Email Abuse and Spam - Botnet promoting website of slickcash.com

Author

Botnet promoting website of slickcash.com

fhh

2005-06-20, 6:00 pm

An affiliate of slickcash.com is promoting a website through a special kind
of botnetwork controlled by sham.zerotollerance.biz on IP 72.36.136.118 .

The spam advertizes (among others) domain jywududale.com . This page
redirects to cumshotblast.com of slickcash.com .
jywududale.com -> 68.142.234.[44-47] (yahoo)
www.cumshotblast.com -> 66.235.134.245, 66.235.134.246

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL24730 says
| 66.235.134.244/30 is listed on the Register Of Known Spam Operations
| (ROKSO) database as being assigned to, under the control of, or providing
| service to a known professional spam operation run by Brian Fabian /
| Gregory Parsons.

Zombiemasters:

sham.zerotollerance.biz -> 72.36.136.118 (controlling trojaned hosts)
Authoritative nameservers:
ns1.nameself.com -> 195.161.113.218
ns2.nameself.com -> 217.16.27.36

64.71.177.103 TCP port 8712 (pumping spam through trojaned hosts)
65.98.89.146 TCP port 8712 (pumping spam through trojaned hosts)

---------------------------------------------
The relevant trojan is located here:

web-free-hosting.net/ imb.exe
[directly related to the massive googkle.com infections]

Imb.exe drops a dll file that works together with explorer.exe. It is
detected as Email-Worm.Win32.Prox.d by Kaspersky.com .

The malware adds these lines to the hosts file of victim:

127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 download.mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 update.symantec.com

A trojaned host will contact sham.sexfab.com (no IP) or
sham.zerotollerance.biz on port 80 for instructions.

----------------------------------------------
Communication between trojaned hosts and sham.zerotollerance.biz

A trojaned host connnects to sham.zerotollerance.biz on port 80 . Although
port 80 is meant for http traffic, the communications between a trojaned
host and sham.zerotollerance.biz:80 do not look like "normal" http traffic
at all. Instead, binary codes get exchanged. Probably these binary codes
contain instructions for trojaned hosts.

A trojaned host may first upload 50012 bytes (all zeroes) to
sham.zerotollerance.biz . Apparently this is a bandwidth test.

One can easily check that the webserver at 72.36.136.118 is running
additional software on port 80. Eg on a linux or unix machine:

$ echo 0A0000000000000000000000 | xxd -r -p | netcat -n 72.36.136.118 80

(which mimicks the way a trojaned host starts to communicate with its
controller) . 72.36.136.118 replies with a data packet of 12 bytes (all
zeroes) and the connection is kept alive. I guess this is not normal
behavior for a webserver ?!

---------------
Pumping spam

A trojaned host may try to connect to 64.71.177.103 on TCP port 8712
(probably sham.zerotollerance.biz asks a trojaned host to do so) .

Though in my case 64.71.177.103 answered with TCP RST packets, my on purpose
trojaned hosts kept on hammering 64.71.177.103:8712 with TCP SYN packets
like a mad man . Therefore I filtered traffic to 64.71.177.103. Then my
trojaned host connected to 65.98.89.146:8712 . This zombiemaster
immediately sent a Socks4 Connect request, asking the trojaned host to make
a connection with a mailserver. When the connection "succeeded" the trojan
answered with 8 bytes, all zero except byte 2 (5A) (as far as I know a non
standard Socks4 reply) . Then the trojaned host sent the banner of the
mailserver and a spam message was sent through the trojaned host (in my set
up all mail was actually routed to a local mailserver, so no spam was sent
to the targeted recipients) .

This is almost identical to proxy hijacking, except that in this case a
trojaned host establishes a Socks connection itself and then just waits for
Socks commands from the zombiemaster.

One can easily check that 65.98.89.146:8712 (and 64.71.177.103) wants to
send mail. On a linux or unix machine just type:

$ netcat -n 65.98.89.146 8712

and capture all internet traffic. You will see that after connecting to
65.98.89.146 (and sending no data at all) IP 65.98.89.146 will immediately
send 9 bytes back, for example:

04 01 00 19 04 4f b5 0c 00

where bytes 5-8 will vary. These 9 bytes contain a Socks 4 request to
connect to port 25 (hexadecimal 19) on IP 4.79.181.12, which has rDNS
mta-v1.level3.mail.vip.mud.yahoo.com .

-------------------------------------------

A sample of an intercepted spam message:

Received: from MUNGED ([MUNGED])
by MUNGED
for MUNGED @ mx3.redestb.es;
Mon, 20 Jun 2005 ..... +0200
Received: from mx1.mail.yahoo.com
by MUNGED (8.9.3/8.9.3) with SMTP id tecbWh8cSp5v
for <MUNGED @ mx3.redestb.es>; Sun, 19 Jun 2005 .... -0400
Received: from passamon ([65.45.31.2])
by mx1.mail.yahoo.com with SMTP id PEv4FTF5JUAV
for <acanela@mx3.redestb.es>; Sun, 19 Jun 2005 .... -0400
Reply-To: "Bryce West" <MUNGED @ yahoo.com>
From: "Bryce" <MUNGED @ yahoo.com>
Message-ID: <MUNGED>
Date: Sun, 19 Jun 2005 ..... -0400
To: <MUNGED @ mx3.redestb.es>
Subject: Hot babe gets her XXX stuffed
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Cute Hairy Asian Amateur Banging & Facial Movies
Hot blonde threesome
Cute teen possing

http://www.jywududale.com?[random string]

Japanese Deepthroater Jizzed

----------------------------------------------
$ whois zerotollerance.biz

Domain Name: ZEROTOLLERANCE.BIZ
Domain ID: D9090771-BIZ
Sponsoring Registrar: TLDS INC.
Sponsoring Registrar IANA ID: 320
Domain Status: clientTransferProhibited
Registrant ID: 5801489-SRSPLUS
Registrant Name: Neville Scheevel
Registrant Organization: neveschee
Registrant Address1: 5451 Lance Dr.
Registrant City: Knoxville
Registrant State/Province: TN
Registrant Postal Code: 37909
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.8656930578
Registrant Email: neveschee@f2s.info
Administrative Contact ID: 5801499-SRSPLUS
Administrative Contact Name: Neville Scheevel
Administrative Contact Organization: neveschee
Administrative Contact Address1: 5451 Lance Dr.
Administrative Contact City: Knoxville
Administrative Contact State/Province: TN
Administrative Contact Postal Code: 37909
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.8656930578
Administrative Contact Email: neveschee@f2s.info
Billing Contact ID: 5801499-SRSPLUS
Billing Contact Name: Neville Scheevel
Billing Contact Organization: neveschee
Billing Contact Address1: 5451 Lance Dr.
Billing Contact City: Knoxville
Billing Contact State/Province: TN
Billing Contact Postal Code: 37909
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.8656930578
Billing Contact Email: neveschee@f2s.info
Technical Contact ID: 5801509-SRSPLUS
Technical Contact Name: Neville Scheevel
Technical Contact Organization: neveschee
Technical Contact Address1: 5451 Lance Dr.
Technical Contact City: Knoxville
Technical Contact State/Province: TN
Technical Contact Postal Code: 37909
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.8656930578
Technical Contact Email: neveschee@f2s.info
Name Server: NS2.NAMESELF.COM
Name Server: NS1.NAMESELF.COM
Created by Registrar: TLDS INC.
Last Updated by Registrar: TLDS INC.
Domain Registration Date: Sat Feb 26 14:00:46 GMT 2005
Domain Expiration Date: Sat Feb 25 23:59:59 GMT 2006
Domain Last Updated Date: Sat Feb 26 17:06:13 GMT 2005
-----------------------------------------------------

$ whois cumshotblast.com

Registrant:
1564476 Ont Ltd, Net Cost
6075 South Eastern Avenue
Suite 1
las Vegas, NV 89119-3146
US
416-536-6020

Domain Name: CUMSHOTBLAST.COM

Administrative Contact:
Aministrator, DNS dnsadmin@slickcash.com
6075 South Eastern Avenue
Suite 1
las Vegas, NV 89119-3146
US
416-536-6020

Technical Contact:
Aministrator, DNS dnsadmin@slickcash.com
6075 South Eastern Avenue
Suite 1
las Vegas, NV 89119-3146
US
416-536-6020

Record last updated 05-10-2005 08:32:57 PM
Record expires on 08-11-2005
Record created on 08-11-2003

Domain servers in listed order:
UDNS1.ULTRADNS.NET 204.69.234.1
UDNS2.ULTRADNS.NET 204.74.101.1
---------------------------------------
$ whois jywududale.com

Domain Name.......... jywududale.com
Creation Date........ 2005-05-29
Registration Date.... 2005-05-29
Expiry Date.......... 2006-05-29
Organisation Name.... Jeff Busche
Organisation Address. 16835 Algonquin St.
Organisation Address.
Organisation Address. Huntington Beach
Organisation Address. 92649
Organisation Address. CA
Organisation Address. UNITED STATES

Admin Name........... Jeff Busche
Admin Address........ 16835 Algonquin St.
Admin Address........
Admin Address........ Huntington Beach
Admin Address........ 92649
Admin Address........ CA
Admin Address........ UNITED STATES
Admin Email.......... huntingbeachpalm@yahoo.com
Admin Phone.......... +1.7144805203
Admin Fax............

Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com

--
feike

BlackHat034287

2005-06-20, 8:49 pm

Very nice explanation. Given this information or similar information,
how does one kill the botnet?

BlackHat

fhh wrote:
> An affiliate of slickcash.com is promoting a website through a special kind
> of botnetwork controlled by sham.zerotollerance.biz on IP 72.36.136.118 .
>
> The spam advertizes (among others) domain jywududale.com . This page
> redirects to cumshotblast.com of slickcash.com .
> jywududale.com -> 68.142.234.[44-47] (yahoo)
> www.cumshotblast.com -> 66.235.134.245, 66.235.134.246
>
> http://www.spamhaus.org/sbl/sbl.lasso?query=SBL24730 says
> | 66.235.134.244/30 is listed on the Register Of Known Spam Operations
> | (ROKSO) database as being assigned to, under the control of, or providing
> | service to a known professional spam operation run by Brian Fabian /
> | Gregory Parsons.
>
>
> Zombiemasters:
>
> sham.zerotollerance.biz -> 72.36.136.118 (controlling trojaned hosts)
> Authoritative nameservers:
> ns1.nameself.com -> 195.161.113.218
> ns2.nameself.com -> 217.16.27.36
>
> 64.71.177.103 TCP port 8712 (pumping spam through trojaned hosts)
> 65.98.89.146 TCP port 8712 (pumping spam through trojaned hosts)
>
> ---------------------------------------------
> The relevant trojan is located here:
>
> web-free-hosting.net/ imb.exe
> [directly related to the massive googkle.com infections]
>
> Imb.exe drops a dll file that works together with explorer.exe. It is
> detected as Email-Worm.Win32.Prox.d by Kaspersky.com .
>
> The malware adds these lines to the hosts file of victim:
>
> 127.0.0.1 downloads1.kaspersky-labs.com
> 127.0.0.1 downloads2.kaspersky-labs.com
> 127.0.0.1 downloads3.kaspersky-labs.com
> 127.0.0.1 downloads4.kaspersky-labs.com
> 127.0.0.1 download.mcafee.com
> 127.0.0.1 liveupdate.symantecliveupdate.com
> 127.0.0.1 liveupdate.symantec.com
> 127.0.0.1 update.symantec.com
>
> A trojaned host will contact sham.sexfab.com (no IP) or
> sham.zerotollerance.biz on port 80 for instructions.
>
> ----------------------------------------------
> Communication between trojaned hosts and sham.zerotollerance.biz
>
> A trojaned host connnects to sham.zerotollerance.biz on port 80 . Although
> port 80 is meant for http traffic, the communications between a trojaned
> host and sham.zerotollerance.biz:80 do not look like "normal" http traffic
> at all. Instead, binary codes get exchanged. Probably these binary codes
> contain instructions for trojaned hosts.
>
> A trojaned host may first upload 50012 bytes (all zeroes) to
> sham.zerotollerance.biz . Apparently this is a bandwidth test.
>
> One can easily check that the webserver at 72.36.136.118 is running
> additional software on port 80. Eg on a linux or unix machine:
>
> $ echo 0A0000000000000000000000 | xxd -r -p | netcat -n 72.36.136.118 80
>
> (which mimicks the way a trojaned host starts to communicate with its
> controller) . 72.36.136.118 replies with a data packet of 12 bytes (all
> zeroes) and the connection is kept alive. I guess this is not normal
> behavior for a webserver ?!
>
> ---------------
> Pumping spam
>
> A trojaned host may try to connect to 64.71.177.103 on TCP port 8712
> (probably sham.zerotollerance.biz asks a trojaned host to do so) .
>
> Though in my case 64.71.177.103 answered with TCP RST packets, my on purpose
> trojaned hosts kept on hammering 64.71.177.103:8712 with TCP SYN packets
> like a mad man . Therefore I filtered traffic to 64.71.177.103. Then my
> trojaned host connected to 65.98.89.146:8712 . This zombiemaster
> immediately sent a Socks4 Connect request, asking the trojaned host to make
> a connection with a mailserver. When the connection "succeeded" the trojan
> answered with 8 bytes, all zero except byte 2 (5A) (as far as I know a non
> standard Socks4 reply) . Then the trojaned host sent the banner of the
> mailserver and a spam message was sent through the trojaned host (in my set
> up all mail was actually routed to a local mailserver, so no spam was sent
> to the targeted recipients) .
>
> This is almost identical to proxy hijacking, except that in this case a
> trojaned host establishes a Socks connection itself and then just waits for
> Socks commands from the zombiemaster.
>
>
> One can easily check that 65.98.89.146:8712 (and 64.71.177.103) wants to
> send mail. On a linux or unix machine just type:
>
> $ netcat -n 65.98.89.146 8712
>
> and capture all internet traffic. You will see that after connecting to
> 65.98.89.146 (and sending no data at all) IP 65.98.89.146 will immediately
> send 9 bytes back, for example:
>
> 04 01 00 19 04 4f b5 0c 00
>
> where bytes 5-8 will vary. These 9 bytes contain a Socks 4 request to
> connect to port 25 (hexadecimal 19) on IP 4.79.181.12, which has rDNS
> mta-v1.level3.mail.vip.mud.yahoo.com .
>
> -------------------------------------------
>
> A sample of an intercepted spam message:
>
>
> Received: from MUNGED ([MUNGED])
> by MUNGED
> for MUNGED @ mx3.redestb.es;
> Mon, 20 Jun 2005 ..... +0200
> Received: from mx1.mail.yahoo.com
> by MUNGED (8.9.3/8.9.3) with SMTP id tecbWh8cSp5v
> for <MUNGED @ mx3.redestb.es>; Sun, 19 Jun 2005 .... -0400
> Received: from passamon ([65.45.31.2])
> by mx1.mail.yahoo.com with SMTP id PEv4FTF5JUAV
> for <acanela@mx3.redestb.es>; Sun, 19 Jun 2005 .... -0400
> Reply-To: "Bryce West" <MUNGED @ yahoo.com>
> From: "Bryce" <MUNGED @ yahoo.com>
> Message-ID: <MUNGED>
> Date: Sun, 19 Jun 2005 ..... -0400
> To: <MUNGED @ mx3.redestb.es>
> Subject: Hot babe gets her XXX stuffed
> MIME-Version: 1.0
> Content-Type: text/plain; charset="iso-8859-1"
> Content-Transfer-Encoding: 7bit
>
>
> Cute Hairy Asian Amateur Banging & Facial Movies
> Hot blonde threesome
> Cute teen possing
>
> http://www.jywududale.com?[random string]
>
> Japanese Deepthroater Jizzed
>
>
> ----------------------------------------------
> $ whois zerotollerance.biz
>
> Domain Name: ZEROTOLLERANCE.BIZ
> Domain ID: D9090771-BIZ
> Sponsoring Registrar: TLDS INC.
> Sponsoring Registrar IANA ID: 320
> Domain Status: clientTransferProhibited
> Registrant ID: 5801489-SRSPLUS
> Registrant Name: Neville Scheevel
> Registrant Organization: neveschee
> Registrant Address1: 5451 Lance Dr.
> Registrant City: Knoxville
> Registrant State/Province: TN
> Registrant Postal Code: 37909
> Registrant Country: United States
> Registrant Country Code: US
> Registrant Phone Number: +1.8656930578
> Registrant Email: neveschee@f2s.info
> Administrative Contact ID: 5801499-SRSPLUS
> Administrative Contact Name: Neville Scheevel
> Administrative Contact Organization: neveschee
> Administrative Contact Address1: 5451 Lance Dr.
> Administrative Contact City: Knoxville
> Administrative Contact State/Province: TN
> Administrative Contact Postal Code: 37909
> Administrative Contact Country: United States
> Administrative Contact Country Code: US
> Administrative Contact Phone Number: +1.8656930578
> Administrative Contact Email: neveschee@f2s.info
> Billing Contact ID: 5801499-SRSPLUS
> Billing Contact Name: Neville Scheevel
> Billing Contact Organization: neveschee
> Billing Contact Address1: 5451 Lance Dr.
> Billing Contact City: Knoxville
> Billing Contact State/Province: TN
> Billing Contact Postal Code: 37909
> Billing Contact Country: United States
> Billing Contact Country Code: US
> Billing Contact Phone Number: +1.8656930578
> Billing Contact Email: neveschee@f2s.info
> Technical Contact ID: 5801509-SRSPLUS
> Technical Contact Name: Neville Scheevel
> Technical Contact Organization: neveschee
> Technical Contact Address1: 5451 Lance Dr.
> Technical Contact City: Knoxville
> Technical Contact State/Province: TN
> Technical Contact Postal Code: 37909
> Technical Contact Country: United States
> Technical Contact Country Code: US
> Technical Contact Phone Number: +1.8656930578
> Technical Contact Email: neveschee@f2s.info
> Name Server: NS2.NAMESELF.COM
> Name Server: NS1.NAMESELF.COM
> Created by Registrar: TLDS INC.
> Last Updated by Registrar: TLDS INC.
> Domain Registration Date: Sat Feb 26 14:00:46 GMT 2005
> Domain Expiration Date: Sat Feb 25 23:59:59 GMT 2006
> Domain Last Updated Date: Sat Feb 26 17:06:13 GMT 2005
> -----------------------------------------------------
>
>
> $ whois cumshotblast.com
>
> Registrant:
> 1564476 Ont Ltd, Net Cost
> 6075 South Eastern Avenue
> Suite 1
> las Vegas, NV 89119-3146
> US
> 416-536-6020
>
>
> Domain Name: CUMSHOTBLAST.COM
>
> Administrative Contact:
> Aministrator, DNS dnsadmin@slickcash.com
> 6075 South Eastern Avenue
> Suite 1
> las Vegas, NV 89119-3146
> US
> 416-536-6020
>
>
> Technical Contact:
> Aministrator, DNS dnsadmin@slickcash.com
> 6075 South Eastern Avenue
> Suite 1
> las Vegas, NV 89119-3146
> US
> 416-536-6020
>
>
> Record last updated 05-10-2005 08:32:57 PM
> Record expires on 08-11-2005
> Record created on 08-11-2003
>
> Domain servers in listed order:
> UDNS1.ULTRADNS.NET 204.69.234.1
> UDNS2.ULTRADNS.NET 204.74.101.1
> ---------------------------------------
> $ whois jywududale.com
>
> Domain Name.......... jywududale.com
> Creation Date........ 2005-05-29
> Registration Date.... 2005-05-29
> Expiry Date.......... 2006-05-29
> Organisation Name.... Jeff Busche
> Organisation Address. 16835 Algonquin St.
> Organisation Address.
> Organisation Address. Huntington Beach
> Organisation Address. 92649
> Organisation Address. CA
> Organisation Address. UNITED STATES
>
> Admin Name........... Jeff Busche
> Admin Address........ 16835 Algonquin St.
> Admin Address........
> Admin Address........ Huntington Beach
> Admin Address........ 92649
> Admin Address........ CA
> Admin Address........ UNITED STATES
> Admin Email.......... huntingbeachpalm@yahoo.com
> Admin Phone.......... +1.7144805203
> Admin Fax............
>
> Tech Name............ YahooDomains TechContact
> Tech Address......... 701 First Ave.
> Tech Address.........
> Tech Address......... Sunnyvale
> Tech Address......... 94089
> Tech Address......... CA
> Tech Address......... UNITED STATES
> Tech Email........... domain.tech@YAHOO-INC.COM
> Tech Phone........... +1.6198813096
> Tech Fax............. +1.6198813010
> Name Server.......... yns1.yahoo.com
> Name Server.......... yns2.yahoo.com
>
> --
> feike

fhh

2005-06-21, 5:51 pm

BlackHat034287 wrote:

> Very nice explanation. Given this information or similar information,
> how does one kill the botnet?

Killing a botnet might be hard. When I write to ISPs about botnets in their
network, many of them do not reply. When an ISP does take action,
zombiemasters may move elsewhere.

So frankly speaking in many cases I no longer complain about botnets, unless
I know chances are high that an ISP will take my email seriously.

--
feike

My ISP won't fight spam

2005-06-22, 5:55 pm

Utlradns took them down a few weeks ago, did they manage to sneak back
in or is that DNS information outdated?

fhh

2005-06-22, 5:55 pm

My ISP won't fight spam wrote:

> Utlradns took them down a few weeks ago, did they manage to sneak back
> in or is that DNS information outdated?

Do you mean the website of cumshotblast.com ? That site is up and running:

$ dig cumshotblast.com

[...]

;; ANSWER SECTION:
cumshotblast.com. 14354 IN A 66.235.134.246
cumshotblast.com. 14354 IN A 66.235.134.245

;; AUTHORITY SECTION:
cumshotblast.com. 86354 IN NS udns2.ultradns.net.
cumshotblast.com. 86354 IN NS pdns1.ultradns.net.
cumshotblast.com. 86354 IN NS pdns2.ultradns.net.
cumshotblast.com. 86354 IN NS pdns3.ultradns.org.
cumshotblast.com. 86354 IN NS pdns4.ultradns.org.
cumshotblast.com. 86354 IN NS pdns5.ultradns.info.
cumshotblast.com. 86354 IN NS pdns6.ultradns.co.uk.
cumshotblast.com. 86354 IN NS udns1.ultradns.net.

;; ADDITIONAL SECTION:
pdns1.ultradns.net. 73697 IN A 204.74.108.1
pdns2.ultradns.net. 72069 IN A 204.74.109.1
pdns3.ultradns.org. 65298 IN A 199.7.68.1
pdns4.ultradns.org. 65298 IN A 199.7.69.1
pdns5.ultradns.info. 65298 IN A 204.74.114.1
pdns6.ultradns.co.uk. 377 IN A 204.74.115.1
udns1.ultradns.net. 151693 IN A 204.69.234.1
udns2.ultradns.net. 151693 IN A 204.74.101.1

$ curl -I http://cumshotblast.com/

HTTP/1.1 200 OK
Date: Wed, 22 Jun 2005 21:..:.. GMT
Content-Type: text/html
Connection: close
Server: Apache/1.3.29 (Unix) prxp_module/1.5.8 PHP/4.3.10 mod_perl/1.29
X-Powered-By: PHP/4.3.10

--
feike

SuN Tsu

2005-06-22, 5:55 pm

fhh wrote:

> My ISP won't fight spam wrote:
>
>
> Do you mean the website of cumshotblast.com ?
> That site is up and running:
>
> $ dig cumshotblast.com
>
> [...]
>
> ;; ANSWER SECTION:
> cumshotblast.com. 14354 IN A 66.235.134.246
> cumshotblast.com. 14354 IN A 66.235.134.245

881 (almost all) pr0n feeder sites belonging to Turvil Consultant are
sitting on 66.235.134.246

http://whois.webhosting.info/66.235.134.246

1 0AMATEUR.COM.
2 0AMATEURASIANS.COM.
3 0AMATEURBLOWJOBS.COM.
4 0AMATEUREBONY.COM.
5 0AMATEURHARDCORE.COM.
6 0AMATEURLESBIAN.COM.
7 0ANAL.COM.
8 110PERCENTAMATEUR.COM.
9 1ON1GAYMEN.COM.
10 1ON1HARDCORE.COM.
11 3PORNO.ORG.
12 401KL.COM.
13 420PRICELESS.COM.
14 A-AMATEURSEX.COM.
15 AARPPHARMACY.NET.
16 ABCCASINOONLINE.COM.
17 ABONDAGEGALLERY.COM.
18 ABSOLUTEGRANNIES.COM.
19 ABSOLUTEGRANNIES.NET.
20 ABSOLUTEGRANNYS.COM.
21 ABSOLUTELYSHEMALE.COM.
22 ABSOLUTEPICS.COM.
23 ADDERALLADHD.COM.
24 ADDITUDE.ORG.
25 ADULPORN.COM.
26 ADULTBEASTIALITY.COM.
27 ADULTFRIEND-FINDER.COM.
28 ADULTSIMPSONS.COM.
29 ADULTSPIDER.COM.
30 ADULTWEBRESOURCES.COM.
31 AGAY.COM.
32 AL4AINDEX.COM.
33 ALLADDINCASINO.COM.
34 ALLADULTMOVIES.COM.
35 ALLTHREESOMES.COM.
36 ALLTHREESOMES.NET.
37 ALPRAZOLAMXANAX.COM.
38 AMATEURFILE.COM.
39 AMATEURINDIANS.COM.
40 AMATEURNAKEDWIVES.COM.
41 AMATEURNAKEDWOMAN.COM.
42 AMATEURNAKEDWOMEN.COM.
43 AMATEURNUDEMEN.COM.
44 AMATEURNUDETEENS.COM.
45 AMATEURNUDEWIVES.COM.
46 AMATEURNUDEWOMAN.COM.
47 AMATEURSETC.COM.
48 AMATUEREROTICA.COM.
49 AMAZINGORGIES.COM.
50 AMAZONSNUDE.COM.
51 AMERICANSPANKING.COM.
52 AMISH-DONKEY.COM.
53 AMPLANDMAIN.COM.
54 AMPLANDMOVIES.ORG.
55 AMPOLAND.COM.
56 ANALEXPLORATION.COM.
57 ANALMACHINES.COM.
58 ANALTV.COM.
59 ANASTASIAWEB.ORG.
60 ANGELODUCA.COM.
61 ANIMALSEXBEASTIALITY.COM.
62 ANIMALSEXMPEGS.COM.
63 ANIMEPLEASURES.COM.
64 ARE-YOU-GAY.COM.
65 ARGENTINAWOMAN.COM.
66 ARTISTICMODELS.COM.
67 ASAINTHUMBS.COM.
68 ASHLEYMADISONS.COM.
69 ASIAN-AVENUE.COM.
70 ASIAN-GOLD.COM.
71 ASIANGALLERYS.COM.
72 ASIANS2000.COM.
73 ASIANSHOWER.COM.
74 ASIANTHUMBS.COM.
75 ASIANTHUMS.COM.
76 ASIANXAVE.COM.
77 ASSCHERDIAMOND.COM.
78 ASSTATTOO.COM.
79 ASSWALLPAPER.COM.
80 ASTALASVISTA.COM.
81 ATIVANLORAZEPAM.COM.
82 ATTRACTIVELEGS.COM.
83 AVIEXPRESS.COM.
84 AWSOMETEENS.COM.
85 BACCART.COM.
86 BANG-THUMBS.COM.
87 BBSANDNYMPHET.COM.
88 BDSMCASTLE.COM.
89 BDSMSTORY.COM.
90 BEASTALITYPICTURES.COM.
91 BEASTIALITYSTORY.COM.
92 BEAUTIFULHENTAI.COM.
93 BETTERMASTURBATION.COM.
94 BEXTRADRUG.COM.
95 BIG-BOOBS-GALLERY.COM.
96 BIGBOOBSCOM.COM.
97 BIGBREASTLOVERS.NET.
98 BIGCLITPICTURES.COM.
99 BIGGESTBUST.COM.
100 BIGWHORE.COM.
101 BIKINIANIME.COM.
102 BIKINIASIAN.COM.
103 BIKINIBABES.COM.
104 BIZARRRE.COM.
105 BLACKCOCKWIFE.COM.
106 BLACKSNBLONDES.COM.
107 BLAKSONBLONDES.COM.
108 BLEEDINGVAGINAS.COM.
109 BLONDECARTOONS.COM.
110 BLOODRAYNETOPLESS.COM.
111 BLOORPHARMACY.COM.
112 BOARDJUNKIES.COM.
113 BOARDWHORES.COM.
114 BONDAGEWIZARD.NET.
115 BOOK-MARK.ORG.
116 BRALESSWIFE.COM.
117 BRANDERODERICKGALLERY.COM.
118 BREAKHERHYMEN.COM.
119 BREAKHERHYMEN.NET.
120 BREAKINGTHEHYMEN.COM.
121 BREITLINGNAVITIMER.COM.
122 BRIANASCURRY.COM.
123 BRITISHWOMAN.COM.
124 BRITNEYSPEARSL.COM.
125 BRITNEYSPEERS.COM.
126 BUBBASPARXX.COM.
127 BUSTYCARTOONS.COM.
128 BUTTBUNNIES.COM.
129 BUYADDERALL.COM.
130 BUYEFFEXOR.COM.
131 BUYINGHYDROCODONE.COM.
132 BUYLORCET.COM.
133 CALCONNECTIONS.COM.
134 CAMILLIA.COM.
135 CAMPNUDIST.COM.
136 CAMPUSVIDEOS.COM.
137 CANADAHEALTHPLAN.COM.
138 CANADIANFREIGHT.COM.
139 CARTOONPERSON.COM.
140 CARTOONPORN.COM.
141 CARTOONSTRIPPERS.COM.
142 CASINOTOPLIST.COM.
143 CASTRATIONPICTURES.COM.
144 CELEBRITIES-NAKED.COM.
145 CELEBSNVINTAGE.COM.
146 CELEXAGENERIC.COM.
147 CHARLIEREESE.COM.
148 CHEAPLORTAB.COM.
149 CHEERLEADERHARDCORE.COM.
150 CHERRYHYMEN.COM.
151 CHINKPORN.COM.
152 CHOBITSGALLERY.COM.
153 CHOBITSHENTAI.COM.
154 CHOBITSWALLPAPER.COM.
155 CIALISDOSAGE.COM.
156 CITYBINGO.COM.
157 CLEANPORNMOVIES.COM.
158 CODTRAMADOL.COM.
159 CONSUPTIONJUNTION.COM.
160 CORSETFETISH.COM.
161 COUPLENUDE.COM.
162 COUPLESPICTURES.COM.
163 COUPLESSEXPICS.COM.
164 CREAMPIEMPG.COM.
165 CUCKOLDHUMILIATION.COM.
166 CUMSHOTBLAST.COM.
167 CUMSLUTPARTY.COM.
168 CUPIDCAMS.COM.
169 CUPIDCAMS.NET.
170 CUPIDSINTRODUCTIONS.COM.
171 CUTEKIRSTEN.COM.
172 DATELINEPERSONALS.COM.
173 DEARPRUDIE.COM.
174 DEBBYBOONE.COM.
175 DEFLOWERVIRGIN.COM.
176 DESPERATELYSEEKINGSUSAN.COM.
177 DEVIANTS.COM.
178 DICTIONARYL.COM.
179 DIESELBUCKS.COM.
180 DIGIMONANIME.COM.
181 DIGIMONFANART.COM.
182 DIGIMONKARI.COM.
183 DIGIMONNAKED.COM.
184 DIGIMONPORNO.COM.
185 DIGIMONSORA.COM.
186 DIGIMONYAOI.COM.
187 DIGITALSWINGERS.COM.
188 DILBERTCARTOON.COM.
189 DILBERTCARTOONS.COM.
190 DISCOUNTPAXIL.COM.
191 DISCREETSWINGERS.COM.
192 DOCTORBIZARRO.COM.
193 DOGBESTIALITY.COM.
194 DOMAIGIRLS.COM.
195 DOMAIPHOTO.COM.
196 DOUBLE-DRILLED.COM.
197 DOUBLEVAGINA.COM.
198 DRAGONBALLBULMA.COM.
199 DRAGONBALLYAOI.COM.
200 DRIPPINGCLITS.COM.
201 DRIPPINGCREAMPIES.COM.
202 DRUGLITHIUM.COM.
203 DRUGPDR.COM.
204 DRUGWHORES.COM.
205 DUNTS.COM.
206 EBONYARCHIVES.NET.
207 EBONYMANSION.COM.
208 EBONYPERSONALS.COM.
209 EBONYUNIVERSE.COM.
210 EDWARDNORTON.COM.
211 EJACULATIONSQUIRTERS.COM.
212 ELEPHANTLINK.COM.
213 ELEPHANTLIST.NET.
214 ENGLISHSWINGERS.COM.
215 EROTICPIX.COM.
216 EROTICPLAYGROUND.COM.
217 EROTICSPORTS.COM.
218 EUROTEENAGER.COM.
219 EVALANGORIA.COM.
220 EVALONGORIANUDE.COM.
221 EVANGELIONWALLPAPER.COM.
222 EXCLAMATION-EROTIC-SEX-STORIES.COM.
223 EXTREMETHUMBZ.COM.
224 EZIHOST.COM.
225 FAMILYNATURALIST.COM.
226 FAMOUSLADIES.COM.
227 FARMXXX.COM.
228 FARSCAPEWALLPAPER.COM.
229 FEMALEASSHOLES.COM.
230 FEMALECLEAVAGE.COM.
231 FERNANDAMARTINELLI.COM.
232 FINDSEX.COM.
233 FIORICETGENERIC.COM.
234 FIRSTEJACULATION.COM.
235 FISTINGASSHOLES.COM.
236 FISTINGL.COM.
237 FISTINGORGY.COM.
238 FLASHPUBLIC.COM.
239 FLOPPYKNOCKERS.COM.
240 FLUOXETINEHCL.COM.
241 FLUOXETINEHYDROCHLORIDE.COM.
242 FLUTICASONEPROPIONATE.COM.
243 FOOTWORSHIPPARTY.COM.
244 FOZYABBS.COM.
245 FREE-BIGTIT.COM.
246 FREEBLACKMOVIES.ORG.
247 FREECELEBNUDITY.COM.
248 FREECHEERLEADERCAMS.COM.
249 FREEDILDOCAMS.COM.
250 FREEDOUJIN.COM.
251 FREEINCESTSTORY.COM.
252 FREELESBIANWEBCAMS.COM.
253 FREENAKEDINDIANWOMEN.COM.
254 FREENAUGHTYWEBCAMS.COM.
255 FREENUDEINDIANWOMEN.COM.
256 FREENUDELATINAS.COM.
257 FREENYLONPORN.COM.
258 FREENYMPHET.COM.
259 FREEORGYCAMS.COM.
260 FREEPERSONALCAMS.COM.
261 FREEPORNSTORY.COM.
262 FREEPORNTV.COM.
263 FREESCHOOLGIRLCAMS.COM.
264 FREESEXEROTICSTORIES.COM.
265 FREESEXUSA.COM.
266 FREESMUTSITES.COM.
267 FREETEENAGECAMS.COM.
268 FREETOILETCAMS.COM.
269 FREETWINKCAMS.COM.
270 FREEUPSKIRTCAMS.COM.
271 FREEVOYEURNUDEPHOTOS.COM.
272 FREEVOYEURNUDEPICS.COM.
273 GALLERIESTITS.COM.
274 GALLERYTHONG.COM.
275 GALLERYTHONGS.COM.
276 GAMBLING101.COM.
277 GANGBANGHIGH.COM.
278 GAPINGBUTTHOLE.COM.
279 GAPINGGIRLS.COM.
280 GAPINGGIRLS.NET.
281 GAYBLACKDUDES.COM.
282 GAYBUKAKE.COM.
283 GAYCOWBOYS.COM.
284 GAYDATECAM.COM.
285 GAYEDUCATION.COM.
286 GAYMOVIELIST.NET.
287 GAYPROMOTE.COM.
288 GAYSEARCH.COM.
289 GAYSEXPLANET.COM.
290 GAYTOGAYS.COM.
291 GENERICACCUTANE.COM.
292 GEORGIANMALL.COM.
293 GIANTESSGALLERIES.COM.
294 GIANTESSGALLERY.COM.
295 GIANTESSVORE.COM.
296 GIANTESSWOMAN.COM.
297 GIGANTICASSES.COM.
298 GIRLNATURALS.COM.
299 GIRLSINLINGERIE.COM.
300 GLITTERSEX.COM.
301 GLORYHOLECOCKS.COM.
302 GORSLAVE.COM.
303 GRANNYANAL.COM.
304 GRANNYBUTTS.COM.
305 GRANNYMPEGS.COM.
306 GREEN-GAY.COM.
307 GREG-PIX.COM.
308 GYNOVIDEO.COM.
309 GYNOVIDEOS.COM.
310 HAIRYNUDEWOMEN.COM.
311 HAIRYPUSSYWOMEN.COM.
312 HAIRYSWINGERS.COM.
313 HARDCOREJUNKEY.NET.
314 HARDECOREJUNKY.COM.
315 HARRAHAS.COM.
316 HARUNOSAKURA.COM.
317 HEARTDETECTIVES.NET.
318 HELZBERG.ORG.
319 HENTAICHEERLEADERS.COM.
320 HENTAIGIF.COM.
321 HIGHHEELGALLERIES.COM.
322 HILTONMINNEAPOLIS.COM.
323 HILTONNIAGARA.COM.
324 HILTONSIDEKICK.COM.
325 HISBUTT.COM.
326 HORNEYCOUPLES.COM.
327 HORNYGRANNYSEX.COM.
328 HORNYPREGGOS.COM.
329 HORNYPRISONERS.COM.
330 HORSEBESTIALITY.COM.
331 HOTGAYBEARS.COM.
332 HOTNAKEDOLDERWOMEN.COM.
333 HOTNUDEBLACKWOMEN.COM.
334 HOTNUDEOLDERWOMEN.COM.
335 HOUSEOFSLUTS.COM.
336 HUBLOTWATCHES.COM.
337 IGF2.NET.
338 IMPERFORATEHYMEN.COM.
339 IMPERIALPALACECASINO.COM.
340 IMPREGNATION.NET.
341 INDIANNAKEDWOMEN.COM.
342 INDIANNUDEGIRLS-NUDEWOMEN.COM.
343 INDIANSEXCOM.COM.
344 INERRACIAL.COM.
345 INFLATIONFETISH.COM.
346 INTERACIALPERSONALS.COM.
347 INTERRACIAL.COM.
348 INTERRACIAL.ORG.
349 INTERRACIALDATINGSERVICE.COM.
350 INTERRACIALSITE.COM.
351 INTERRACIEL.COM.
352 INTRACIALPORN.COM.
353 INTRRACIALPORN.COM.
354 INUYASHAYAOI.COM.
355 JAPANESENUDIST.COM.
356 JASARAS.COM.
357 JENIFERHAWKINS.COM.
358 JENNALEWISNUDE.COM.
359 JENNIFERANISTONTOPLESS.COM.
360 JENNIFERHENDRICK.COM.
361 JESSICAKARR.COM.
362 JESSICAMENDOZA.COM.
363 JESSICARABBITNUDE.COM.
364 JESSICASAVITCH.COM.
365 JOGGSGALLERY.COM.
366 JOHNCREASY.COM.
367 JORDANTOPLESS.COM.
368 JOSHUARASKIN.COM.
369 JUGGYBABES.COM.
370 JUSTHENTAI.COM.
371 KAGOMEHENTAI.COM.
372 KANSASCITYSTRIPPERS.COM.
373 KARLANELSON.COM.
374 KASUMIHENTAI.COM.
375 KENSHINWALLPAPER.COM.
376 KEYWESTHILTON.COM.
377 KIMCATTRELL.COM.
378 KIRAYAMATO.COM.
379 LARACROFTPICTURES.COM.
380 LARGEBLACKCOCK.COM.
381 LARGEBLACKCOCKS.COM.
382 LARGESTCLITS.COM.
383 LARGESTCOCK.COM.
384 LASVEGASL.COM.
385 LATINAVIDEOS.COM.
386 LEAHREMININUDE.COM.
387 LEGALMEDSONLINE.NET.
388 LESBIANPRON.COM.
389 LESBIANSCOM.COM.
390 LESBIANTHUMBNAILS.COM.
391 LESBIANTRAINING.COM.
392 LESBIANTRAINING.NET.
393 LESBIENPICTURES.COM.
394 LESBOTOONS.COM.
395 LETSBULLSHIT.COM.
396 LEVITRAPILL.COM.
397 LEVITRAPILLS.COM.
398 LICKLICKA.COM.
399 LINDSAYLOHANBIKINI.COM.
400 LINDSAYLOHANBOOBS.COM.
401 LINDSAYLOHANNIPPLE.COM.
402 LINDSAYLOHANSNIPPLE.COM.
403 LINDSAYLOHANTOPLESS.COM.
404 LITATOPLESS.COM.
405 LITTLESCHOOLGIRLS.COM.
406 LOLICONHENTAI.COM.
407 LOLITAPASSWORDS.COM.
408 LORCETPRESCRIPTION.COM.
409 LORENABOBBITT.COM.
410 LUSCIOUSLESBIANS.COM.
411 LUSTVISION.COM.
412 LUXORCASINO.COM.
413 MAFIASERVER.COM.
414 MALEBULGES.COM.
415 MALEEROTIKA.COM.
416 MALETORSO.COM.
417 MANDINGOPORN.COM.
418 MAPQUESTL.COM.
419 MARIAAGNESI.COM.
420 MARIAVONTRAPP.COM.
421 MARLYNCHAMBERS.COM.
422 MARRIOTTATLANTA.COM.
423 MARRIOTTBOSTON.COM.
424 MARRIOTTMIAMI.COM.
425 MARRIOTTPHILADELPHIA.COM.
426 MARRIOTTSANFRANCISCO.COM.
427 MASSAGEHANDJOBS.COM.
428 MASSIVECLITORIS.COM.
429 MASSIVECLITORISES.COM.
430 MASSIVEPINK.COM.
431 MASSIVEWOMEN.COM.
432 MASTERBATIONMOVIES.COM.
433 MASTURBATIONLESSONS.COM.
434 MATCHDOCTOR.ORG.
435 MATCHMACKER.COM.
436 MATHEWMANWELLER.COM.
437 MATURETALENT.COM.
438 MEGAMANHENTAI.COM.
439 MENWANTED.COM.
440 METRONIDAZOLEFLAGYL.COM.
441 MICHEALSCRAFTS.COM.
442 MITOSISANIMATION.COM.
443 MIUMIUSHOES.COM.
444 MODELPICTURES.COM.
445 MODELSTOPLESS.COM.
446 MOMSASLUT.COM.
447 MOMSASLUT.NET.
448 MONSTERL.COM.
449 MONTREALCANADIAN.COM.
450 MONTREALVILLE.COM.
451 MOVADOGENTRY.COM.
452 MUFFDIVINGMOVIES.COM.
453 MULLETFETISH.COM.
454 MYWHITEPANTIES.NET.
455 NAKEDDIAMONDS.COM.
456 NAKEDHENTAI.COM.
457 NARUTOCOSPLAY.COM.
458 NARUTODOUJINSHI.COM.
459 NARUTOPICTURES.COM.
460 NARUTOWALLPAPERS.COM.
461 NASDAQL.COM.
462 NATASJATGP.COM.
463 NATURALISTTEEN.COM.
464 NATURALISTTEENS.COM.
465 NATURISMFAMILY.COM.
466 NATURISMGIRLS.COM.
467 NAVELPICS.COM.
468 NEWGALS.ORG.
469 NEWORLEANSHILTON.COM.
470 NICEFANNY.COM.
471 NICOLEBAYARD.COM.
472 NIGGERCARTOONS.COM.
473 NIGGERPICTURES.COM.
474 NIGHTHOSTING.COM.
475 NIGHTPROWLER.COM.
476 NIKKISTAR.COM.
477 NONNUDEBBS.COM.
478 NUDENAKEDINDIANWOMEN.COM.
479 NUDEPORNSTARPHOTOS.COM.
480 NUDEPORNSTARSPHOTOS.COM.
481 NUDESMOOTHIES.COM.
482 NUDESTPICTURES.COM.
483 NUDETRANSSEXUALSPICS.COM.
484 NUDISMSMOOTH.COM.
485 NUDISTGATHERING.COM.
486 NUDISTPARTY.COM.
487 NUDISTSAMPLES.COM.
488 NUDISTSFREEPICTURES.COM.
489 NUDISTSMOOTHIES.COM.
490 NYLONZONE.COM.
491 NYMPHETBBS.COM.
492 NYMPHETMODELS.COM.
493 NYMPHETPHOTO.COM.
494 NYMPHETSNUDE.COM.
495 OBESITYPHOTOS.COM.
496 OLDESTWOMAN.COM.
497 OLYMPICPICS.COM.
498 ONE2ONEMATCH.NET.
499 ONLINEGAMBILING.COM.
500 ONLINELEVITRA.COM.
501 ONMONEYL.COM.
502 ONTARIOEMPLOYMENT.COM.
503 ORALTV.COM.
504 ORDERULTRAM.COM.
505 ORGASMGALLERIES.COM.
506 ORGASMMPEGS.COM.
507 OTTAWAROUGHRIDERS.COM.
508 OVERNIGHTHYDROCODONE.COM.
509 OZZYPICS.COM.
510 P2PDOWNLOADS.COM.
511 PAIGOWONLINE.COM.
512 PAIGOWTILES.COM.
513 PALACEOFPLEASURE.COM.
514 PAMELAANDERSOM.COM.
515 PANHENTAI.COM.
516 PARESIS.COM.
517 PEESQUATTING.COM.
518 PENETRATION.COM.
519 PENETRATIONVALLEY.COM.
520 PENTHOUSEPICTURES.COM.
521 PERKYBIGTITS.COM.
522 PERSONALSUK.COM.
523 PERVERTEDHENTAI.COM.
524 PHENTERMINECHEAPEST.COM.
525 PHOTOSOFSWINGERS.COM.
526 PIAGETWATCH.COM.
527 PIAGETWATCHES.COM.
528 PICTURESNUDIST.COM.
529 PILLPROMOTE.COM.
530 PINK-WORLD.COM.
531 PISSINGWATERSPORTS.COM.
532 PLANETULTIMATE.NET.
533 PLAYGIRLMEN.COM.
534 PLEASURED.COM.
535 PLEASUREROOM.COM.
536 PLEASURESTATION.COM.
537 PLIOCENE.COM.
538 POKEMONANIME.COM.
539 PORNOACTRESS.COM.
540 PORNPICSVIDS.COM.
541 PORNSTARBOOK.NET.
542 PORNSTARSNUDEPHOTOS.COM.
543 PORNSTARSNUDEPICS.COM.
544 PORNWOMAN.COM.
545 PORNWOMEN.COM.
546 PREGNANCYSPOTTING.COM.
547 PREGNANTNUDITY.COM.
548 PREGNANTSITE.COM.
549 PREGNANTWOMAN.COM.
550 PRICELESSDRUNKGIRLS.COM.
551 PRICELESSNUDITY.COM.
552 PRIMERICAFINANCIAL.COM.
553 PRIVATEVOYUER.COM.
554 PUBLICSTREAKING.COM.
555 PUERXTC.COM.
556 PUEXTC.COM.
557 PUFFYBREAST.COM.
558 PUFFYTIT.COM.
559 PURCHASEADDERALL.COM.
560 PURCHASEHYDROCODONE.COM.
561 PURCHASEVALIUM.COM.
562 PURCHASEXANAX.COM.
563 PUREBITCH.COM.
564 PURESLUT.COM.
565 PUSSYLESBO.COM.
566 PYRETHRIN.COM.
567 QUACKO.COM.
568 QUICKENL.COM.
569 RANCIDPICTURES.COM.
570 RANDNWEBPAGEDESIGN.COM.
571 RATEMYAPPEARANCE.COM.
572 RAYBOURQUE.COM.
573 REALTIMEDRUGS.COM.
574 REBUILTMOTORS.COM.
575 REDHEADCAMS.COM.
576 REPLICAMOVADO.COM.
577 RICKETTSIA.COM.
578 RICKSAVINETTI.COM.
579 RIVERBOATGAMBLING.NET.
580 ROADRUNNERWEBMAIL.COM.
581 ROLEX16264.COM.
582 ROMANCASINOS.COM.
583 RONSHAWSROSES.COM.
584 ROPED.COM.
585 RUSSIANNATURISM.COM.
586 RXPLATINUM.COM.
587 SAKURALEMON.COM.
588 SAKURANARUTO.COM.
589 SANDRAMAR.COM.
590 SANFRANCISCOHILTON.COM.
591 SANFRANCISCOMARRIOTT.COM.
592 SARAHMANNERS.COM.
593 SCABIOSA.COM.
594 SCREWMAGAZINE.COM.
595 SELFSUCKGALLERY.COM.
596 SEXACS.COM.
597 SEXATTORNEY.COM.
598 SEXFANATIC.COM.
599 SEXHUNGYJOES.COM.
600 SEXPROMOTE.COM.
601 SEXPROWLER.COM.
602 SEXSPONSORS.COM.
603 SEXXXSTORIES.COM.
604 SEXYASAINS.COM.
605 SEXYASSIN.COM.
606 SEXYFLEXYGIRLS.COM.
607 SHAVEDGRANNIES.COM.
608 SHAVEDHAIR.COM.
609 SHAVEDHUNKS.COM.
610 SHEMALEFREAKSHOW.COM.
611 SHEMALEHUGECOCK.COM.
612 SHES18.COM.
613 SHOCKING-GAYSITES.COM.
614 SHOCKINGGAYSITES.NET.
615 SHOCKINGVIRGINS.COM.
616 SHOWERSPYCAMS.COM.
617 SHYHEIM.COM.
618 SIMPSONNUDE.COM.
619 SIMPSONSXXXXING.COM.
620 SINGLEAD.COM.
621 SINGLEPERSONALS.COM.
622 SINGLESCOLORADO.COM.
623 SKATERTWINKS.COM.
624 SLAYERLYRICS.COM.
625 SLLADVANTAGE.COM.
626 SLUTHOSTING.COM.
627 SLUTWIFESTORY.NET.
628 SMOOTHIECLUB.COM.
629 SMUTBOARDS.COM.
630 SMUTWIZARD.COM.
631 SNAKELIST.COM.
632 SNAKES-WORLD.COM.
633 SNAKESWORD.COM.
634 SNAKSWORLD.COM.
635 SNATCHMOVIE.COM.
636 SNLCLIPS.COM.
637 SPACECARTOONS.COM.
638 SPEEDYCLICKL.COM.
639 SPIDERENTERTAINMENT.COM.
640 SPIDERMANPICS.COM.
641 SPIDERSPLACE.COM.
642 SPLOSHFETISH.COM.
643 STACYKLEIBER.COM.
644 STARCRAFTGUNDAM.COM.
645 STAUERWATCHES.COM.
646 STEPHENPEARCY.COM.
647 STOCKINGSMODELS.COM.
648 STORIESABOUTSEX.COM.
649 STRETCHEDPUSSIES.COM.
650 STRETCHEDVAGINA.COM.
651 STRIPPERVIDS.COM.
652 STRIPTEASETHENXXXX.COM.
653 STRIPTEASETHENXXXX.NET.
654 SUCKTHATDICK.COM.
655 SUCKTHATDICK.NET.
656 SUNBATHINGTEENS.COM.
657 SUSANESTRICH.COM.
658 SUSANFREI.COM.
659 SUZUKICANADA.COM.
660 SWEETIEXXX.COM.
661 SWEETPINKHOLES.COM.
662 SWIMSUITTOPLESS.COM.
663 SZILVIA.COM.
664 TAGHUER.COM.
665 TAIWANESEWOMAN.COM.
666 TAMPAMARRIOTT.COM.
667 TARAREIDBIKINI.COM.
668 TARAREIDGALLERY.COM.
669 TARAREIDNIPPLE.COM.
670 TEENAGEFISTING.COM.
671 TEENAGEHOLES.COM.
672 TEENAGERPREGNANCY.COM.
673 TEENBEASTIALITY.COM.
674 TEENSEXY.COM.
675 TEENTHUMS.COM.
676 TERAREED.COM.
677 TERRAREED.COM.
678 TEXAS-SLUTS.COM.
679 TEXASNUDIST.COM.
680 THECLITORIS.COM.
681 THEDAILYASIAN.COM.
682 THEELEPHANTLIST.COM.
683 THEHNU.NET.
684 THEHUNNS.COM.
685 THELOSTPRINCE.COM.
686 THESHEMP.COM.
687 THETRUEVOYEUR.NET.
688 THIMBZILLA.COM.
689 THIOUREA.COM.
690 THONGTOPLESS.COM.
691 THONGWET.COM.
692 THTHUN.COM.
693 THTHUN.NET.
694 THUMZILA.COM.
695 THUNBNAILPOST.COM.
696 TIFFANYJEWELLERY.COM.
697 TIGERSLEGGROOM.COM.
698 TINYHENTAI.COM.
699 TINYNUDIST.COM.
700 TITSL.COM.
701 TOONHENTAI.COM.
702 TOONSHEMALES.COM.
703 TOONTGP.COM.
704 TOPLESSTANNING.COM.
705 TOPPEEING.COM.
706 TOPSHITTING.COM.
707 TORONTODJS.COM.
708 TORONTOJEWELLERY.COM.
709 TORONTOLACROSSE.COM.
710 TORONTOMODELING.COM.
711 TORONTOMODELLING.COM.
712 TRAMADOLHCI.COM.
713 TRANNYPASSWORDS.COM.
714 TRASHYMOMS.COM.
715 TRAVELODGE.NET.
716 TRICIAWILD.COM.
717 TRIGGERTHUMB.COM.
718 TRIGUNHENTAI.COM.
719 TRIGUNMAXIMUM.COM.
720 TRIGUNPICS.COM.
721 TRIGUNVASH.COM.
722 TRIGUNWALLPAPER.COM.
723 TSLIST.ORG.
724 TWINKPICTURES.COM.
725 TWINKTOONS.COM.
726 TWINKVIDEOS.COM.
727 UCCHOCKEY.COM.
728 UKSWINGER.COM.
729 ULTRA-PASSWORD.COM.
730 ULTRA-PASSWORDS.COM.
731 UNREALBOOBS.NET.
732 UPSKIRTCHAMP.COM.
733 VALIUMDOSAGE.COM.
734 VALIUMINFORMATION.COM.
735 VANCOUVERCANUCKS.NET.
736 VANCOUVERCANUKS.COM.
737 VANDREADHENTAI.COM.
738 VENTURASTRIPPERS.COM.
739 VIAGRADOSAGE.COM.
740 VICTORIABOWMAN.COM.
741 VICTORIASILVSTED.COM.
742 VICTORIAVETRI.COM.
743 VIDELHENTAI.COM.
744 VIOXXMEDICATION.COM.
745 VIOXXPILL.COM.
746 VIRGINBONDAGE.COM.
747 VISIONTECK.COM.
748 VIXENDOMME.COM.
749 VOLKSWAGENCANADA.COM.
750 VOTEURWEB.COM.
751 VOUEURWEB.COM.
752 VOYEIRWEB.COM.
753 VOYEURNUDEPHOTOS.COM.
754 VOYEZ.COM.
755 WADEEDWARDS.COM.
756 WAFTOFHENTAI.COM.
757 WATERSPORTSLINKS.COM.
758 WATERSPORTSVIDEOS.COM.
759 WEBCAMSL.COM.
760 WEBMASTERUNIVERSE.COM.
761 WEBVOYEUR.COM.
762 WELOVETEENS.COM.
763 WHALE-TAIL.NET.
764 WHORETV.COM.
765 WIFEDISCIPLINE.COM.
766 WINNIPEGJETS.COM.
767 WIVESPICTURES.COM.
768 WOMANNUDE.COM.
769 WOMENNUDITY.COM.
770 WORLDBOOTY.COM.
771 WORLDSEXL.COM.
772 WWW3PIC.COM.
773 WWWABADBOY.COM.
774 WWWABSOLUTEAGENCY.COM.
775 WWWADULTZINE.COM.
776 WWWALLBLACKMOVIES.COM.
777 WWWASHLEYMADISON.COM.
778 WWWATLANTABRAVES.COM.
779 WWWAUNTPOLLY.COM.
780 WWWBIGCHURCH.COM.
781 WWWBJ21.COM.
782 WWWBULLDOGLIST.COM.
783 WWWCARLASCHOICE.COM.
784 WWWCASINOMAGIC.COM.
785 WWWCATLIST.COM.
786 WWWCHRISTIANSINGLESDATING.COM.
787 WWWCIRCUSCIRCUSCASINO.COM.
788 WWWCOWLIST.COM.
789 WWWDIRTYDAUGHTER.COM.
790 WWWDOUBLEDAYBOOKCLUB.COM.
791 WWWDOUBLEDRILLED.COM.
792 WWWDRIVERGUIDE.COM.
793 WWWDVDEMPIRE.COM.
794 WWWEASYPIC.COM.
795 WWWEBONYARCHIVES.COM.
796 WWWEBONYBLACK.NET.
797 WWWETEAMZ.COM.
798 WWWEXCEL.COM.
799 WWWEXOTICA.COM.
800 WWWFREEBIGMOVIES.COM.
801 WWWFREEFORUM.COM.
802 WWWFREEGAYPIX.COM.
803 WWWFREEPICSERIES.COM.
804 WWWFREEXMOVIES.COM.
805 WWWFREEXPICTURES.COM.
806 WWWXXXXINGFREEMOVIES.COM.
807 WWWGALLVIEW.COM.
808 WWWGAMEWINNERS.COM.
809 WWWGAYPICLIST.COM.
810 WWWGAYSPA.COM.
811 WWWGRAMPLAND.COM.
812 WWWGRANDCASINOS.COM.
813 WWWIGF2.COM.
814 WWWJUICYBOOBS.COM.
815 WWWLADYLUCK.COM.
816 WWWLANASBIGBOOBS.COM.
817 WWWLEZBOMOVIES.COM.
818 WWWLOLITANU.COM.
819 WWWLOVEBYNET.COM.
820 WWWMATUREPOST.COM.
821 WWWMILKMANBOOK.COM.
822 WWWMMM100.COM.
823 WWWMONTECASINO.COM.
824 WWWMYFREEPHOTOS.COM.
825 WWWNEWYORKNEWYORK.COM.
826 WWWOUTPERSONALS.COM.
827 WWWPICWAREHOUSE.COM.
828 WWWPLANETMPG.COM.
829 WWWPLUMPRUMPS.COM.
830 WWWPORNSTARFINDER.NET.
831 WWWPRIVATECHANNELS.COM.
832 WWWPRIVATECINEMA.COM.
833 WWWPRIVATELIVE.COM.
834 WWWPRIVATESHOPS.COM.
835 WWWPUPPYKIBBLE.COM.
836 WWWPURESCANS.COM.
837 WWWRAIDERS.COM.
838 WWWRENVIL.COM.
839 WWWRUNESCAPE.COM.
840 WWWSEXGRANNIES.COM.
841 WWWSHAVEDGOAT.COM.
842 WWWSINDYMARGOLIS.COM.
843 WWWSLEAZYDREAM.COM.
844 WWWSMOKINMOVIES.COM.
845 WWWSONOFSNAKE.COM.
846 WWWTEENAX.COM.
847 WWWTGW.COM.
848 WWWTHEMIRAGE.COM.
849 WWWTOPIX.NET.
850 WWWTSLIST.COM.
851 WWWTWISTKIM.COM.
852 WWWUGAS.COM.
853 WWWULTRADONKEY.COM.
854 WWWVIDSVIDSVIDS.COM.
855 WWWYAHHO.COM.
856 WWWYAHOOL.COM.
857 WWWYAHOOO.COM.
858 XANAXDOSAGE.COM.
859 XANAXDRUG.COM.
860 XANAXPHARMACY.COM.
861 XANAXPRESCRIPTION.COM.
862 XXPICTURES.COM.
863 XXX-SEX.COM.
864 XXXDISNEY.COM.
865 XXXHOTSPOTS.COM.
866 YAOIDOUJINSHI.COM.
867 YHUMBZILLA.COM.
868 YKAHOO.COM.
869 YNOTADULT.COM.
870 YOUNGESTSLUT.COM.
871 YOUNGLIPS.NET.
872 YOUNGMODELS.COM.
873 YOUNGMODELSINCORPORATED.COM.
874 YOUNGSINGLESWEEKEND.NET.
875 YOUNGYEARS.COM.
876 YOUREASYDNS.COM.
877 YOURFREEHOST.COM.
878 YOUROFFER2DAY.COM.
879 YURIANIME.COM.
880 YURIHENTAI.COM.
881 ZOLOFTINFORMATION.COM.

Notice the Billing Contact / ADULTFRIEND-FINDER.COM. / Turvill
Consultants and owner/controller of the 881 domains:

http://groups-beta.google.com/group...coring=d&hl=en&

Results 1 - 10 of 163 for Consultants , Turvill

Domain Name: AMATEURNUDEWOMAN.COM

Registrant [NIC-20721]:
Parsons, Greg
Baltic Consultants
77 Mowat Ave.
St. 300
Toronto
Ontario
CA
M6K3E3

Administrative Contact [NIC-20721]:
Parsons, Greg
Baltic Consultants
77 Mowat Ave.
St. 300
Toronto
Ontario, CA
M6K3E3
Phone: +1.4165366020

Billing Contact [NIC-12257]:
Consultants, Turvill
Turvill Consultants
265 Port Union Rd.
15525
Scarborough
Ontario, CA
M1C4Z7
Phone: +1.4165366020

--

Domain Name: ZOLOFTINFORMATION.COM

Registrant [NIC-12260]:
Administrator, DNS
Turvill Consultants Ltd - RD
265 Port Union Rd Suite 15525
Scarborough
Ontario
CA
M1C 2L3

-

Domain Name: WWWBJ21.COM

Registrant [NIC-22084]:
Consultants, Turvill
Turvill Consultants
265 Port Union Rd.
15525
Scarborough
Ontario
CA
M1C4Z7

-

Domain Name: MANDINGOPORN.COM

Registrant [NIC-12257]:
Consultants, Turvill
Turvill Consultants
265 Port Union Rd.
15525
Scarborough
Ontario
CA
M1C4Z7

--

Domain Name: WWWYAHHO.COM

Registrant [NIC-21699]:
Consultants, Turvill
Turvill Consultants
265 Port Union Rd.
15525
Scarborough
Ontario
CA
M1C4Z7

=====

This one is very itneresting, it redircets to:
http://www.investorsedge.com/

Domain Name: 401KL.COM

Registrant [NIC-22092]:
Consultants, Turvill
Turvill Consultants
265 Port Union Rd.
15525
Scarborough
Ontario
CA
M1C4Z7

-

investorsedge.com

Only 1 hit in Google from 1998 ...

http://groups-beta.google.com/group...sedge.com+abuse

I get BUSY with a spammer-- Investorsedge.com
Subj: more info

Date: 98-04-05 07:56:54 EDT From: <snipped for
privacy> To: abuse
<AT> gte <DOT> net, gte <DOT> net <AT> sh <DOT> abuse <DOT> net To ...

news.admin.net-abuse.email - Apr 7 1998, 12:02 am by Anonymous Sender
- 2 messages - 2 authors

and 1 hit in Google for SUNGROUP1

Investors Edge 3-Month Trial Offer (http://www. ...
.... his web page. Thank you. k...@NETPAGE.COM sungroup1@aol.com
Unwanted junk
e-mail. Consider this a return to sender. This address ...
news.admin.net-abuse.sightings - Mar 23 1998, 2:53 pm by Frederi108

---

IP Addresses: 66.207.212.146
IP Country: CANADA
Reverse IP Lookup: IP hosts 31 domains

Hosting Company Name:
ICANN Registrar: INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM
Creation Date: Feb 15 2004
Expiry Date: Feb 15 2006

Web Server: N/A
Website Status: N/A

Registrant:
Turvill Consultants - IE
265 Port Union Rd
Suite 15525
Scarborough, Ontario M1C 2L3
CA
416-536-6020

--

http://whois.webhosting.info/66.207.212.146

1 123BUDDYICONS.COM.
2 ABOUTDAYTRADING.COM.
3 BACCARET.COM.
4 BIGONLINERX.COM.
5 CENTERFOLDWEBCAMS.COM.
6 COVERGIRLWEBCAMS.COM.
7 DRUGLISTINGS.COM.
8 DRUGPEDDLERS.COM.
9 EXTRAMEDS.COM.
10 FREEWEBCAMANGELS.COM.
11 FREEWEBCAMCHAT.BIZ.
12 FTMARKETWATCH.COM.
13 HISTORICALSTOCKS.COM.
14 INSTALLBUCKS.COM.
15 INVESTORSEDGE.COM.
16 JUSTPRESCRIPTIONS.COM.
17 LEGALMEDSONLINE.COM.
18 MEDICINEMONEY.COM.
19 ORIGINALMEDS.COM.
20 PANGEA-INVESTMENTS.COM.
21 PANGEAINVESTMENTS.NET.
22 PANGEAINVESTMENTS.ORG.
23 PANGEAPROCESSING.NET.
24 PREMIERDRUGSRX.COM.
25 PREMIUMPASS.BIZ.
26 PURCHASESTOCKS.COM.
27 STOCKHAWK.COM.
28 STOCKRATES.COM.
29 SUPREMECASINO.COM.
30 WILLHILLS.COM.
31 WORLDSEARCHRX.COM.

--

Registrant:
OKB Offers
701 Rossland Rd East Suite 323
Whitby, Ontario L1N 9K3
CA
1-403-770-8348

--

Registrant:
Turvill Consultants - NARD
265 Port Union Rd
Suite 15525
Scarborough, Ontario M1C 2L3
CA
416-536-6020

Domain Name: SUPREMECASINO.COM

http://groups-beta.google.com/group...PREMECASINO.COM

---

Brian Fabian
.... Reference:
http://arbiter.wipo.int/domains/dec...tml/2002/d2002-
0449 .html ===== Whois: supremecasino.com - 64.157.12.88 ...
news.admin.net-abuse.email - May 17 2003

http://groups-beta.google.com/group...987129849?hl=en

============================
Whois: slickcash.com - 66.230.226.22
Registrant: Turvill Consultants Limited
265 Port Union Rd Suite 15525
Scarborough, Ontario M1C 4Z7, CA
416-536-6020 - Fax: 416-536-4585
Administrative and Technical Contact:
ADMINISTRATOR, DNS b...@cupidcams.com
265 Port Union Rd Suite 15525
Scarborough, Ontario M1C 4Z7, CA
416-536-6020 - Fax:416-536-4585
Record expires on 02-18-2004
Record created on 02-18-2003
Domain servers in listed order:
NS1.YOUREASYDNS.COM 64.157.12.80
NS2.YOUREASYDNS.COM 66.230.214.110
=============================

--

Ingenious ways how to track who did the send.
.... Lots of possibilities to click but basically only three. ----
Spam for supremecasino.com (affiliate ID ...
alt.spam - May 25 2002, 12:51 am by spaml...@nil.nil

http://groups-beta.google.com/group...baede16bd?hl=en

The above is an excellent article by Spamless of some of the "tricj's"
Brian and krew have played on us (tinu) all.

Cheers,

SuN

--
"No, Stalker Kook... it's universal knowledge that the 555 prefix is a
fictional telephone prefix in North America, that number is invalid.
No one has to state that, it's a given, 555 as a bogus telephone
prefix has been that way for literally decades."

-Stalker Kook Darren Glen Brothers on (416) 555-1122; 20 Jun 2005

<http://groups-beta.google.com/group...32079cbc8?hl=en>

"Bellcore is now giving out numbers with 555 prefixes to businesses
nationwide. 555 numbers work in every North American area code."

-Greg Monti; 8 May 1995 (ten *years* earlier) - 555 Prefix Goes Public