[email] I have found it!
Hal Murray
This junk came from:
24.54.13.131 <=> oh-strongsvillecadent2-bdg1-4a-b-131.clvhoh.adelphia.net
24.52.0.0 - 24.55.255.255 is assigned to adelphia.net (US)
24.54.13.131 is listed at: SORBS, SpamCop
adelphia.net is listed at RFC-Ignorant.org (abuse and postmaster)
The spamvertized web host is:
216.180.236.44 => 216.180.236.44, No reverse DNS.
216.180.224.0 - 216.180.255.255 is assigned to gnax.net (US)
That uses javascript to go to:
www.forumdirekt.com => forumdirekt.com
forumdirekt.com => 66.135.34.95
66.135.34.95 <=> server1.attack.se
66.135.32.0 - 66.135.47.255 is assigned to serverbeach.com (US)
URLs involved are:
http://www.forumdirekt.com/tmp/index.html
http://forumdirekt.com/tmp/server.exe
I don't know what the exe does. (I run Linux.)
DNS registration for forumdirekt.com by enom.com/Registerfly.com
Registerfly.com is listed at RFC-Ignorant.org (abuse and postmaster)
DNS servers for forumdirekt.com and attack.se are
ns1.geodns.net <=> 66.139.72.14
ns2.geodns.net <=> 66.139.72.20
66.136.0.0 - 66.143.255.255 is assigned to swbell.net/SBC (US)
swbell.net is listed at RFC-Ignorant.org (abuse, postmaster, and whois)
------- Forwarded Message
Return-Path: <gb_...@yahoo.co.uk>
[local routing snipped]
Received: from oh-strongsvillecadent2-bdg1-4a-b-131.clvhoh.adelphia.net
(oh-strongsvillecadent2-bdg1-4a-b-131.clvhoh.adelphia.net [24.54.13.131])
by plushie.suespammers.org (8.12.9-20030919/8.12.9) with SMTP id
i9UIZ5x2024910
for <hmu...@suespammers.org>; Sat, 30 Oct 2004 11:35:07 -0700
Received: from 233.156.44.112 by 24.54.13.131; Sat, 30 Oct 2004 12:27:16 -0700
Message-ID: <TASZJUTZOXN...@yahoo.com>
From: "Mike" <gb_...@yahoo.co.uk>
Reply-To: "Mike" <gb_...@yahoo.co.uk>
To: hmu...@suespammers.org
Subject: I have found it!
Date: Sat, 30 Oct 2004 13:26:16 -0600
X-Mailer: QUALCOMM Windows Eudora Version 5.1
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--36988977705836797"
X-Priority: 3
X-MSMail-Priority: Normal
----36988977705836797
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
<html>
<body>
Hi!
<br>
I have found it!!
<br><br>
<a href="http://216.180.236.44/login/">http://216.180.236.44/login/</a>
</body>
</html>
----36988977705836797--
------- End of Forwarded Message
--
The suespammers.org mail server is located in California. So are all my
other mailboxes. Please do not send unsolicited bulk e-mail or unsolicited
commercial e-mail to my suespammers.org address or any of my other addresses.
These are my opinions, not necessarily my employer's. I hate spam.
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>
pe...@heypete.com
Return-Path: <mailman...@news.spamcop.net>
Received: from news.spamcop.net (news.cesmail.net [216.154.195.61])
by mailhost.cotse.com (5.7.4/5.7.4) with SMTP id i9UK6iep053919
for <pe...@heypete.com>; Sat, 30 Oct 2004 16:06:44 -0400 (EDT)
(envelope-from mailman...@news.spamcop.net)
Received: (qmail 30163 invoked from network); 30 Oct 2004 20:06:46 -0000
Received: from unknown (HELO news.spamcop.net) (127.0.0.1)
by news.spamcop.net with SMTP; 30 Oct 2004 20:06:46 -0000
Delivered-To: mailman-spamco...@news.spamcop.net
Received: (qmail 30151 invoked from network); 30 Oct 2004 20:06:44 -0000
Received: from unknown (HELO blade5.cesmail.net) (216.154.195.46)
by news.spamcop.net with SMTP; 30 Oct 2004 20:06:44 -0000
Received: (qmail 29327 invoked from network); 30 Oct 2004 20:06:44 -0000
Received: from unknown (192.168.1.103)
by blade5.cesmail.net with QMQP; 30 Oct 2004 20:06:44 -0000
Received: from oh-strongsvillecadent2-bdg1-4a-b-131.clvhoh.adelphia.net
(24.54.13.131)
by mailgate2.cesmail.net with SMTP; 30 Oct 2004 20:06:43 -0000
Received: from 72.188.211.185 by 24.54.13.131; Sat, 30 Oct 2004 23:01:52 +0200
Message-ID: <DKHCCOMQROH...@yahoo.com>To: spamcop-di...@news.spamcop.net
Subject: I have found it!
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--774607600213127"
X-Priority: 3
X-MSMail-Priority: Normal
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on blade5
X-Spam-Level: ********************
X-Spam-Status: hits=20.7 tests=FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,
FORGED_OUTLOOK_TAGS,HELO_DYNAMIC_ADELPHIA,HTML_60_70,HTML_MESSAGE,
HTML_SHORT_LENGTH,MIME_BOUND_DD_DIGITS,MIME_HTML_ONLY,
MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE,MPART_ALT_DIFF,MSGID_SPAM_CAPS,
MSGID_YAHOO_CAPS,NORMAL_HTTP_TO_IP,RCVD_BY_IP,RCVD_DOUBLE_IP_SPAM
version=3.0.0
Sender: mailman...@news.spamcop.net
Errors-To: mailman...@news.spamcop.net
X-Cotse-Filters: Default delivery
X-IMAPbase: 1087236677 6454
Status: O
X-UID: 6451
Content-Length: 262
X-Keywords:
<x-html><!x-stuff-for-pete base="" src="" id="0" charset="Windows-1251"><html>
<body>
Hi!
<br>
I have found it!!
<br><br>
<a href="http://216.180.236.44/login/">http://216.180.236.44/login/</a>
</body>
</html>
</x-html>