Hey all, I just got another "ANABOLIC PHARMACEUTICALS" spam advertising sdi-labs.com and advanced-diets-weight-loss.com. It came from 209.165.234.250. I did some digging on this one, found some interesting things. Let me run them by y'all (or is it all y'all?). spam from 209.165.234.250 www.advanced-diets-weight-loss.com = 209.165.227.204 www.sdi-labs.com = 209.165.227.201 Both of the domains are in the netblock for Samson Distributing Inc. (NETBLK-SAMSON-DIST-INC), which comes as no surprise; I've gotten other supplement spams from them. The originating IP is in the Grow Money Marketing (NETBLK-GROW-MONEY) netblock. Hmm. That name sure smacks of spammy, doesn't it? Both of the above-mentioned netblocks are leased from Volcomnet Communications, who owns 209.165.224.0 - 209.165.239.255 (NETBLK-VOLCOMNET-COMM), which is a combination of 209.165.224.0/22 and 209.165.232.0/21. Arin has no other information about from whom Volcomnet leased their block and they are listed in at least one PGB routing table: http://noc.singaren.net.sg/netstats/routes/la9m34.html so there is no other higher IP leaser to which we can go. Whois on advanced-diets-weight-loss.com shows the ns servers to be NS1.SDI-MARKETING.COM. Neat combination of SDI and Grow Money Marketing, huh? Some digging on Volcomnet: ARIN shows that those two netblocks are the only ones explicitly leased from them. A scan of the Volcomnet block shows 20 hosts that are alive, none of which have rDNS setup (isn't there anyone we can alert about inefficient IP allocation?). Most of those 20 are in the two blocks mentioned above. Volcomnet has a website (http://www.volcomnet.com); it borders on spammy-simple. They purport to offer "a complete range of Internet services to business customers worldwide". They have only one toll-free number for sales, support, corporate, etc... which is a little strange, especially as they advertise themselves as being based in Japan and with operations worldwide. I called the number, which directed me to another toll-free number, which said that they were currently experiencing a high volume of calls, please leave a message with detailed contact information. Yeah, right. OK, let's vote: All in favor of Volcomnet being both Samsom and Grow Money Marketing, and of being the real spammer, raise you're right hand.... The Ayes have it. Looks like it's unanimous, too. Too bad Qwest is their upstream, probably won't see much action out of them... Can't we do a MAPS nom? Margie, other MAPS minions out there, what do you think? If a MAPS nom is feasible, I need to start collecting spams from others, or is someone already working on that? A deja/google search for volcomnet didn't turn up evidence of any in-process noms, mebbe this can be my first one. Enough for now, thanks for wading through all that. -Peter _______________________________________________ SpamCop-List mailing list [EMAIL PROTECTED] http://news.spamcop.net/mailman/listinfo/spamcop-list
