[Warning] Spam warning, dont give hosting to medistarhp.net

kpop · Web Design Newbie Joined: Jul 12, 2004 Posts: 11

Spam warning, dont give hosting to medistarhp.net

Beware of anyone signing up for a hosting account for the domain medistarhp.net

This person uses a cgi script to send spam from his account.
His script connects to an external smtp server to spam meaning when you get the spam report its from your IP address but contains none of the X-Antiabuse headers that cpanel adds making it very very difficult to track what account did the spamming.

We posted about this in the Cpanel forums and another host said he had a customer do the exact same thing with that spam script.

Just now we had an email from another host which got that persons signup after we closed his account yesterday asking why we deleted his account, if it was a tos violation.
So he is obviously moving from host to host after his account gets closed.

He sets up a dummy site on medistarhp.net so it does not look suspicious and he deletes the cgi spam script after it is run.

This is what he left in our logs.

207.43.172.230 - - [14/May/2003:17:14:58 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $
207.43.172.230 - - [14/May/2003:17:15:00 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $
207.43.172.230 - - [14/May/2003:17:15:02 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $
207.43.172.230 - - [14/May/2003:17:15:04 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $
207.43.172.230 - - [14/May/2003:17:15:08 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $
207.43.172.230 - - [14/May/2003:17:15:08 -0500] "POST /cgi-bin/18472.cgi HTTP/1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 4.01; $

The ip 207.43.172.230 does not match the IP the customer signed up with.

The number on the cgi script changes.
Beware of this person.

Glen Ha****in
Payment Method - Visa
ghann****@cox.net
520****899
9*8 S Sierra Nevada Dr
Tucson, AZ 85748
USA
IP Address: 68.0.164.98
IP Location: Phoenix, AZ, United States