ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
BadCow / mAiLIEN

Evidence Menu:

BadCow / mAiLIEN Index


Country: Russian Federation
State:
*** Leo Kuvayev now in prison ***

Founded by Russian/American criminal Leo Kuvayev. Now all in Russia. Spamming "OEM CD" pirated software scams, fake pharmaceuticals, porn spam, porn payment collection, etc. Spam using virus-created botnets and seems to be involved in virus distribution. Partnered with Vladislav Khokholkov - aka "Mr. Green".


BadCow / mAiLIEN SBL Listings History
Current SBL Listings
Archived SBL Listings

Miguel Flores / 2K Services Inc sock postings of 2002


Path: archiver1.google.com!postnews1.google.com!not-for-mail
From: flores@2kservices.com (Miguel Flores)
Newsgroups: news.admin.net-abuse.email
Subject: SPEWS: S1545 (2K SERVICES) - Urgent please!
Date: 4 Jun 2002 16:39:32 -0700
Organization: http://groups.google.com/
Lines: 36
Message-ID: <f5fa5cb3.0206041539.389ddbfc@posting.google.com>
NNTP-Posting-Host: 65.92.25.123
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1023233972 31583 127.0.0.1 (4 Jun 2002 23:39:32 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: 4 Jun 2002 23:39:32 GMT

SPEWS admin,


We have noticed that our name appears in spews under 66.199.164.0 ip.
We at "2K Services" don't tolerate spam like any other isp. We have
terminated the accounts mentioned in your listing long time ago:

GOLDEN7.NET
OWNADULTSITE.COM
FLYINGHIGHCASINO.COM
INNOCENTSISTER.COM
BONUSHOSTING.ORG
ZOOPORN.COM
MYPICPOST.COM
YOURPICPOST.COM
THEIMAGEPOST.COM
ZOOPORN.COM
FRENCH-TOP100.COM
RPGWORLDS.COM

but they still show up in your list. Some of them have been removed
more than a year ago!

I would appreciate any help with getting our name cleared. We are
ready to do whatever it takes to get off the spews list.

Also you mistakenly listed 7 C Classes that never belonged to us:
66.199.160.0  66.199.163.0 and 66.199.165.0  66.199.168.0.

Sincerely,

Miguel Flores
Network Administrator
2K Services Inc
Flores@2kservices.com
(514) 931-2572 x110

______________________________


Path: archiver1.google.com!postnews1.google.com!not-for-mail
From: flores@2kservices.com (Miguel Flores)
Newsgroups: news.admin.net-abuse.email
Subject: Re: SPEWS: S1545 - Cleaning up
Date: 5 Jun 2002 07:26:49 -0700
Organization: http://groups.google.com/
Lines: 97
Message-ID: <f5fa5cb3.0206050626.762b7122@posting.google.com>
References: <f5fa5cb3.0206041539.389ddbfc@posting.google.com> <adjllg030up@drn.newsguy.com>
NNTP-Posting-Host: 65.92.25.123
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1023287210 7690 127.0.0.1 (5 Jun 2002 14:26:50 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: 5 Jun 2002 14:26:50 GMT

Dear SPEWS,

Thanks for looking into our case.

> >We have terminated the accounts mentioned in your listing long time ago:
>
> Are you sure?

I just checked, they are either non-working domains or host with other
ISPs. The only exception is OWNADULTSITE.COM which is our corporate
site and was never involved in spamming. We disabled it anyway to
make sure we comply with SPEWS requirements.

> >GOLDEN7.NET
> >OWNADULTSITE.COM
> >FLYINGHIGHCASINO.COM
> >INNOCENTSISTER.COM
> >BONUSHOSTING.ORG
> >ZOOPORN.COM
> >MYPICPOST.COM
> >YOURPICPOST.COM
> >THEIMAGEPOST.COM
> >ZOOPORN.COM
> >FRENCH-TOP100.COM
> >RPGWORLDS.COM
>
> One more chance, are you really sure?

mm, as I said, the only one owned by us is OWNADULTSITE.COM.

> Some yes, but are you absolutely sure all of them are gone?

PING golden7.net (205.151.202.58):
PING ownadultsite.com (66.199.164.100) <-- website is disabled
PING flyinghighcasino.com (213.139.76.172)
ping: unknown host innocentsister.com
PING bonushosting.org 149.99.184.6
ping: unknown host zooporn.com
ping: unknown host mypicpost.com
PING yourpicpost.com (216.130.177.115):
ping: unknown host theimagepost.com
ping: unknown host french-top100.com
PING rpgworlds.com (66.51.210.110):

> No mistake. You took too long to do anything and the listing was expanded to
> light a fire under your butt.

We are sincerelly sorry, our core business is credit card processing.
So we did not allocated enough resorces to react to spam complaints as
fast as we should have.

> BTW, if they are gone, then what is this?
>
> 06/04/02 19:07:49 dns OWNADULTSITE.COM
> Mail for OWNADULTSITE.COM is handled by mail.2kservices.COM
> Canonical name: OWNADULTSITE.COM
> Addresses: 66.199.164.100
>
> OOPS!
>
> 06/04/02 19:07:58 IP block 66.199.164.100
> Trying 66.199.164.100 at ARIN
> Trying 66.199.164 at ARIN
> Colobrokers.com (NETBLK-PEER1-BLK-04) PEER1-BLK-04
> 66.199.128.0 - 66.199.191.255
> 2K Services Inc (NETBLK-PEER1-2K-01) PEER1-2K-01 66.199.164.0 - 66.199.164.255
>
> Oh my goodness! What next?
>
> Traceroute Output
> FROM dragon.getnet.net TO 66.199.164.100.
> ...
> 13 peer-1-networks-inc.NewYork.cw.net (208.175.103.206) 76.328 ms 76.173 ms
> 80.083 ms
> 14 OC48POS2-0.mtl-gsr-a.peer1.net (216.187.90.5) 89.987 ms 89.390 ms 91.612
> ms
> 15 2kservices.2kservices.com (66.199.164.100) 90.359 ms 92.122 ms 89.984 ms

The only sites that are still listed in SPEWS and hosted by us are:
2KSERVICES.COM - corporate site, never involved in spamming
ECASHSERVICES.COM - billing site, could have received indirect spam
complaints from the affiliates. All spamming affiliates have been
terminated.
MEMBERPRO.COM - billing site, could have received indirect spam
complaints from the affiliates. All spamming affiliates have been
terminated.
OWNADULTSITE.COM - corporate site, never involved in spamming

> I hope you like your SPEWS listing!

We sincerely apologize and will abide by your rules.

Miguel Flores
Network Administrator
2K Services Inc
Flores@2kservices.com
514) 931-2572 x110

_____________________________


Path: archiver1.google.com!postnews1.google.com!not-for-mail
From: flores@2kservices.com (Miguel Flores)
Newsgroups: news.admin.net-abuse.email
Subject: Re: SPEWS: S1545 (2K SERVICES) - Urgent please!
Date: 6 Jun 2002 06:40:46 -0700
Organization: http://groups.google.com/
Lines: 27
Message-ID: <f5fa5cb3.0206060540.273875a@posting.google.com>
References: <f5fa5cb3.0206041539.389ddbfc@posting.google.com> <aacf586.0206050350.62fbee9b@posting.google.com>
NNTP-Posting-Host: 65.94.232.20
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1023370848 10382 127.0.0.1 (6 Jun 2002 13:40:48 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: 6 Jun 2002 13:40:48 GMT

> Do you have a working abuse@ address now?

Yes, abuse@2kservices.com; postmaster@2kservices.com
I am reading it throughout the day from 9am to 6pm EST.

> Is it registered properly with www.abuse.net?

Look up an address in the abuse.net contact database
Database updated June 6, 2002 00:11, current size 106073 entries.
abuse@2kservices.com
abuse@grouptelecom.net
This entry last changed November 28, 2001 23:35.

> Do you plane to start reading the stuff that is sent to your abuse@
> address?

You bet. We've learned the lesson the hard way.

If it's not too much to ask, please remove our upstream ISP blocks
(66.199.160.-163.) and (66.199.165.-66.199.168.) as soon as possible
or they will kick us out.

Miguel Flores
Network Administrator
2K Services Inc
Flores@2kservices.com
514) 931-2572 x110


Related URLs

Usenet post by 2Kservices


The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK6657/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy