oops this one just slipped out of my pocket.
Thursday, May 18th, 2006
Remember a long time ago, when I tracked a longtime blogspammer to Bulgaria? Todor and Iavor Zahariev are spammers, as far as I know.
Trouble is, at some point they seemed to switch gears, and started using Moniker and used fake whois data. The rest seemed identical, so I thought it was the Zahariev twins.
Trouble is, I assumed too much. The Moniker whois coupled with support-something e-mail addresses in the whois, and usually US faked names and addresses, is a mark of another spammer. An early trace led to Israel, but I couldn’t make sense of it and discounted it.
Turns out that was the best trace.
shetef.com
Registrant:
Shetef Solutions Ltd.
10 Azmaut Street
Ness-Ziona, ISRAEL 74010
IL
Administrative Contact, Technical Contact:
xxxx, Yonat [email protected]
Shetef Solutions Ltd.
21 Tlalim street
Raanana 43568
IL
I received a piece of information recently that I can’t divulge. But it squared completely with this information. For a while I didn’t see any spam from them. I don’t know if they were inactive or just avoided my friends.
But they seem to be back, if the post below is any indication:
February 11, 2005
Mystery Tour
I am getting a lot of referrer spam from subdomains of 6q.net, so I thought it might be fun to poke around to see what connections are under the hood.
Picking one at random:
65.165.84.11 – – [11/Feb/2005:13:51:33 -0500] “GET /weblog/archives/000128.html HTTP/1.0” 403 310 “http://party-poker.6q.org/” “Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)”
Okay, that IP belongs to webshield.sulanet.net. The whois gives you this:
Registrant:
INSETEC (SULANET2-DOM)
25th AVE. S.W. 4TH STREET INSETEC
BUILDING
SAN PEDRO SULA, CORTES 144
HN
Domain Name: SULANET.NET
Administrative Contact:
CANAHUATI, JORGE (JCV153) [email protected]
INSETEC
25 AVE. S.O. 4A CALLE
SAN PEDRO SULA, CORTES 144
HN
(504)552-2535
Technical Contact:
ALFARO, JOEL (JA9474) [email protected]
Sulanet
25th AVE S.W., 4TH ST
San Pedro Sula Cortes none, CO 144
HN
+504-550-1212 ext 1505 fax: +504-550-2542
Record expires on 03-Nov-2006.
Record created on 03-Nov-1999.
Database last updated on 11-Feb-2005 14:30:34 EST.
Domain servers in listed order:
NS1.SULANET.NET 65.165.84.2
NS2.SULANET.NET 65.165.84.3
If you browse that IP address, you get:
Error – 400
Requested URL is not valid
So, no help there, although I’ve seen that identical response enough times to begin to form a hypothesis of what’s going on. (Hint: think “open proxies”)
Okay, so let’s browse the target, party-poker.6q.org. That gets me a brief look at what might be an online poker site before redirecting to http://www.6q.org, and a page saying:
This statement is permanently in suspension – Due to mis-proper use of the hosting account
ACCOUNT TERMINATED!
So, the authorities have caught up with the bad guys, right? Well, maybe not. The whois for 6q.org is no longer searchable, but was found to be registered by Moniker, a Chinese spam registar. The IP address for party-poker.6q.org is 219.150.118.16, which is in the Asian (RIPE) block.
On the “Account terminated” page is a form to
” Step up to fight unwanted client practices. Fill the form below so we can take appropriate action.”
The action on this form is:
action=’http://64.234.220.141/submitAbuse.php’
Now THAT ip address goes to shetef.com, and the whois for shetef.com is:
Registrant:
Shetef Solutions Ltd. (SHETEF-DOM)
10 Azmaut Street
Ness-Ziona, ISRAEL 74010
IL
Domain Name: SHETEF.COM
Administrative Contact:
xxxxx, Yonat (YD32) [email protected]
Shetef Solutions Ltd.
21 Tlalim street
Raanana 43568
IL
+972-9-7748832 fax: 999 999 9999
Technical Contact:
Inc., Interland, (DA6173-ORG) [email protected]
101 Marietta St
Atlanta, GA 30303
US
1.800.214.1460 fax: 1.678.365.2899
The IP block belongs to Webstream, Inc., in Fort Lauderdale. If you do a Google search of Webstream, you will find references to referrer spammers and porn sites.
So that’s quite a tangled web. A proxy in Honduras (HN = Honduras?) points to a spammer site in China which redirects to a page that wants you to fill out a form that goes to a domain registered in Israel, hosted in Florida.
All I can think to say, is: WTF?????
Update: I tried the ip address 65.165.84.11 in the following format:
http://65.165.84.11/?http://www.yahoo.com/
and what do you know? I got the Yahoo! home page. So then I tried to proxy myself through them, thusly:
http://65.165.84.11/?http://mdwalters.net/
and much to my surprise got a cornerhost screen saying “This account is disabled”. Holy cow! I quickly loaded my page normally, and it worked fine, so I’m guessing Michal has banned proxies that use my rather primitive proxy technique right at the gateway.
The server logs at cornerhost do not include the “HTTP_X_FORWARDED_FOR” field, so you can’t see the proxies when they come in. I might email Michal and ask if that can be added to the apache log format line, so the logs will reflect proxied requests.
I will spare this fellow the embarassment. Like bouncing around quite a bit.
greek39