Rolex spammers - intheworldseries.com

From: pokk8hmcy@starstream.net
Subject: Swiss Rolex, Patek Philippe, Panerai, Omega, Breitling, IWC, Tag Heuer From $199, Limited Stock! srbb
Date: June 6, 2007 8:07:03 PM GMT+01:00
To: [some email]
Return-Path:
Received: ...
from ioxemua (adsl-dyn12.91-127-77.t-com.sk [91.127.77.12]) by [isp] (Xserve/smtpin60/MantshX 4.0) with SMTP id l56I71Xh018208; Wed, 06 Jun 2007 11:07:26 -0700 (PDT)
Message-Id: <564r564p.6650732@starstream.net>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=surely.changed; d=starstream.net; b=QjJVeUfegyYhvqkLmVHoLomQcOrCDMssOAHyXiVaPuAoJWtvJfSoOBwehpNRjZvfMWYXVJxozeJWNeUT;
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [email]

garden within know? using dark sudden bought,Swiss Watch Retailer
Special From $ 199
Bestseller Watches
A.Lange & Sohne
Audemars Piguet
Breitling
Bvlgari
Cartier
Chanel
Chopard
Franck Muller
IWC
Jaeger-Lecoultre
Omega
Panerai
Patek Philippe
Rolex Ladies
Rolex Mens
SWISS Rolex
Tag Heuer

Checkout the hottest watches now
circumstances know and mistress bad? favour your appearance blue?

had link to http://rymibryk.intheworldseries.com/

Of which we get very similar results than for the previous entry. Again real registrant hidden, but internet.bs is the domain used by the spammers. Once I find a third spammer using that domain, or a spam of a third different product and domain registered by that domain, I'll count that domain registry service as spammer operated as well.

Domain Name: INTHEWORLDSERIES.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.ROCKETSKYROCK.COM
Name Server: NS2.ROCKETSKYROCK.COM
Name Server: NS3.ROCKETSKYROCK.COM
Name Server: NS4.ROCKETSKYROCK.COM
Name Server: NS5.ROCKETSKYROCK.COM
Status: clientTransferProhibited
Updated Date: 05-jun-2007
Creation Date: 05-jun-2007
Expiration Date: 05-jun-2008

Exquisitereplicas

I never realized the fake watches was such a big business. I considered it to be a thing of the past, a thing of the wannabe beach lions beach rolexes from the 1980s .. but they still seem to exist, and they seem to be getting more numerous. First the beautifulswiss thing, now this.
This is getting a bit boring...

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs129766qbf;
Sat, 3 Feb 2007 13:26:23 -0800 (PST)
Received: by 10.49.42.5 with SMTP id u5mr182529nfj.1170537983204;
Sat, 03 Feb 2007 13:26:23 -0800 (PST)
Return-Path:
Received: from localhost.localdomain (cpe-66-68-88-166.austin.res.rr.com [66.68.88.166])
by isp with SMTP id o45si20601923nfa.2007.02.03.13.26.18;
Sat, 03 Feb 2007 13:26:23 -0800 (PST)
Received-SPF: neutral (isp: 66.68.88.166 is neither permitted nor denied by best guess record for domain of iramey@mailbox.sk)
Message-ID: <5ba501c747d9$b6afc8b7$2621bc89@mailbox.sk>
From: Bvlgari Watches
To: [my email]
Subject: Exquisite Replica
Date: Sun, 04 Feb 2007 00:20:33 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_3D3E90D7.57FB7D65"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

QUALITY REPLICAS!

Rolex Watches
Cartier Watches
Breitling Watches
Bvlgari Watches
Omega Watches
Tag Heuer Watches
Officine Panerai Watches
A.Lange & Sohne Watches
Franck Muller Watches
Chopard watches
Hermes watches
Jacob & Co. watches

Get 25% off when buying 2 watches!

VISIT OUR ONLINE SHOP! with the link ...

Of which some whois and we have the registrant :

Domain Name: newdsannysongg.com
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET
Registrant Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Administrative Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Technical Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Record Created on........ 2007-02-01 17:15:16.057
Expire on................ 2008-02-01 17:25:04.000
Domain servers in listed order:
ns1.hairyolddns.com
ns2.hairyolddns.com

Needless to say .. I wouldn't buy from these if I was in the market for a watch.
First - the domain exists for the past 3 days.
Second - and biggest : these people could get sued by the copyright country of any civilized and semicivilized country, probably including even Romania.
Third - wtf is it with the routings of this email? Austin, TX, or Slovakia .. for a Canadian registered site? sure. Now if only I would bother to forward the details to Bvlgari and all these other companies that would be really interested in infringing their name ...

Great responses aol, bol and namecheap.com .. nada

It has been two weeks since I first got my inboxes of email killed by the bounces of the emails sent by the spammers marketing for Beautifulswiss.net or .com.
It has been two weeks since I contacted TOSREPORTS@aol.com, abuse@bol.com.br, and support@namecheap.com. No answers, from any of them.

These beautifulswiss, fineswiss and so on people or someone they pay to do the dirty job, send these spams. My email address is still occasionally showing as the reply-to field, so the undelivered spam bounces to me. Great.

AOL have clear TOS about not using its sites for marketing illegal stuff. Even if AOL would shut down these sites that host the redirects to this site (or its clones), it's still killing them slowly, one by one ... AOL hasn't answered to any TOS report. Fantastic customer service.

Namecheap.com is the domain registrant that has something fancy in their TOS agreement ... But as if they would give a shiitake... allow bulk site registrations, and suddenly any bulk registration site doesn't really care. Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). " Or show me one bulk registration site that cares.

There we go. No answer from any of the TOS breaking and abuse complaints, and the mailboxes still get more bounced shiitake by these same people.
This gives a great image of AOL TOS reports handling people, BOL abuse, and of this bulk spam domain registrant namecheap.com.
Maybe time to write an angry letter to that Mr Maduro if the email address he used in these domain bulk registrations is even valid.
Or one day, time to just get a new email address... it is very frustrating when the address they kill by this shiitake are not the free email addresses but something you actually pay to use. The email provider, as usual, hasn't done anything more than AOL TOS reports on this ...

Beautifulswiss.com War - Part II

Beautifulswiss.com War - Part I

Today 8 AM : discovery that this spammer has invaded my inbox, using my email address as his reply-to.
First spam reports and TOS violations were reported hours ago; no reply yet.

Today 9 PM :
Second round of war.
More spam on my inbox.
Again I am used as reply-to fields. F-ers.

Again as in the previous spam post, again the beautifulswiss.com domain.
This time the only difference : the spammer has used a new aol account to spam :

Message-ID: <0AB1981F.70D59CEA@mac.com>
Date: Wed, 27 Dec 2006 02:53:26 +0600
From: "King, Catherine"
User-Agent: eGroups Message Poster
MIME-Version: 1.0
To: "Daniel"
Subject: ROLEX at unbelievable prices cu
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

High Quality Rrol,x Re*lica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more re.lica watches.

http://members.aol.com/amandagld/

Their stone, nursing a baby in the paradise, wasn't tearfully wax.
Her devil, crying in the toolbox, is silently piggy.


Today around 10 PM,
my response to this last spam attack :


From: me
Subject: Fwd: Undeliverable Mail
Date: December 26, 2006 9:56:17 PM GMT+00:00
To: spam@my email provider, TOSReports@aol.com, support@namecheap.com

This spammer (http://members.aol.com/amandagld/ ) continues to abuse my email address.
My email address in the reply-to field, making me angry...

This aol account forwards to http://beautifulswiss.com/

of which whois:

Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=

Domain registrant,
TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Cheapnames.com, please deactivate.

Mac.com, please do something to help deactivate these irrelevant spam forwards.

Angrily,

ME

[with full spam and its headers followed]

Beautifulswiss.com - invading my emails means WAR

Dear spammers, the fact that you use MY email address in your spams reply-to field means war.

War, 8 AM on 26 December 2006.
My inbox :

From: Postmaster@post4.tele.dk
Subject: Mail System Error - Returned Mail
Date: December 26, 2006 8:50:43 AM GMT+00:00
To: [my email]
Reply-To: Postmaster@post4.tele.dk
Return-Path: <>
Received: from mac.com (smtpin11-en2 [10.13.10.81]) by ms121.mac.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005)) with ESMTP id <0JAV005BHHXQ11@ms121.mac.com> for [my email]; Tue, 26 Dec 2006 00:51:26 -0800 (PST)
Received: from fep34.mail.dk (fep34.mail.dk [80.160.76.198]) by mac.com (Xserve/smtpin11/MantshX 4.0) with ESMTP id kBQ8oj0D023645for ; Tue, 26 Dec 2006 00:50:46 -0800 (PST)
Message-Id:
Mime-Version: 1.0
Content-Type: multipart/report; Boundary="===========================_ _= 6371765(15235)1167123043"; report-type=delivery-status
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]

This Message was undeliverable due to the following reason:

Dansk forklaring, klik her:
http://tdc.mail.dk/cgi-bin/redirect.pl?MsLimitNumMsgs

The user(s) account is temporarily over quota.



Please reply to
if you feel this message to be in error.
Reporting-MTA: dns; fep34.mail.dk
Arrival-Date: Tue, 26 Dec 2006 09:50:42 +0100
Received-From-MTA: dns; fep24.mail.dk (211.59.78.182)

Final-Recipient: RFC822;
Action: failed
Status: 4.2.2

From: "Williams, Joyce"
Date: December 27, 2006 1:56:02 AM GMT+00:00
To: "Brown, Julie" , "Karen" < some user @post4.tele.dk>, "Lisa Davis" , "Smith, Margaret" , "Andrew" , "Anthony Brown" , "White, Brenda"
Subject: An Affordable Rolex [random letters]
Reply-To: "Johnson, Joseph"

High Quality Rro*ex Rep*ica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more repl,ca watches.

http://hometown.aol.com/steed249/

Her vampire, ruling the world in the Shire, nicely nasty.
Her devil, crying in the toolbox, is silently piggy.

The paper, sitting under the roof, was briefly hellish.
His programmer, standing in your house, is quietly slim.
Her ancestor, stealing money in the shadows, isn't perseveringly yellow.

Your dancer, talking crap behind the window, wasn't generously barren.


War, 11 AM
My response :

From: [my email]
Subject: SPAM Fwd: Mail System Error - Returned Mail
Date: December 26, 2006 5:42:26 PM GMT+00:00
To: TOSREPORTS@aol.com, abuse@bol.com.br, support@namecheap.com
Mime-Version: 1.0 (Apple Message framework v752.2)
Message-Id:
Content-Type: multipart/alternative; boundary=Apple-Mail-1--130814484
References: <20061226085043.somenumbers.fep34.mail.dk@fep34>

I forward this spam report to you AOL Tosreports since it IS relevant.

Someone - user steed249 - is forging my email to be used for sending out these emails. the emails with forget details are in the bottom of this email.
I have received several of these emails today.

The URL http://hometown.aol.com/steed249/ is in this spam advertising.
User steed249 is breaking his TOS.
The site is forwarding to replicas of brand products and that is a violation of your TOS, http://help.aol.com/aimhelp/search.do?cmd=displayKC&docType=kc&externalId=http--helpchannelsaolcom-kjumpadparticleId219305&sliceId=&dialogID=63390544&stateId=1%200%2063416598

Needless to say, I am angry that my email is used in these spams as reply-to.

And bol.com.br and the bulk domain support used for registering these domain are in to field too.
I would think that the TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Here are the registrant details I have found out using whois searches for who registered the domains that website redirects to :

Domain Name: FINESWISS.NET
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: fineswiss.net

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.mygoodswiss.net
ns2.mygoodswiss.net

Creation date: 30 Oct 2006 12:12:26
Expiration date: 30 Oct 2007 12:12:26

It also redirects to :
Domain Name: BEAUTIFULSWISS.COM
[whois.enom.com]
=-=-=-=
Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=
The data in this whois database is provided to you for information
purposes only, that is, to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is," and do not guarantee its accuracy. By submitting a
whois query, you agree that you will use this data only for lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume, automated, electronic processes that stress or load
this whois database system providing you this information; or (2) allow,
enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by telephone. The compilation, repackaging, dissemination or
other use of this data is expressly prohibited without prior written
consent from us.

[and in the bottom the full full headers and full text of the spam I had bounced in my email inbox]

Regards,

ME

----- to be continued as soon as I get answers for this spam.