Dorank

From Spamhuntress

News:

dorank.com is online again. On 69.50.179.146

---

Had some comment spam on spamhuntress June 27, 2005 that gave me a sniff of this spammer. Got wiki spam July 17, 2005, to the Webtouch talk page. Wiki spam August 14 to the Zahariev domains page.

dorank.com

He started spamming this domain at least as early as April 21. It may have been his first project, and the category was submitter software, with a page in Russian. It automatically subscribes to forums. This might be used for so called forum profile spam. The site is gone from the internet, and I was only able to see what it was about with the help of archive.org and babelfish. I'm happy to say webhosts are generally more willing to take down any kind of spam software since the MCI and Send Safe debacle, where MCI almost got some of their connectivity cut off for harboring spam software.

Here's the Russian text on the website, translated by Babelfish:

Systems of automatic registration on the forums and the guest books,
base, the generators of durveyev, sale of references from the pages
and pages themselves with high PR, increase PR to your resource and much other!

Spambot:

• 67.18.98.36

All spam is entered from this bot. Former spambot: 69.50.170.170

He uses domains, free websites and dynamic IP subdomains.

Webhost IP numbers:

• 67.18.98.36
• 67.18.98.37
• 69.50.179.146

Chances are he also owns other IP numbers, but haven't started using them for hosting just yet. These have name servers on them:

• 67.18.98.41
• 67.18.98.46

Whois:

Eremeev, Dmitriy  dima@iteh.ru
Gavrilova str. 42-45
Kazan, Tatarstan 420137
Russian Federation
8432560090      Fax -- 

Intech
Aslan Basurman        (areafix@areafix.net)
Gambit str. 13
Aljabiboba
null,678842
TR
Tel.  7.9172889885

cooltobacco.com
Igor Rodionov (rin33@rol.ru)
 7.8129232094
Fax: none
Yahtennaya str. 9/1-286
Saint-Petersburg,  197374
RU

Ziro LLC
Igor Rodionov (14103068.fly@spamfly.com)
 1.3023972098
Fax:  1.3023972098
3422 Old Capitol Trail
Suite 700
Wilmington, DE 19808
US

Other domains:

• divtab.com
• fixtab.com
• cpills.com
• ifauto.com
• ourtablets.com
• sopill.com
• areaseo.com
• dirare.com

Additional Details:

On an older version of the dorank site, there was an ICQ number. And checking that profile nets me a little more info. He appears to be one of the admins of the admins on cs.rin.ru, a cs (counter strike) server. This phone number was provided at the same place his e-mail address was: 7 8432 363013 saztec@rambler.ru. The phone number belongs to rin.ru, a gigantic domain that contains just about everything. I kinda doubt our spammer owns that domain.

More Link spammer pages