RackSpace06

Yes sir. Verynice, both dealz and site here.

"Rajesh Khanna". Oh well. Maybe not. That's the name he is using. If it's for real? I don't know.
No sir, I really don't know. Yet. Mayor or Moe? I really don't know.

Provider of bulletproof servers for both mail and hosting.
Has some space in lacnic and something at fdc-servers.
And probably other places too.

It's a sad day for the spammers and spamsupporters when you cannot trust anyone.
Not even the Romanians. Never scam a Romanian.

Bluehost strikes again

Less than 10 minutes again to remove a paypal phish site.

But of course, others can have complained earlier.
I don't think so, the same happened after the first time I sent a heads up.
A bit early to say, but there could be a pattern here.

Which tells me Bluehost is extremely effective.

hetzner.de - tragic. Or wait - Is it Google mail? Or wait - is it Hetzner after all?

Received a spam for a Lloyds Bank phish and sent off an email to the abuseaddress at hetzner.de, who host the site.
That spam arrived yesterday, but the phish site is still up. So I thought I should send off a heads up when I discovered it.

I must confess that I messed up a bit and used the mail to bluehost regarding the paypal phish. so it became a paypal instead of a Lloyds phish in the email.

But anyway, here is the response from hetzner.de, their abuse@. Correction, this could be google not sending it out at all:

Delivery to the following recipient failed permanently:

    abuse[at]hetzner.de

Technical details of permanent failure:
PERM_FAILURE: SMTP Error (state 16): 550 This message contains malware (Email.Phishing.RB-1597)


Doh.
Should I think a bit and try to rewrite it? Naw.
I have no idea what triggers that response.
OK, then. I will leave out the full link and only give the domain. And not use the word "phish".
But only one more try.

Update two days later

Nine hours ago I received the following from Hetzner:

Hello,

thanks a lot for the information. We have informed our customer to take care
of the problem. If you have trouble with one of our servers furthermore,
don't hesitate to contact us again.

Sorry for the problems.

Not a problem for me, mate.
But it could be a problem for others that the phishing page is still up.

This is a lloyds bank phish site.
And this week is apparently "National Identity Fraud Prevention Week" in the UK, starting today:
http://www.lloydstsb.com/security/fraud_prevention_week.asp.
Ironic.

Bluehost: Less than 10 minutes to remove a phishing site.
Hetzner: (Two) (Three) (Four days) 5 days.......
Last check Thursday October 11 and the phishing page was gone, took them around 5 days.

Bluehost - fastest I have seen

Paypal phish on sendinbox.info.
Sent off an email to bluehost abuse, less then ten minutes later the phish setup was gone.
Others could have made bluehost aware of it earlier, of course, but it is the fastest I have seen.

Usually those phish sites are hacked, but this one was registered yesterday using bluehost.
I am not so sure if it was a hacked site this time.

Cudos to whoever is at work reading bluehosts abusebox on this saturday.

bigjohnson / eliteboy ...

Igor Shaposhnikov.

This is confirmed. And checked. And doublechecked. I even triplechecked.
So I guess I can't be wrong.

Convicted for bankfraud.

Gave spam-court.com as return addresses for a spamrun earlier this year.
Hm, "three years of supervised release", what about spamming during that time?

More details later. If I get around to do something.