IT Employment

Ask something
Discussion Locked

SPAM from Canada

0 helpful
11 replies

by pgm554 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Anybody got a clue as to how the SPAM laws are enforced in Canada?
I've gotten a couple of SPAMS and the imbedded url points to a domain in Canada by some clown in Ontario (porno)called www.approved1.biz.

I would like to see if I can make his life a bit more interesting.

Also ,is their a tool or service that would let me find out who hosts these morons websites ,so that I could put heat on the ISP.

11 replies

by oz_media

The spam is from Florida (most such spam originates in Florida it seems), Guyana, New Guinnea, Cuba or your next door neighbour.

Spam is generally spoofed, I have seen people get spammed by email originating at TR, because someone posted thier email addy or used it as an alias, a web crewler combs sites for email addresses and then spoofs itself from them as they are generally known or at least active addresses.

by jamesrl

My address has been used, and as a result a few ISPs have blocked my mail(mymail.com for example). I sent a few messages to my ISP for investigation, and they confirm I have been spoofed.

Though these days I get fake-o stuff - messages from ISPs about messages I never sent, which have viral attachments or links to servers with tracking cookies.

There was a big arrest of a Canadian Spammer a few months back. I think the Ontario agency that does this kind of thing is a group called PhoneBusters - setup for telemarketing scams but they do internet too I think. They are a division of the Ontario Provincial Police, and if they aren't the right ones they can certainly point you in the right direction.

James

by oz_media

Two weeks ago I had a guy email one of my online accounts complaining that I MUST stop sending him SPAM with viruses in it or he will contact "the authorities" because he keeps getting rid of a virus only to get another in an emial from me.

I stopped laughing long enough to realize this is just some poor confused guy trying to keep his PC clean and decided to just send him some info instead.

I sent him a few papers on email spoofing to read over, and then explained how to keep his PC virus free while also mentioning that he should turn off his preview pane in OUtlook and simply create a rule to block my address (with instructions of course).

I thyen gave him all my ISP contact info in case he wanted to further his complaint and let him know how to submit a full header. They'll get a chuckle out of it anyway.

What a nice guy. :)

by pgm554

It's not the Email address ,but the imbedded URL.
I did a whois and this info came up:
***ABUSE REPORT MESSAGE IS ADDED AUTOMATICALLY HERE***

--begin full headers--

Return-Path:
Delivered-To:
Received: (qmail 10478 invoked from network); 22 Nov 2004 18:07:21 -0000
Received: from h-64-105-92-21.snvacaid.covad.net (64.105.92.21)
by mail.westol.com with SMTP; 22 Nov 2004 18:07:21 -0000
Received: from 40.126.16.110 by 64.105.92.21; Mon, 22 Nov 2004 19:10:32 +0100
Message-ID:
From: "Ann Grubbs"
Reply-To: "Ann Grubbs"
To: cpalmer@westol.com
Subject: hi bud
Date: Mon, 22 Nov 2004 16:09:32 -0200
X-Mailer: AOL 9.0 for Windows US sub 828
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--300606404248537"
X-Priority: 1
X-MSMail-Priority: High
X-IP:126.37.104.90
----300606404248537
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

--begin full message body source--

Untitled Document

15,000+
emails will be sent from horny house wifes to men they want to fuck.
Will you get one?
250+ married women will cheat on their husbands.
Will you sleep with one?
30,000+ women will login and look for a man to fuck.
Will you be found?
CLICK
HERE TO ENTER
..........................................................................................
We have proof that our members get laid - the numbers don't lie!
Stop waiting and get laid NOW!
More than 100,000 horny women who want sex
with no commitments.

Come
fuck one tonight.
CLICK HERE TO ENTER

----300606404248537--

The www.approved1.biz whois data base gives this info on the jerk:

WHOIS information for approved1.biz:

Domain Name: APPROVED1.BIZ
Domain ID: D8092818-BIZ
Sponsoring Registrar: TUCOWS INC.
Sponsoring Registrar IANA ID: 69
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant ID: TUFRWO0XLUGFOQFS
Registrant Name: DANIEL SAUNDERS
Registrant Organization: INDIVIDUAL
Registrant Address1: 5418 YOUNG STREET
Registrant Address2: N/A
Registrant City: NORTH YORK
Registrant State/Province: ON
Registrant Postal Code: M4K5Y8
Registrant Country: Canada
Registrant Country Code: CA
Registrant Phone Number: +1.5554442212
Registrant Facsimile Number: +1.5554442213
Registrant Email: DU9007@YAHOO.COM
Administrative Contact ID: TUFRWO0XLUGFOQFS
Administrative Contact Name: DANIEL SAUNDERS
Administrative Contact Organization: INDIVIDUAL
Administrative Contact Address1: 5418 YOUNG STREET
Administrative Contact Address2: N/A
Administrative Contact City: NORTH YORK
Administrative Contact State/Province: ON
Administrative Contact Postal Code: M4K5Y8
Administrative Contact Country: Canada
Administrative Contact Country Code: CA
Administrative Contact Phone Number: +1.5554442212
Administrative Contact Facsimile Number: +1.5554442213
Administrative Contact Email: DU9007@YAHOO.COM
Billing Contact ID: TUFRWO0XLUGFOQFS
Billing Contact Name: DANIEL SAUNDERS
Billing Contact Organization: INDIVIDUAL
Billing Contact Address1: 5418 YOUNG STREET
Billing Contact Address2: N/A
Billing Contact City: NORTH YORK
Billing Contact State/Province: ON
Billing Contact Postal Code: M4K5Y8
Billing Contact Country: Canada
Billing Contact Country Code: CA
Billing Contact Phone Number: +1.5554442212
Billing Contact Facsimile Number: +1.5554442213
Billing Contact Email: DU9007@YAHOO.COM
Technical Contact ID: TUFRWO0XLUGFOQFS
Technical Contact Name: DANIEL SAUNDERS
Technical Contact Organization: INDIVIDUAL
Technical Contact Address1: 5418 YOUNG STREET
Technical Contact Address2: N/A
Technical Contact City: NORTH YORK
Technical Contact State/Province: ON
Technical Contact Postal Code: M4K5Y8
Technical Contact Country: Canada
Technical Contact Country Code: CA
Technical Contact Phone Number: +1.5554442212
Technical Contact Facsimile Number: +1.5554442213
Technical Contact Email: DU9007@YAHOO.COM
Name Server: NS1.MUAISEN.BIZ
Name Server: NS2.MUAISEN.BIZ
Created by Registrar: TUCOWS INC.
Last Updated by Registrar: TUCOWS INC.
Domain Registration Date: Tue Nov 02 21:13:16 GMT 2004
Domain Expiration Date: Tue Nov 01 23:59:59 GMT 2005
Domain Last Updated Date: Tue Nov 02 21:16:46 GMT 2004

by mlandis

OZ,

I thought you were going to write you were in the uh........ shots!

Did you charge the guy a case of Stellas for the service?

By the way, many of us Yanks won't be around on Thursday or Friday because of Thanksgiving. Would you consider starting the yuk?

Maureen

Maureen

by anonynona

Sure, spammers try to hide, but most want you to contact somebody and reverse tracing is possible. In your case, whatever you're using to get a whois listing isn't even close! Here's where "www.approved1.biz" originates...BTW...China won't care about any "heat" you could possibly bring them. ;) Good luck!

% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 0.0.0.0 - 255.255.255.255
netname: IANA-BLOCK
descr: General placeholder reference for all IPv4 addresses
remarks: ------------------------------------------------------
remarks:
remarks: Important:
remarks:
remarks: This registration object does not contain
remarks: specific registration details.
remarks:
remarks: This registration object is used only as a
remarks: general placeholder for all IPv4 addresses
remarks: and may include:
remarks:
remarks: - reserved address ranges
remarks: - private use ranges
remarks: - multicast ranges
remarks: - address ranges administered by RIRs (Regional
remarks: Internet Registries)
remarks:
remarks: If your query does not return an address range
remarks: more specific than 0.0.0.0 - 255.255.255.255, it
remarks: means the address is not administered by any RIR.
remarks: For more specific information on the use of this
remarks: IPv4 address space, see the Internet Assigned
remarks: Numbers Authority (IANA) website at:
remarks:
remarks: http://www.iana.org
remarks:
remarks: ------------------------------------------------------
country: AU
admin-c: IANA1-AP
tech-c: IANA1-AP
mnt-by: MAINT-APNIC-AP
mnt-lower: MAINT-APNIC-AP
status: ALLOCATED PORTABLE
changed: hm-changed@apnic.net 20030403
changed: hm-changed@apnic.net 20040928
changed: hm-changed@apnic.net 20040928
source: APNIC

inetnum: 202.0.0.0 - 203.255.255.255
netname: APNIC-AP
descr: Asia Pacific Network Information Center, Pty. Ltd.
descr: Regional Internet Registry for the Asia-Pacific Region
descr: Level 1 - 33 Park Road.
descr: PO Box 2131
descr: Milton QLD 4064
descr: Australia
country: AU
admin-c: HM20-AP
tech-c: NO4-AP
remarks: Unresolved Spam complaints to Auto-responder spam@apnic.net.
remarks: Unresolved Network Abuse issues to Auto-responder
remarks: abuse@apnic.net.
mnt-by: APNIC-HM
mnt-lower: APNIC-HM
changed: dbmon@apnic.net 20000725
changed: hm-changed@apnic.net 20021001
status: ALLOCATED PORTABLE
source: APNIC

inetnum: 202.102.224.0 - 202.102.255.255
netname: CNCGROUP-HA
country: CN
descr: CNCGROUP Henan province network
admin-c: CH455-AP
tech-c: LZ33-AP
status: ALLOCATED PORTABLE
changed: abuse@cnc-noc.net 20031201
mnt-by: APNIC-HM
mnt-lower: MAINT-CNCGROUP-HA
changed: hm-changed@apnic.net 20040302
source: APNIC

role: Internet Assigned Numbers Authority
address: see http://www.iana.org.
e-mail: nobody@apnic.net
admin-c: IANA1-AP
tech-c: IANA1-AP
nic-hdl: IANA1-AP
remarks: For more information on IANA services
remarks: go to IANA web site at http://www.iana.org.
mnt-by: MAINT-APNIC-AP
changed: nobody@apnic.net 20020530
source: APNIC

role: APNIC Hostmaster
address: Level 1
address: 33 Park Road
address: Milton QLD 4064
country: AU
phone: +61 7 3858 3100
fax-no: +61 7 3858 3199
e-mail: helpdesk@apnic.net
admin-c: DNS3-AP
tech-c: NO4-AP
nic-hdl: HM20-AP
remarks: Administrator for APNIC
notify: dbmon@apnic.net
mnt-by: MAINT-APNIC-AP
changed: hostmaster@apnic.net 19981111
changed: dbmon@apnic.net 19990702
changed: hostmaster@apnic.net 20020211
source: APNIC

role: CNCGroup Hostmaster
e-mail: abuse@cnc-noc.net
address: No.156,Fu-Xing-Men-Nei Street,
address: Beijing,100031,P.R.China
nic-hdl: CH455-AP
phone: +86-10-82993155
fax-no: +86-10-82993102
country: CN
admin-c: CH444-AP
tech-c: CH444-AP
changed: abuse@cnc-noc.net 20041119
mnt-by: MAINT-CNCGROUP
source: APNIC

person: APNIC Network Operations
address: Level 1
address: 33 Park Road
address: Milton QLD 4064
country: AU
phone: +61 7 3858 3100
fax-no: +61 7 3858 3199
e-mail: technical@apnic.net
nic-hdl: NO4-AP
remarks: Administrator for APNIC Network Operations
notify: dbmon@apnic.net
mnt-by: MAINT-APNIC-AP
changed: technical@apnic.net 19981111
changed: hostmaster@apnic.net 20020211
source: APNIC

person: Liping Zhong
address: Henan Multimedia Information Bureau
address: 70, Nong Ye Road
address: ZhengZhou, Henan 450002
address: CN
country: CN
phone: +86-371-3962276
fax-no: +86-371-3962068
e-mail: antispam@public.zz.ha.cn
nic-hdl: LZ33-AP
mnt-by: MAINT-NULL
changed: zhail@email.online.ha.cn 20001124
source: APNIC

by pgm554

I used these guys and it seems to be quite different than yours.
Is it possible to register in two differnt places?

Check it out yourself.

by pgm554

You would figure if the government over there blocks access to the western media ,there would be some way to try and track these clowns .
I doubt that the folks in China are trying to get me to re-morgage .
Just some rat bastards over here trying to use them as a shield to cover tracks.

by oz_media

But when studying spam blocking and heuristics spam scanning, I read that over 80% of the WORLD's spam originates in Florida.

by oz_media

I am STILL listed as the admin contact for several sites that I have nothing to do with. A peer here some time ago, did a whois on an old employer and decided it was enough to confirm who I was and where I worked, again not accurate at all.

You can register completely bogus information that will e returned in a whois search, they are just not accurate enough to go on, now somebody spamming is definitely not going to have a traceable domain registry, a whois is not gonna cut it.

This discussion is closed to new replies.