Got a big image spam from some party advertising colon cleansers.

The spammer link was on t012cutter.com, found the WHOIS for that,
LARTed DirectNic.

directNIC makes this information available "as is", and does not
guarantee
its accuracy.

Registrant:
SC Ana Maria Flor Impex SRL
Str. SOLD ZAMBILA IONITA 1
Bucuresti, Bucuresti 00000
RO
0724.350.622

Domain Name: T012CUTTER.COM

Administrative Contact:
Constanta, Gheorghe abuse@anaflornet.com
Str. SOLD ZAMBILA IONITA 1
Bucuresti, Bucuresti 00000
RO
0724.350.622

http://www.spamsuite.com/node/397

MINUTE entry before Judge Honorable James B. Zagel: Motion to
reconsider is denied.

===

No big shock there.

I can't figure out how to get comments accepted, so I will comment here.

Chandlers says:

Raise your hand if you're shocked by this one, but the Judge has
denied e360Insight's Motion to Reconsider

I'm not shocked. I am heartened that apparently Northern Illinois has
developed some spine.

http://www.spamsuite.com/node/397

Since when does the IRS relies on Aol and MS Live for its communications?

-------------------------------------

WHOIS information for: citibanksgroup.com:

[whois.melbourneit.com]

Domain Name.......... citibanksgroup.com
Creation Date........ 2006-11-11
Registration Date.... 2006-11-11
Expiry Date.......... 2008-11-11
Organisation Name.... Citi Bank Group
Organisation Address. 507 s adair st
Organisation Address.
Organisation Address. clinton
Organisation Address. 29325
Organisation Address. SC
Organisation Address. UNITED STATES

From the Past week, at least three PHISH, to one account, for Italian and
Canadian banks hosted by McluelessUSA or its customers:

http://209.255.13.140/proteggi.htm (a week ago yesterday)
http://209.253.17.232/ (several days back)
http://209.255.13.140/index.htm (yesterday)

Delivered by the usual botnets..

Based on previous sightings they get around to shutting them down after a
week or two, I guess they want to make sure the cheque clears. Or they just
like frequent PHISHing holidays.

All reported via castlecops.

It is another *presentation format* with added per country and ASN summaries
of data published at http://www.spamcop.net/w3m?action=hoshame
* ASN info: asn.routeviews.org http://www.routeviews.org/
* Country info: zz.countries.nerd.dk http://countries.nerd.dk/

Top 200 targets of spamcop.net spam reports
For *the week* ending Wed Apr 30 07:06:34 2008 UTC
----------------------------------------------------
Total spamcop.net spam reports volume: 101585178
Top200 share of all spamcop.net spam reports: 2.45%% (2488575/101585178)
The worst country: US 48.0%% [UNITED STATES OF AMERICA]
The worst ASN: AS3462 14.0%% (TW)
The worst routing prefix: 118.169.0.0/16 13.5%% (TW AS3462)
The worst IP: 205.209.161.188 (US AS27645 205.209.128.0/18)

*Top12 IP Adresses (The Dirtiest Dozen)*
#;IP;Country;ASN;prefix;spamcop.net spam reports;age;duration;reverse DNS
1 205.209.161.188 US AS27645 205.209.128.0/18 72731 34.0 h 5.4 d
2 205.209.161...

Last-modified: 2003-10-04 (revision 1.14)
Posted-by: postfaq 1.15 (Perl 5.8.8)
Archive-name: net-abuse-faq/newsgroups
URL: http://www.eyrie.org/~eagle/faqs/nana-groups.html
Original-author: Fluffy usa.net>
Posting-frequency: weekly

We have a plentiful selection of newsgroups about network abuse and
related issues, but what is the best one to use? Here are excerpts from
the newsgroups' charters, with emphasis added to help make things clear.
Please refer to the full charters, URLs included here when available, if
you would like more detail.

If you want to learn more about network abuse -- what it is, what can be
done about it and just what all those acronyms mean -- Tim Skirvin has
pointers to more sources of information at:

<http://www.killfile.org/~tskirvin/nana/>

Thank you for following these recommendations. It will make these
newsgroups more useful for all involved.

Network Abuse Newsgroups: