Via Peter Warren, it’s a phoney email suggesting that the sinister puppetmaster of the Conservative Hidden Agenda[tm] has spoken…
(Email’s content in the extended entry)
A computer expert on the show says he’s run a traced the email to St.Petersburg, Russia, which is a sign that it’s created by someone intent on hiding their tracks who has a little more knowledge of the internet than the average spoofer. The account was opened Dec.18, 2005.
Furthermore, as a member of the VRWC, I can also assure folks that it didn’t come from us.
Update – More on this case of the spy who spammed me….
Upperdate – Skimming the comments, at the rate the resident SDA “geeks” are going, expect disclosure of the culprit’s shoe size by mid-afternoon. Heh.
*****
From: National Council
To: standupf@standupforcanada.net
SUBJECT: JUST A FEW DAYS LEFT…NOTHING TO WORRY ABOUT
Date: Sun., 15 Jan. 2006 06:28:44 +0300
Dear Fellow Conservatives:
These are exciting times. Here we are in the home stretch on our way to victory in Election 2006!
In just a few more days, our leader Stephen Harper will become the next Prime Minister of Canada!
As your Chair, I want to thank each and everyone of you for your work in bring us so close to the victory. During a campaign like this one, it is not always possible or wise to speak about every details of our plans. Don’t be confused or upset by Stephen saying that he has “evolved.” After all, winning is the name of the game.
When we form Government on Jan. 23rd., be rest assured that we will not let you and your families down. As promised, all the issues that are precious to you will be dealt with. We will have the power to get on with repairing the social fabric of this country and restoring the Christian values we all hold dear.
Keep the faith, keep up the pressure, and God bless Canada.
Don
PS: This is a post-only mailing — please do not reply to this message
*****
As much as I am not a Stronach fan…I think she was referring to the other email from earlier in the week. Here – this was on ctv’s site, from Jan 11th.
http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20060111/ELXN_Stronach_response_060111?s_name=election2006&no_ads=
There is however no doubt in my mind that the e-mail mentioned in this story inspired the fake one.
I’ve composed an email with a cut and paste of the bogus one and sent to everyone I know, of all political strips to warn them that the next week will likely see more of the same level of deceit and desperation.
I would never tell anyone how to vote, but to give them a head’s up not to believe everything they see (as some people tend to do). I encourage all us to do the same.
I am sorry to say that I believe Christ4Canada is a troll. Anybody check him/her out?
Somebody tech savvy could have a field day sending e-mails from Tongsun Park’s cell to Paulie and Maurice, pleading for bail money, or asking them to use their connections with their good friends in the US to spring him.
Possibly a U.S. troll? Or is google email available to Canadians now?
Canada is not a godless country, nor was it abandoned by Jesus – so, yes, I’d believe a troll.
This is all just a reminder that the people in the various war-rooms have all read Machiavelli’s The Prince and Sun Tzu’s The Art of War. And lucky us, it’s only going to get dirtier and more nasty in the next week.
What a lovely country.
This is just the beginning…For the next 7 days until the polls close, the opposition will hit us with all kinds of attacks. As soon as you smell a rat or see something fishy call your local candidates office and give them a heads up.
Today when this one came across, I received a call and e-mails simultaneously and forwarded them to CPC H.Q., it was dealt with immediatly.
Get out there and make sure friends and family get out to the last advance poll and vote.Go down to your local candidates office and volunteer as a scrutineer or GOTV caller for election day.Time to take your future in your own hands, STAND UP FOR CANADA.
“It looks like they went through some lengths to make it look real, right down to registering the domain name standupforcanada.net.”
“The domain name is registered to:
Alice A Tokareff
Alice A Tokareff (standupforcanada@replay.ru)
7 Moscoyskiy Av
St.Petersburg
Leningradskaya oblast,190031
RU
Tel. +007.8125794869
http://www.standupforcanada.net gives a template page from a Russian server, IP address 85.142.35.104 which is also a network block assigned to the same Russian ISP.
What might prove really useful though would be the original email with headers intact showing the full path that the mail traveled from it’s source. Do you happen to have the original email, headers and all?
Infor from ARIN WHOIS query of ISP:
This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-proposal-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html
% Note: This output has been filtered.
% To receive output for a database update, use the “-B” flag
% Information related to ‘85.142.34.0 – 85.142.35.255’
inetnum: 85.142.34.0 – 85.142.35.255
netname: NETFOX
descr: Netfox Ltd.
country: RU
admin-c: INTV-RIPE
tech-c: RN-RIPE
tech-c: BAKH-RIPE
status: ASSIGNED PA “status:” definitions
remarks: Use abuse@infobox.ru for complaint on spam etc.
mnt-by: RUNNET-MNT
source: RIPE # Filtered
person: Vladimir E Kuznetsov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: abuse@infobox.ru
e-mail: vova@kuznetsov.spb.ru
nic-hdl: INTV-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered
person: Rustam A Narmanov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: rustam@infobox.ru
nic-hdl: RN-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered
person: Alexey V Bakhtiarov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: manager@infobox.ru
nic-hdl: BAKH-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered
% Information related to ‘85.142.32.0/22AS30968’
route: 85.142.32.0/22
descr: Infobox
descr: Alkor Ltd, hosting service provider
origin: AS30968
mnt-by: RUNNET-MNT
source: RIPE # Filtered
Don’t know if it helps or not.
We are now into the last week of the election, and a lot of crap is going to be thrown out there. I do not know if its me or not, but I haven’t noticed any polls lately.
Somehow, I have the feeling that the theory of strategic voting isn’t going to work in this election. Most Canadians do not want another election in 6 to 18 months time. I believe there will be a majority government but by a small margin.
Those parties that suggest strategic voting, only want another kick at the can for their own selfish reasons sometime in the near future. Besides I do not believe that the Libs could afford another election so soon, let alone trying to afford this one.
Canadians will vote and elect a majority government basically for the simple reason of returning to some form of normalacy(sp?).
Shmake. Snake. Fake?
“Taking a stand, for themselves, their families and their country!”
Nothing fake here:
…………
Tonight [Saturday] Esther and I finished the day in a living room with a dozen gentlemen, most of them in turbans, sipping tea and eating samosas hot enough to flame kindling. They were polite, respectful, engaged, connected and supportive. One man said openly that immigrants from India, and all over, at first supported the Liberals because they had given them passage and a new home. We just wanted to settle, he said. But now, tonight, these guys told me they want lower mortgage rates, a better economy, more tax fairness, breaks for investors and small business, an honest workmanlike government and more opportunity for their kids.
That�s because they have stopped seeing themselves as a special community, and define themselves now as middle class.
In this room – as in Tim�s, as in the plaza parking lot, as in the ditches with the pounders, as in the new houses with the new frozen sod, as in the campaign office with the people who work all day for no money, as in the jammed polling stations today � it is middle class people on the move. Taking a stand, for themselves, their families and their country.
A long time coming. A short time away. >>>
http://www.garth.ca/weblog/
Conservative candidate for Halton, Ont.
christ4canada? I can’t say for sure but I think it’s a pretty good guess that he/she is a troll. Google mail is certainly available in Canada but the email address used by him/her is definately phony. Try it and see for yourself.
interesting address they chose for the domain registrant
All Lib candidates were told Don’t worry, something big is going to happen after Christmas. Is this it, or is there worse. Martin is dancing today, re Conservative budget, now the economist who praised it is now saying she wasn’t given all the info. What next. Glad I voted last week. Are the libs so stupid they didn’t think anyone would trace this. That item re Strong, and the copy of the cheque should be sent to everyone. Rush had all this re Oil for Food months ago. I did fwd that item to the PM.
Re: Ed and separation of church and state.
Understand your feelings, but who says Stephen Harper has to nozzle his personal spirituality about what or who he prays about.
Don’t be offended by “God Bless Canada”. If you don’t believe, him saying this has nothing to do with you. Just ignore it. But for those of us who believe, the Lord holds our hopes and dreams in His hands.
I’m 100 per cent sure Mr. Harper will NOT be setting up a federal program to baptise non-believers.
I’m tired of being silent for people whose sensitivity to spirituality or religion and their non-belief has to be worn like a badge on their shoulder.
Check out http://ftp.standupforcanada.net Very strange. Anyone read Russian.
Hi Craig, nothing at all remarkable about the site: they sell security and cosmetic accessories for several makes of cars: the business is in St Petersburg, there is no contact name or number: you call them, they visit.
Well , I feel like I have won my own little battles over the weekend. I have listen to different friends tell me over the last year “Harper’s scary”. Just this weekend alone, I have had 5 people that I would say were not sure of Harper. I have been able to tell them policy, plateform and I have been able to remind them of the scandals. There are today 5 more people confirmed that they are voting for Mr. Harper. This is what has to happen. Talk to people, explain what WE have been reading for the last months on this site. The Truth!
Question: Do we really want to go down that road again?
Adscam
Options Canada
Income Trust Scandal
Relocation Scandal
Gun Registry 1.9 Million budget to date costing over 1.5 BILLION
34+ Scandals that the RCMP are invesigating the Paul Martin’s Liberal’s …….
could anyone please point me to a place where the MSM talk about the relocation scandal.
The interesting thing to me is that this guy seems to have a real Conservative party email list. To help avoid spam, whenever I give an email address, I create a unique one on my domain. I got the email and it was addressed to conservative@ my domain. No one else but the Conservative party had that address. Actually, come to think of it, I may have used it for the PCs, too. Hmmm, could disgruntled Red Tories be responsible?
re:ftp.standupforcanada.net
It’s a site for auto mirrors for german cars. Bizarre.
The page title means:”Exclusive protection of lateral mirrors against theft.”
P.S. I also suspect that “Christ4Canada” is a troll.
That is the real problem we are facing. There are so many scandal’s taking place that we have to remind ourselves. What did happen with this scandal? With the monies allocated to the relocation “funds” (my opinion deluxe paid for by the taxpayer holidays.)
BUT the best is watching Paulie and his “team” or lack of. The media is there with a few select people and (party members (MP’s) with no choice but to stand there) in empty gyms. The CSL is sinking! Good night, sleep tight, one week to go!
Here are the complete headers as received here this evening. Not much to go on:
From: nationalcouncil@standupforcanada.net
Date: January 15, 2006 9:08:01 PM GMT-06:00
Subject: Just a few days left…nothing to worry about.
To: dave@balderstone.ca
Return-Path:
Received: from jupiter.usedns.com (85.142.33.27.ip.infobox.ru [85.142.33.27]) by aliencreed.com (8.9.3p2/8.9.3) with ESMTP id UAA08675 for ; Sun, 15 Jan 2006 20:08:12 -0800
Received: from standupf by jupiter.usedns.com with local (Exim 4.52) id 1EyKiv-0007Se-H9 for dave@balderstone.ca; Mon, 16 Jan 2006 06:08:01 +0300
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Message-Id:
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname – jupiter.usedns.com
X-Antiabuse: Original Domain – balderstone.ca
X-Antiabuse: Originator/Caller UID/GID – [33424 32003] / [47 12]
X-Antiabuse: Sender Address Domain – jupiter.usedns.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist
X-Spam-Checker-Version: SpamAssassin 2.63-aliencreed011 (2004-01-11) on aliencreed.com
X-Spam-Status: No, hits=2.7 required=3.9 tests=BLANK_LINES_70_80, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY autolearn=no version=2.63-aliencreed011
Hmmm….so to confirm, this is going to real people, not just the MSM? I did a quick check, and http://www.standupforcanada.ru leads directly to http://www.standupforcanada.net. The WHOIS info for that is as follows:
domain: STANDUPFORCANADA.RU
type: CORPORATE
descr: domain hosted by http://www.replay.ru
nserver: ns1.usedns.com.
nserver: ns2.usedns.com.
state: REGISTERED, DELEGATED
person: Ekaterina A Tokareva
phone: +7 812 5704168
fax-no: +7 812 5704168
e-mail: etokareva@inbox.ru
registrar: R01-REG-RIPN
created: 2005.12.09
paid-till: 2006.12.09
source: TC-RIPN
Hang on, let me check… Yep. My daughter says I’m a real person.
But I’m not a journalist. And the Conservatives *DO* have the email address the fake message was sent to.
In a written letter to the members of his constituency Rob Anders M.P. in Calgary West, stated that his opponent, current Tory MLA Jocelyn Burgener is NOT anti-gay and anti-abortion enough! He is courting the religious right and all the anti-abortion advocates and their supporters to bolster his support. These are the kind of right wing homophobic people that Day is attracting to the new Alliance Party.
Guess what they’re still there.
A few more updates posted on my digging here. Tired. Need any and all assistance. Have to rack out. It smells.
http://www.conservativelife.com/blog/index.php/canada/2006/01/01/bombshell_liberals_rewarding_their_frien
Not an MSM site–but here is the article re relocation services
Re: “Separation of Church and State”
Many of the early founders of Canada were devout Christians who had fled countries with state religions, and had seen firsthand how government can corrupt Christ’s church, and therefore advocated the separation of church and state.
As the Baptist preacher Charles Spurgeon wrote in the U.S. sometime in the mid 1800s, “Is it not proven beyond all dispute that there is no limit to the enormities which men will commit when they are once persuaded that they are keepers of other men’s consciences? To spread religion by any means, and to crush heresy by all means is the practical inference from the doctrine that one man may control another’s religion. Given the duty of a state to foster some one form of faith, and by the sure inductions of our nature slowly but certainly persecution will occur. To prevent for ever the possibility of Papists roasting Protestants, Anglicans hanging Romish priests, and Puritans flogging Quakers, let every form of state-churchism be utterly abolished, and the remembrance of the long curse which it has cast upon the world be blotted out for ever.”
However getting rid of state-sponsored religion isn’t how many people define “separation of church and state” these days. Now for many people it seems to mean that if you are a person of faith, you need to abandon any views informed by the teachings of your faith before entering politics. Paul Martin, a Roman Catholic who argues that the teachings of his church on the sanctity of marriage are un-Canadian, certainly seems to believe so. Unfortunately many conservatives seem to believe so as well.
I got it too, and here are the details:
Return-Path:
Received: from jupiter.usedns.com ([85.142.33.27])
by priv-edmwes24.telusplanet.net
(InterMail vM.6.01.05.04 201-2131-123-105-20051025) with ESMTP
id
for ; Sun, 15 Jan 2006 20:21:36 -0700
Received: from standupf by jupiter.usedns.com with local (Exim 4.52)
id 1EyKw3-00038T-FR
for djacks01@telus.net; Mon, 16 Jan 2006 06:21:35 +0300
To: djacks01@telus.net
Subject: Just a few days left…nothing to worry about.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: National Council
Message-Id:
Date: Mon, 16 Jan 2006 06:21:35 +0300
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – jupiter.usedns.com
X-AntiAbuse: Original Domain – telus.net
X-AntiAbuse: Originator/Caller UID/GID – [33424 32003] / [47 12]
X-AntiAbuse: Sender Address Domain – jupiter.usedns.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist
Let’s look at this for a sec.
Mail headers of interest here are the ones with “Received: from ” at the beginning of the line, and going from top of the file to bottom you’ll find the last machine it passed through first, and the first machine it passed through lower down in the file.
I find it a little odd that there are only 2 lines with this information for a file coming from Russia.
THanks to djb, we at least have those to headers to work with:
Received: from jupiter.usedns.com (85.142.33.27.ip.infobox.ru [85.142.33.27]) by aliencreed.com (8.9.3p2/8.9.3) with ESMTP id UAA08675 for ; Sun, 15 Jan 2006 20:08:12 -0800
Received: from standupf by jupiter.usedns.com with local (Exim 4.52) id 1EyKiv-0007Se-H9 for dave@balderstone.ca; Mon, 16 Jan 2006 06:08:01 +0300
We can determine:
1) The mail server or personal machine that sent email had the hostname set to ‘standupf’
2) ‘standupf’ sent it to jupiter.usedns.com which after looking further points to replay.ru.
3) jupiter.usedns.com sent it to 85.142.33.27.ip.infobox.ru
4) the ip at infobox.ru above is 85.142.33.27, which is indeed registered to infobox, which says:
inetnum: 85.142.33.0 – 85.142.33.255
netname: INFOBOX-COL02
descr: Net of Alkor Ltd, hosting service provider, which provides shared
descr: hosting, mail hosting and domain name registration.
person: Vladimir E Kuznetsov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: abuse@infobox.ru
e-mail: vova@kuznetsov.spb.ru
nic-hdl: INTV-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered
5) and lastly, it’s off to North America to aliencreed.com, the host of Dave’s balderstone.ca website.
Further sleuthing provides:
usedns.com
Administrative Contact:
Bogdanov, Anatoly info@replay.ru
Internet agency REPLAY
BPPS -100 a Office 406
Saint-Petersburg, na 197101
Russian Federation
8127158528 Fax — 8123351164
domain: REPLAY.RU
type: CORPORATE
nserver: ns1.usedns.com.
nserver: ns2.usedns.com.
state: REGISTERED, DELEGATED
person: Anatoly G Bogdanov
So there we have it. Our perpetrator is Bogdanov, Anatoly. Even though he fakes his name here when he registers this standupforcanada.net domain he doesn’t seem to be smart enough to hide the details of his other domains which have full names and addresses attached.
We could do much more looking, but I’ll hold it there. You could do google lookups on this character, etc, trace the addresses to make sure they are valid, etc.
However, I think a couple more people that get this email should post it here because, as we’ve seen in the past, a compromised machine (virus, break-in) can send spam mail. There may be more than one source.
I think the most important thing that everyone here should know is that the real host of this machine that sent this fake email IS infobox.ru. They list their email address as abuse@infobox.ru – which means, abuse should be sent there. My suggestion is that everyone who gets this email, and the person who was impersonated in the email, should send the complete email along with a complaint to abuse@infobox.ru so they can take action if they desire. If you know someone who got this email, please give them this information so we can put a stop to this and maybe even get to the bottom of who initiated it.
Who knows, there may even be an investigation into the whole matter if we can generate enough stink about it. Wow, wouldn’t the culprits face be *red* if they raided the mass emailers house and took his computers and bank statements and you could point a finger at who paid him to do it.
Hmmm….I’m having a weird sense of Deja Vu….
Altruistic, you want to have a look at my post on this. I could use your help.
Am I the only one cynical enough to see the connection with auto parts in Russia to auto parts manufacturers in Canada?
red ant at 10:54:
“re:ftp.standupforcanada.net
It’s a site for auto mirrors for german cars. Bizarre.
The page title means:”Exclusive protection of lateral mirrors against theft.”
http://www.magna.ca/magnaWeb.nsf/webpages/Magna+Worldwide+-+Locations+-+Europe?OpenDocument
This is just fascinating to me.
The non-confidence vote was November 28th. Based on WHOIS information, December 9th, someone registers the domain standupforcanada.ru. Then on December 12th, someone else registers standupforcanada.net under another Russian address, using the Canadian site publicdomainregistry.com. They sit on it a whils and now, in the final days of the campaign, they are using those sites to spam a hoax email to a Conservative list. Was the CPC database hacked into? I am dying to know who this is and why they are doing this?
Isn’t this stuff fun?
If anyone runs a mail server I’d love to see the log entry of the incoming message to verify IPs.
Meanwhile, Shaken and I will be dressed as transient male’s. We’ll be in a dumpster across the street from Martin’s house relaying our surveillance via encrypted radio to a delivery van parked around the corner with a big satellite dish on the top and a stick on sign that says “Flowers By Irene”.
I’m also awaiting the Gomery report on this incident…
Shaken,
I did look at it now. Good work. I’d love to help. Hopefully you can get some info from above.
I guess I an put work aside for a few minutes to help out….
OK,
jupiter.usedns.com verified via dns root servers
;; QUESTION SECTION:
;jupiter.usedns.com. IN A
;; ANSWER SECTION:
jupiter.usedns.com. 3600 IN A 85.142.33.27
jupiter.usedns.com. 3600 IN A 85.142.33.26
——
further search of usedns.com reveals they are on a different netblock, also with infobox – no useful information.
—
85.142.33.27 is running a web server with no content except an apache page at the default location that returns the following headers:
HTTP/1.1 200 OK
Date: Mon, 16 Jan 2006 05:51:21 GMT
Server: Apache/1.3.34 (Unix) mod_throttle/3.1.2 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 Fron
tPage/5.0.2.2635 mod_ssl/2.8.25 OpenSSL/0.9.7a PHP-CGI/0.1b
Content-Location: index.html.en
Vary: negotiate,accept-language,accept-charset
TCN: choice
Last-Modified: Tue, 08 Nov 2005 07:59:03 GMT
Only the Last-modified header is interesting, indicating the web server was probably installed on Nov 8, 2005.
———–
telnet to port 25 on the above address indicates a mail server is running and returns the following:
Connected to 85.142.33.27.
Escape character is ‘^]’.
220-jupiter.usedns.com ESMTP Exim 4.52 #1 Mon, 16 Jan 2006 08:53:43 +0300
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
——
The two above facts indicate this machine was probably setup to only transfer bulk mail – despite the (default) message.
——
Stand by for more….
Rob Andres facing off with a Liberal candidate that could out shrill and outshout anything Anne Maclennan could ever do. her only former job , an elected position as a Calgary Public School Board rep. she had the unprecendented pleasure of being fired from. spent the time nattering and chattering till the whole thing came apart and the disfunctional board was dismantled.
apres that, she became a lawyer. and even sadder occupation than school trustee.
You guys are AWESOME! I have questions but have to let this stuff sink in. Need to go back and read. DIAL-UP SUCKS!
85.142.33.27
is NOT Listed by the following black hole, open relay or known spammer lists:
spambag.org
spamcop.net
mail-abuse.com
They ARE listed in:
sorbs.net as of Aug 19, 2005
http://www.au.sorbs.net/lookup.shtml?85.142.33.26
—
a report at senderbase.org, ref:
http://www.senderbase.org/search?oOrder=lastday%20desc&searchString=85.142.33.27%2F24
states that jupiter.usedns.com has a monthly magnitude of 3.4 for sending mail, and mercury.usedns.com at 4.1 magnitude. By way of comparison, all users of sasktel.net have a magnitude of 3.4 as well. Yep, usedns.com sends as much mail in a month as all the users of sasktel.
———
There are several infobox.ru spam entries in newsgroup news.admin.net-abuse.sightings
———
There are NO entries in the abuse newsgroups for usedns.com
———
it appears usedns.com has a bunch of planet names for hosts.
———
replay.ru is now working for me. It says “replay internet agencry: netfox.ru” on the home page, and they are selling hosting services.
———–
staupforcanada.net is not redirecting me to standupforcanada.ru as it was for others, but both contain the same info on the page.
————
still working on it….
Altruistic – what was happening for me was if I typed in standupforcanada.ru, I was redirected to its .net counterpart.
Do you ever feel like…….
http://www.databaseolympics.com/players/playerpage.htm?ilkid=BOGDAANA01
Anatoly Bogdanov, Olympic shooter in 1952 or mass emailer plotting against the Conservative party of Canada?
Maybe he played hockey for the Ukraine?
http://hockey.penza.net/player.asp?TXT=7307&Language=e
I hate identity theft.
Maybe that’s jsut a really popular name.
Here’s some details for this guy….
http://72.14.203.104/search?q=cache:9eha7nqVudkJ:forum.hostobzor.ru/index.php%3Fact%3DProfile%26CODE%3Dshowcard%26MID%3D553%26download%3D1+%22Bogdanov,+Anatoly%22&hl=en
This is Google’s cache of the page that I can’t get now. It lists Anatoly Bogdanov’s ICQ as 105645 and he says his homepage is replay.ru. That makes sense. He’s the guy we were after. At least he owns the same domain name that is tied to standupforcanada.net and usedns.com.
This forum at the site appears to be for people who engage in hosting activities.
————–
Found another reference to a person of the same name at a site with a title that says “the wall street journal and financial times”. He lists his company as: Grant Thornton Trid
————-
Found a reference to a person of the same name listed as a student at Kennesaw State University. KSU is in Georgia, USA and boasts “More than 1,500 international students from 132 different countries in attendance.”
————–
Hanuma net ltd
Nahimova av., 180-4
Mariupol 87525
Ukraine
Administrative Contact:
Bogdanov, Anatoly
SpaceWeb
2 Line VO 53 A
Saint-Petersburg 199004
Russian Federation
812 3271923 Fax —
——————-
That’s pretty much all I could get tonight. My guess is the info is probably correct, but it looks like the name is common.
We know for sure that standupforcanada.net and standupforcanada.ru both use fake registration info. We know that there are multiple domains, at the same host which do use the same info. If anyone can find this guy in a St. Petersburg phone book that may help. We know the machine name, we know the path it took, and we know where the box is hosted at.
Let me know if anyone gets any further. Can anyone tie Anatoly Bogdanov to either a known mass email company or to someone in Canada?
Remember to send those mails in to abuse@infobox.ru and keep posting if you got one of these emails. Note whether you indicated to receive email from either the Liberals or Conservatives so we can try and determine who in Canada initiated this mail.
Hi KP.
I’m impressed that the ‘from’ address on the email that contained the standupforcanada.net domain name was actually real! I get spam once in a while and it has my domain name on it! I didn’t send the spam, someone just chose to steal my domain name to put as the return address for a mass emailing. It has gotten so bad in the past that I’ve had to actually remove my domain name from the Internet’s root DNS servers so that I wouldn’t be flooded with bounced emails.
Anyway, it is interesting that they used the proper from address instead of a fake. The dns servers for standupforcanada.net are the same as the dns for the server that sent the email (even though the names are different), and the dns and person name for replay.ru are the same.
If I was going to mess with an election in a country, I’d want to hide better.
Then again, they probably are hiding something for someone in Canada.
Last post tonight, I swear. Sorry for the space Kate….
I did find this page about our guy at ICQ.
http://www.icq.com/whitepages/about_me.php?uin=105645
He’s 32 years old, lists his occupation as ‘web building’ and his title is ‘on top’ at the company re:play (replay.ru also hosted by infobox.ru)
His telephone is on there but I would bet it is company phone because he lists his email as support@replay.ru and basically makes a comment that would be equated to “we don’t respond to ICQ messages from anyone who isn’t a customer” from what I can gather.
I suspect that Anatoly Bogdanov is the guy who runs the usedns.com mail server, and isn’t connected with this particular e-mail. I could be wrong, though.
In case it helps anyone, here’s my post on the matter.
These headers struck me as interesting:
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist
This suggests that the sender used a PHP script to automatically send the emails, thus the short number of hops on the mail…
Notice the third header… it looks like a URL doesn’t it.. fudge it a bit and you get:
http://www.standupforcanada.ru/mlist/
Try it… You’ll get the interface for a script called Newsletter 1.0 where you can sign up for the mailing list.
Anyone here familiar with this script? The site provides a link to Newsletter 1.0, but it gives an error page for a site called assaultcms.com. Is there an admin URL or any other hidden files that might be used to determine who sent this email?
My wife just got the e-mail in her mailbox this morning. I’m trying to figure out how the sender would have gotten her address, as I’m the more active one for the CPC.
Two of the names I have researched are found at a site where freelancers can advertise their services and bid on work. There is even a history of the bids. When I have time today, I will go through their bid history to see if someone from Canada was fishing for an election dirty tricks misinformation assistant in the last 3 or 4 months.
How would you feel if a Muslim became PM under the Conservative banner and ended all of his or her speeches with “Praise Allah”?
“Allah bless Canada” I can live with: “praise Allah” is different.
Methinks our Russki spammer is miffed at Harper cutting off the 4.7 billion dollars the Libs were about to send to mother Russia for “carbon credits”.
Seems Martin has more supporters in Prison and Russia than in Canada.