Sheck Media - spammers and Usenet harvesters! Update: 2-Mar-2004: They still spam, but using new domain names, too. Update: 19-May-2004: SheckMedia still blasts people with dozens of spams a day! sheck-buy.com, sheckmedia.com, real-coupons.com, carefulchristianconsumer.com, fyi-consumer.com, consumer-based.com, swell-buy.com, 4epurchase.com, go2ebuy.com, divineaccessories.net, [64.70.43.0 - 64.70.43.255], [66.98.138.0 - 66.98.138.255], [216.39.69.224 - 216.39.69.239]:Access denied! === Spam example === === === From: David Ramalho Newsgroups: news.admin.net-abuse.sightings Subject: [email][Fwd: ADV: Debt Consolidation with a Christian Perspective] Followup-To: news.admin.net-abuse.email Date: Sat, 10 Jan 2004 13:45:18 +0000 (UTC) Organization: VeriMod () Lines: 83 Approved: nanas-sub@cybernothing.org Message-ID: <56c3676b.0401100545.76f34764@posting.google.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: victor.killfile.org 1073742318 22226 216.43.25.138 (10 Jan 2004 13:45:18 GMT) X-Complaints-To: usenet@killfile.org X-Spam-Level: Level *********** X-Spamscanner: mailbox7.ucsd.edu (v1.4 Oct 30 2003 22:20:52, 11.1/5.0 2.60) X-Spam-Flag: Spam YES X-Mailscanner: PASSED (v1.2.8 97223 i0ADjCjE002908 mailbox7.ucsd.edu) Processed-By: Bob the NANAS ModBot X-Auth: PGPMoose V1.1 PGP news.admin.net-abuse.sightings iD8DBQFAAAHuv1i8LqUfqQURAlZmAJ9qNsekfi0PTuBcmtopuJej/XQ3RQCcD8lI o1+55+HvZ9tH8JfycG+KO84= =uFtt X-Group-Homepage: http://www.killfile.org/~tskirvin/nana/ X-Mail-Path: mailbox7.ucsd.edu!proxy.google.com!10.8.0.80[UNTRUSTED]!news@google.com X-Modbot: Bob the NANAS ModBot X-No-Confirm: yes X-Organization: http://groups.google.com X-Original-Date: Sat, 10 Jan 2004 05:45:11 -0800 X-Original-NNTP-Posting-Date: Sat, 10 Jan 2004 13:45:12 +0000 (UTC) X-Original-NNTP-Posting-Host: 24.101.71.73 X-Original-Path: not-for-mail X-Original-To: news-admin-net-abuse-sightings@moderators.isc.org X-Poster-Complaints-To: groups-abuse@google.com X-Poster-Trace: posting.google.com 1073742312 17910 127.0.0.1 (10 Jan 2004 13:45:12 GMT) X-Submissions-To: nanas-sub@cybernothing.org Sending IP: 64.70.43.6 = mx6.sheck-buy.com class-name: network auth-area: 0.0.0.0/0 network-name: 64.70.43.0 ip-network: 64.70.43.0/24 organization: Sheck Media, Inc. name: Chuck Sheckells email: chuck@sheckmedia.com street: 1736 E. Charleston Blvd. PMB 112 city: LAS VEGAS state: NV postal-code: 89104 country-code: USA advertised site: www.christian-finance.com = 198.41.3.45 198.41.3.45 = wx.dnsmanaged.com -------- Original Message -------- From: - Sat Jan 10 08:26:04 2004 X-UIDL: <1073725712.9400@mx6.sheck-buy.com> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Received: from mx6.sheck-buy.com ([64.70.43.6]) by fep02-mail.bloor.is.net.cable.rogers.com (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with SMTP id <20040110090600.KLWH388176.fep02-mail.bloor.is. net.cable.rogers.com@mx6.sheck-buy.com> for ; Sat, 10 Jan 2004 04:06:00 -0500 To: earthscibbs@rogers.com Date: Sat, 10 Jan 2004 01:08:32 -0800 Message-ID: <1073725712.9400@mx6.sheck-buy.com> From: Sheck-Buy Reply-To: Sheck-Buy Subject: ADV: Debt Consolidation with a Christian Perspective Content-Type: text/html MIME-Version: 1.0 _ Click Here to Unsubscribe from Sheck-Buy.com we want to ensure that your online shopping experience is great. If you are dissatisfied with our service please unsubscribe from our Database. You may do so by the link above, direct mail, phone, replying to this message or by email. If you have questions about any offer, or if you are having trouble purchasing/ or signing up for any offer then just call this 1-800 number, 1-877-571-1552. Have a great day from all of us here at Sheck-Buy.com! To unsubscribe via *Direct Mail*: Unsub. Dep. of Sheck-Buy 4089 Spring Mountain Rd. Las Vegas, NV 89103 To unsubscribe via *Phone #*: 1-877-576-6257 To unsubscribe via *e-mail:* unsubscribe@sheck-buy.com ebaftxkrl rnegufpvoof^ebtref(pbz caroanhti Advertisement for CDM 4770 N.W. Boca Raton Blvd. Suite B Boca Raton, FL. 33431 -- All postings to news.admin.net-abuse.sightings are unconfirmed and unverified unless stated otherwise by the moderators. All opinions expressed above are considered the opinions of the original poster, not the moderators or their respective employers. For a copy of the guidelines to this group, see: === More data on the spammers === === === From: David Ramalho User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031208 X-Accept-Language: en, zh-cn MIME-Version: 1.0 Newsgroups: news.admin.net-abuse.email Subject: sheckmedia.com / BUDGET LOANS Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Lines: 489 Message-ID: <2mVLb.64643$AJB.3464@news04.bloor.is.net.cable.rogers.com> Date: Sat, 10 Jan 2004 16:02:06 GMT NNTP-Posting-Host: 24.101.71.73 X-Complaints-To: abuse@rogers.com X-Trace: news04.bloor.is.net.cable.rogers.com 1073750526 24.101.71.73 (Sat, 10 Jan 2004 11:02:06 EST) NNTP-Posting-Date: Sat, 10 Jan 2004 11:02:06 EST Good morning Looks like we now have a so-called legal spammer. Unfortunately, what he is doing is illegal in Australia, Canada and the EU countries. The contact addresses track back to two loan companies. ======================== class-name: network auth-area: 0.0.0.0/0 network-name: 64.70.43.0 ip-network: 64.70.43.0/24 organization: Sheck Media, Inc. name: Chuck Sheckells email: chuck@sheckmedia.com street: 1736 E. Charleston Blvd. PMB 112 city: LAS VEGAS state: NV postal-code: 89104 country-code: USA advertised site: www.christian-finance.com = 198.41.3.45 198.41.3.45 = wx.dnsmanaged.com To unsubscribe via *Direct Mail*: Unsub. Dep. of Sheck-Buy 4089 Spring Mountain Rd. Las Vegas, NV 89103 To unsubscribe via *Phone #*: 1-877-576-6257 To unsubscribe via *e-mail:* unsubscribe@sheck-buy.com Advertisement for CDM 4770 N.W. Boca Raton Blvd. Suite B Boca Raton, FL. 33431 ========================= Whois: sheckmedia.com = 66.98.138.15 Registrant: Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447, Herndon, VA. 20172-0447 Administrative Contact: Sheckells, Charles by9b37qq62f@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447, Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025, US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 10-Jan-2004 08:54:29 EST. Domain servers in listed order: NS69.WORLDNIC.COM 216.168.225.209 NS70.WORLDNIC.COM 216.168.225.210 ====================== Whois: sheck-buy.com = 66.98.138.15 Registrant: Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447, Herndon, VA. 20172-0447 Administrative Contact: Sheckells, Charles by9b37qq62f@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447, Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025, US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 10-Jan-2004 08:57:11 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 ===================== Nevada Secretary of State - Corporate Information Name: SHECK MEDIA, INC. Type: Corporation File Number: C30159-2003 State: NEVADA Incorporated On: December 05, 2003 <--- Please note Status: Articles Filed <--- Please note Corp Type: Regular Resident Agent: ALLF & SZOSTEK (Accepted) Address: 302 EAST CARSON, SUITE 918 LAS VEGAS, NV 89101- ===================== Testing e-mail addy: chuck@sheckmedia.com Validation results - Success canonical address: MX records preference exchange IP address (if included) 10 inbound.sheckmedia.com.verisignmail.net [0.0.0.0] SMTP session [Contacting inbound.sheckmedia.com.verisignmail.net [216.168.230.166]...] [Connected] 220 imr2.verisignmail.com ESMTP -------------------- Testing e-mail addy: unsubscribe@sheck-buy.com Validation results - Timed out canonical address: MX records preference exchange IP address (if included) 10 mx3.sheck-buy.com [64.70.43.3] SMTP session [Contacting mx3.sheck-buy.com [64.70.43.3]...] [Timed out] Tisk, tisk. His unsubscribed is not working. ================== Now going back to his Unsubscribe mailing address Unsub. Dep. of Sheck-Buy 4089 Spring Mountain Rd. Las Vegas, NV 89103 - It looks like a shopping mall to me. The Center at Spring Mountain 3811-4089 Spring Mountain Road http://www.harsch.com/southern_nevada/industrial/springmt1.htm Located in Chinatown on the south side of Spring Mountain Road between Valley View Boulevard and Wynn Road, the Asian-themed Center has spaces ranging from 800 SF to 6,000 SF to accommodate retail, showroom, storage, warehousing, light distribution and manufacturing uses. also http://www.centeratspringmountain.com/ Retail / Office Business Directory Listing Budget Loans Loan Company 4089 Spring Mountain Las Vegas NV, 89102 Phone: (702) 307-0688 702-338-0834 Reference: http://www.centeratspringmountain.com/yellowPages.asp ================== Searching on Ph: 702-307-0688 Budgets Loans Inc (702) 307-0688 71 N Pecos Rd, Las Vegas, NV 89101 ================== installment loan - State of Nevada BUDGET LOANS #1 71 N PECOS RD #110 LAS VEGAS NV 89101 NOEL SHECKELLS /MGR <--- Hello 702-307-0688 CUR-LIC-NO: 02003 DATE-ORIG-LIC: 02/11/00 BUDGET LOANS #2 2040 E CRAIG ROAD, SUITE 104 N LAS VEGAS NV 89031 MYRNA TRUEBLOOD, MGR 702-399-1707 CUR-LIC-NO: 02004 DATE-ORIG-LIC: 06/05/01 BUDGET LOANS #3 4089 SPRING MOUNTAIN ROAD LAS VEGAS NV 89102 PAULA MENESES, MGR* 702-368-0600 CUR-LIC-NO: 02129 DATE-ORIG-LIC: 08/08/01 Reference: http://fid.state.nv.us/installment%20loan_1.html INSTALLMENT LOAN - as of December 3, 2003 http://fid.state.nv.us/installment%20loan.htm - Total of ten locations ========================== Clark County Clerk Fictitious Firm Search FILE #: 0249629 BUSINESS NAME: BUDGET LOANS CURRENT BUSINESS STATUS: ACTIVE EXPIRE/ TERMINATE DATE: 01-31-2005 BUSINESS ADDRESS: 71 N PECOS RD STE 110 LAS VEGAS NV 89101 INDIVIDUAL/CORP NAME: NCS, INC. CURRENT OWNER STATUS: ACTIVE =========================== Clark County Clerk Fictitious Firm Search FILE #: 0226120 BUSINESS NAME: ENERGY GROUP CURRENT BUSINESS STATUS: EXPIRED EXPIRE/ TERMINATE DATE: 05-31-2003 BUSINESS ADDRESS: INDIVIDUAL/CORP NAME: SHECKELLS, NOEL CURRENT OWNER STATUS: ACTIVE FILE #: 0155205 BUSINESS NAME: SUN CITY ELECTRONICS CURRENT BUSINESS STATUS: EXPIRED EXPIRE/ TERMINATE DATE: 12-31-2002 BUSINESS ADDRESS: 4410 N RANCHO DR LAS VEGAS NV 89130 INDIVIDUAL/CORP NAME: SHECKELLS, NOEL CURRENT OWNER STATUS: ACTIVE =========================== Nevada Secretary of State - Corporate Information Name: NCS, INC. Type: Corporation File Number: C25754-1999 State: NEVADA Incorporated On: October 18, 1999 Status: Current list of officers on file Corp Type: Regular Resident Agent: NANCY L. ALLF (Accepted) Address: 302 E. CARSON AVE LAS VEGAS, NV 89101- President: NOEL SHECKELLS (also Secretary & Treasurer) Address: 302 E CARSON AVE #918 LAS VEGAS, NV 89101- ===================== Nevada Secretary of State - Corporate Information Name: HOME THEATER, INC. Type: Corporation File Number: C11719-1992 State: NEVADA Incorporated On: October 27, 1992 Status: Default Corp Type: Regular Resident Agent: ALLF & ASSOCIATES (Accepted) Address: 302 E CARSON #918 LAS VEGAS, NV 89101- President: NOEL SHECKELLS (also Secretary & Treasurer) Address: 71 N PECOS ROAD, SUITE 111 LAS VEGAS, NV 89101- ======================= Nevada Secretary of State - Corporate Information Name: NRG GROUP, INC. Type: Corporation File Number: C12596-1998 State: NEVADA Incorporated On: May 29, 1998 Status: Revoked Corp Type: Regular Resident Agent: NITZ, WALTON & HEATON (Accepted) Address: 601 S TENTH ST LAS VEGAS, NV 89101- President: GIB GANSCHOW (also Secretary) Address: 4396 SPOONER LAKE CIR LAS VEGAS, NV 89147- Treasurer: NOEL SHECKELLS Address: 5309 CAMINO DEL RANCHO LAS VEGAS, NV 89130- ==================== Now going back to the Florida Contact: Advertisement for CDM 4770 N.W. Boca Raton Blvd. Suite B Boca Raton, FL. 33431 Toll Free: 1- 800-513-9442 Fax: 1- 561-997-1695 E-mail: consult@debt-relief.ws US Mail: Debt Relief, Inc. 4770 N.W. Boca Raton, Suite B Boca Raton, FL 33431 Reference: http://www.debt-relief.ws/contact.htm Whois: DEBT-RELIEF.WS = 209.108.162.46 Registrant: Dennis McDevitt Domain created on 29-AUG-02 Domain last updated on 29-AUG-02 Name servers: dns2.atlantis-intl.com 216.132.19.130 ns1.atlantis-intl.com 209.108.162.24 ========================== Whois: 209.108.162.46 OrgName: Atlantis International OrgID: ATLANT-10 Address: 17595 Harvard Ave., Suite C538 City: Irvine StateProv: CA PostalCode: 92714-8546 Country: US NetRange: 209.108.162.0 - 209.108.162.255 CIDR: 209.108.162.0/24 NetName: NETCOM-BLK4-CUST025 NetHandle: NET-209-108-162-0-1 Parent: NET-209-108-160-0-1 NetType: Reassigned Comment: RegDate: 1998-01-13 Updated: 1998-01-13 TechHandle: LN61-ARIN TechName: Novelli, Leo A TechPhone: +1- 714-901-0016 TechEmail: lnovelli@atlantis-intl.com OrgTechHandle: LN61-ARIN OrgTechName: Novelli, Leo A OrgTechPhone: +1-714-901-0016 OrgTechEmail: lnovelli@atlantis-intl.com # ARIN WHOIS database, last updated 2004-01-09 19:15 ========================== InterMark Media Takes Action on Delinquent Debt Agencies. PR Newswire, August 20, 2002 SYOSSET, N.Y. -- InterMark Media is fighting back against delinquent debt consolidation agencies BMV Debt Consolidation and Debt Relievers, Inc. InterMark Media, the nation's top lead generation service to the debt consolidation industry, has filed a lawsuit against the companies in the Civil Division, Palm Beach County, Florida, for non-payment of services rendered. "It's agencies like these that give the debt consolidation industry a bad name," says InterMark CEO Mike Krongel, citing that the industry has seen rough times in the recent past mainly due to a misunderstanding of the industry itself and due to agencies that have questionable reputations. "We'd like to ensure that these companies wouldn't be able to take advantage of any other business or consumer." BMV Debt Consolidation has incurred charges from InterMark's services dating back to May of this year and Debt Relievers' charges date back to April. Despite notices and legal involvement, both companies have yet to pay for the services they were provided. BMV Debt Consolidation is located at 23123 State Road 7, Suite 310 Boca Raton, Florida 33428. Also, Debt Relievers, Inc. is located at 4770 N.W. Boca Raton Blvd., Suite B, Boca Raton, Florida 33431. Reference: http://www.findarticles.com/cf_dls/m4PRN/2002_August_20/90830384/p1/article.jhtml Consumer complaints about Debt Relievers, Inc.: Debt Relievers, Inc. 4770 NW Boca Raton Blvd. Suite B Boca Raton, FL http://www.consumeraffairs.com/debt_counsel/debt_relievers.html =========================== Florida Division of Corporations DEBT RELIEVERS, INC. - Florida Profit Principal and Mailing Address 4770 NW BOCA RATON BLVD STE B BOCA RATON FL 33431 Document Number: P01000065396 FEI Number: 651118630 Date Filed: 06/28/2001 State: FL Status: ACTIVE Registered Agent: MCDEVITT, DENNIS 4770 NW BOCA RATON BLVD STE B BOCA RATON FL 33431 Officer/Director Detail MCDEVITT, DENNIS (DPST - title) 4770 NW BOCA RATON BLVD STE B BOCA RATON FL 33431 ========================= Spammed website: Whois: christian-finance.com = 198.41.3.45 Registrant: Debt Relievers, Inc. (DLNPWDNCED) 4770 N.W. Boca Raton Blvd. Suite B Boca Raton, FL 33431, US Administrative Contact: McDevitt, Dennis (34980906I) info@christiandebt.net 4742 NW Boca Raton Blvd Boca Raton, FL 33431, US 954-296-6822 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive, Herndon, VA 20171-3025, US 1-888-642-9675 fax: 571-434-4620 Record expires on 23-Aug-2004. Record created on 23-Aug-2003. Database last updated on 10-Jan-2004 10:54:35 EST. Domain servers in listed order: NS1.DNSMANAGED.COM 192.5.6.34 NS4.DNSMANAGED.COM 192.31.80.34 NS6.DNSMANAGED.COM 192.35.51.34 NS7.DNSMANAGED.COM 192.42.93.34 =========================== Whois: christiandebt.net = 0.0.0.0 Registrant: Debt Relievers, Inc. (GJMXNSANND) 4770 N.W. Boca Raton Blvd. Suite B Boca Raton, FL 33431, US Administrative Contact: McDevitt, Dennis (34980906I) info@christiandebt.net 4742 NW Boca Raton Blvd., Boca Raton, FL 33431, US 954-296-6822 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive, Herndon, VA 20171-3025, US 1-888-642-9675 fax: 571-434-4620 Record expires on 10-Sep-2004. Record created on 10-Sep-2003. Database last updated on 10-Jan-2004 10:58:03 EST. Domain servers in listed order: NS1.DNSMANAGED.COM 192.5.6.34 NS4.DNSMANAGED.COM 192.31.80.34 NS6.DNSMANAGED.COM 192.35.51.34 NS7.DNSMANAGED.COM 192.42.93.34 === My complaint === From: Admin Reply-To: abuse-Jan@2004.dolphinwave.org Organization: Private person To: , uce@ftc.gov, nanas@killfile.org, abuse@ev1.net, spamcomplaints@cw.net, abuse@cw.net, abuse@exodus.net, postmaster@networksolutions.com, postmaster@worldnic.com, privacy@networksolutions.com, abuse@networksolutions.com Subject: [email] Persistent spamming attempts (Usenet harvest: sheck-buy.com/sheckmedia.com)! Date: Thu, 15 Jan 2004 00:41:58 +0200 User-Agent: KMail/1.5 X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200401150041.58911@2003.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: My mailserver logs persistent spamming attempts from several sheck-buy.com mailservers, targeting my various e-mail addresses, used on the Usenet in the last years (usenet-nov2001@..., usenet-dec2001@..., nanae@...)! Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Refusing to deal with your abusers will lead your whole IP range to be blocked from accessing of my mailservers ever again, and this info will be shared with other admins and public blocklists! sheck-buy.com [66.98.138.15] ============= Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECK-BUY.COM Administrative Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 14-Jan-2004 17:31:00 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 Everyones Internet IP block [66.98.128.0 - 66.98.239.255] Upstream: Everyones Internet (ivhou-207-218-245-46.ev1.net). Nameservers: cw.net. sheckmedia.com [66.98.138.15] ============== Registrant: Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECKMEDIA.COM Administrative Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 14-Jan-2004 17:41:07 EST. Domain servers in listed order: NS69.WORLDNIC.COM 216.168.225.209 NS70.WORLDNIC.COM 216.168.225.210 Everyones Internet IP block [66.98.128.0 - 66.98.239.255] Upstream: Everyones Internet (ivhou-207-218-245-46.ev1.net). Nameservers: NS69.WORLDNIC.com, NS70.WORLDNIC.com. mx5.sheck-buy.com [64.70.43.5] ================= Sheck Media IP block [64.70.43.0/24] <== SPAMMERS which is in the Exodus IP range [64.70.0.0/18]. Upstream: Cable & Wireless (csr1-ve242.Elsegundola1.cw.net). Nameservers: cw.net. ======= Sendmail logs (GMT+0200) ======= Jan 9 09:34:28 orca sendmail[11771]: i097YPxa011771: ruleset=check_rcpt, arg1=, relay=mx4.sheck-buy.com [64.70.43.4], reject=553 5.3.0 ... E-mail from 64.70.43.4 refused using the SPEWS list - see Jan 9 09:34:28 orca sendmail[11771]: i097YPxa011771: lost input channel from mx4.sheck-buy.com [64.70.43.4] to MTA after rcpt -- Jan 9 10:13:21 orca sendmail[12162]: i098DHxa012162: ruleset=check_rcpt, arg1=, relay=mx6.sheck-buy.com [64.70.43.6], reject=553 5.3.0 ... E-mail from 64.70.43.6 refused using the SPEWS list - see Jan 9 10:13:21 orca sendmail[12162]: i098DHxa012162: lost input channel from mx6.sheck-buy.com [64.70.43.6] to MTA after rcpt -- Jan 9 10:20:41 orca sendmail[12288]: i098Kdxa012288: ruleset=check_rcpt, arg1=, relay=mx6.sheck-buy.com [64.70.43.6], reject=553 5.3.0 ... E-mail from 64.70.43.6 refused using the SPEWS list - see Jan 9 10:20:43 orca sendmail[12288]: i098Kdxa012288: lost input channel from mx6.sheck-buy.com [64.70.43.6] to MTA after rcpt -- Jan 9 11:13:20 orca sendmail[12923]: i099DGxa012923: ruleset=check_rcpt, arg1=, relay=mx9.sheck-buy.com [64.70.43.9], reject=553 5.3.0 ... E-mail from 64.70.43.9 refused using the SPEWS list - see Jan 9 11:13:21 orca sendmail[12923]: i099DGxa012923: lost input channel from mx9.sheck-buy.com [64.70.43.9] to MTA after rcpt -- Jan 9 12:31:28 orca sendmail[14056]: i09AVOxa014056: ruleset=check_rcpt, arg1=, relay=mx9.sheck-buy.com [64.70.43.9], reject=553 5.3.0 ... E-mail from 64.70.43.9 refused using the SPEWS list - see Jan 9 12:31:28 orca sendmail[14056]: i09AVOxa014056: lost input channel from mx9.sheck-buy.com [64.70.43.9] to MTA after rcpt -- Jan 9 16:40:49 orca sendmail[16969]: i09Eehxa016969: ruleset=check_rcpt, arg1=, relay=mx4.sheck-buy.com [64.70.43.4], reject=553 5.3.0 ... E-mail from 64.70.43.4 refused using the SPEWS list - see Jan 9 16:40:51 orca sendmail[16969]: i09Eehxa016969: lost input channel from mx4.sheck-buy.com [64.70.43.4] to MTA after rcpt -- -- Jan 11 02:44:42 orca sendmail[27029]: i0B0iRxa027029: ruleset=check_rcpt, arg1=, relay=mx9.sheck-buy.com [64.70.43.9], reject=553 5.3.0 ... E-mail from 64.70.43.9 refused using the Spamhaus Block List - see Jan 11 02:44:44 orca sendmail[27029]: i0B0iRxa027029: lost input channel from mx9.sheck-buy.com [64.70.43.9] to MTA after rcpt -- -- Jan 11 07:59:51 orca sendmail[30074]: i0B5xnxa030074: ruleset=check_rcpt, arg1=, relay=mx8.sheck-buy.com [64.70.43.8], reject=553 5.3.0 ... E-mail from 64.70.43.8 refused using the Spamhaus Block List - see Jan 11 07:59:51 orca sendmail[30074]: i0B5xnxa030074: lost input channel from mx8.sheck-buy.com [64.70.43.8] to MTA after rcpt -- -- Jan 13 14:09:15 orca sendmail[10347]: i0DC9AVB010347: ruleset=check_rcpt, arg1=, relay=mx3.sheck-buy.com [64.70.43.3], reject=553 5.3.0 ... E-mail from 64.70.43.3 refused using the Spamhaus Block List - see Jan 13 14:09:15 orca sendmail[10347]: i0DC9AVB010347: lost input channel from mx3.sheck-buy.com [64.70.43.3] to MTA after rcpt -- -- Jan 14 02:36:39 orca sendmail[21178]: i0E0aYVB021178: ruleset=check_rcpt, arg1=, relay=mx5.sheck-buy.com [64.70.43.5], reject=553 5.3.0 ... E-mail from 64.70.43.5 refused using the Spamhaus Block List - see Jan 14 02:36:40 orca sendmail[21178]: i0E0aYVB021178: lost input channel from mx5.sheck-buy.com [64.70.43.5] to MTA after rcpt -- -- Jan 14 04:46:14 orca sendmail[22938]: i0E2kBVB022938: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=553 5.3.0 ... E-mail from 64.70.43.10 refused using the Spamhaus Block List - see Jan 14 04:46:15 orca sendmail[22938]: i0E2kBVB022938: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt -- -- Jan 14 19:22:48 orca sendmail[1861]: i0EHMhVB001861: ruleset=check_rcpt, arg1=, relay=mx3.sheck-buy.com [64.70.43.3], reject=553 5.3.0 ... E-mail from 64.70.43.3 refused using the Spamhaus Block List - see Jan 14 19:22:48 orca sendmail[1861]: i0EHMhVB001861: lost input channel from mx3.sheck-buy.com [64.70.43.3] to MTA after rcpt -- === Another day, and yet more of the spamming attempts. My another complaint === From: Admin Reply-To: abuse-Jan@2004.dolphinwave.org Organization: Private person To: , uce@ftc.gov, nanas@killfile.org, abuse@ev1.net, admin@ev1.net, spamcomplaints@cw.net, abuse@cw.net, abuse@exodus.net, postmaster@networksolutions.com, postmaster@worldnic.com, privacy@networksolutions.com, abuse@networksolutions.com Subject: [email] More of the persistent spamming attempts (Usenet harvest: sheck-buy.com/sheckmedia.com)! Date: Thu, 15 Jan 2004 23:53:05 +0200 User-Agent: KMail/1.5 X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200401152353.05406@2003.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: The spamming attempts by these Sheck Media abusers continue, multiple times a day! Still targeting my various e-mail addresses, used on the Usenet in the last years (usenet-nov2001@..., usenet-dec2001@..., nanae@...)! My previous complaint is archived on Google Groups: http://groups.google.com/groups?selm=200401150041.58911%402003.dolphinwave.org Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Refusing to deal with your abusers will lead your whole IP range to be blocked from accessing of my mailservers ever again, and this info will be shared with other admins and public blocklists! Everyones Internet! Maybe, before trying to remove yourself from SPEWS you should start to read complaints and ACT on them, while yet another your IP range wasn't listed in there? sheck-buy.com [66.98.138.15] ============= Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECK-BUY.COM Administrative Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 14-Jan-2004 17:31:00 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 Everyones Internet IP block [66.98.128.0 - 66.98.239.255] Upstream: Everyones Internet (ivhou-207-218-245-46.ev1.net). Nameservers: cw.net. sheckmedia.com [66.98.138.15] ============== Registrant: Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECKMEDIA.COM Administrative Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 14-Jan-2004 17:41:07 EST. Domain servers in listed order: NS69.WORLDNIC.COM 216.168.225.209 NS70.WORLDNIC.COM 216.168.225.210 Everyones Internet IP block [66.98.128.0 - 66.98.239.255] Upstream: Everyones Internet (ivhou-207-218-245-46.ev1.net). Nameservers: NS69.WORLDNIC.com, NS70.WORLDNIC.com. mx5.sheck-buy.com [64.70.43.5] ================= Sheck Media IP block [64.70.43.0/24] <== SPAMMERS which is in the Exodus IP range [64.70.0.0/18]. Upstream: Cable & Wireless (csr1-ve242.Elsegundola1.cw.net). Nameservers: cw.net. ======= Last Sendmail logs (GMT+0300) ======= Jan 15 02:42:10 orca sendmail[8972]: i0F0g9VB008972: ruleset=check_rcpt, arg1=, relay=mx8.sheck-buy.com [64.70.43.8], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 15 02:42:11 orca sendmail[8972]: i0F0g9VB008972: lost input channel from mx8.sheck-buy.com [64.70.43.8] to MTA after rcpt -- Jan 15 04:35:36 orca sendmail[21879]: i0F2ZXVB021879: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 15 04:35:37 orca sendmail[21879]: i0F2ZXVB021879: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt -- -- Jan 15 19:38:29 orca sendmail[11164]: i0FHcQVB011164: ruleset=check_rcpt, arg1=, relay=mx7.sheck-buy.com [64.70.43.7], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 15 19:38:31 orca sendmail[11164]: i0FHcQVB011164: lost input channel from mx7.sheck-buy.com [64.70.43.7] to MTA after rcpt -- Jan 15 21:05:18 orca sendmail[12973]: i0FJ5CVB012973: ruleset=check_rcpt, arg1=, relay=mx7.sheck-buy.com [64.70.43.7], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 15 21:05:19 orca sendmail[12973]: i0FJ5CVB012973: lost input channel from mx7.sheck-buy.com [64.70.43.7] to MTA after rcpt ======= PREVIOUS SPAMMING ATTEMPTS ======= === Everyones Internet has pulled the plug on them === === === Newsgroups: news.admin.net-abuse.blocklisting From: "Ev1-Chrisn" Subject: Re: [SPEWS] S373 Approved: NANAB Moderators X-Complaints-To: abuse@supernews.com User-Agent: Xnews/5.04.25 Sender: nanab@zorch.sf-bay.org (Charlie Root) Organization: Everyones Internet Message-ID: References: Date: Fri, 16 Jan 2004 14:14:12 GMT X-Robomod: STUMP, ichudov@algebra.com (Igor Chudov), C++/Perl/Unix Consulting Lines: 123 Dolphin wrote in news:slrnc0e69n.eqd.usenet-Jan+nanae@orca.dolphinwave.org: > If you was really terminating the spammers when it was first brought > to your attention, you wouldn't be ending up in SPEWS so widely. And > people wouldn't need to report your spammers to you more than once. > sheck-buy.com has been terminated by our customer, however being our customer does not control dns for sheck-buy.com, neither he nor us can prevent the dns from resolving to our network. When I resolve sheck- buy.com from both on and off our network I get: Test Page for the SSL/TLS-aware Apache Installation on Web Site

Hey, it worked !
The SSL/TLS-aware Apache webserver was
successfully installed on this website.

If you can see this page, then the people who own this website have just installed the Apache Web server software and the Apache Interface to OpenSSL (mod_ssl) successfully. They now have to add content to this directory and replace this placeholder page, or else point the server at their real content.

ATTENTION!
If you are seeing this page instead of the site you expected, please contact the administrator of the site involved. (Try sending mail to <webmaster@domain>.) Although this site is running the Apache software it almost certainly has no other connection to the Apache Group, so please do not send mail about this site or its contents to the Apache authors. If you do, your message will be ignored.

The Apache online documentation has been included with this distribution.
Especially also read the mod_ssl User Manual carefully.

Your are allowed to use the images below on your SSL-aware Apache Web server.
Thanks for using Apache, mod_ssl and OpenSSL!

Apache Webserver   mod_ssl Interface   OpenSSL Toolkit
-- Regards Chris Abuse Team Everyones Internet ev1servers.net -- Comments posted to news.admin.net-abuse.blocklisting are solely the responsibility of their author. Please read the news.admin.net-abuse.blocklisting FAQ at http://www.blocklisting.com/faq.html before posting. === And spamming attempts from Sheck Media continue === From: Admin Reply-To: abuse-Jan@2004.dolphinwave.org Organization: Private person To: , uce@ftc.gov, nanas@killfile.org, spamcomplaints@cw.net, abuse@cw.net, dns@CW.NET, abuse@exodus.net Subject: [email] Sheck Media (sheck-buy.com/sheckmedia.com) spamming attempts continue! Date: Sat, 17 Jan 2004 19:01:55 +0200 User-Agent: KMail/1.5 X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200401171901.55155@2003.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: The spamming attempts by these Sheck Media abusers continue, multiple times a day! Still targeting my various e-mail addresses, used on the Usenet in the last years (usenet-nov2001@..., usenet-dec2001@..., nanae@...)! Their web pages were terminated by Everyones Internet, but the mailservers are still being hosted by Exodus / Cable and Wireless, despite on the numerous complaints were sent there since January 9th, that were ignored by them! My previous complaints are archived on Google Groups: http://groups.google.com/groups?selm=200401150041.58911%402003.dolphinwave.org http://groups.google.com/groups?selm=200401152353.05406%402003.dolphinwave.org Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Refusing to deal with your abusers will lead your whole IP range to be blocked from accessing of my mailservers ever again, and this info will be shared with other admins and public blocklists! mx9.sheck-buy.com [64.70.43.9] ================= Registrant: Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECK-BUY.COM Administrative Contact, Technical Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 17-Jan-2004 11:57:05 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 Sheck Media IP block [64.70.43.0/24] <== SPAMMERS which is in the Exodus IP range [64.70.0.0/18]. Upstream: Cable & Wireless (csr1-ve242.Elsegundola1.cw.net). Nameservers: cw.net. sheckmedia.com [taken over by Verisign/Network Solutions] ============== Registrant: Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECKMEDIA.COM Administrative Contact, Technical Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECKMEDIA.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 17-Jan-2004 11:58:39 EST. Domain servers in listed order: NS69.WORLDNIC.COM 216.168.225.209 NS70.WORLDNIC.COM 216.168.225.210 $ jwhois 64.70.43.9 =================== [Querying whois.arin.net] [Redirected to rwhois.exodus.net:4321] [Querying rwhois.exodus.net] [rwhois.exodus.net] network:Class-Name:network network:Auth-Area:0.0.0.0/0 network:Network-Name:64.70.43.0 network:IP-Network:64.70.43.0/24 network:Organization;I:Sheck Media, Inc. network:Name;I:Chuck Sheckells network:Email;I:chuck@sheckmedia.com network:Street;I:1736 E. Charleston Blvd. PMB 112 network:City;I:LAS VEGAS network:State;I:NV network:Postal-Code;I:89104 network:Country-Code;I:USA ======= Last Sendmail logs (GMT+0200) ======= Jan 16 07:45:49 orca sendmail[27278]: i0G5isVB027278: ruleset=check_rcpt, arg1=, relay=mx9.sheck-buy.com [64.70.43.9], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 16 07:45:52 orca sendmail[27278]: i0G5isVB027278: lost input channel from mx9.sheck-buy.com [64.70.43.9] to MTA after rcpt -- Jan 17 06:24:25 orca sendmail[24615]: i0H4OMVB024615: ruleset=check_rcpt, arg1=, relay=mx8.sheck-buy.com [64.70.43.8], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 17 06:24:26 orca sendmail[24615]: i0H4OMVB024615: lost input channel from mx8.sheck-buy.com [64.70.43.8] to MTA after rcpt -- Jan 17 09:27:36 orca sendmail[27972]: i0H7RWVB027972: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 17 09:27:36 orca sendmail[27972]: i0H7RWVB027972: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt -- Jan 17 09:27:41 orca sendmail[27976]: i0H7RdVB027976: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 17 09:27:42 orca sendmail[27976]: i0H7RdVB027976: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt -- Jan 17 16:42:59 orca sendmail[4092]: i0HEgtVB004092: ruleset=check_rcpt, arg1=, relay=mx4.sheck-buy.com [64.70.43.4], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 17 16:43:00 orca sendmail[4092]: i0HEgtVB004092: lost input channel from mx4.sheck-buy.com [64.70.43.4] to MTA after rcpt ======= PREVIOUS SPAMMING ATTEMPTS ======= === And more of the spamming attempts, and Exodus ignores complaints === From: Admin Reply-To: abuse-Jan@2004.dolphinwave.org Organization: Private person To: , uce@ftc.gov, nanas@killfile.org, spamcomplaints@cw.net, abuse@cw.net, dns@CW.NET, abuse@exodus.net Subject: [email] Sheck Media (sheck-buy.com/sheckmedia.com) spamming attempts continue! Date: Wed, 21 Jan 2004 03:02:28 +0200 User-Agent: KMail/1.5 X-Complaints-To: abuse@dolphinwave.org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200401210302.28326@2003.dolphinwave.org> Status: RO X-Status: S X-KMail-EncryptionState: X-KMail-SignatureState: The spamming attempts by these Sheck Media abusers continue, multiple times a day! Still targeting my various e-mail addresses, used on the Usenet in the last years (usenet-nov2001@..., usenet-dec2001@..., nanae@...)! Their web pages were terminated by Everyones Internet, but the mailservers are still being hosted by Exodus / Cable and Wireless, despite on the numerous complaints were sent there since January 9th, that were ignored by them! My previous complaints are archived on Google Groups: http://groups.google.com/groups?selm=200401150041.58911%402003.dolphinwave.org http://groups.google.com/groups?selm=200401152353.05406%402003.dolphinwave.org Please, terminate the spammer's accounts as soon as possible! Thanks! ======= Refusing to deal with your abusers will lead your whole IP range to be blocked from accessing of my mailservers ever again, and this info will be shared with other admins and public blocklists! mx10.sheck-buy.com [64.70.43.10] ================= Registrant: Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA. 20172-0447 Domain Name: SHECK-BUY.COM Administrative Contact, Technical Contact: Sheckells, Charles zp3xk2su77z@networksolutionsprivateregistration.com Sheck Media, Inc. ATTN: SHECK-BUY.COM c/o Network Solutions P.O. Box 447 Herndon, VA 20172-0447 570-708-8780 Record expires on 02-Jan-2005. Record created on 02-Jan-2004. Database last updated on 17-Jan-2004 11:57:05 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 Sheck Media IP block [64.70.43.0/24] <== SPAMMERS which is in the Exodus IP range [64.70.0.0/18]. Upstream: Cable & Wireless (csr1-ve242.Elsegundola1.cw.net). Nameservers: cw.net. $ jwhois 64.70.43.10 =================== [Querying whois.arin.net] [Redirected to rwhois.exodus.net:4321] [Querying rwhois.exodus.net] [rwhois.exodus.net] network:Class-Name:network network:Auth-Area:0.0.0.0/0 network:Network-Name:64.70.43.0 network:IP-Network:64.70.43.0/24 network:Organization;I:Sheck Media, Inc. network:Name;I:Chuck Sheckells network:Email;I:chuck@sheckmedia.com network:Street;I:1736 E. Charleston Blvd. PMB 112 network:City;I:LAS VEGAS network:State;I:NV network:Postal-Code;I:89104 network:Country-Code;I:USA ======= Last Sendmail logs (GMT+0200) ======= Jan 20 20:50:46 orca sendmail[22813]: i0KIoWVB022813: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 20 20:50:47 orca sendmail[22813]: i0KIoWVB022813: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt -- Jan 20 20:50:54 orca sendmail[22814]: i0KIoVVB022814: ruleset=check_rcpt, arg1=, relay=mx10.sheck-buy.com [64.70.43.10], reject=550 5.0.0 ... Access denied - Sheck Media - spammers and Usenet harvesters - http://www.DolphinWave.org/spam/SheckMedia.txt Jan 20 20:50:56 orca sendmail[22814]: i0KIoVVB022814: lost input channel from mx10.sheck-buy.com [64.70.43.10] to MTA after rcpt ======= PREVIOUS SPAMMING ATTEMPTS ======= === More spams from them, but using new domain names, too === From: howardk@cts.com (Howard Knight) Newsgroups: news.admin.net-abuse.email Subject: Sheck Media (SHECK-BUY.COM) Going Apeshit Date: Tue, 02 Mar 2004 19:26:03 -0000 Organization: Nuke a Spammer for Bob Message-ID: <1049nub1p6itj24@corp.supernews.com> Summary: X-Complaints-To: abuse@supernews.com Lines: 45 Path: uni-berlin.de!fu-berlin.de!feed.ac-versailles.fr!freenix!sn-xit-02 !sn-xit-06!sn-xit-01!sn-post-02!sn-post-01!supernews.com!corp.supernews.com !not-for-mail Xref: uni-berlin.de news.admin.net-abuse.email:2173471 For the last couple of months, I've been getting spam from SHECK-BUY.COM. My complaints to Exodus/CW (the spam whores) have been ignored. On average, I get about two or three of these a day. Now, the parasites are sending me spam from other domains (real-coupons.com, carefulchristianconsumer.com, and fyi-consumer.com). Is there any way to get Exodus' attention? Or, are they aiding and abetting spammers these days? Howard From lines from the last 12 days: From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Sheck-Buy" From: "Online Auction University" From: "Sheck-Buy" From: "NickelTalk" From: "Education Provider" From: "Security For The Home" From: "Point.com" From: "Duplicator" From: "Online Auction University" From: "Smoking Solution" From: "DreamShape" From: "PC Bug Doctor" From: "Christian-DebtManagement.com" From: "Binoc" From: "Duplicator" From: "Online Auction University" From: "BodyShape" From: "Inspiration -- Mel Gibson's" From: "PC Access" From: "Inspiration -- Mel Gibson's" From: "Mel Gibson movie book" From: "PC Bug Doctor" === WHOIS data === $ jwhois real-coupons.com [Querying whois.internic.net] [Redirected to whois.networksolutions.com] [Querying whois.networksolutions.com] [whois.networksolutions.com] <...> Registrant: Sheck Media, Inc. (HTRGJXYNKD) 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US Domain Name: REAL-COUPONS.COM Administrative Contact: Sheckells, Charles (36749900P) chuck@sheckmedia.com Sheck Media, Inc. 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US 702-290-8325 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 23-Feb-2005. Record created on 23-Feb-2004. Database last updated on 2-Mar-2004 16:44:07 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 $ jwhois carefulchristianconsumer.com [Querying whois.internic.net] [Redirected to whois.networksolutions.com] [Querying whois.networksolutions.com] [whois.networksolutions.com] <...> Registrant: Sheck Media, Inc. (FNOOKBUELD) 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US Domain Name: CAREFULCHRISTIANCONSUMER.COM Administrative Contact: Sheckells, Charles (36749900P) chuck@sheckmedia.com Sheck Media, Inc. 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US 702-290-8325 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 23-Feb-2005. Record created on 23-Feb-2004. Database last updated on 2-Mar-2004 16:44:36 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 Registrant: Sheck Media, Inc. (VUYEYOGFSD) 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US Domain Name: FYI-CONSUMER.COM Administrative Contact: Sheckells, Charles (36749900P) chuck@sheckmedia.com Sheck Media, Inc. 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US 702-290-8325 Technical Contact: Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com 13200 Woodland Park Drive Herndon, VA 20171-3025 US 1-888-642-9675 fax: 571-434-4620 Record expires on 16-Feb-2005. Record created on 16-Feb-2004. Database last updated on 2-Mar-2004 16:45:15 EST. Domain servers in listed order: DNS01.CW.NET 209.1.222.244 DNS02.CW.NET 209.1.222.245 === More IPs from Exodus, they still ignore the abuse === $ host fyi-consumer.com fyi-consumer.com has address 216.39.69.234 $ jwhois 216.39.69.234 [Querying whois.arin.net] [Redirected to rwhois.exodus.net:4321] [Querying rwhois.exodus.net] [rwhois.exodus.net] network:Class-Name:network network:Auth-Area:0.0.0.0/0 network:Network-Name:216.39.69.224 network:IP-Network:216.39.69.224/28 network:Organization;I:Sheck Media, Inc. network:Name;I:Chuck Sheckells network:Email;I:chuck@sheckmedia.com network:Street;I:1736 E. Charleston Blvd. PMB 112 network:City;I:LAS VEGAS network:State;I:NV network:Postal-Code;I:89104 network:Country-Code;I:USA network:Class-Name:network network:Auth-Area:0.0.0.0/0 network:Network-Name:216.39.64.0 network:IP-Network:216.39.64.0/19 network:Organization;I:Exodus IDC - DL/DL1 network:Name;I:Exodus IP Address Administrator network:Email;I:ipaddressadmin@exodus.net network:Street;I:14901 FAA Blvd. Building 1 network:City;I:Fort Worth network:State;I:TX network:Postal-Code;I:76155 network:Country-Code;I:USA === But they try to remove themselves from the blocklists === Path: uni-berlin.de!fu-berlin.de!nntp.cs.ubc.ca!torn!canopus.cc.umanitoba.ca !not-for-mail From: Jem Berkes Newsgroups: news.admin.net-abuse.email Subject: sheck-buy.com Date: 23 Apr 2004 02:25:43 GMT Organization: PC9 Lines: 15 Sender: umberkes@wnpgmb01dc6-124-173.dynamic.mts.net Message-ID: NNTP-Posting-Host: wnpgmb01dc6-124-173.dynamic.mts.net X-Trace: canopus.cc.umanitoba.ca 1082687143 7258 142.161.124.173 (23 Apr 2004 02:25:43 GMT) X-Complaints-To: abuse@cc.umanitoba.ca NNTP-Posting-Date: 23 Apr 2004 02:25:43 GMT User-Agent: Xnews/5.04.25 X-Face: "lSxJlq"(eahd21S6n})>8f#lx%H`'&dseeU_;`ss0(92:cYhwE){!n"f:@vqEmUGW2;a[|Ve~UbIIK w[>%3Y8b1~,TDEOFG@xR;Wb5HM"V`%2Rz`Pn5g]$ Xref: uni-berlin.de news.admin.net-abuse.email:2191139 There's no doubt these guys are major spammers. In January and into February I was getting almost a spam a day. So mx?.sheck-buy.com got into my blocklist pretty quickly. But I was curious to observe someone today removing the listing for one of their relays, via the manual removal form I offer. Who would want to delist this spam source? Thought I'd share the info for anyone researching sheck-buy.com or carefulchristianconsumer.com 141.156.112.118 - - [22/Apr/2004:17:06:14 -0500] "GET /cgi-bin/detail.cgi? ip=64.70.43.4 HTTP/1.1" 200 1432 "http://groups.google.com/groups? q=carefulchristianconsumer.com+group:*abuse*&hl=en&lr=&ie=UTF-8&oe=UTF-8 &scoring=d&selm=Xns94A164365C88Djbuserspc9org%40130.179.16.24&rnum=7" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)" 141.156.112.118 - - [22/Apr/2004:17:06:25 -0500] "POST /cgi-bin/remove.cgi HTTP/1.1" 200 58 "http://wpbl.pc9.org/cgi-bin/detail.cgi?ip=64.70.43.4" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)" === Data === $ host 64.70.43.4 4.43.70.64.in-addr.arpa domain name pointer mx4.sheck-buy.com. $ host 141.156.112.118 118.112.156.141.in-addr.arpa domain name pointer dpvc-141-156-112-118.res.east.verizon.net. === SheckMedia still blasts people with dozens of spams a day === Path: uni-berlin.de!fu-berlin.de!border1.nntp.dca.giganews.com !border2.nntp.dca.giganews.com!nntp.giganews.com!elnk-atl-nf1 !newsfeed.earthlink.net!cyclone.tampabay.rr.com!news-post.tampabay.rr.com !twister.southeast.rr.com.POSTED!53ab2750!not-for-mail Sender: wbe@UBEblock.psr.com Newsgroups: news.admin.net-abuse.email Subject: spamming by Sheck Media (on Exodus) Mail-Copies-To: never From: wbe @ubeblock.psr.com.invalid (Winston) Message-ID: Lines: 20 X-Newsreader: Gnus v5.3/Emacs 19.34 Date: Wed, 19 May 2004 06:59:35 GMT NNTP-Posting-Host: 24.31.196.49 X-Complaints-To: abuse@rr.com X-Trace: twister.southeast.rr.com 1084949975 24.31.196.49 (Wed, 19 May 2004 02:59:35 EDT) NNTP-Posting-Date: Wed, 19 May 2004 02:59:35 EDT Organization: Road Runner - Columbia Xref: uni-berlin.de news.admin.net-abuse.email:2199637 I'd been noticing a fair bit of spam sent with "adv@"{various domains} as the envelope return addresses. It was all caught by my filters, but tonight I checked the logs to see just how much there'd been. C&W/Exodus's customer Sheck Media, has spammed me 529 times so far this year, and 127 times from 64.70.43.* and 216.39.87.* in just the last two weeks. Recently, they've sent as many as 19 a day. :( This is all unsolicited bulk/commercial email. 64.70.43/24: listed on SBL, SORBS, and SPEWS. 216.39.87/24: on SBL and SPEWS, but not listed by SORBS. Sheck Media sent this email directly from their own IP blocks, not via proxies. I sent a summary to and also posted it to NANAS (it's Message-ID: ). Those of you not already blocking Exodus might want to add the IP ranges to your list. -WBE === More of the persistent spamming example === === http://rikus.org/spam.html === Spam Sheck Media, Inc. This is where most of my spam comes (came) from. I even tried to unsubscribe myself (why not? they already have my email address), but it didn't work. Mr. Sheckells has not yet responded to my email. I would recommend blocking out all emails from Sheck Media, Inc. Note: this place [http://www.dolphinwave.org/spam/SheckMedia.txt] seems to have already gathered a lot of information on sheckmedia.com. Update, 2004-09-14 11:34: I seem to have stopped receiving emails from Sheck Media (they are no longer touching my mail server), so maybe they went ahead and removed me from their list. If so, the person to email about getting removed is chuck@sheckmedia.com. Sheckells, Charles (36749900P) chuck@sheckmedia.com Sheck Media, Inc. 4089 Spring Mtn. Rd. Las Vegas, NV 89103 US 702-290-8325 IP Address Blocks 64.70.43.0/24 216.39.87.0/24 216.39.69.0/24 Email addresses ADV@ @sheck-buy.com @fyi-consumer.com (many more) Mail servers .sheckmedia.com Other These are some other spam sources that have so far been unrepsonsive to complaints. 80.248.64.0/24 62.56.188.0/24 $Id: spam.html,v 1.3 2004/09/14 15:38:36 rikus Exp $