rien reçu non plus mais pour passer le temps rien de mieux que de se pencher sur les arcanes du net
Ghost of Benoit Caen a écrit:
c'est un système externe qui gère tout cela
Code:
Return-Path: <mailreturn@smtp12.ymlpsrv.net>
Received: from smtp12.ymlpsrv.net (smtp12.ymlpsrv.net. [87.237.8.206])
by mx.google.com with SMTP id bi3si6030775wib.38.2014.06.19.02.22.25
grace au code source nous avons une ip et un nom de domaine
une recherche sur un whois ou un traceroute nous donne le nom de societe belge ymlpsrv, tenue par patrick von acker (sic) qui vend ses mass mailing à des societes, qui evitent le spam en leur nom :
Patrick Van Acker / YMLP SPAMMER group.
Related domains: ymlpserver.com (2007-02-16T17:46:46Z), ymlpserver.net (2007-02-16T17:46:47Z), ymlpsrv.net (2007-02-16T17:46:47Z), ymlp.net (2010-01-22 18:56:27), ymlp.com (2002-04-20T21:47:30.0Z) and 1000+ (!!!) domains:
from ymlp1.net (2007-06-01T17:46:42.0Z) to ymlp500.net (2011-12-04T17:44:54.0Z) and
from ymlp1.com (2007-06-02T19:24:02.0Z) to ymlp500.com (2011-12-04T17:45:01.0Z)
Domain Name: ymlpsrv.net
Creation Date: 2007-02-16T17:46:47Z
Registrar: Hosting Concepts B.V. d/b/a Openprovider
Registrant Name: Patrick Van Acker
Registrant Organization: YMLP
Registrant Street: P.O. BOX 25
Registrant City: Poperinge
Registrant Postal Code: 8970
Registrant Country: BE
Registrant Phone: +32.57300801
Registrant Fax: .
Registrant Email:
patrick@ymlp.comName Server: ns5.ymlp.com
Name Server: ns4.ymlp.com
This is one of 710 domains owned by Patrick Van Acker, on IP 87.237.13.66 in ASN AS8368 Belgian Network Solutions, and used by clients for legitimate mailing and for spamming. The service is promoted at ymlp.com which provides a token "anti-spam" policy but no way to actually report spam. Visitors and spam recipients are offered the options to update their email addresses, or to "unsubscribe" which seems deceptive when you did not originally subscribe.
Most of the domain names are similar - e.g. ymlp101.com, ymlp101.net, ymlp102.com, ymlp102.net. Spam emails contain links to subdomains such as
- t.ymlp101.net, each of which points to multiple IP addresses (with no domains) which resolve to still other domain names;
- smtp.ymlp101.net, each of which points to one IP address (with no domains) which resolves back to the original domain.
These domains appear to be used in rotation: a group is activated for a period of time, and then replaced by another group. Previous reports at PhishTank show that these domains once resided on other IP addresses, so they may be relocated periodically, possibly to avoid IP filtering:
http://www.google.com/search?q=ymlp*.ne ... shtank.comReference:
http://hosts-file.net/default.asp?s=87.237.13.66 "
une blague belge n'havrante donc