pdns1.ultradns.net:
204.74.108.1
pdns2.ultradns.net:
204.74.109.1
pdns3.ultradns.org:
199.7.68.1
pdns4.ultradns.org:
199.7.69.1
pdns5.ultradns.info:
204.74.114.1
pdns6.ultradns.co.uk:
When I cross reference this with my own archives I find:
PDNS1.ULTRADNS.NET 204.74.108.1
PDNS3.ULTRADNS.ORG 199.7.68.1
PDNS2.ULTRADNS.NET 204.74.109.1
PDNS6.ULTRADNS.CO.UK
PDNS4.ULTRADNS.ORG 199.7.69.1
PDNS5.ULTRADNS.INFO 204.74.114.1
Would anybody agree this linkage provides proof the spam is coming from these servers for the domain mentioned. Because if it is you will not believe who is doing this.
greek39
I wouldn’t agree because sierrastarcasino is the ultimate destination of one of the links posted in the email. It is NOT the source of the email itself.
The sources are:
Received: from 66-79-17-75.dsl.coastalnow.net (66.79.17.75)
Received: from [62.212.219.169] ([62.212.219.169])
Received: from host-81-190-73-39.gdynia.mm.pl (81.190.73.39)
It should be patently obvious that this is coming from various infected PCs, with the real origin completely masked. Without knowing what trojan is on these PCs, you will never be able to tell what the real source is unless you track the owners of the links such as:
1stmart.com – the first spammer, apparently unrelated:
Global Soft Technologies, Inc.
265 Klassen Rd.
Kelowna, BC V1X7P1
CA
Registrar: DOTSTER
Domain Name: 1STMART.COM
Created on: 28-FEB-99
Expires on: 28-FEB-07
Last Updated on: 01-MAR-06
Administrative, Technical Contact:
Sadowick, Fred [email protected]
Global Soft Technologies, Inc.
265 Klassen Rd.
Kelowna, BC V1X7P1
CA
(250) 491-9386
(250) 491-5644
Domain servers in listed order:
NS1.1STCHOICE-UN.NET
NS2.1STCHOICE-UN.NET
and arengor.com. which is where all the links in the following emails point to:
Name: Lenin Leon
Address: 482 Pennsylvania Avenue
Kenova, WV 25530
US
Email Address: [email protected]
Phone Number: (304)438-3839
Administrative Contact
Name: Lenin Leon
Address: 482 Pennsylvania Avenue
Kenova, WV 25530
US
Email Address: [email protected]
Phone Number: (304)438-3839
Technical Contact
Name: Lenin Leon
Address: 482 Pennsylvania Avenue
Kenova, WV 25530
US
Email Address: [email protected]
Phone Number: (304)438-3839
Record Created on…….. 2006-12-22 15:05:17.449
Expire on……………. 2007-12-22 15:15:01.000
Domain servers in listed order:
ns1.aruanresar.com
ns2.bustersolg.com