ROKSO

Daniel Lessing

An oldtimer, listed in ROKSO (Spamhaus' Register of Known Spam Operations).
Nicks on bulkerforum.biz are seedcash and cluster.
He used "cluster" on the spammer forum specialham too, in addition to dl1227.
On other he used dl69hunt.

Into porn, mortgage spamming, hosting and trying to sell some harvested lists on bulkerforum.

Hmm, selling harvested lists? Is that legal?

r3v3nu

"r3v3nu" sounded familiar. Had seen that one somewhere else, but where?
As usual, it turned out to be on spamhaus.org. Or at least very similar: "r3v3nu3".
Just has to be George Ryan in ROKSO. Take a look there:
http://www.spamhaus.org/rokso/index.lasso.
Look out for George Ryan.

We again steal a couple of sentences from Spamhaus:

Joshua Burch

Nicks on bulkerforum.biz: MastaP and R8N.

More on Joshua P. Burch on spamhaus.org.

We steal the three first sentences from the main info page on Burch from spamhaus and hope we don't "brake" any copyright laws (we did not consult Crypto this time either):

Bits and pieces

December 28 2006:

Lindsay moving mx for trixmail around. And imedia.
mail.trixmail.com and mail.imedia.net:

; <<>> DiG 9.2.4 <<>> mail.trixmail.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36610
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;mail.trixmail.com.             IN      A

;; ANSWER SECTION:
mail.trixmail.com.      86392   IN      A       205.209.147.31

;; Query time: 0 msec
;; SERVER: 
;; WHEN: Thu Dec 28 14:20:07 2006
;; MSG SIZE  rcvd: 51

66.109.20.196

Both centralposition.com and unitedimagedomain.com have been at that IP. Typical Reinertsen domain info.
A bit interesting is that unitedimagedomain.com now (December 11, 2006) lives at 65.213.162.217, covered by a spamhaus listing (http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36194).
A dig from November 9, showed that unitedimagedomain.com was living at 66.109.20.196, not listed.
Now another domain, centralposition.com also seems to live at 65.213.162.217. With the usual Reinertsen domain info.
A quick check for the IP-address 66.109.20.196 at:
RUS-CERT indicates that centralposition.com was hosted there sometime: