ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
Pavka / Artofit

Evidence Menu:

Pavka / Artofit Index


Country: Russian Federation
State:
A Russian gang who have been spamming for years. Started with porn, now into many types of spam, always via hijacked PCs. Part of a large criminal group involving ROKSO spammers Leo Kuvayev & Alex Blood. Also see "Yambo Financials" ROKSO.


Pavka / Artofit SBL Listings History
Current SBL Listings
Archived SBL Listings

bpbill.com / vmcards.com / oxbill / kochetov.com


[194.135.19.58] kochetov.com
[194.135.19.58] ns3.downloadsoft.biz

Domain revoked:
Checking server [whois.neulevel.biz]
Results:
Not found: downloadsoft.biz

_______

Domain Name: KOCHETOV.COM
Registrar: GO DADDY SOFTWARE, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Name Server: NS1.KOCHETOV.COM
Name Server: NS2.KOCHETOV.COM
Name Server: NS3.KOCHETOV.COM
Status: REGISTRAR-LOCK
Updated Date: 16-feb-2006
Creation Date: 28-sep-2003
Expiration Date: 28-sep-2007

Registrant:
Alexei Kochetov
Olminskogo str. 9-12
Saint-Petersburg 196243
Russian Federation

Registered through: GoDaddy.com
Domain Name: KOCHETOV.COM
Created on: 28-Sep-03
Expires on: 28-Sep-07
Last Updated on: 06-Dec-05

Administrative Contact:
Kochetov, Alexei alex@kochetov.com
Olminskogo str. 9-12
Saint-Petersburg 196243
Russian Federation
9116074376 Fax --

Technical Contact:
Kochetov, Alexei alex@kochetov.com
Olminskogo str. 9-12
Saint-Petersburg 196243
Russian Federation
9116074376 Fax --

Domain servers in listed order:
NS1.KOCHETOV.COM
NS2.KOCHETOV.COM
NS3.KOCHETOV.COM

__________

ns4.oxbill.com [209.190.4.210]
NS.OXBILLEU.COM
NS3.KOCHETOV.COM
NS4.OXBILL.COM
NS1.BILLINGEMAIL.COM

ns3.oxbill.com [209.190.4.211]
NS3.OXBILL.COM
NS2.OXBILLEU.COM

ns.espassport.com [64.62.171.155]
NS.ESPASSPORT.COM
NS2.BILLINGEMAIL.COM

ns2.espassport.com [64.116.168.98]
NS2.ESPASSPORT.COM
NS1.ANCERNET.COM
________

Domain Name: OXBILL.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS4.OXBILL.COM
Name Server: NS2.OXBILL.COM
Name Server: NS3.OXBILL.COM
Status: REGISTRAR-LOCK
Updated Date: 19-oct-2005
Creation Date: 20-jul-2002
Expiration Date: 20-jul-2007

domain: oxbill.com
organization: OXBILL LTD
email: inf@oxbill.com
address: P.O. BOX 16
city: Moscow
state: --
postal-code: 117525
country: RU
phone: +7 095 2349449
fax: --
admin-c: inf@oxbill.com#2
tech-c: inf@oxbill.com#2
billing-c: mironov_vlad@bk.ru#0
nserver: ns2.oxbill.com 80.92.240.136
nserver: ns3.oxbill.com 209.190.4.211
nserver: ns4.oxbill.com 209.190.4.210
status: lock
created: 2002-07-20 14:32:20 UTC
modified: 2005-10-14 10:26:31 UTC
expires: 2007-07-20 14:32:20 UTC
source: joker.com live whois service

________

Domain Name: BILLINGEMAIL.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.BILLINGEMAIL.COM
Name Server: NS2.BILLINGEMAIL.COM
Status: REGISTRAR-LOCK
Updated Date: 24-aug-2005
Creation Date: 23-aug-2005
Expiration Date: 23-aug-2006

domain: billingemail.com
owner: EMMANUEL COHEN
email: arich3221@yahoo.com
address: 2nd floor 80 Great Eastern Street
city: London
state: --
postal-code: EC2A 3LJ
country: GB
phone: +44 845 2802710
admin-c: arich3221@yahoo.com#0
tech-c: arich3221@yahoo.com#0
billing-c: arich3221@yahoo.com#0
nserver: ns1.billingemail.com 209.190.4.210
nserver: ns2.billingemail.com 64.62.171.155
status: lock
created: 2005-08-23 11:16:43 UTC
modified: 2005-08-24 07:28:14 UTC
expires: 2006-08-23 07:16:42 UTC
source: joker.com live whois service

________

Domain Name: ESPASSPORT.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS.ESPASSPORT.COM
Name Server: NS2.ESPASSPORT.COM
Status: REGISTRAR-LOCK
Updated Date: 17-aug-2005
Creation Date: 06-dec-2004
Expiration Date: 06-dec-2006



domain: espassport.com
organization: GSPAY LIMITED
email: support@espassport.com
address: Tooley str. 88a
address: London Bridge
city: London SE1 2TF
state: --
postal-code: London SE1 2TF
country: GB
phone: --
fax: --
admin-c: support@espassport.com#0
tech-c: support@espassport.com#0
billing-c: mironov_vlad@bk.ru#0
nserver: ns.espassport.com 64.62.171.155
nserver: ns2.espassport.com 64.116.168.98
status: lock
created: 2004-12-06 14:32:51 UTC
modified: 2005-10-05 06:41:19 UTC
expires: 2006-12-06 14:32:51 UTC
source: joker.com live whois service

_______

Domain sold?

http://vmcards.com
>>> http://virtualmoneyinc.com


Domain Name: VMCARDS.COM
Registrar: DOTSTER, INC.
Whois Server: whois.dotster.com
Referral URL: http://www.dotster.com
Name Server: NS1.FASTSERVE.NET
Name Server: NS2.FASTSERVE.NET
Name Server: NS3.FASTSERVE.NET
Name Server: NS4.FASTSERVE.NET
Status: ACTIVE
Updated Date: 22-apr-2005
Creation Date: 16-nov-2004
Expiration Date: 16-nov-2006

Registrant:
VMCARDS
726 CASINO BLVD, #207
LAS VEGAS, NEVADA 89101
US

Registrar: DOTSTER
Domain Name: VMCARDS.COM
Created on: 16-NOV-04
Expires on: 16-NOV-06
Last Updated on: 14-DEC-04

Administrative, Technical Contact:
DILSIZIAN, RAFFI GOLDENVAILS@YAHOO.COM
VMCARDS
726 CASINO BLVD, #207
LAS VEGAS, NEVADA 89101
US
800-776-5438


Domain servers in listed order:
NS1.FASTSERVE.NET
NS2.FASTSERVE.NET
NS3.FASTSERVE.NET
NS4.FASTSERVE.NET

______


____________


Hosted on Foonet

Checking server [whois.joker.com]
Results:
domain: bpbill.com
status: production
organization: OXBILL LTD
owner: Alexey Kudinov
email: info@vmcards.com
address: Ordzhonikidze str. 9-12
city: Saint-Petesburg
postal-code: 196243
country: RU
admin-c: info@vmcards.com#0
tech-c: info@vmcards.com#0
billing-c: info@vmcards.com#0
Your request failed. The reason is:

TCL error: too many rows returned for unique key 84522 in row handle of table w_host: 0

Sorry that it didn't work.
____________________________________________________________

Registrant:
OXBILL LTD
Ordzhonikidze str. 9-12
Saint-Petersburg 196243
Russian Federation

Registered through: GoDaddy.com
Domain Name: VMCARDS.COM
Created on: 25-Aug-03
Expires on: 25-Aug-04
Last Updated on: 12-Nov-03

Administrative Contact:
Koudinov, Alexei adam@oxbill.com
OXBILL LTD
Ordzhonikidze str. 9-12
Saint-Petersburg 196243
Russian Federation
9112526460 Fax --
Technical Contact:
Koudinov, Alexei adam@oxbill.com
OXBILL LTD
Ordzhonikidze str. 9-12
Saint-Petersburg 196243
Russian Federation
9112526460 Fax --

Domain servers in listed order:
NS4.OXBILL.COM
NS3.OXBILL.COM

vmcards.com MX 10 vmcards.com
vmcards.com NS ns1.oxbill.com
vmcards.com NS ns2.oxbill.com
vmcards.com NS ns3.oxbill.com
vmcards.com NS ns4.oxbill.com
vmcards.com A 69.65.31.26 <-----*
ns3.oxbill.com A 69.65.31.25
ns4.oxbill.com A 66.252.21.141

220 olga.oxbill.com ESMTP

mail.oxbill.com A 69.65.31.25 <-----*
ns1.oxbill.com A 69.10.154.146
ns2.oxbill.com A 66.250.57.34
ns3.oxbill.com A 69.65.31.25
ns4.oxbill.com A 66.252.21.141

220 olga.oxbill.com ESMTP
____________________________________________________________

secure.bpbill.com A 202.148.45.17
secure.bpbill.com NS ns1.dservers.biz
ns1.dservers.biz A 202.148.45.17
mail.bpbill.com A 202.148.45.17 <-----*

220 dservers.biz ESMTP



inetnum: 202.148.32.0 - 202.148.47.255
netname: SPIDER-NET
descr: Spidernet Software Solution Pvt. Ltd
descr: Internet Service Provider
country: IN
admin-c: SG29-AP
tech-c: SG29-AP
remarks: -------------------------------------------------------------
remarks: This object can only be modified by APNIC hostmaster
remarks: If you wish to modify this object details please
remarks: send email to hostmaster@apnic.net with your organisation
remarks: account name in the subject line.
remarks: --------------------------------------------------------------
status: ALLOCATED PORTABLE
mnt-by: APNIC-HM
mnt-lower: MAINT-IN-SPIDER-NET
mnt-routes: MAINT-IN-SPIDER-NET
changed: hm-changed@apnic.net 20030908
source: APNIC

person: SAMEER GODBOLE
nic-hdl: SG29-AP
e-mail: SOFTREK@TECHNOLOGIST.COM
address: 4, Mayur Complex,
address: Near Kothrud Tel. Exchg,
address: Kothrud, Pune.
phone: +91-20-538-6081
fax-no: +91-20-566-0194
country: IN
changed: softrek@technologist.com 20030516
mnt-by: MAINT-NULL
source: APNIC
____________________________________________________________

Domain Name: DSERVERS.BIZ
Domain ID: D5842758-BIZ
Sponsoring Registrar: DIRECT INFORMATION PVT. LTD., (D.B.A. DIRECTI.COM)
Domain Status: clientTransferProhibited
Registrant ID: DI_213737
Registrant Name: Dev
Registrant Organization: offshoreservers
Registrant Address1: Vancouver
Registrant City: Vancouver
Registrant Postal Code: 4400010
Registrant Country: Canada
Registrant Country Code: CA
Registrant Phone Number: +91.9890455665
Registrant Email: mybulkdomains@hotmail.com
Administrative Contact ID: DI_213737
Administrative Contact Name: Dev
Administrative Contact Organization: offshoreservers
Administrative Contact Address1: Vancouver
Administrative Contact City: Vancouver
Administrative Contact Postal Code: 4400010
Administrative Contact Country: Canada
Administrative Contact Country Code: CA
Administrative Contact Phone Number: +91.9890455665
Administrative Contact Email: mybulkdomains@hotmail.com
Billing Contact ID: DI_213737
Billing Contact Name: Dev
Billing Contact Organization: offshoreservers
Billing Contact Address1: Vancouver
Billing Contact City: Vancouver
Billing Contact Postal Code: 4400010
Billing Contact Country: Canada
Billing Contact Country Code: CA
Billing Contact Phone Number: +91.9890455665
Billing Contact Email: mybulkdomains@hotmail.com
Technical Contact ID: DI_213737
Technical Contact Name: Dev
Technical Contact Organization: offshoreservers
Technical Contact Address1: Vancouver
Technical Contact City: Vancouver
Technical Contact Postal Code: 4400010
Technical Contact Country: Canada
Technical Contact Country Code: CA
Technical Contact Phone Number: +91.9890455665
Technical Contact Email: mybulkdomains@hotmail.com
Name Server: NS1.DSERVERS.BIZ
Name Server: NS2.DSERVERS.BIZ
Created by Registrar: DIRECT INFORMATION PVT. LTD., (D.B.A. DIRECTI.COM)
Last Updated by Registrar: DIRECT INFORMATION PVT. LTD., (D.B.A. DIRECTI.COM)
Domain Registration Date: Tue Dec 09 12:04:01 GMT 2003
Domain Expiration Date: Wed Dec 08 23:59:59 GMT 2004
Domain Last Updated Date: Mon Dec 15 09:13:43 GMT 2003

dservers.biz A 202.148.45.17
dservers.biz NS ns1.dservers.biz
____________________________________________________________

http://groups.google.com/groups?selm=200312050515.hB55F9j23709%40NanasPost

Newsgroups: news.admin.net-abuse.sightings
Date: 2003-12-04 21:14:59 PST

URLs still active on Dec 21 2003.

Pirate software:
MS WIND0WS XP PR0 2002 $50
MS 0FFICE XP PR0 2003 $110
AD0BE PH0T0SH0P 7.0 $60
AD0BE ACR0BAT PR0 6.0 $100
MS WIND0WS 2000 PR0 $50
MS WINDOWS SERVER 2003 $200
N0RT0N ANTIVIRUS C0RP0RATE 2003 $15
N0RT0N SYSTEM W0RKS 2003 $40
DELPHI 7.0 $70
etc.
offered at https://secure.oxbill.com/cc.php?site_id=2115
on Global Crossing (their US location) and
offered at https://secure.bpbill.com/cc.php?site_id=2115
on gatewaysys.com/"SPIDER-NET" (their new location, outside the US).
with billing using oxbill's/bpbill's "Virtual Money Card"
(available at https://new.vmcard.com/index.php/processing)

Spamvertized URL: http://www.softwareforyou.biz/bestvalue/?[tracking_tag]
at the Russian IP address 81.9.53.101 on eltel.net.
abuse@eltel.net,postmaster@eltel.net,sam@eltel.net,
noc@eltel.net,hostmaster@eltel.net,webmaster@eltel.net

This just has links to the actual site for selection and purchase of the
pirate software hosted on oxbill.com (site_id=2115) at the:

Spamvertized PIRATE SOFTWARE SITE: https://secure.bpbill.com/cc.php?site_id=2115&adv_id=2984
[OFFSHORE LOCATION] (this is "site_id=2115" hosted on bpbill who use their own
"Virtual Money Card" for handling their customers' payments)
at IP address 202.148.44.5 on gatewaysys.com/"SPIDER-NET"
anis@gatewaysys.com,support@gatewaysys.com,abuse@gatewaysys.com,
postmaster@gatewaysys.com,rajesh@GATEWAYSYS.COM,sysadmin@GATEWAYSYS.COM

While this is the site to which the starting spamvertized page (which just
has links to this site where you make your selection of pirate software)
sends one, this is a copy of their US site, at which the pirate software
is also for sale (and which was originally the site to which one was sent):

PIRATE SOFTWARE SITE: https://secure.oxbill.com/cc.php?site_id=2115&adv_id=2984
[US LOCATION] (this is "site_id=2115" hosted on oxbill who use their own
"Virtual Money Card" for handling their customers' payments)
at IP address 146.82.216.189 on GBLX/cmm.net.
abuse@gblx.net,legal@gblx.net,security@gblx.net,postmaster@gblx.net,
abuse@ccm.net,postmaster@ccm.net,abuse@oxbill.com,postmaster@oxbill.com,
legal@oxbill.com,abuse@vmcard.com,postmaster@vmcard.com,legal@vmcard.com,
ip-admin@foonet.net,abuse@foonet.net,joshua.schichtel@foonet.net,
sales@oxbill.com,adam@oxbill.com

Oxbill/Bpbill only sell "values" on their "Virtual Money Card" which
are redeemed by their customers. The site used to sell these "values"
to be redeemed for the pirate software is at the:

Spamvertized SALE SITE: https://new.vmcard.com/index.php/processing
(you reach this site with a POST - including data for the spamvertized
pirate software site which bpbill/oxbill is hosting, site_id=2115)
at IP address 146.82.216.190 on GBLX/ccm.net.
abuse@gblx.net,legal@gblx.net,security@gblx.net,postmaster@gblx.net,
abuse@ccm.net,postmaster@ccm.net,abuse@oxbill.com,postmaster@oxbill.com,
legal@oxbill.com,abuse@vmcard.com,postmaster@vmcard.com,legal@vmcard.com,
ip-admin@foonet.net,abuse@foonet.net,joshua.schichtel@foonet.net,
sales@oxbill.com,adam@oxbill.com
____________________________________________________________





The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK2993/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy