Blog for hpHosts, and whatever else I feel like writing about ....

Friday 7 February 2014

Amazon spam, BuyURL Ltd.

Won't be long until we see Valentines malspam, happens every year, but in the meantime, some of those selling on Amazon, seem to be resorting to spam to peddle their wares.

I received a couple on the 1st, and have another one this morning. In all 3 cases, the spam was sent via my sites contact form (and yes, I actually like receiving spam before someone tells me I should be filtering it);

*********************************************************************
General
*********************************************************************
Ref: PI0021323817513
Reason for message: Feedback Notification
Sent from Server: mysteryfcm.co.uk
Date submitted: 07 February 2014
Time submitted: 08:14:50
Submitted by: 213.238.175.13
Referring page: hxxp://mysteryfcm.co.uk/?mode=Contact
*********************************************************************
Details
*********************************************************************
Name: harryanaaron
E-mail: accuratephysici6MQ85@outlook.com
How did you find us?: Not provided
... Other: Not provided
Site navigation: Not provided
Comments:

Let's just say it appeared he used cordless drill consumer reports for sale. Sometimes these problems can be quite as easy bit changes. Accidents due to quick control. [url=hxxp://powerpak445.livejournal.com/ ]power-pak 445 [/url] This particular gigantic internet retailers provides the following few maintenance practices, the scratches. Also, a rotisserie basket would make the tool and accessories, such as refrigerators will go down. By grilling from top and bottom of the drill and a heavier-duty performance for shareholders.

This manufacturer pioneered the technology does have to leave the oven below it. The lumen side of the main metros. While you use them. hxxp://www.cssforest.org/blog/index.php?id=164
hxxp://www.club-natation-romont.ch/index.php?option=com_jambook&Itemid=21&task=add
hxxp://www.lucyophoto.com/blog/happy-monday#comment-251047
hxxp://sangbleu.com/2014/01/31/pretty-vacant-the-graphic-language-of-punk/comment-page-1/#comment-1383991
hxxp://tmisource.com/2013/11/27/watch-actors-talk-unique-fighting-styles-in-the-mortal-instruments-city-of-bones/#comment-96045
If it comes to implementing our strategic growth plan. By using the drill, saw or a coal stoker. Twist right and perfect for all products. A 12v drill driver.


All 3 came from the same IP too, 213.238.175.13;

inetnum: 213.238.175.0 - 213.238.175.255
netname: BuyURL-NET
descr: BuyURL Ltd.
remarks: http://www.buyurl.net
country: EU
admin-c: IHAC2-RIPE
tech-c: IHAC2-RIPE
mnt-by: IDEALHOSTING-MNT
org: org-ihsi1-ripe
status: ASSIGNED PA
source: RIPE # Filtered
remarks: ###################################
remarks: Abuse & intrusion reports should
remarks: be sent to: abuse@buyurl.net
remarks: ###################################

organisation: ORG-IHSI1-RIPE
org-name: IDEAL HOSTING SUNUCU INTERNET HIZM. TIC. LTD. STI
descr: iDeal Hosting Network Coordination Center
address: Nish Istanbul D Blok No 84
address: 34196 Bahcelievler, Istanbul - TR
org-type: Other
phone: +90 (212) 706 0300
fax-no: +90 (212) 706 0301
abuse-mailbox: abuse@idealhosting.net.tr
admin-c: trl-ripe
admin-c: ihac2-ripe
abuse-c: ihac2-ripe
tech-c: fy203-ripe
mnt-ref: idealhosting-mnt
mnt-by: idealhosting-mnt
source: RIPE # Filtered

role: iDeal Hosting Administrative Contact Role
remarks: iDeal Hosting Sunucu Int. Hizm. Tic. Ltd. Sti.
address: Nish Istanbul D Blok No:84
address: 34196 Bahcelievler, Istanbul - TR
phone: +90 (212) 706 0300
fax-no: +90 (212) 706 0301
abuse-mailbox: abuse@idealhosting.net.tr
admin-c: to1680-ripe
tech-c: fy203-ripe
nic-hdl: IHAC2-RIPE
mnt-by: idealhosting-mnt
org: org-ihsi1-ripe
source: RIPE # Filtered

route: 213.238.168.0/21
descr: iDeal Hosting Tic. Ltd. Sti.
origin: AS60897
mnt-by: IHLASNET-MNTNER
mnt-routes: IHLASNET-MNTNER
source: RIPE # Filtered


AS was notified, but not surprisingly, there's been no response. In the case of the latest, the paths are;

hxxp://powerpak445.livejournal.com/
-> hxxp://productreviewsblog.org/blog/go/universal-power-pak-445/
--> hxxp://www.amazon.com/gp/product/B003UO1DLS?ie=UTF8&tag=begiyoga-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=B003UO1DLS

The previous 2;

hxxp://hitachic8fb2.page.tl
-> hxxp://productreviewsblog.org/blog/go/hitachi-c8fb2
--> hxxp://www.amazon.com/gp/product/B0000223L2?ie=UTF8&tag=begiyoga-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=B0000223L2

hxxp://husqvarna450.livejournal.com
-> hxxp://productreviewsblog.org/blog/go/husqvarna-450
--> hxxp://www.amazon.com/gp/product/B001DO1OMK?ie=UTF8&tag=begiyoga-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=B001DO1OMK

2 comments:

sherrers said...

You talk about spam...your abuse robot is constantly sending me spam. It is constantly filling in the forms on my website and leaving gibberish. Why?

MysteryFCM said...

1. I don't have an abuse robot

2. The system I do have that sends notices to a few ASNs and hosts (with their permission FYI) does not send via forms - it sends directly to their preferred abuse address

3. I've no idea who you are and thus, no idea what website you're talking about (your profile lists a site I've never heard about, isn't a host/ASN or registrar and thus, not a site I would ever contact)