Report joe-jobs here.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Fri Apr 19, 2013 1:58 pm

milfbeach.net identical to previously reported milfbeach.com

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Sun Apr 21, 2013 3:21 am

drugspowerstore.com is another joe-job with the subject Forum about Legal highs .
This time the domain does not only offer - not innocent - "recreation drugs", but also drugs that normally are offered by known pharmacy-scam operations like "EvaPharmacy" and similar affiliate-program providers. The domain claims to sell their products "Exclusively for research chemicals goal", but also admits that 'some' goods may be illegal in certain countries. Contrary to previous sites that were victim of a joe-job and labeled as "Forum about Legal highs", this domain is in English. As with previous 'dubious' sites, this domain can be commented on and rated based on the content of the domain and/or based on personal experience from users. Just do not simply comment on it and rate it as a spam site only because of a mail with the "joe job" subject "Forum about Legal highs". The joe-job mail for this domain was again sent through the Slenfbot-spambot: http://cbl.abuseat.org/lookup.cgi?ip=88.81.233.202
The headers of the mail are also consistent with those of previous "Forum about Legal highs"-jobs.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Apr 25, 2013 1:52 pm

Subject: Underage cp archive Domain mentioned: hornytube.xxx Explicit adult videos.
The text-only-link masks a click-able link for ru.y8.com Russian site that offers games and puzlles.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=190.206.116.146

Subject:Welcome, we have the best Domain mentioned: exposedwebcams.com Adult webcam site, already listed on March 22. The text-only-link masks a click-able link for myfreecams.com adult webcam site. Joe-job contains text: "Download cp movies".
The IP-address 202.89.105.100 used for this joe job is unlisted.

Subject: child porn and zoophilia videos! Domain mentioned: http://ad.teenyweenystory.com/
Portal for an adult dating site. No nude content on page mentioned, nor on home-page. The text-only-link masks a click-able link for ru.y8.com. Russian game/puzzle site mentioned above.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=148.246.154.196

Subject: Check US CC data Domain mentioned: cam4.fr Identical to webcam-site cam4.com listed on April 6.
The text-only-link masks a click-able link for already on March 30 listed ixxx.com. Joe-job contains text: "Underage cp archive".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=134.19.209.225

Subject: access to CC data archive Domain mentioned: xcams.com Adult webcam site.
The text-only-link masks a click-able link for -again- already listed games-site ru.y8.com. Joe-job contains text: "Underage cp archive".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=117.213.141.176

Subject: Credit Cards from the US Domain mentioned: xlovecam.nl Adult webcam site, Dutch version of xlovecam.com listed on April 6.
The text-only-link masks a click-able link for above listed adult dating-site ad.teenyweenystory.com. Joe-job contains text: "zoo movies 2012".
From compromised IP-address: http://cbl.abuseat.org/lookup.cgi?ip=87.12.222.79

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Sun May 05, 2013 11:57 am

Subject: JWH, Naphyrone, 5-IAI and more forum Domain mentioned: sultan74.net This Russian site offers water-pipes, tobacco, aromatic essences and incense. When I visited this website, I found no mentioning of the substances mentioned in the subject (which are synthetic drugs, banned in most countries). The only "offensive" thing I noticed was a picture of an "AK-47" weapon: it had a price mentioned of 3,000 Russian Ruble (around $80) but no link. Maybe just shown as a prank. The site also has a warning against scammers who run a website called sultan74.biz (not resolving at the time of writing).

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Tue May 07, 2013 5:18 pm

Subject: Украинский пиратский союз Domain mentioned: pp-ua.org The subject translates to Ukrainian pirate Union. The website is the Ukraine pirate party of Ukraine which has political content. The website already has a disclaimer stating that they are the victim of a smear campaign. This joe job is clearly political motivated.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Tue May 07, 2013 5:31 pm

Subject: Do you want zoo and CP movs? Come here! Domain targeted: 50plussexdating.nl Adult dating site for people aged 50+.
The IP-address 85.94.228.63 used for this joe job is unlisted.

Subject: Only here tons of CP movs Domain targeted: nl.mydirtyhobby.com Site offering adult amateur movies and webcams. The design of the site suggests that it was also made by amateurs.
http://www.spamhaus.org/query/ip/196.45.132.21 has no details of the CBL listing yet.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu May 09, 2013 1:53 pm

Subject: Download CP and zoo movies Domain mentioned: partycasino.com Casino-site, possibly a scam.Site has a poor reputation.
The text-only-link masks a click-able link for lp.gamloveer.com. That link redirects to koramgame.com/en, which offers - online - games.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=188.255.169.174

Subject: Fresh CC cards Domain mentioned: pub.webcamo.com French adult webcam meeting site. No nudity.
The text-only-link masks a click-able link for cocklobster.com. yet another adult video site. Joe job message contains the text "Download cp movies".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=187.45.68.2

Subject: Fresh porn 100% download free‏ Domain mentioned: trafficshop.com Domain involved in buying/selling adult traffic.
The text-only-link masks a click-able link for exposedwebcams.com. This is a webcam domain mentioned above and in many other joe job mails. Joe job message contains the text "Only fresh CC zoo movies 2012".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=186.15.160.239

Subject: Do you want zoo and CP movs? Come here!‏ Domain mentioned: flirt4free.com Adult webcam and chat site. Site has a poor reputation.
The text-only-link masks a click-able link for xvideoslive.com. Another adult webcam site.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=89.205.88.111

Subject: Welcome, best CP movies here!‏ Domain mentioned: mydirtyhobby.com previously listed amateur adult webcam and movies site.
The text-only-link masks a click-able link for tukif.com. A French adult movies site.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=46.144.207.70

Subject: She loves blowing it large‏‏ Domain mentioned: tukif.com previously listed French adult movies site.
The text-only-link masks a click-able link for asswriter.com. Another explicit adult movies site. Joe job message contains the text "zoo movies 2012".
Message was sent from an unlisted IP-address.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Sat May 18, 2013 4:26 pm

Subject: Unreadable characters Domain mentioned: ruprava.info The site is described as: "Deprived of a driving licence, you must stay behind the wheel? You want to BUY the RIGHT driver's license, How to distinguish threw read.."
This does not look like a legal site, as it seems to be about illegally buying a Russian driver's license. Apparently there even is competition in Russia in that line of business, because ruprava.info is victim of a joe job.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Fri May 24, 2013 6:20 pm

Subject: Welkome to Russian Magic! Domain rus-koldovstvo.com a forum about Russian magic.
IP-address not listed.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Wed May 29, 2013 12:30 am

Another victim of the recent massive joe-job against Russian domains is zelenogradskiy.org which is described as a social and political magazine of a group of patriots of Zelenka/Zelenogradsk-town in a district of Moscow.
Joe jobs processed through the Slenfbot botnet:
http://cbl.abuseat.org/lookup.cgi?ip=188.190.65.7, http://cbl.abuseat.org/lookup.cgi?ip=211.8.166.3 .
NB The site was listed at SURBL because of spam; on 30-may-2013 SURBL has removed the listing as a FP.

Post Reply

Who is online

Users browsing this forum: Bing [Bot], Majestic-12 [Bot] and 3 guests