Submitted by Rune on May 18, 2008 – 16:05

I don’t ever bother to mention the problematic “affiliate did it” argument.

This guy is not directly spamming the domain in question, cheapest-drug.org.
He has instead registered as a user on several forums/communities, giving a link to a domain (or several) in his userprofile and spamvertizes his userprofile via comments.

The latest from today came in via 207.38.4.12 which appears to be a free open proxy on “M9 Systems” in Canada. Tries to leave a comment on the posting about can-spam mailers.

“User”: Paeal (including a link to a wikidot.com site, I reckon they will nuke it).
Subject: “Your site has very much liked me.” (That seems to be a favourite among commentspammers).
The links in the commentspam:
http://forums.ugo.com/member.php?u=46618 “>Buy Viagra
http://www.mixx.com/users/viagrapill “>buy viagra online<
http://ubuntuforums.org/member.php?u=580712 “>buy cialis online
http://www.flixster.com/user/levitraa “>buy levitra

For examples of this comment- (and guestbook-) spammer, see this search result (Google):
“u=46618” +ugo

The links in the userprofiles at the forums/communities above all goes to various pages at cheapest-drug.org.
cheapest-drug.org is hosted at 91.199.112.8, which is rx-partners.biz who has their own listing in Spamhaus:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL64756

rx-partners.biz are sneaky. This probably does not violate their policies and their “affiliates” can happily continue with their comment spam. Or what, Jessica? (rx-partners won’t listen, jessicaeagloff@yahoo.co.uk comes back to me and their form submission does not work/or I can’t read their captcha. Not my problem)

Screenshot from cheapest-drug.org (click on it for a larger one):

Address lookup

Domain Whois record

Queried whois.publicinterestregistry.net with “cheapest-drug.org“…

Domain ID:D149813888-LROR
Domain Name:CHEAPEST-DRUG.ORG
Created On:15-Nov-2007 17:56:41 UTC
Last Updated On:01-Jan-2009 00:28:52 UTC
Expiration Date:15-Nov-2009 17:56:41 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:OK

Registrant ID:ec82bbcdbb3
Registrant Name:WhoisGuard  Protected
Registrant Organization:WhoisGuard
Registrant Street1:8939 S. Sepulveda Blvd. #110 -
Registrant City:Westchester
Registrant State/Province:CA
Registrant Postal Code:90045
Registrant Country:US
Registrant Phone:+1.6613102107
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:b946005550354558b4e48120e77d6930.protect@whoisguard.com

Admin ID:ec82bbcdbb3
Admin Name:WhoisGuard  Protected
Admin Organization:WhoisGuard
Admin Street1:8939 S. Sepulveda Blvd. #110 -
Admin City:Westchester
Admin State/Province:CA
Admin Postal Code:90045
Admin Country:US
Admin Phone:+1.6613102107
Admin Email:b946005550354558b4e48120e77d6930.protect@whoisguard.com

Tech ID:ec82bbcdbb3
Tech Name:WhoisGuard  Protected
Tech Organization:WhoisGuard
Tech Street1:8939 S. Sepulveda Blvd. #110 -
Tech City:Westchester
Tech State/Province:CA
Tech Postal Code:90045
Tech Country:US
Tech Phone:+1.6613102107
Tech Email:b946005550354558b4e48120e77d6930.protect@whoisguard.com

Name Server:ELD.STEELURK.COM
Name Server:ISA.STEELURK.COM

Network Whois record

Queried whois.ripe.net with “-B 91.199.112.104“…

Information related to '91.199.112.0 - 91.199.112.255'

inetnum:        91.199.112.0 - 91.199.112.255
netname:        CENTRALUX
descr:          Centralux Ltd
country:        CY
org:            ORG-CLUX1-RIPE
admin-c:        JE782-RIPE
tech-c:         JE782-RIPE
status:         ASSIGNED PI
notify:         lexa@wahome.ru
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         MNT-CENTRALUX
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     MNT-CENTRALUX
mnt-domains:    MNT-CENTRALUX
changed:        hostmaster@ripe.net 20080111
source:         RIPE

organisation:   ORG-CLUX1-RIPE
org-name:       Centralux Limited
org-type:       OTHER
address:        Kolokotroni, 6
                1-st floor, Office 6
                P.C. 1101, Nicosia, Cyprus
e-mail:         admin@cluxltd.com
mnt-ref:        RU-WEBALTA-MNT
mnt-by:         MNT-CENTRALUX
changed:        lexa@wahome.ru 20080110
source:         RIPE

person:         Jessica Eagloff
address:        Kolokotroni, 6
                1-st floor, Office 6
                P.C. 1101, Nicosia, Cyprus
mnt-by:         MNT-CENTRALUX
phone:          +44 0121 288 8651
nic-hdl:        JE782-RIPE
changed:        lexa@wahome.ru 20080110
source:         RIPE

% Information related to '91.199.112.0/24AS43816'

route:          91.199.112.0/24
descr:          Centralux
origin:         AS43816
mnt-by:         MNT-CENTRALUX
changed:        lexa@wahome.ru 20080112
source:         RIPE

DNS records

DNS query for 104.112.199.91.in-addr.arpa returned an error from the server: NameError

— end —

cheapest-drug.org

Domain ID:D149813888-LROR
Domain Name:CHEAPEST-DRUG.ORG
Created On:15-Nov-2007 17:56:41 UTC
Last Updated On:22-Jan-2008 13:37:03 UTC
Expiration Date:15-Nov-2008 17:56:41 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd.
					d/b/a PublicDomainRegistry.com (R27-LROR)
Status:OK
Registrant ID:DI_7040912
Registrant Name:saniok
Registrant Organization:RX-partner
Registrant Street1:Alexandr cel bun 94/53
Registrant City:Hincesti
Registrant State/Province:0
Registrant Postal Code:3401
Registrant Country:MD
Registrant Phone:+373.079777957
Registrant Phone Ext.:
Registrant Email:saniok44@gmail.com

Admin ID:DI_7040912
Admin Name:saniok
Admin Organization:RX-partner
Admin Street1:Alexandr cel bun 94/53
Admin City:Hincesti
Admin State/Province:0
Admin Postal Code:3401
Admin Country:MD
Admin Phone:+373.079777957
Admin Email:saniok44@gmail.com

Tech ID:DI_7040912
Tech Name:saniok
Tech Organization:RX-partner
Tech Street1:Alexandr cel bun 94/53
Tech City:Hincesti
Tech State/Province:0
Tech Postal Code:3401
Tech Country:MD
Tech Phone:+373.079777957
Tech Phone Ext.:

Tech Email:saniok44@gmail.com
Name Server:ONLINE.RXP-FOREVER.COM
Name Server:LIVE.RXP-FOREVER.COM

; <<>> DiG 9.3.4-P1 <<>> cheapest-drug.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59717
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;cheapest-drug.org.             IN      A

;; ANSWER SECTION:
cheapest-drug.org.      1200    IN      A       91.199.112.8

;; AUTHORITY SECTION:
cheapest-drug.org.      1200    IN      NS      online.rxp-forever.com.
cheapest-drug.org.      1200    IN      NS      live.rxp-forever.com.

;; ADDITIONAL SECTION:
live.rxp-forever.com.   52213   IN      A       91.199.112.8
online.rxp-forever.com. 52213   IN      A       91.199.112.7

;; Query time: 201 msec
;; SERVER: 217.13.7.140#53(217.13.7.140)
;; WHEN: Sun May 18 14:58:55 2008
;; MSG SIZE  rcvd: 138

91.199.112.8

inetnum:        91.199.112.0 - 91.199.112.255
netname:        CENTRALUX
descr:          Centralux Ltd
country:        CY
org:            ORG-CLUX1-RIPE
admin-c:        JE782-RIPE
tech-c:         JE782-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         MNT-CENTRALUX
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     MNT-CENTRALUX
mnt-domains:    MNT-CENTRALUX
source:         RIPE # Filtered

organisation:   ORG-CLUX1-RIPE
org-name:       Centralux Limited
org-type:       OTHER
address:        Kolokotroni, 6
                1-st floor, Office 6
                P.C. 1101, Nicosia, Cyprus
e-mail:         admin@cluxltd.com
mnt-ref:        RU-WEBALTA-MNT
mnt-by:         MNT-CENTRALUX
source:         RIPE # Filtered

person:         Jessica Eagloff
address:        Kolokotroni, 6
                1-st floor, Office 6
                P.C. 1101, Nicosia, Cyprus
mnt-by:         MNT-CENTRALUX
phone:          +44 0121 288 8651
nic-hdl:        JE782-RIPE
source:         RIPE # Filtered

% Information related to '91.199.112.0/24AS43816'

route:          91.199.112.0/24
descr:          Centralux
origin:         AS43816
mnt-by:         MNT-CENTRALUX
source:         RIPE # Filtered

“jessica Eagloff”. That is rx-partners.biz.
See this SBL-listing: