ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
Brian Kramer / Expedite Media Group

Evidence Menu:

Brian Kramer / Expedite Media Group Index


Country: United States
State: Illinois
Massive spamhaus. Kicked off of MCI, Anet, Mzima, Uninet, SingTel, Yipes, Servercentral, WilTel, Triara in Mexico, Broadwing, a Panamanian host, Schlund and lastly Speakeasy - just between Jul-Oct 2005!


Brian Kramer / Expedite Media Group SBL Listings History
Current SBL Listings
Archived SBL Listings

Hijacking Virus-infected PCs


Confirmed hijacking of trojan/virus-infected PCs to relay spam.

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL25662
---------------------------------------------------------
smokersatwar.com. IN A 209.203.194.149
smokersatwar.com. IN NS ns.x-dnssecure.net.
smokersatwar.com. IN NS ns.z-dnssecure.net.
ns.x-dnssecure.net. IN A 209.203.192.8
ns.z-dnssecure.net. IN A 209.203.200.2
---------------------------------------------------------


--
[ Offending message ]
Envelope-to: x
Received: from localhost ([127.0.0.1])
by mx13.global.net.uk with smtp (Exim 4.42)
id x
for x; Sun, 10 Apr 2005 07:xx:xx +0000
Received: from TROJAN-INFECTED-PC ([x.x.x.x]
helo=x.x.x.x)
by mx13.global.net.uk with smtp (Exim 4.42)
id x
for x; Sun, 10 Apr 2005 07:xx:xx +0000
From: "x" <x@yahoo.com>
Subject: reply from team
To: x
Content-Type: text/plain;
charset="x"
Reply-To: theangrysmoker2@yahoo.com
Date: Mon, 11 Apr 2005 20:xx:xx +0700
X-Priority: 3
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-BV-Spam-Score: 4.9 (++++)
X-Envelope-From: x@yahoo.com


4/10/2005 3:xx:xx PM
hello x,


Dear smoker or friend of smoker!

We have been penalised, long enough, it is time to fight back!, while surfing
the net, I found a great web page for you to look at, and to pass on to your family and
friends.
If you are fed up of being ripped off by a British government, who continually
raise taxes on tobacco, take away your rights of freedom by banning smoking in public
places, then
it is time to take a look at either of these websites:
http://www.geocities.com/lovesmoking2005/index.html or
http://www.smokersatwar.com
they can send you FREE info on where to join the british Smokers Club (free to
join), and details of online shops, where you can buy cigarettes at 2 pounds a
packet!!!!


Regards


The Angry Smoker



---------------------------------------------------------

The smokersatwar.com payload page consisted of hyperlinks to:

http://www.tobaccobritain.com
http://www.britishsmoker.com
http://www.eurotobacco.net
http://www.tobaccosecret.com
http://www.britishsmokersclub.com
http://www.smokersclubusa.com
http://www.tobaccoforbritain.com
http://www.tobaccogift.com
http://www.tobaccotiger.com

and a contact email of: webreporter2005@yahoo.com

----------------------------------------------------------
Most of these are have anonymized WHOIS through domains-by-proxy. Some of them have public registrations with this info:

--
Domain Name: SMOKERSCLUBUSA.COM
Registrant:
Costa Business Bureau S.L.
Avda. El Gamonal,12
Local 09
Edificio Jupiter
Arroyo de la Miel, Malaga 29631
ES
952577751
Fax:952442651
Administrative Contact:
Diamond, Max webman@costabusiness.com
Avda. El Gamonal,12
Local 09
Edificio Jupiter
Arroyo de la Miel, Malaga 29631
ES
952577751
Fax:952442651




The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK4971/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy