A global spam termination operation launched by CastleCops, the volunteer SIRT Squad is comprised of folks who report spam, investigate spam, and actively work on spam takedown and termination. SIRT is funded by CastleCops. Become a SIRT Squad terminator by reporting spam today!
tembow: Extended information for AS4134:
State/Province:
Country: cn
Responsible Domain: chinanet.cn.net
Abuse Email: cncert@cert.org.cn
Handler Note: 20 Jul, 2008 02:26:40
tembow: PART I
GEOCITIES/YAHOO
Redirection abuse that breaks the Geocities Terms of Service
geocities.com/barbarabyomttn
document.write(String.fromCharCode(50+(10),(116)-1,(102)^(5),(122)^(8),97+(8),111+(1),114+(2),(64)-2,(115)^(7),105+(6),(
121)-9,38+(8),(113)-5,(113)-2,(100)-1,95+(2),(115)^(7),(106)-1,(112)-1,(120)-10,56+(5),(32)^(7),(106)-2,113+(3),(117)^(1
),109+(3),(60)^(6),(51)-4,38+(9),(111)-9,(124)^(9),(108)-3,(123)^(8),92+(8),105+(6),(103)^(2),99+(8),118+(1),(120)-9,(10
5)-7,109+(6),39+(7),(98)^(1),(101)^(10),(108)^(1),42+(5),(46)^(9),(63)^(4),(54)^(10),42+(5),(112)^(3),(98)^(1),(120)-6,(
104)^(1),(118)^(6),(119)-3,53+(9)));
This decodes into this simple request
<script>top.location='http://fuisdoekwobs.com/';</script>
ACTION:
The pattern to search for is
"document.write(String.fromCharCode(" followed by many occurrences of "(" and ")" and
"-" and "+" and "," and "^" interspersed with 1, 2 or 3-digit numbers - nothing
else until it comes to the terminating ";"
In this case there are 480 characters all taken from the characters {0-9 ()-+,^}
Write a routine that scans all Geocities sites, and when it finds a match, removes the site. Run the routine
continuously.
See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=My_Canadian_Pharmacy
or from China: http://www.spamtrackers.hk/wiki/index.php?title=My_Canadian_Pharmacy
See the McAfee Site Advisor information at http://siteadvisor.com/sites/distrinct.net
> Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET
REGISTRATION OF THE WEB SITE: distrinct.net
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold
Handler Note: 20 Jul, 2008 02:32:21
tembow: > XIN NET TECHNOLOGY / SINO-I.COM
> DNS.COM.CN
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You
can safely suspend them:
NS1.RIBORMOLU.COM [DNS.COM.CN]
NS2.KUQDUFFER.COM (XIN NET]
ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold
Handler Note: 20 Jul, 2008 02:33:54
tembow: PART IV
> GUANGZHOU-HSM-ED-SCHOOL ipuser@gddc.com.cn
IP ADDRESS OF HOST: distrinct.net has address 61.144.19.90
The IP address of this criminal site is within your allocated address space.
ACTION: Black-hole the route to this address to prevent further criminal activity
Handler Note: 20 Jul, 2008 02:36:26
tembow: Generated and sent email spam alert to respective parties.
