* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 00:46:00 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 00:45:58 +0200
Received: (qmail 13915 invoked by uid 110); 23 Oct 2005 00:41:26 +0200
Received: (qmail 13913 invoked from network); 23 Oct 2005 00:41:26 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 00:41:26 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: a...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sat, 22 Oct 2005 17:41:40 -0500
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>EasyDVDx</title>
</head>
<body>
<p align="center"><br>
<u><i><b><font size="7" color="#CC0000">Promotional Offer</font></b></i></u></p>
<p align="center"><font size="7" color="#0000FF"><b><i>Kazaa Lite Official
WebSite</i></b></font></p>
<p align="center"><b><font size="5">Now Offer:</font></b></p>
<p align="center"><font face="Tahoma"><b>Unlimited 24/7 Downloads!!!</b> No time
limits, no bandwidth limits, no content limits!!! </font></p>
<p align="center"><font face="Tahoma" color="#CC0000"><b>Download anything you
want, any time you want!</b></font></p>
<p align="center"><b><font face="Tahoma" color="#0000FF">You're 3 minutes away
from downloading the "World"</font></b></p>
<p align="center"><b>MP3 Music Instant Download</b></p>
<ul>
<li>
<p align="center"><b>UNLIMITED <font color="#CC0000">FREE</font><font color="#0000FF">
MP3 Music</font></b> Downloads </li>
<li>
<p align="center"><b>UNLIMITED <font color="#CC0000">FREE</font>
<font color="#0000FF">DVD Movie</font></b> Downloads </li>
<li>
<p align="center"><b>UNLIMITED <font color="#CC0000">FREE </font>
<font color="#0000FF">Games</font></b> Downloads </li>
<li>
<p align="center"><b>UNLIMITED <font color="#CC0000">FREE </font>
<font color="#0000FF">Adult Content</font></b> Downloads </li>
</ul>
<p align="center"><b><font face="Tahoma" size="4">B</font></b><font face="Tahoma" size="4"><b>urn
your music or DVD Videos to CD</b></font><p align="center"><font color="#0000FF" size="4"><b>Over 3 Million Files</b></font></p>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E13011432130116145C1C1E0E4A4442400E46404A4A0E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E13011432130116145C1C1E0E4A4442400E46404A4A0E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E13011432130116145C1C1E0E4A4442400E46404A4A0E430E420E08.somedynamicextention?x'>
</font><font color="#999999" face="arial, verdana" size="2">MANDEL Enterprises LTD. · 24 Tangerine Street · Belmopan, Belize C.A.<br>This e-mail message is an advertisement and/or solicitation.</font></p></td></tr></table></body>
</html>
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 03:43:08 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 03:43:08 +0200
Received: (qmail 21575 invoked by uid 110); 23 Oct 2005 03:38:38 +0200
Received: (qmail 21573 invoked from network); 23 Oct 2005 03:38:38 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 03:38:38 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sat, 22 Oct 2005 20:38:53 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E130116141432130116145C1C1E0E4A4442400E46404A450E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E130116141432130116145C1C1E0E4A4442400E46404A450E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E130116141432130116145C1C1E0E4A4442400E46404A450E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 05:54:17 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 05:54:15 +0200
Received: (qmail 29345 invoked by uid 110); 23 Oct 2005 05:49:41 +0200
Received: (qmail 29343 invoked from network); 23 Oct 2005 05:49:41 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 05:49:41 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: sa...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sat, 22 Oct 2005 22:49:56 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E0113161432130116145C1C1E0E4A4442400E46404A450E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E0113161432130116145C1C1E0E4A4442400E46404A450E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E0113161432130116145C1C1E0E4A4442400E46404A450E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 10:12:20 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 10:12:19 +0200
Received: (qmail 1977 invoked by uid 110); 23 Oct 2005 09:07:46 +0200
Received: (qmail 1975 invoked from network); 23 Oct 2005 09:07:46 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 09:07:46 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: f...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 02:08:01 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E14151A32130116145C1C1E0E4A4442400E46404A440E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E14151A32130116145C1C1E0E4A4442400E46404A440E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E14151A32130116145C1C1E0E4A4442400E46404A440E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 10:15:14 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 10:15:14 +0200
Received: (qmail 3617 invoked by uid 110); 23 Oct 2005 10:10:41 +0200
Received: (qmail 3615 invoked from network); 23 Oct 2005 10:10:41 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 10:10:41 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 03:10:57 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B430E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B430E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B430E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 17:58:08 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 17:58:07 +0200
Received: (qmail 24622 invoked by uid 110); 23 Oct 2005 17:53:30 +0200
Received: (qmail 24620 invoked from network); 23 Oct 2005 17:53:30 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 17:53:30 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 10:53:47 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B420E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B420E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B420E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Sun Oct 23 22:31:41 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Sun, 23 Oct 2005 22:31:41 +0200
Received: (qmail 3362 invoked by uid 110); 23 Oct 2005 22:27:02 +0200
Received: (qmail 3360 invoked from network); 23 Oct 2005 22:27:02 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 23 Oct 2005 22:27:02 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: s...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 15:27:19 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E01171432130116145C1C1E0E4A4442400E46404B400E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E01171432130116145C1C1E0E4A4442400E46404B400E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E01171432130116145C1C1E0E4A4442400E46404B400E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Mon Oct 24 00:25:35 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Mon, 24 Oct 2005 00:25:32 +0200
Received: (qmail 10816 invoked by uid 110); 24 Oct 2005 00:20:48 +0200
Received: (qmail 10814 invoked from network); 24 Oct 2005 00:20:47 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 24 Oct 2005 00:20:47 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 17:21:05 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B410E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B410E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B410E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Mon Oct 24 06:41:16 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Mon, 24 Oct 2005 06:41:16 +0200
Received: (qmail 27518 invoked by uid 110); 24 Oct 2005 06:36:33 +0200
Received: (qmail 27516 invoked from network); 24 Oct 2005 06:36:33 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 24 Oct 2005 06:36:33 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Sun, 23 Oct 2005 23:36:51 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B440E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B440E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E46404B440E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Mon Oct 24 20:58:42 2005
Received: from domain.victim.example ([213.222.13.125])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Mon, 24 Oct 2005 20:58:40 +0200
Received: (qmail 13222 invoked by uid 110); 24 Oct 2005 20:53:49 +0200
Received: (qmail 13220 invoked from network); 24 Oct 2005 20:53:49 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 24 Oct 2005 20:53:49 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: asdf...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Mon, 24 Oct 2005 13:54:09 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E130116141301161432130116145C1C1E0E4A4442400E46404B4B0E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E130116141301161432130116145C1C1E0E4A4442400E46404B4B0E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E130116141301161432130116145C1C1E0E4A4442400E46404B4B0E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Mon Oct 24 22:02:44 2005
Received: from domain.victim.example ([ipv4.victim.example])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Mon, 24 Oct 2005 22:02:41 +0200
Received: (qmail 18662 invoked by uid 110); 24 Oct 2005 21:57:48 +0200
Received: (qmail 18660 invoked from network); 24 Oct 2005 21:57:48 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 24 Oct 2005 21:57:48 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Mon, 24 Oct 2005 14:58:08 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142420E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142420E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142420E430E420E08.somedynamicextention?x'>
* http:// has been subtituted.
* some dynamic extentions has been replaced
* an effort has started to subtitute tracking id's to other stuff
Ipnumbers listed are stored in a public rbl.
========================================================================
>From acc...@domain.example Mon Oct 24 23:36:20 2005
Received: from domain.victim.example ([ipv4.victim.example])
by server.domain.victim.example (8.11.6p2/8.12.8) with ESMTP id munged.id
for <acc...@domain.victim.example>; Mon, 24 Oct 2005 23:36:20 +0200
Received: (qmail 25995 invoked by uid 110); 24 Oct 2005 23:31:29 +0200
Received: (qmail 25993 invoked from network); 24 Oct 2005 23:31:29 +0200
Received: from softdnserror (HELO last-minute-offer-site.com) (63.223.17.56)
by ipv4.victim.example with SMTP; 24 Oct 2005 23:31:29 +0200
From: "Kazaa Lite" <acc...@domain.example>
Subject: Download Unlimited FREE Music, Movies, Games, Videoclip, TV Shows,
Software and much more...
To: as...@asdf.nl
Reply-To: Kaza...@last-minute-offer-site.com
Date: Mon, 24 Oct 2005 16:31:49 -0500
<html>
<body>
<p align="center">
<a target="_blank" href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142430E400E44444B42450E08.somedynamicextention?x'>Click Here to Download Now...</a></p>
<br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'>
<div align='center'><a href='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142430E08.somedynamicextention?x'><img src='[protocol]last-minute-offer-site.com/img.gif' width='531' height='80' border='0'></a>
<font size='1' face='Arial, Helvetica, sans-serif'><br><img src='[protocol]last-minute-offer-site.com/080E1301161432130116145C1C1E0E4A4442400E464142430E430E420E08.somedynamicextention?x'>