Return-Path: <adventuresafloat@gci.net>
Received: from msgmmp-4.gci.net (209.165.130.14) by studio42.com with 
ESMTP (Eudora Internet Mail Server 3.2.10) for <chris@studio42.com>; 
Sun, 16 Mar 2008 13:03:30 -0800
Received: from gci.net ([208.138.130.9]) by msgmmp-1.gci.net (Sun 
Java System Messaging Server 6.2-3.03 (built Jun 27 2005)) with ESMTP id 
<0JXU00I3UADQ6Y20@msgmmp-1.gci.net> for chris@studio42.com; 
Sun, 16 Mar 2008 12:03:56 -0800 (AKDT)
Received: from www.cucind.poliba.it[193.204.60.95] by mailstore-1.gci.net 
(mshttpd); Sun, 16 Mar 2008 21:03:27 +0100
Date: Sun, 16 Mar 2008 21:03:27 +0100
From: FRANCIS-LINDA-ERIN KADRLIK <adventuresafloat@gci.net>
Subject: Donazion --
Bcc:
Reply-to: mailingmartinnina08@gmail.com
Message-id: <f674ced82ec2.47dd8b1f@gci.net>
MIME-version: 1.0
X-Mailer: Sun Java(tm) System Messenger Express 6.2-4.03 (built Sep 22 2005)
Content-type: text/plain; charset=us-ascii
Content-language: en
Content-transfer-encoding: 7BIT
Content-disposition: inline
X-Accept-Language: en
Priority: normal



The Church of Ireland would like to notify you that you have been chosen by the board of trustees as one of the final recipients of a cash Grant/Donation for your own personal, educational, and business development. The Church, established in the year 1872, is one  of the biggest church  built for God in Ireland.  In the year 1901, they started offering collection for the sole aim of human growth, educational and Community development. In conjunction with the ECOWAS, UNO, and the EU,We are giving out a yearly donation of US$850,000.00 each to 100 lucky
recipients each year. These specific  Donations/Grants will be awarded to 100 lucky international recipients worldwide; in different categories for their personal business development.

The objective is to make a notable change in the standard of living of people all around the Universe (From America to Europe, Asia to Africa
and all around). Kindly note that you will only be chosen to receive the donation once, which means that subsequent yearly donation will not get to you. Take time and thought in spending the donation wisely on something that will last you a long time.

Based on the random selection exercise of internet websites and millions of supermarket cash invoices worldwide, you were selected among the lucky recipients to receive the award sum of US$850,000.00 as charity donations/aid from the Church of Ireland, ECOWAS, EU and the UNO in
accordance with the enabling act of Parliament. (Note that all beneficiaries email addresses were selected randomly from over 100,000
Internet websites or a shop's cash invoice around your area in which you might have purchased something from). You are required to contact the Church Executive Secretary below, for qualification documentation and processing of your claims.  After contacting the secretary, you will be given your donation pin number, which you will use in collecting the funds. Please endeavour to quote your Qualification numbers (C-302-2143, B-713-21) in all discussions.

Exec Sec. Rev. Martin Nina
Email: rev.martinnina@gmail.com

Please note that the EU, ECOWAS, UNO, strictly administers these donations/Grants.You are by all means hereby advised to keep this whole information confidential until you have been able to collect your donation.

On behalf of God, The Church, ECOWAS, UNO and the EU, accept our warmest congratulations.

May God Bless you with this donation.


[studio42@flatus studio42]$ host 209.165.130.14
14.130.165.209.in-addr.arpa domain name pointer msgmmp-4.gci.net.
[studio42@flatus studio42]$ whois 209.165.130.14@whois.arin.net
[whois.arin.net]

OrgName:    GCI Communications, Inc.
OrgID:      GCOM
Address:    2550 Denali St.
Address:    Suite 1000
City:       Anchorage
StateProv:  AK
PostalCode: 99503
Country:    US

ReferralServer: rwhois://rwhois.gci.net:4321/

NetRange:   209.165.128.0 - 209.165.191.255
CIDR:       209.165.128.0/18
NetName:    GCI-ALASKA-0BLK
NetHandle:  NET-209-165-128-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation
NameServer: VANS-1.GCI.NET
NameServer: VANS-2.GCI.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    1997-12-10
Updated:    2003-12-12

RTechHandle: GDA5-ORG-ARIN
RTechName:   GCI IP Administrator
RTechPhone:  +1-907-868-0100
RTechEmail:  ipadmin@gci.net

OrgAbuseHandle: GNS10-ARIN
OrgAbuseName:   GCI Network Security
OrgAbusePhone:  +1-907-868-5330
OrgAbuseEmail:  abuse@gci.net

OrgNOCHandle: GCNCC-ARIN
OrgNOCName:   GCI Customer Network Control Center
OrgNOCPhone:  +1-907-868-0100
OrgNOCEmail:  intcncc@gci.net

OrgTechHandle: GDA5-ORG-ARIN
OrgTechName:   GCI IP Administrator
OrgTechPhone:  +1-907-868-0100
OrgTechEmail:  ipadmin@gci.net

# ARIN WHOIS database, last updated 2008-03-15 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Server spotted.

Now onto the exploited machine:

[studio42@flatus studio42]$ host 193.204.60.95
95.60.204.193.in-addr.arpa domain name pointer www.cucind.poliba.it.
[studio42@flatus studio42]$ whois 193.204.60.95@whois.ripe.net
[whois.ripe.net]
% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag

% Information related to '193.204.48.0 - 193.204.63.255'

inetnum:        193.204.48.0 - 193.204.63.255
netname:        BARI-POLI-NET
descr:          Politecnico di Bari
country:        IT
admin-c:        EV182-RIPE
tech-c:         GL965-RIPE
tech-c:         VG371-RIPE
tech-c:         LAG2-RIPE
status:         ASSIGNED PA
remarks:        To notify abuse mailto: cert@garr.it
remarks:        Multiple LAN of Departments and Institutes
remarks:        of the Politecnico di Bari
remarks:        GARR - Italian academic and research network
mnt-by:         GARR-LIR
source:         RIPE # Filtered

role:           GARR LIR
address:        Consortium GARR
address:        Via dei Tizii, 6
address:        I-00185 Roma
address:        Italy
remarks:        trouble:      To notify abuse mailto: cert@garr.it
remarks:        trouble:      Information at http://www.lir.garr.it/
admin-c:        EV182-RIPE
tech-c:         GP4562-RIPE
tech-c:         VP541-RIPE
tech-c:         BM2532-RIPE
tech-c:         MG473-RIPE
nic-hdl:        GL965-RIPE
mnt-by:         GARR-LIR
source:         RIPE # Filtered
abuse-mailbox:  cert@garr.it

person:         Enzo Valente
address:        Consortium GARR
address:        Via dei Tizii, 6
address:        I-00185 Roma
address:        Italy
phone:          +39 06 4962 1
fax-no:         +39 06 4962 2044
nic-hdl:        EV182-RIPE
mnt-by:         GARR-LIR
source:         RIPE # Filtered

person:         Valentino Gratton
address:        Servizi Informatici Tecnici e Sistemistici
address:        Politecnico di Bari
address:        Via G. Amendola 126/b
address:        I-70126 Bari
phone:          +39 080 5962212
fax-no:         +39 080 5963421
nic-hdl:        VG371-RIPE
source:         RIPE # Filtered

person:       Luigi Antonio Gatto
address:      Direzione Amministrativa - Politecnico di Bari
address:      via E.Orabona, 4
address:      I-70125 Bari
phone:        +39 080 5963434
fax-no:       +39 080 5963421
nic-hdl:      LAG2-RIPE
source:       RIPE # Filtered

% Information related to '193.204.0.0/15AS137'

route:        193.204.0.0/15
descr:        GARR routes
origin:       AS137
mnt-by:       GARR-LIR
source:       RIPE # Filtered


Dirtball tactics for zomie/exploit rape.