers. Dozens of "hosting" companies that are merely shell corporations registered to PO Boxes, pumping out large volumes of spam. Names associated: Mark Wulff / Liana Dunlap


Big Sky Services / Corespace SBL Listings History
Current SBL Listings
Archived SBL Listings

Main Info


Big Sky Services is an operation which acquires large amounts of IP addresses through various means, which are then leased to spammers. Partner in spam with Michael Persaud, Michael Jenkins / Inbox Beyond.

Some methods that Big Sky uses to obtain IP addresses are:

- Setting up fake "hosting" companies using false identities and Nevada PO boxes, and then justifying new IP allocations from ARIN for their non-existent "hosting" customers. This is very similar to how a company named "Micfo" is alleged to have operated. See: https://www.justice.gov/usao-sc/pr/charleston-man-and-business-indicted-federal-court-over-9m-fraud

- Buying out the assets of defunct companies (including IP ranges) and then keeping up the appearance that the company is still in business, such as operating an old copy of the website, and impersonating the former owners.

- Apparently hijacking dead IP ranges by announcing them through one of the previously mentioned fake "hosting" companies.

- Apparently using a hijacked company's role accounts or domain to provide forged documents to upstream ISPs or RIRs when required. This is similar to how "Adconion Direct" is alleged to have operated, see: https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/

- Partnering with a Honduran individual or business that has the ability to obtain IP allocations directly from LACNIC, which are then used to spam.


Some of the company names used by Big Sky Services to acquire ARIN allocations are:

ACE COLOCATION, INC. (Liana Dunlap)
All Nine Hosting, Inc.
ALTEC IT, INC.
APEX COMMUNICATIONS, INC.
AURORA NETWORKING, INC.
AVALANCHE NETWORKS, INC.
AXIS NETWORKS, INC.
BIG SKY SERVICES, INC. (Mark Wulff)
BREAKAWAY INTERNET GROUP, INC.
BRIGHTFINITY LLC
Certified Host, LLC
CLOUD HOLDINGS, LLC (Liana Dunlap)
CONNECTIONET SOLUTIONS, INC.
COSMIC IT SERVICES CORPORATION
COUGAR COMMUNICATIONS CORPORATION
CRYSTAL CONNECTIONS CORPORATION
Cyclone Networking, LLC
DASH SYSTEMS, INC.
DINO SOLUTIONS, INC.
DIRECT IMPRESSION, INC.
DIVINE HOSTING SERVICES, INC.
EMPIRE WEB HOSTING, INC.
EXTREME LINK CORPORATION
Fast Lane Communications LLC
FIBER ESSENCE, INC.
Grand Web Solutions Inc.
HALO COLOCATION LLC
HOST TEMPLE, LLC
INTERNET TECHNICAL SERVICES, LLC (Mark Wulff)
LANSING TECHNOLOGY CORPORATION
LAVANET CORPORATION
LINKZONE, INC.
LONG NETWORKING, INC.
MEGA COLOCATION INC
METROGLOBE, INC.
MT TECHNOLOGY, INC.
NAQUE IT GROUP CORPORATION
NETEX ONLINE SERVICES, INC.
NETWIDE CORPORATION
NEUTRON TECH SERVICES CORPORATION
ONE WORLD TELECOM CORPORATION
OPTIMUM TIER, INC.
PARAMOUNT TECHNOLOGY CORPORATION
PATRIOT WEB SOLUTIONS LLC
POWELL HOSTING, INC.
PRECISION TECHNOLOGY, INC.
PRESTIGE CONNECTION CORPORATION
PRIMELINK SERVICES LLC
QUANTACT HOSTING SOLUTIONS, INC.
ROYAL WEB SOLUTIONS CORPORATION
Sparrowise Technology LLC
STRATA1 LINK CORPORATION
THUNDER IT SERVICES, INC.
Triumph Networking LLC
Ultra Hosting
VERTICAL SOLUTIONS
VIKING WEB SOLUTIONS, INC.
VOYAGE TECHNOLOGIES, INC.
Zenith Networking LLC


Formerly legitimate ISPs now controlled by Big Sky Services and used for spamming:

GETNET, INC.
INTELLIGENCE NETWORK ONLINE, INC. / INTELLIGENCE NETWORK, LLC
NETIN.COM, INC.
Speedsite Online
ThoughtPort Networking Svcs
US Net Incorporated
VRX NETWORK SERVICES, INC.


IP ranges seem to have been hijacked from some of these companies:

CSC Holdings Inc.
Inform, Ltd.
Process Control Systems, Inc.
Retix (confirmed hijack)
Union Carbide Corporation (confirmed hijack)
Vitalink Communications Corporation
Bogons (unallocated IP space used to send illegal spam)


Company names used to acquire LACNIC IP ranges (mostly Honduras):

CLNETWORKS SA
Corporación Dana S.A.
Corporacion Laceibanetsociety
Grupo Financiero Invermexico S.A.
HOST PARA TU VIDA S.A.
INFORMATICA DE HONDURAS S.A.
My Tech BZ
PrimeTel Services Inc.
Soluciones Favorables
TODAS LAS REDES SA
Udasha S.A.


See the individual ROKSO record for a company for detailed information about that company's operations.


The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK11571/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2023 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy