Report joe-jobs here.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 06, 2013 12:53 pm

Subject: You can do it too‏ Domain mentioned: ixxx.com previously listed explicit adult site.
The text-only-link masks a click-able link for ext.amateurcommunity.com. Adult movies, pictures and webcams. Joe job message contains the text "zoo movies 2012, Download cp movies".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=181.177.137.56

Subject: Credit cards base (dump+pin) cheap!‏ Domain mentioned: 50plussexdating.nl previously listed adult dating site.
The text-only-link masks a click-able link for v2notobacco.com. Site selling electronic cigarettes. Joe job message contains the text "Download cp movies".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=84.232.148.82

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 13, 2013 3:59 pm

Subject: Legal Drug Reviews Domain groupluyu.com a Chinese company engaged in Import & Export of various kind of Hormone & steroids and other organic products.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=178.137.209.77

Subject: Best legal powders Domain shtangfang.lookchem.com a Chinese pharmaceutical and biopharmaceutical company.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=178.172.229.112

Subject: About Legal Drugs Domain shijin.lookchem.com a Chinese pharmaceutical and biopharmaceutical company.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=2.43.169.235

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 13, 2013 4:22 pm

Subject: Re: Rolex For You - 22%‏ Domain mentioned: xvideoslive.com a previously listed explicit video site.
The text-only-link masks a click-able link lp.gamloveer.com which redirects to koramgame.com an online game site.
The joe-job message contains the text "zoo movies 2012".
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=69.156.31.136


Subject: Re: CP movies here‏‏ Domain mentioned: sexdollbuy.net‏ webcams and dating site. Domain has already been suspended on 2013-05-07.
The text-only-link masks a click-able link for exposedwebcams.com, a previously listed webcam site.
Festi spambot: http://cbl.abuseat.org/lookup.cgi?ip=220.94.141.103

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 20, 2013 6:03 pm

Subject: re: New lif e bnge is. Va riga Pro .‏ Link mentioned: http://0nlinedrugstore.com/?/2013/87+copulatory+butters+placid+hystericals. With corrected spelling Onlinedrugstore.com redirects to canadadrugs.com, a Canadian Pharmacy that is not approved by the US FDA, but has several genuine seals (CIPA Pharmacy, Pharmacy checker) and is - though not approved - also not considered by LegitScript to be a "rogue pharmacy". The culprits behind this joe job may well be any of the operators of scam-sites that ARE considered to be a "rogue pharmacy", like "Canadian Pharmacy" (Spamit/Glavmed), "Canadian Health&Care Mall", "My Canadian Pharmacy" and "Toronto Drugstore" (all EvaPharmacy/Bulker.biz) or "Pharmacy Express" (Kuvayev family).
Edit: A recent mail in this joe job with the subject RE: Yo ur lady wlil be se k o rt d dumb by y ou r suax el po So r efwt Viagr a.‏ mentioned the link http://94.23.19.106/?/2013/08+copulatory+butters+placid+hystericals which redirects to biklannumestas.com = well known scam "Online Pharmacy":
http://spamtrackers.eu/wiki/index.php/Online_Pharmacy

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 20, 2013 6:23 pm

Subject: Online movies/Watch movies online/Free films Domain movie2k.tl downloadable and streaming - non-adult- movies.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=2.90.115.126
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=178.219.253.34 and many more.

Subject: All about legal substances Domain rcblog.biz Russian blog about chemicals and more:
Nobody likes gulls. Even the gulls do not like seagulls. In this article we will describe the fierce 100% of the way chaiko-huntingNo idea what that means; hardly seems to relate to chemicals, unless the use of some 'chemical' caused that the text was written as it is ;)
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=37.212.156.19

Subject: Grover Domain growbro.org Russian forum about the cultivation of recreation drugs. Forums are in Russian, but threards are in Western language too. I noticed several spam-messages for generic Viagra and replica goods.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=178.125.89.112

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Mon Jun 24, 2013 11:15 am

Subject: Forum about Legal Cocaine Domain pandachem.co Russian company selling chemicals. Several of those chemicals can be abused as 'recreation drugs', however some of the synthetic THC-related drugs are used in the treatment of Alzheimer's disease.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=93.84.59.192

Subject: Blast Off Natural Party Powder forum Domain allrc.biz Russian company selling chemicals and herbal products. The latter products includes cannabis to be used as incense. The disclaimer that the product "...is not for human consumption ..., but exclusively for scenting premises" seems far-fetched.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=190.26.105.187

Subject: Legal drugs Domain svmrc.in Russian forum dedicated to research in the field of psycho-active substances. The home-pages mentions: "The administration has no relation to the sale or manufacture substances, in accordance with the current legislation, the Administration disclaims any representations and warranties, the provision of which may otherwise violate the law, and specifically disclaims any liability with regard to the site, the content and its use."
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=176.222.129.15

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Tue Jun 25, 2013 8:50 pm

Subject: Allah Akbar Domain vdagestan.com Russian domain: "the official website of Dagestan province of the Caucasus Emirate". With the jihadist content certainly not a site to everyone's liking. Precisely because of that it is victim of a political motivated joe job.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=210.191.35.174

Subject: carding forum Domain carder.pro Highly criminal Russian domain involved in trade in stolen credit-cards and other illegal activities. The domain is members-only and (as Nodus remarked in the review at SiteAdvisor) most likely membership will be by invitation only. Such a domain will not send spam. This is clearly a case of criminals attacking other criminals.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=46.164.130.93

Subject: Investec - Important Account Notification and Gaza News Domain alkotla.org Arabic news site about the Gaza Strip in the Middle East. The message with the subject "Investec" suggests that this is a phishing scam, which it is not. This is another political motivated joe job.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=178.172.154.65

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Sat Jul 13, 2013 11:27 pm

Subjects: Party Pills/(Forum about) Legal Highs Domain rcblog.cc. Russian blog. Earlier mentioned rcblog.biz now redirects to this domain. This site also mentions on top of the homepage the domain pandachem.co which is another previously reported joe-job target.
h/t to Mandrake09 for spotting that this rcblog.cc is a new target.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=85.135.219.76
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=93.85.117.232

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Mon Jul 22, 2013 2:17 pm

Subjects: For Investor Domain traderush.com From the Meta description: "Traderush offers popular binary options trading service with lots of benefits. Open an account to binary trading options or digital options now to get full benefits...".
h/t to Mandrake09 again for spotting this new target.
Slenfbot spambot: http://cbl.abuseat.org/lookup.cgi?ip=2.134.168.241

jgilbertstl
Posts: 2
Joined: Wed Jul 24, 2013 7:06 am

RE: Report joe-jobs here.

Post by jgilbertstl » Wed Jul 24, 2013 7:06 am

Victim here!! stlbackstore.com.Help! lol!

Not sure what to do or where to report. I contacted my ISP who says they will escalate and have our IP changed. Not sure what that will do other than change any affect on a BL. (A bit of a newbie here....)

I assume we should either 'ride it out' or change our email addresses? What are the odds they follow us to the new address?

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests