Re: IP not found ... discarding as fake

Mike Easter wrote:
> Cannot resolve http://akbvci.salaryquilt.net/?35227582

There are a couple of other things going on with that url.

The path gets redirected to
http://akbvci.salaryquilt.net/legalrx/?35227582 -- which doesn't
actually change anything about the IP.

Also, for some reason my SSpadeWin GET console can't handle the gzipped
condition of the page, but websniffer can.

Connect to 218.24.148.105 on port 80 ... ok
GET /legalrx/?35227582 HTTP/1.1
Host: akbvci.salaryquilt.net
Connection: close
Accept-Encoding: gzip
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
Web-Sniffer/1.0.24 (web-sniffer.net)
Referer: http://web-sniffer.net/

HTTP Response Header
HTTP Status Code: HTTP/1.1 200 OK
Date: Mon, 15 May 2006 05:48:15 GMT
Server: Apache/2.0.53 (Fedora) ua40d987c
X-Powered-By: ib8118460
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 9252
Connection: close
Content-Type: text/html; charset=iso-8859-1

Content (encoded: 9.04 KiB / decoded: 40.13 KiB)
<snip pharm spamvertisement with lots of links to another site>

The other site is here
http://62.75.178.134:8080/legalrx/images/more_info.gif
62.75.178.134  rDNS  static-ip-62-75-178-134.inaddr.intergenia.de
inetnum:      62.75.178.0 - 62.75.178.255
netname:      SERVER4YOU-1
descr:        SERVER4YOU Dedicated Server Hosting
descr:        http://www.server4you.de
abuse-mailbox:  [email protected]

62.75.178.134/32 is listed on the Spamhaus Block List
62.75.178.134/32 is listed on the Register Of Known Spam Operations
(ROKSO) database as being assigned to, under the control of, or
providing service to a known professional spam operation run by Yambo
Financials.
8 April 2006: Yambo Pharmacy website, image hosts.

Found 7 SBL listings for IPs under the responsibility of intergenia.de
Long ROKSO page for yambo
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Yambo%20Financials

> IMO the notification business for spamvertisers is a useless waste of
> time for a variety of reasons.  And, besides, SC notification and
> discovery of the spamvertisers has no real teeth.  All SC should be
> doing is giving the spamvertised sites to sc-surbl and do no notifying
> or resolving.

-- 
Mike Easter
kibitzer, not SC admin