Spammers BAD, spam reporters GOOD

Oh my! I seem to have upset the good folk of New Horizons Springfield, who wouldn't take my call today. I guess they really want to run an illegal pharmacy site after all.

http://nhsgf.com:8088/cg/

New Horizons - new website, old pharmacy site

Well, well, New Horizons of Springfield, Missouri - still offering training courses in computer security, now with a new and shiny website, but still hosting a discount pharmacy site. It looked as if they had resolved their illegal website problem, but no, they were having a website redesign. They still have the discount pharmacy website running though.

http://66.119.4.23:8088/cg

Does NOBODY at New Horizons know how to manage a server?

Computerland® of Silicon Valley - Security specialists and illegal pharmacy store

Hahaha!! These idiots have not one, but two compromised servers, and the pharmacy site is much better than their own. Compare this:-

http://209.237.17.169

with

http://209.237.17.169:8088/cg

Computerland®, you are fraudsters! You are selling computer security solutions and yet you have two servers which have been compromised?? Idiots!!

And look at their list of partners!



I see IBM is in there, are they trading pharmacy server page hits?

Pipex - one of the "send us an e-mail so we can ignore it..." brigade

Now this is a cautionary tale of how incompetent service providers can be, Pipex this time - you telephone them to tell them one of their client's servers has been compromised, and ask if they can do anything about it. They say emphatically 'yes, send us an e-mail' and they give you the e-mail address. You send the e-mail. Nothing happens. Days go by. You phone again. They ask which e-mail address you used, you tell them. They say 'wrong e-mail address, send it again'. You send the message again. Nothing happens. Days go by. Nothing happens.

Note: I am not the only person to report this site to Pipex.

Pipex, just how difficult is it to block web access to an illegal server? 8 days and counting.

People have DIED from buying counterfeit medications from sites such as this one.

Technical Services and Solutions - in other words, a pharmacy site

Ah, we have another bunch of clowns masquerading as computer specialists! Computerland® of Silicon Valley, sounds as if they're at the heart of all things technological: they deal with SECURITY; storage; technical services and solutions...and hosting a discount pharmacy site. Another bunch of idiots who should be flagged as too stupid to be on the internet. Unresponsive to e-mail, impossible to contact by phone, and hosting a pharmacy site on their server. If you want to know why you have so much spam, folks, thank people like IBM and this shower. This is what Computerland® do:-

Our experienced security consultants help the clients understand their current security risks and provide an array of services to minimize and mitigate those risks. We partner with the finest companies in the internet security field such as, Cisco Systems, Check Point, McAfee, Trend Micro, Symantec, and others, to bring the highest level of protection possible for our clients’ computing environment.

Ah, I see! They protect their clients' computing environment, NOT THEIR OWN!!! On their own server, people can intrude, install a webserver, redirect traffic to a back-end processor and that's absolutely fine. Let me tell you, Computerland® of Silicon Valley, your server is like, totally, pwned - the intruders have administrator access and can do what the hell they like - maybe Computerland® just aren't using enough of the "finest companies in the internet security field such as, Cisco Systems, Check Point, McAfee, Trend Micro, Symantec, and others"...

The truth is out there, folks:
Go to http://cland.com in your browser - you will see the lovely Computerland site, replete with glowing phrases about how knowledgeable they are and how they can help your business. Now look at http://cland.com:8088/cg - not quite the same thing, is it?

And what is REALLY funny is that the pharmacy site is a lot more sophisticated than their site, isn't it?

IBM - Idiots Buy Medicines from a hacked IBM server

Need a little blue pill? Contact Big Blue, AKA IBM...


Good old IBM! The pharmacy site they are hosting is still going strong, THREE WEEKS after it being reported to them. To quote from their website:-

Drawing on a deep understanding of today’s security threats from both within and outside the enterprise, IBM provides a unified strategy for developing enterprise security solutions, and identity and access management represents a modular entry point into IBM security solutions. A comprehensive, standards-based approach that integrates access authorization and identity management enables organizations to cost-effectively provide authorized users with access to applications and data while protecting these assets from unauthorized access.

No shit, Sherlock!

Let me translate:- What this means is that even on one of OUR OWN SERVERS, we will let an intruder hack our system, install a proxy redirector, and leave it there for weeks undisturbed while the spammers and criminals are profiting from it.


Would you buy a server from this company, and let them manage the security of it?

http://170.224.180.131

whois 170.224.180.131

OrgName: IBM
OrgID: IBM-1
Address: 3039 Cornwallis Road
City: Research Triangle Park
StateProv: NC
PostalCode: 27709-2195
Country: US

NetRange: 170.224.0.0 - 170.227.255.255
CIDR: 170.224.0.0/14
NetName: IBM-COMMERCIAL
NetHandle: NET-170-224-0-0-1
Parent: NET-170-0-0-0-0
NetType: Direct Assignment
NameServer: RTPUSSXDNSB03.RALEIGH.MEBS.IHOST.COM
NameServer: RTPUSSXDNSB04.RALEIGH.MEBS.IHOST.COM
NameServer: BLDUSWXDNSB01.BOULDER.MEBS.IHOST.COM
NameServer: BLDUSWXDNSB02.BOULDER.MEBS.IHOST.COM
Comment:
RegDate: 1995-04-21
Updated: 2007-01-31

New Horizons finally takes its medicine

At last the drug vendors of Springfield, Missouri have come to their senses! Clearly, New Horizons of Springfield are having 'technical issues', as their website is down and the mailserver has been moved. It is rare to meet a company in the field of IT who are as unremittingly stupid - not only do they allow their server to be compromised, but they maintain it in this state for weeks, allowing the spammers to do as they please.

Oh dear! New Horizons Learning Center of Springfield, Missouri definitely make a better online pharmacy than a training outfit, have a look:-

http://66.119.4.23 , New Horizons <<< OH DEAR! ALSO DOWN! Hmmmm...
http://66.119.4.23:8088/cg , Discount Pharmacy <<< DOWN AT LAST!

Some people shouldn't be allowed on the internet - and frankly, I would happily leave them to it except for the fact that it helps the spammer economy which means that we all get more spam.

Think on this, New Horizons Learning Center, aka Viagra vendors of Springfield, Missouri...

So, New Horizons Computer Learning Center of Springfield, Missouri STILL haven't prevented their server from being a botnet-0wned pharmacy webserver? Tsk, tsk.

What is it people say - those that can, do and those that can't, teach? Quite.

IBM have now joined the botnet, welcome! Disappointing but not surprising to see that IBM don't know diddly about maintaining their servers, a weak Remote Desktop password and off we go. Have fun with your botnet, IBM!

170.224.180.131 is the place to be, buy drugs from your IBM-hosted website here.

Well done New Horizons Springfield, 27 domains sitting on your server that you know nothing about. What exactly DO you teach in your training courses?

The Spamhammer Hall of Shame

Congratulations to the New Horizons Computer Learning Center of Springfield, Missouri, who offer courses such as:-

• Managing and Maintaining a Microsoft Windows Server 2003 Environment

• Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

• Planning and Maintaining a MS Windows Server 2003 Network Infrastructure

• Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure

..unfortunately. they need to attend one of their own courses - their Windows 2003 server is now part of a botnet and has been acting as a webserver for a spammer pharmacy for the last three days. Ho hum. I won't be joining up for any of their courses in a hurry.