Good question to ask.

Once a while I receive email spam, but in the last few months I am getting it apparent and allegedly from forums.searchenginewatch.com as private email. I am not sure how big is the problem at this IncisiveMedia property, but lately it is becoming a pain in you know where. Here is a header section of the latest email. Emphasis added in bold text.

Received: from unknown (HELO web-2.rpm.incbase.net) ([62.140.213.243])
by mx10.prw.net with ESMTP; 11 Jan 2009 03:45:05 -0400
Received: from web-2.rpm.incbase.net (localhost.localdomain [127.0.0.1])
by web-2.rpm.incbase.net (8.13.1/8.13.1) with ESMTP id n0B75Lp9028420
for ; Sun, 11 Jan 2009 07:05:21 GMT
Received: (from apache@localhost)
by web-2.rpm.incbase.net (8.13.1/8.13.1/Submit) id n0B75Kfu028419;
Sun, 11 Jan 2009 07:05:20 GMT
Date: Sun, 11 Jan 2009 07:05:20 GMT
To: admin@miislita.com
Subject: New Private Message at Search Engine Watch Forums
From: “Search Engine Watch Forums” <webmaster@forums.searchenginewatch.com>
Auto-Submitted: auto-generated
Message-ID: <200901110719.5efc68459520@forums.searchenginewatch.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=”ISO-8859-1″
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP

The from claims is from their webmaster, but the first Received indicates incbase.net and the HELO gives an IP to follow.

A WhoIs using http://whois.domaintools.com/incbase.net  gives:

Registrant:
Incisive Media
28-29 Haymarket House
Haymarket
London, London SW1Y 4RX
GB

Registrar: 000DOM
Domain Name: INCBASE.NET
Created on: 16-APR-08
Expires on: 16-APR-10
Last Updated on: 16-APR-08

Administrative, Technical Contact:
Bartlett, Chris
Incisive Media plc
28-29 Haymarket House
Haymarket
London, London SW1Y 4RX
GB
44.2074849860

Domain servers in listed order:
L3DNS1.VNU.CO.UK
L4DNS1.VNU.CO.UK

And a WhoIs using http://whois.domaintools.com/62.140.213.243  gives

inetnum: 62.140.213.0 – 62.140.213.255
netname: VNU
descr: London office 1st assignment
remarks: all abuse complaints to
remarks: all abuse complaints to
country: GB
admin-c: RD4902-RIPE
tech-c: BJ441-RIPE
status: Assigned PA
mnt-by: MNET-MNTNER
source: RIPE # Filtered

person: Ron Doobay
address: 32-34 Broadwick Street
address:
address: London W1A 2HG
phone: +44 020 7316 9677
fax-no: +44 020 7316 9695
e-mail:
nic-hdl: RD4902-RIPE
source: RIPE # Filtered

person: Byron Jones
address: 32-34 Broadwick Street
London
W1A 2HG
phone: +44 20 7816 9650
e-mail:
nic-hdl: BJ441-RIPE
source: RIPE # Filtered

route: 62.140.192.0/19
descr: Aldgate LONDON POP
origin: AS24867
remarks: Abuse reports to
remarks: Peering contact is
mnt-by: MNET-MNTNER
source: RIPE # Filtered

It appears spammers got Incisive Media and SEW number!

Advertisements