Blog for hpHosts, and whatever else I feel like writing about ....

Sunday, 11 January 2015

Release: Spambot Search Tool v0.58

AHBL lookup has been removed folks, as per;

http://www.ahbl.org/content/last-notice-wildcarding-services-jan-1st

Hat tip to Julie for the heads up!

Download
http://support.it-mate.co.uk/index.asp?mode=Products&p=spambotsearchtool
http://forum.hosts-file.net/viewtopic.php?f=68&t=4227
Posted by MysteryFCM at 00:58
0 comments

Wednesday, 7 January 2015

INFO: hpHosts website

Just a note folks, the hpHosts site is now working properly (issue was caused by my specifying an incorrect path for one of the paths in the code that grabs the latest date).

Cheers goes to my friend Alex!
Posted by MysteryFCM at 07:44
0 comments

Monday, 5 January 2015

hpHosts: Updated January 6th 2015

The hpHOSTS Hosts file has been updated. There is now a total of 1,014,846 listed hostsnames.

If you are NOT using the installer, please read the included Readme.txt file for installation instructions. Enjoy! :)
  1. Latest Updated: 06/01/2014 01:00
  2. Last Verified: 05/01/2014 18:00
Download hpHosts now!
http://hosts-file.net/?s=Download

Enjoy!
Posted by MysteryFCM at 19:58
0 comments

Thursday, 4 December 2014

Oh joy - @it-mate.co.uk address being spoofed again

Found out about this courtesy of recipients of this spam responding;

<http://click.icptrack.com/icp/relay.php?r=3D7360092&msgid=3D15823&act=3DYP5T&c=3D1519003&destination=0xACF5B583////////6d5fgh.65d6f5g?iIqQbieJgBbgV=bqjvbcnOSdkDT11xdd1m010eru01c3aw0207l011gba7k806t1>
Rainelcuba
Reclaim-your-mis-sold-PPI-money-today-with-this-30-second-application

<http://click.icptrack.com/icp/relay.php?r=3D7360092&msgid=3D15823&act=3DYP5T&c=3D1519003&destination=0xACF5B583////////6d5fgh.65d6f5g?iIqQbieJgBbgV=bqjvbcnOSdkDT11xdd1m010eru01c3aw0207l011gba7k806t1>
<http://click.icptrack.com/icp/relay.php?r=3D7360092&msgid=3D15823&act=3DYP5T&c=3D1519003&destination=0xACF5B583////////6d5fgh.65d6f5g?SfmuQuhfTCMrR=HiwKgVhajqAzW21xdd1m010eru01c3aw0207l011gba7k806t1>

<http://click.icptrack.com/icp/relay.php?r=3D7360092&msgid=3D15823&act=3DYP5T&c=3D1519003&destination=0xACF5B583////////6d5fgh.65d6f5g?lPgMpwMMVTwwA=OaPIFgRnzuXle31xdd1m010eru01c3aw0207l011gba7k806t1>




These folks, are known as "Joe Jobs" and in short, mean the from address is being spoofed. Please check the email headers to determine the REAL origin (hint: it's not me).

FYI, the folks responsible;

hxxp://click.icptrack.com/icp/relay.php?r=3D7360092&msgid=3D15823&act=3DYP5T&c=3D1519003&destination=0xACF5B583////////6d5fgh.65d6f5g?iIqQbieJgBbgV=bqjvbcnOSdkDT11xdd1m010eru01c3aw0207l011gba7k806t1
-> hxxp://0xacf5b583////////6d5fgh.65d6f5g?iIqQbieJgBbgV=bqjvbcnOSdkDT11xdd1m010eru01c3aw0207l011gba7k806t1 (aka hxxp://172.245.181.131////////6d5fgh.65d6f5giIqQbieJgBbgV=bqjvbcnOSdkDT11xdd1m010eru01c3aw0207l011gba7k806t1)
--> hxxp://ob1trk.com/?a=201&c=5318&s1=201&s2=273_1698762_1gba7k8_1&s3=116516938&s4=2_8821
---> hxxp://formregistration.com/register/1111/519/417?_msai=201&_msd=32332034
----> hxxp://formregistration.com/register/1111/519/417?_msai=201&_msd=32332034

And yes, they've been blacklisted.

The phone number for the company resonsible (displayed after you fill in the details) is;

0161 362 4062 (Telecoms company that leases this number: Six Degrees Unified Comms Limited)



Company responsible: TheClaimsGuys (theclaimsguys.co.uk)

/Update:

FYI for those wondering, icptrack.com is owned by icontact.com (iContact LLC). Feel free to shout at them too;

Domain Name: ICONTACT.COM
Registry Domain ID: 89509667_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Update Date: 2014-03-25 09:57:23
Creation Date: 2002-08-20 13:07:51
Registrar Registration Expiration Date: 2020-08-20 13:07:51
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.480-624-2505
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Domain Status: clientRenewProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: iContact LLC
Registrant Organization: iContact LLC
Registrant Street: 2450 Perimeter Park Dr Suite 105
Registrant City: Morrisville
Registrant State/Province: North Carolina
Registrant Postal Code: 27560
Registrant Country: United States
Registrant Phone: +1.3014592590
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: sysadmin@icontact.com
Registry Admin ID:
Admin Name: iContact LLC
Admin Organization: iContact LLC
Admin Street: 2450 Perimeter Park Dr Suite 105
Admin City: Morrisville
Admin State/Province: North Carolina
Admin Postal Code: 27560
Admin Country: United States
Admin Phone: +1.9194330726
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: sysadmin@icontact.com
Registry Tech ID:
Tech Name: Domain Registrar
Tech Organization: Registercom
Tech Street: 575 8th Avenue
Tech City: New York
Tech State/Province: New York
Tech Postal Code: 10018
Tech Country: United States
Tech Phone: +1.9027492701
Tech Phone Ext:
Tech Fax: +1.9027492701
Tech Fax Ext:
Tech Email: domainregistrar@register.com
Name Server: ns1.clt.hostedsolutions.com
Name Server: ns1.bos.hostedsolutions.com
Name Server: ns1.ral.hostedsolutions.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database: 2014-12-05T00:00:00Z

Domain Name: ICPTRACK.COM
Registry Domain ID: 109533312_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Update Date: 2014-06-18 08:29:57
Creation Date: 2004-01-08 11:14:58
Registrar Registration Expiration Date: 2015-06-18 06:59:59
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.480-624-2505
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Domain Status: clientRenewProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: Site Operations
Registrant Organization: iContact LLC
Registrant Street: 2450 Perimeter Park Dr
Registrant Street: Suite 105
Registrant City: Morrisville
Registrant State/Province: North Carolina
Registrant Postal Code: 27560
Registrant Country: United States
Registrant Phone: +1.3014599259
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: sysadmin@icontact.com
Registry Admin ID:
Admin Name: Site Operations
Admin Organization: iContact LLC
Admin Street: 2450 Perimeter Park Dr
Admin Street: Suite 105
Admin City: Morrisville
Admin State/Province: North Carolina
Admin Postal Code: 27560
Admin Country: United States
Admin Phone: +1.3014599259
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: sysadmin@icontact.com
Registry Tech ID:
Tech Name: Site Operations
Tech Organization: iContact LLC
Tech Street: 2450 Perimeter Park Dr
Tech Street: Suite 105
Tech City: Morrisville
Tech State/Province: North Carolina
Tech Postal Code: 27560
Tech Country: United States
Tech Phone: +1.3014599259
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: sysadmin@icontact.com
Name Server: ns1.clt.hostedsolutions.com
Name Server: ns1.bos.hostedsolutions.com
Name Server: ns1.ral.hostedsolutions.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database: 2014-12-05T00:00:00Z


Contact number for iContact LLC:

+44 (0)208 099 7855
+1 (877) 820-7837 (toll free)

And formregistration.com;

Domain Name: FORMREGISTRATION.COM
Registry Domain ID: 1605128633_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.register.it
Registrar URL: http://we.register.it
Updated Date: 2014-09-22T00:00:00Z
Creation Date: 2010-07-05T00:00:00Z
Registrar Registration Expiration Date: 2016-07-05T00:00:00Z
Registrar: REGISTER.IT S.P.A.
Registrar IANA ID: 168
Registrar Abuse Contact Email: abuse[at]register.it
Registrar Abuse Contact Phone: +39.0353230310
Reseller:
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: Peter Gowrie-Smith
Registrant Organization: Peter Gowrie-Smith
Registrant Street: Apartment 23, 18, Point Pleasant
Registrant City: London
Registrant State/Province: Greater London
Registrant Postal Code: SW18 1GG
Registrant Country: GB
Registrant Phone: +44.8453633630
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: transfers-auth@names.co.uk
Registry Admin ID:
Admin Name: Domain Administrator
Admin Organization: Namesco Limited
Admin Street: Acton House, Perdiswell Park
Admin City: Worcester
Admin State/Province: England
Admin Postal Code: WR3 7GD
Admin Country: GB
Admin Phone: +44.8453633630
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: transfers-auth@names.co.uk
Registry Tech ID:
Tech Name:
Tech Organization: Namesco Limited
Tech Street: Acton House, Perdiswell Park
Tech City: Worcester
Tech State/Province: England
Tech Postal Code: WR3 7GD
Tech Country: GB
Tech Phone: +44.8453633630
Tech Phone Ext:
Tech Fax: +44.8453633631
Tech Fax Ext:
Tech Email: register.it@names.co.uk
Name Server: ns-1701.awsdns-20.co.uk
Name Server: ns-1141.awsdns-14.org
Name Server: ns-462.awsdns-57.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

Last update of whois database: 2014-12-05T00:14:29Z


And theclaimsguys.co.uk;

Domain name:
theclaimsguys.co.uk

Registrant:
LeadX Limited

Registrant type:
UK Limited Company, (Company number: 5494152)

Registrant's address:
1st Floor Lynnfield House, Church Street
Altrincham
WA14 4DZ
United Kingdom

Data validation:
Registrant contact details validated by Nominet on 16-Dec-2013

Registrar:
1 & 1 Internet AG [Tag = SCHLUND]
URL: https://www.1and1.co.uk

Relevant dates:
Registered on: 28-Jan-2009
Expiry date: 28-Jan-2015
Last updated: 03-Jul-2014

Registration status:
Registered until expiry date.

Name servers:
ns-1389.awsdns-45.org
ns-182.awsdns-22.com
ns-1957.awsdns-52.co.uk 205.251.199.165
ns-639.awsdns-15.net

WHOIS lookup made at 00:53:40 05-Dec-2014


Domain Name: leadx.com
Registry Domain ID:
Registrar WHOIS Server: whois.1und1.info
Registrar URL: http://1and1.com
Updated Date: 2014-07-03 00:00:00
Creation Date: 2004-12-16 00:00:00
Registrar Registration Expiration Date: 2014-12-16 00:00:00
Registrar: 1&1 Internet AG
Registrar IANA ID: 83
Registrar Abuse Contact Email: abuse@1and1.com
Registrar Abuse Contact Phone:
Reseller:
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Mark Simpkins
Registrant Organization: LeadX Limited
Registrant Street: Church Street
Registrant City: Altrincham
Registrant State/Province: CHS
Registrant Postal Code: WA14 4DZ
Registrant Country: GB
Registrant Phone: +44.8448714300
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: webmaster@leadx.com
Registry Admin ID:
Admin Name: Mark Simpkins
Admin Organization: LeadX Limited
Admin Street: Church Street
Admin City: Altrincham
Admin State/Province: CHS
Admin Postal Code: WA14 4DZ
Admin Country: GB
Admin Phone: +44.8448714300
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: webmaster@leadx.com
Registry Tech ID:
Tech Name: Mark Simpkins
Tech Organization: LeadX Limited
Tech Street: Church Street
Tech City: Altrincham
Tech State/Province: CHS
Tech Postal Code: WA14 4DZ
Tech Country: GB
Tech Phone: +44.8448714300
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: webmaster@leadx.com
Name Server: ns-1276.awsdns-31.org
Name Server: ns-521.awsdns-01.net
Name Server: ns-296.awsdns-37.com
Name Server: ns-1936.awsdns-50.co.uk
DNSSEC: Unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database:
Posted by MysteryFCM at 15:50
0 comments

Wednesday, 3 December 2014

hpHosts: Updated December 3rd 2014

The hpHOSTS Hosts file has been updated. There is now a total of 927,540 listed hostsnames.

If you are NOT using the installer, please read the included Readme.txt file for installation instructions. Enjoy! :)
  1. Latest Updated: 03/12/2014 10:00
  2. Last Verified: 02/12/2014 23:00
Download hpHosts now!
http://hosts-file.net/?s=Download

Enjoy!
Posted by MysteryFCM at 04:15
0 comments
Subscribe to: Posts (Atom)