Newsgroup: it.news.net-abuse
Titolo: Help requested: slamming a Dutch spammer at an Italian ISP

Hi all,
[Posting in English, my Italian stops at Bon Giorno]
I'm trying to get an ISP shut down a Dutch mortgage spammer[1]. This
happens to be an Italian ISP, named 
7host.com
 (they also have
7host.it
). I have already complained at their abusedesk (no answer),
the owner of their IP-blocks (no answer) and their upstream (only an
auto-responder). The actual spamming happends through open/hijacked
proxies.
The case is as follows:
The spamvertized domain is 
http://www.hypotheekaanvraag.com/
This is hosted in China on some bulletproof hosting setup. Upon
requesting that page, you get a frameset. In that frameset another
frameset gets opened. If you look at the source with a regular
browser (Mozilla, IE) you'll probably only see the bogus frames: one
filled with about:blank and one with an URL to some Chinese page.
Obfuscated in the first frame is a reference to a file called
rd-main.htm. This opens the second frameset. In one of those frames
this URL gets loaded:
http://www.hinet.net
^sdTHserOIe-102.31.221.86~w423rbwiefhwiHGQWuuIoplOYTREhdihwdwhei-21.88.220.196~
rhwekjdhiwu3ed...@www.bb5l.com/hypotheekofferte/default.asp?partner=3902XW3
If you skip everything before the @ this remains:
www.bb5l.com/hypotheekofferte/
The 
bb5l.com
 domain is filled with (as far as I know) semi-fake
Italian contact info (which by the way is the same as
hypotheekaanvraag.com
's whois info). 
bb5l.com
 and 
www.bb5l.com
 point
to 66.194.37.237 (reverse DNS is 
pcbs10.7host.com
). At this host a
info-request form is hosted, that sends information to the spammer.
So far my tries in getting this 
bb5l.com
 shut down have failed. Since
7host.com
 seems Italian and since they do both DNS and hosting I am
posting here (thanks to Furio for pointing me here).
So, the bottom line:
- Does anyone here have some tips/tricks in getting this ISP's
  attention?
- Maybe someone knows a person at 
7host.com
, or maybe someone from
  7host is reading along. Do they reply to abusereports at all?
- Any other help in getting 
7host.com
 to shutdown this spammer
  is greatly appreciated.
One other thing: while doing some Googling I found an old posting by
some guy named Mauro:
http://groups.google.com/groups?selm=cf7d0198.0208300557.6fa93442%40posting.google.com
His email is at 
7host.com
, but he seems to speak on behalf of ECUI,
which is the owner of the IP's that 
7host.com
 uses. And the
ecui.com/net
 webpage gives me some error for a few days in a row now.
Something smells fishy here...
[1] For a 'reputation sheet' of this Dutch spammer:
 
http://www.spamvrij.nl/lijsten/lijst.php?type=bedrijf&sort=date&order=up&bedrnaam=Akinfranks
    (The page is in Dutch, but you should be able to see the scope of
    this)
Thanks so far. If anyone wants additional info, you can post here
(I'll keep reading this group for a while) or mail me (the From:
address is my valid email).
Best regards,
Carel

 info-request form is hosted, that sends information to the spammer.
Reverse DNS cannot be considered because can be easly faked.
Start considering routing details about 66.194.37.237, part of network
66.194.36.0/22
 assigned to apparently US provider, using "Time Warner
Telecom"'s netblocks. Details follows:
===========================================
Country: Unknown
Looking up !NET-66-194-36-0-1 at 
whois.arin.net
.
NOTE: More information appears to be available at EU9-ARIN.
Using cached answer (or, you can get fresh results).
OrgName:    Electronic Communications Unlimited, Inc. 
OrgID:      ECU-5
Address:    P.O. Box 682096
City:       Orlando
StateProv:  FL
PostalCode: 32868-2096
Country:    US
NetRange:   66.194.36.0 - 66.194.39.255 
CIDR:       
66.194.36.0/22
 
NetName:    TWTC-ECU-1
NetHandle:  NET-66-194-36-0-1
Parent:     NET-66-192-0-0-1
NetType:    Reassigned
Comment:    
RegDate:    2003-08-21
Updated:    2003-08-21
OrgTechHandle: EU9-ARIN
OrgTechName:   Unrein, Ed 
OrgTechPhone:  
+1-407-445-6352
OrgTechEmail:  
dnsa...@ecui.com
# ARIN WHOIS database, last updated 2003-10-20 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
===========================================
DNS service is really at 
7host.com
, but is NOT an Italian provider,
whois details are most probably faked, this is hosted again by "Time
Warner Telecom":
===========================================
Domain Type 	Class 	TTL 	Answer
7host.com
. 	A 	IN 3600 66.194.37.220 
===========================================
Looking up !NET-66-192-0-0-1 at 
whois.arin.net
.
NOTE: More information appears to be available at ZT87-ARIN.
Using cached answer (or, you can get fresh results).
OrgName:    Time Warner Telecom 
OrgID:      TWTC
Address:    10475 Park Meadows Drive
City:       Littleton
StateProv:  CO
PostalCode: 80124
Country:    US
ReferralServer: rwhois://
rwhois.twtelecom.net:4321
NetRange:   66.192.0.0 - 66.195.63.255 
CIDR:       
66.192.0.0/15
, 
66.194.0.0/16
, 
66.195.0.0/18
 
NetName:    TWTC-NETBLK-4
NetHandle:  NET-66-192-0-0-1
Parent:     NET-66-0-0-0-0
NetType:    Direct Allocation
NameServer: 
NS1.MILW.TWTELECOM.NET
NameServer: 
NS1.IPLT.TWTELECOM.NET
NameServer: 
NS1.ORNG.TWTELECOM.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    2001-10-25
Updated:    2003-09-17
TechHandle: ZT87-ARIN
TechName:   Time Warner Telecom 
TechPhone:  
+1-800-898-6473
TechEmail:  
ipma...@twtelecom.net
 
OrgAbuseHandle: TWTAD-ARIN
OrgAbuseName:   Time Warner Telecom Abuse Desk 
OrgAbusePhone:  
+1-800-898-6473
OrgAbuseEmail:  
ab...@twtelecom.net
OrgNOCHandle: TDN1-ARIN
OrgNOCName:   TWTC Data NOC 
OrgNOCPhone:  
+1-800-898-6473
OrgNOCEmail:  
sup...@twtelecom.net
OrgTechHandle: NST12-ARIN
OrgTechName:   NOC SWIP Team 
OrgTechPhone:  
+1-800-898-6473
OrgTechEmail:  
sw...@twtelecom.com
# ARIN WHOIS database, last updated 2003-10-01 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
===========================================
Abuse references are:
ab...@twtelecom.net
, 
sw...@twtelecom.com
, 
sup...@twtelecom.net
,
ipma...@twtelecom.net
, 
dnsa...@ecui.com
bye Krmel
-- 
Questo messaggio ha eseguito un'operazione non valida e viene terminato.
Se il problema persiste, reinstallare tutti i partecipanti al newsgroup.

===========================================
You find 7host srl in the Infoimprese database, at the same Francavilla
address seen in the whois record of both 
7host.com
 and 
7host.it
.
So these servers are in the USA, but are controlled by an italian
company (and it is not too uncommon, a lot of the cheap hosters
do that).  The problem is that this company seems to be spammer-
friendly by ignoring complaints.
furio ercolessi

friendly by ignoring complaints.
Can an Italian company lawfully handle SPAM? I doubt it.
Therefore, reporting to police authorities might be the only way to
go.
-- 
ATTENZIONE: CAMBIO E-MAIL!
e-pe...@libero.it
 --> 
e-pe...@e-world-europe.com
--