ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
Alan Ralsky

Evidence Menu:

Alan Ralsky Index


Country: United States
State: Michigan
Convicted fraudster, spams using hijacked proxies & virus infected PCs and in the past by hijacking mail servers and mail accounts. One of the first people to host spam-websites in China to evade US law. Served years in prison due to stock-fraud spamming, but soon after being released, seemed to get right back into spamming.


Alan Ralsky SBL Listings History
Current SBL Listings
Archived SBL Listings

RBL nomination for his Telodigm


TO: RBL TEAM

CC: TELODIGM/SPRINT

SJ: RBL nom - 216.144.192.0-216.144.223.255 & 208.20.161.197-200
Supporting documentation
________________________________________________________

For the purpose of archiving publicly, a copy of the RBL nomination
will be posted to news.admin.net-abuse.email.

This is an official request to add the 216.144.192.0 - 216.144.223.255
range of IP addresses to the RBL. The reason for this large section of
IP space is that there is no responsible authority working it. Telodigm
has no "official" presence in Jackson, MI. The phone number there is
646 514-4775. 1) It is a voice mail box, i.e., no human will ever answer
the phone, 2) it is located in New York, NOT in Jackson, MI, as advertised,
and 3) it is the same number associated with the bogus domain registration
of one of the name servers used with every single one of the berrytrim.com
spams, my-dns.net.

Please note the registration of Telodigm below:
++++++++++++++++++++++++++++
Telodigm (TELODIGM3-DOM)
3151 W. Michigan Ave
Jackson, MI 49202

Domain Name: TELODIGM.NET

Administrative Contact, Technical Contact, Billing Contact:
Hostmaster, Telodigm (HT4374-ORG) hostmaster@TELODIGM.NET
Telodigm
3151 W. Michigan Ave
Jackson, MI 49202
US
+1 646 514-4775 Fax- +1 646-514-4775

Record last updated on 07-Aug-2000.
Record expires on 06-Aug-2001.
Record created on 06-Aug-2000.
Database last updated on 28-Nov-2000 00:50:45 EST.

Domain servers in listed order:

S01.DNS.US.TELODIGM.NET 216.144.223.125
S02.DNS.US.TELODIGM.NET 216.144.223.126

Now the listing for my-dns.net
++++++++++++++++++++++++++++
John Kerberos (MY-DNS3-DOM)
220 E Huron, Ste 709
Ann Arbor, MI 48104
US

Domain Name: MY-DNS.NET

Administrative Contact, Technical Contact, Billing Contact:
Kerberos, John (JKC471) chokeyfee@HOTMAIL.COM
220 E Huron St, Ste 709
Ann Arbor, MI 48104
1-646-514-4775 (FAX) 1-646-514-4775 <-- same as telodigm.net

Record last updated on 04-Aug-2000.
Record expires on 16-Jul-2001.
Record created on 16-Jul-2000.
Database last updated on 28-Nov-2000 00:49:09 EST.

Domain servers in listed order:

NS1.MY-DNS.NET 63.168.104.8
NS2.MY-DNS.NET 208.20.161.200

The address "chokeyfee@hotmail.com" is bogus - it does not exist.
The given address is also bogus.

For the record:
dns4you.net
Registrant:
IC
Erb Avore (erb@bigfoot.com)
517-424-7121
FAX: 517-424-7122
137 Pleasant Dr.
Tecumseh, MI 49286
Also a bogus entry. There is no such person.

These are set up by Alan Ralsky, the "Additional Benefits" spammer.
Every single berrytrim/winfix spam using a domain name to attract people
to the website has used a bogus registry, but always uses my-dns.net
or dns4you.net 216.144.208.200 (on Telodigm netspace).

Again, there is no person there are Telodigm. There is no phone number
listed with Directory Assistance for Telodigm. It is a bogus company; a
sham, designed to give the appearance of legitimacy, while being able to
spam at will from uu.net dial-ups and have a safe place to host Ralsky's
scam sites.

Feed is through Digital Realm, who I am told helped set up Telodigm
for Ralsky. They are aware I know this, but have taken no action to
discontinue feed to Telodigm.

As you can see from a scan below, every single one of these
bogus domains is set up on telodigm, waiting to be used on the
next spam run. All receive DNS from the same two name servers
mentioned above:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++
216.144.197.11 (dz9-isdn-11.mashedtators.org)
216.144.197.12 (dz9-isdn-12.cyberbicul.com)
216.144.197.13 (dz9-isdn-13.aboutclad-cont.com)
216.144.197.14 (dz9-isdn-14.ebonton-bonus.com)
216.144.197.15 (dz9-isdn-15.bib-bris.com)
216.144.197.16 (dz9-isdn-16.sparsebiz.com)
216.144.197.17 (dz9-isdn-17.webbinebilge.com)
216.144.197.18 (dz9-isdn-18.bib-brisfitness.com)
216.144.197.19 (dz9-isdn-19.cybermort.com)
216.144.197.20 (dz9-isdn-20.mastertrio.org)
216.144.197.21 (dz9-isdn-21.internetbosonbosky.com)
216.144.197.22 (dz9-isdn-22.mayuandi.com)
216.144.197.23 (dz9-isdn-23.webbiped-bipod.com)
216.144.197.24 (dz9-isdn-24.cybermortrates.com)
216.144.197.25 (dz9-isdn-25.internetbosun-botan.com)
216.144.197.26 (dz9-isdn-26.toponeman.com)
216.144.197.27 (dz9-isdn-27.webbiped.com)
216.144.197.28 (dz9-isdn-28.trailonline.com)
216.144.197.29 (dz9-isdn-29.aboutclad.com)
216.144.197.30 (dz9-isdn-30.webbipedbipod.com)
216.144.197.31 (dz9-isdn-31.melrun.org)
216.144.197.32 (dz9-isdn-32.moneyisgone.com)
216.144.197.33 (dz9-isdn-33.giveprops.net)
216.144.197.34 (dz9-isdn-34.webbipod-biped.com)
216.144.197.35 (dz9-isdn-35.coolpool.org)
216.144.197.36 (dz9-isdn-36.bibbris.com)
216.144.197.37 (dz9-isdn-37.gizleft.com)
216.144.197.38 (dz9-isdn-38.mort-rates.com)
216.144.197.39 (dz9-isdn-39.bibfitness.com)
216.144.197.40 (dz9-isdn-40.bicorn-bicul.com)
216.144.197.41 (dz9-isdn-41.globalsparse.com)
216.144.197.42 (dz9-isdn-42.globalwhirl.com)
216.144.197.43 (dz9-isdn-43.sparsebusiness.com)
216.144.197.44 (dz9-isdn-44.mortrates.com)
216.144.197.45 (dz9-isdn-45.internetbosun.com)
216.144.197.46 (dz9-isdn-46.ebontonbonus.com)
216.144.197.47 (dz9-isdn-47.sparsedirectory.com)
216.144.197.48 (dz9-isdn-48.coolsand.net)
216.144.197.49 (dz9-isdn-49.cyberonline-sales.com)
216.144.197.50 (dz9-isdn-50.moveoverplease.org)
216.144.197.51 (dz9-isdn-51.webbipod.com)
216.144.197.52 (dz9-isdn-52.sparsefirm.com)
216.144.197.53 (dz9-isdn-53.internetbosunbotan.com)
216.144.197.55 (dz9-isdn-55.cyberonlinesales.com)
216.144.197.56 (dz9-isdn-56.ebonus-bonton.com)
216.144.197.57 (dz9-isdn-57.gofaster.org)
216.144.197.58 (dz9-isdn-58.aboutcladcont.com)
216.144.197.59 (dz9-isdn-59.movershere.net)
216.144.197.60 (dz9-isdn-60.gogetdeno.org)
216.144.197.61 (dz9-isdn-61.aboutcont-clad.com)
216.144.197.62 (dz9-isdn-62.cornsgood.net)
216.144.197.63 (dz9-isdn-63.aboutcont.com)
216.144.197.64 (dz9-isdn-64.goincampin.com)
216.144.197.65 (dz9-isdn-65.sparseonline.com)
216.144.197.66 (dz9-isdn-66.sparseportal.com)
216.144.197.67 (dz9-isdn-67.webbolt-bolus.com)
216.144.197.68 (dz9-isdn-68.crafterman.net)
216.144.197.69 (dz9-isdn-69.bicornbicul.com)
216.144.197.70 (dz9-isdn-70.gonecatchin.org)
216.144.197.71 (dz9-isdn-71.hotwheatfield.com)
216.144.197.72 (dz9-isdn-72.airnoair.com)
216.144.197.73 (dz9-isdn-73.aboutcontclad.com)
216.144.197.74 (dz9-isdn-74.goneintwo.net)
216.144.197.75 (dz9-isdn-75.aboutfas.com)
216.144.197.76 (dz9-isdn-76.bicul-bicorn.com)
216.144.197.77 (dz9-isdn-77.cyberrates-mort.com)
216.144.197.78 (dz9-isdn-85.sparsesearch.com)
216.144.197.79 (dz9-isdn-93.gonelikethat.net)
216.144.197.80 (dz9-isdn-80.webboltbolus.com)
216.144.197.81 (dz9-isdn-81.aboutgast.com)
216.144.197.82 (dz9-isdn-82.aboutgaz-gast.com)
216.144.197.83 (dz9-isdn-83.ebonusbonton.com)
216.144.197.84 (dz9-isdn-84.webbolus-bolt.com)
216.144.197.85 (dz9-isdn-85.sparsesearch.com)
216.144.197.86 (dz9-isdn-86.aboutgaz.com)
216.144.197.87 (dz9-isdn-87.aboutgazgast.com)
216.144.197.88 (dz9-isdn-88.internetbotan.com)
216.144.197.89 (dz9-isdn-89.sparseshop.com)
216.144.197.90 (dz9-isdn-90.sparsesite.com)
216.144.197.91 (dz9-isdn-91.webbolus.com)
216.144.197.92 (dz9-isdn-92.gonelikethat.com)
216.144.197.93 (dz9-isdn-93.gonelikethat.net)
216.144.197.94 (dz9-isdn-94.webbolusbolt.com)
216.144.197.95 (dz9-isdn-95.biculbicorn.com)
216.144.197.96 (dz9-isdn-96.bigmountaintop.org)
216.144.197.97 (dz9-isdn-97.ebosky-boson.com)
216.144.197.98 (dz9-isdn-98.cruise-flight.com)
216.144.197.99 (dz9-isdn-99.mycont-clad.com)
216.144.197.100 (dz9-isdn-100.webbonton-bonus.com)
216.144.197.101 (dz9-isdn-101.cruiseflight.com)
216.144.197.102 (dz9-isdn-102.webbotan.com)
216.144.197.103 (dz9-isdn-103.cutlikearazor.net)
216.144.197.104 (dz9-isdn-104.bigneedle.org)
216.144.197.105 (dz9-isdn-105.bigtigerpaw.net)
216.144.197.106 (dz9-isdn-106.myfel-fas.com)
216.144.197.107 (dz9-isdn-107.sparsestore.com)
216.144.197.108 (dz9-isdn-108.webbonton.com)
216.144.197.109 (dz9-isdn-109.mygastgaz.com)
216.144.197.110 (dz9-isdn-110.cyberratesmort.com)
216.144.197.111 (dz9-isdn-111.cutsinthewall.net)
216.144.197.112 (dz9-isdn-112.internetbotanbosun.com)
216.144.197.113 (dz9-isdn-113.sparsetrade.com)
216.144.197.114 (dz9-isdn-114.bigtree-bihari.com)
216.144.197.115 (dz9-isdn-115.cyberabstra-abstru.com)
216.144.197.116 (dz9-isdn-116.cybersales-internet.com)
216.144.197.117 (dz9-isdn-117.webbontonbonus.com)
216.144.197.118 (dz9-isdn-118.mygaz-gast.com)
216.144.197.119 (dz9-isdn-119.webbonus-bonton.com)
216.144.197.120 (dz9-isdn-120.bigtreebihari.com)
216.144.197.121 (dz9-isdn-121.mygazgast.com)
216.144.197.122 (dz9-isdn-122.grandcar.org)
216.144.197.123 (dz9-isdn-123.cyberabstra.com)
216.144.197.124 (dz9-isdn-124.mygran-gre.com)
216.144.197.136 (dz9-isdn-136.cyberabstraabstru.com)
216.144.197.137 (dz9-isdn-137.sparseworld.com)
216.144.197.138 (dz9-isdn-138.bihari-bigtree.com)
216.144.197.139 (dz9-isdn-139.cybersales-online.com)
216.144.197.140 (dz9-isdn-140.grangre.com)
216.144.197.141 (dz9-isdn-141.internetbotre-boud.com)
216.144.197.142 (dz9-isdn-142.aboutgran.com)
216.144.197.143 (dz9-isdn-143.grapefield.org)
216.144.197.144 (dz9-isdn-144.cybersalesinternet.com)
216.144.197.145 (dz9-isdn-145.internetbotre.com)
216.144.197.146 (dz9-isdn-146.internetbotreboud.com)
216.144.197.147 (dz9-isdn-147.mygre-gran.com)
216.144.197.148 (dz9-isdn-148.webbotanbosun.com)
216.144.197.149 (dz9-isdn-149.biharibigtree.com)
216.144.197.150 (dz9-isdn-150.myt-myxo.com)
216.144.197.151 (dz9-isdn-151.ebosonbosky.com)
216.144.197.152 (dz9-isdn-152.myt-myxomovies.com)
216.144.197.153 (dz9-isdn-153.cyberslim-trim.com)
216.144.197.154 (dz9-isdn-154.cyberslimtrim.com)
216.144.197.155 (dz9-isdn-155.myt-myxomusic.com)
216.144.197.156 (dz9-isdn-156.greatbod.org)
216.144.197.157 (dz9-isdn-157.webbonusbonton.com)
216.144.197.158 (dz9-isdn-158.mytmusic.com)
216.144.197.159 (dz9-isdn-159.aboutgre.com)
216.144.197.160 (dz9-isdn-160.notallmine.com)
216.144.197.161 (dz9-isdn-161.mytmyxomovies.com)
216.144.197.162 (dz9-isdn-162.greenball.org)
216.144.197.199 (dz9-isdn-199.ebosun.com)
216.144.197.200 (dz9-isdn-200.internetboudbotre.com)
216.144.197.201 (dz9-isdn-201.summitrene.com)
216.144.197.202 (dz9-isdn-202.abstru.com)
216.144.197.203 (dz9-isdn-203.ebosunbotan.com)
216.144.197.204 (dz9-isdn-204.sweetnoel.net)
216.144.197.205 (dz9-isdn-205.bilinbilious.com)
216.144.197.206 (dz9-isdn-206.swingingate.net)
216.144.197.207 (dz9-isdn-207.heisout.net)
216.144.197.208 (dz9-isdn-208.internetcalcelt.com)
216.144.197.209 (dz9-isdn-209.eboud-botre.com)
216.144.197.210 (dz9-isdn-210.internetcelt-cal.com)
216.144.197.211 (dz9-isdn-211.talktoyoulater.net)
216.144.197.212 (dz9-isdn-212.abstruabstra.com)
216.144.197.213 (dz9-isdn-213.eboud.com)
216.144.197.214 (dz9-isdn-214.bilious-bilin.com)
216.144.197.215 (dz9-isdn-215.hin-hur.com)
216.144.197.216 (dz9-isdn-216.internetceltcal.com)
216.144.197.217 (dz9-isdn-217.internetdietweightloss.com)
216.144.197.218 (dz9-isdn-218.cybertripvacation.com)
216.144.197.219 (dz9-isdn-219.thegateisopen.net)
216.144.197.220 (dz9-isdn-220.cyberacad.com)
216.144.197.221 (dz9-isdn-221.cybervacation-trip.com)
216.144.197.222 (dz9-isdn-222.biliousbilin.com)
216.144.197.223 (dz9-isdn-223.webbosonbosky.com)
216.144.197.224 (dz9-isdn-224.webbosun-botan.com)
216.144.197.225 (dz9-isdn-225.ebotan-bosun.com)
216.144.197.226 (dz9-isdn-226.internetebonecru.com)
216.144.197.227 (dz9-isdn-227.hin-hurfitness.com)
216.144.197.228 (dz9-isdn-228.webbosun.com)
216.144.197.229 (dz9-isdn-229.cyberacadacapn.com)
216.144.197.230 (dz9-isdn-230.cyberacapn-acad.com)
216.144.197.231 (dz9-isdn-231.hinhur.com)
216.144.197.232 (dz9-isdn-232.internetecru-ebon.com)
216.144.197.233 (dz9-isdn-233.webbosunbotan.com)
216.144.197.234 (dz9-isdn-234.bine-bilge.com)
216.144.197.235 (dz9-isdn-235.hitthewall.net)
216.144.197.236 (dz9-isdn-236.internetecru.com)
216.144.197.237 (dz9-isdn-237.acad-acapn.com)
216.144.197.238 (dz9-isdn-238.acadacapn.com)
216.144.197.239 (dz9-isdn-239.acapn-acad.com)
216.144.197.240 (dz9-isdn-240.nohorseok.org)
216.144.197.241 (dz9-isdn-241.webbot-boudty.com)
216.144.197.242 (dz9-isdn-242.internetezr-exp.com)
216.144.197.243 (dz9-isdn-243.cybervacationtrip.com)
216.144.197.244 (dz9-isdn-244.hotattic.net)
216.144.197.245 (dz9-isdn-245.internetezrexp.com)
216.144.197.246 (dz9-isdn-246.binebilge.com)
216.144.197.247 (dz9-isdn-247.webbotan-bosun.com)
216.144.197.248 (dz9-isdn-248.noplacelikehere.net)
216.144.197.249 (dz9-isdn-249.cyberweightloss-diet.com)
216.144.197.250 (dz9-isdn-250.ebotan.com)
216.144.197.251 (dz9-isdn-251.cyberacapn.com)
216.144.197.252 (dz9-isdn-252.acapn.com)
216.144.197.253 (dz9-isdn-253.throwabone.org)
216.144.197.254 (dz9-isdn-254.internetflight-cruise.com)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Concerning Sprint netblocks 208.20.161.197-200:
Please note that several spams copied below go to 208.20.161.198
which has been in the RBL for several months (near a year, I believe).
Ralsky has his DNS server set up on 208.20.161.200. Going to any
of those IP addresses, brings up MAILSVC.NET. This domain has no
actual DNS of it's own, however the registry of this domain makes
who the individual is being this spamming activity very clear:

Sam Smith (MAILSVC2-DOM)
200 W. Long Lake Drive
Troy, MI 48332
US

Domain Name: MAILSVC.NET

Administrative Contact, Technical Contact, Billing Contact:
Smith, Sam (SS9752) aral@ADDITIONALBENEFITS.COM
Additional Benefits
2121 Richard Ave
W. Bloomfield, MI 48322
248-200-3492

Record last updated on 23-Jan-2000.
Record expires on 23-Jan-2002.
Record created on 23-Jan-2000.
Database last updated on 21-Dec-2000 16:50:14 EST.

Domain servers in listed order:

NS.GALAXIESERVICE.NET 207.231.139.198
NS2.GALAXIESERVICE.NET 207.231.139.196

Additional Benefits has always been associated with Alan Ralsky.
The above domain name is dead, and again, has no DNS. The e-mail
address is also non-functional. Again, there is no way to reach
any responsible party concerning this activity.

The IP range 208.20.161.197-200 on Sprint has been associated
with this spamming for over a year. Ralsky continues to work
within that IP space.

I spoke with Bill Bracco, Network Security at Sprint, on both
Tuesday Jan 2, 2001, and Thursday, Jan 4, 2001. He mentioned
that they were in the final stages of removing this spammer from
their networks. While this is all well and good, it has, as
mentioned above, taken over a year to react to. In the mean time,
208.20.197.200 is being used for DNS by Ralsky as spam support
service.

You might also wish to re-consider putting berrytrim.com BACK
on the RBL listing, since their spamming has not stop while it
was ON or after it was taken OFF the RBL.

Copies of the spam related to this activity are attached. Note: In
order to save space, some of the text of the berrytrim-related
spams has been snipped. Otherwise, the complaint and headers remain
as they were posted to news.admin.net-abuse.sightings.

{{{{{Copy of spam complaints snipped.}}}}}


Related URLs

The RBL never took place, but an old address range of Ralsky's was in. Nomination should have tried to tie to this existing one.

UPDATE: August 2009: 'Erb Avore' is a real person, although that is a name he adopted as an adult.


The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK1297/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy