IP Address Inspector

P.Hauser commented...

Received some "Russian Bride" SPAM from this IP. Here's the header of this advanced payment fraud crap:

Return-Path: info@1800387save.com
Received: from xx (xx)
by xx with LMTP; Wed, 19 Sep 2007 21:06:27 +0200
Received: from smtp27.orange.fr ([80.12.242.94]) by xx
with esmtp id 1IY4sJ-0puOPY0; Wed, 19 Sep 2007 21:06:15 +0200
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2702.orange.fr (SMTP Server) with ESMTP id EBB731C000AE
for xx@xx; Wed, 19 Sep 2007 21:06:14 +0200 (CEST)
Received: from [192.168.11.2] (LAubervilliers-151-11-53-125.w193-251.abo.wanadoo.fr [193.251.89.125])
by mwinf2702.orange.fr (SMTP Server) with SMTP id 2F2A51C000AF;
Wed, 19 Sep 2007 21:06:13 +0200 (CEST)
From: "=?windows-1251?"Juli P." info@1800387save.com
To: pfoser@same target domain, pfotenh@same target domain,
pfreisen@same target domain, pfuhl.rhenke@same target domain,
p-gerhard@same target domain, pgeuther@same target domain,
pg-grafschaft@same target domain, p-goebbels@same target domain,
pgoldreich@same target domain, pgries@same target domain,
pgrigori@same target domain, ph.mirko-weber@same target domain,
phantom-@same target domain, phantom1400@same target domain
Subject: =?windows-1251?Remember me?
Date: Wed, 19 Sep 2007 21:13:46 +0200
September 19 2007 05:08 PM

P.Hauser commented...

Here's the body of this advanced payment fraud crap:

Aloha, my dear friend

It is the first time in my life that I joined such a site, probably because
I believe in my lucky star. Sometimes things at home don't work out the way
you want and so it is hard to find your soul mate. I have not joined the
site to find sex only. Nowadays sex is easy to find anywhere.
I have joined the site looking for a nice man, who can stand as a man at my
side and knows when and how to be a man. A man to whom I will give myself
completely and he will give himself to me completely, a man, with whom I
will share my life. You might be the one! At least I indeed hope so. I am
not into this to play any kind of games. That is why I am waiting for you
at http://russianbridelive.cn/?idAff=101 to get acquainted better
and to continue from a good friendship to passionate love and creating a family.
Please don't make me wait too long for our happiness.

So long
Juliya P
September 19 2007 05:07 PM

P.Hauser commented...

None of the harvesters or neighbors can be confirmed from here. Hostname russianbridelive.cn is registered through whois.cnnic.net.cn

Domain Name: russianbridelive.cn
ROID: 20070906s10001s67585726-cn
Domain Status: ok
Registrant Organization: dm
Registrant Name: MorozovaNatali
Administrative Email: smodels@Phreaker.net
Sponsoring Registrar: 厦门华商盛世网络有限公司
Name Server:ns3.cnmsn.com
Name Server:ns4.cnmsn.com
Registration Date: 2007-09-06 03:04
Expiration Date: 2008-09-06 03:04

Following IPs in this range are blacklisted at backscatterer.org:

80.12.242.1, 80.12.242.100, 80.12.242.101, 80.12.242.111, 80.12.242.112, 80.12.242.113, 80.12.242.138, 80.12.242.139, 80.12.242.140, 80.12.242.150, 80.12.242.151, 80.12.242.152, 80.12.242.163, 80.12.242.17, 80.12.242.18, 80.12.242.26, 80.12.242.27, 80.12.242.46, 80.12.242.47, 80.12.242.48, 80.12.242.49, 80.12.242.50, 80.12.242.94, 80.12.242.95, 80.12.242.96, 80.12.242.97, 80.12.242.99

For backscatterer please check http://www.backscatterer.org/?target=backscatter
September 19 2007 05:07 PM