[email] 100% natural viagra, get it and get hard!

Blacklist Administrator

unread,

Nov 2, 2004, 6:39:24 AM11/2/04

to

NOTE: This message is the result of web or usenet address harvesting.
Addresses are created dynamically for address harvesters by Seed
Spambots: http://freshmeat.net/projects/seedspambots/

Since NANAS postings are unmunged, it is also possible that this address
was harvested from usenet.

This IP address is RBL listed: http://www.spamhaus.org/query/bl?ip=196.9.164.54

This message has been assigned a unique identifier by the receiving SMTP server: ScubaSteve-1099395920-28292

On Tue Nov 2 11:45:26 2004 -0000 a message was received from
196.9.164.54 [[196.9.164.54]] which said HELO as PROPNETPROXY
and left the following turdlet for all to see:

Received: from [196.9.164.54] (HELO PROPNETPROXY) (196.9.164.54)
by ScubaSteve-1.13 with SMTP; Tue Nov 2 11:45:26 2004 -0000
X-Message-Info: FVPszoZ676dPHnlKtr640h649R41JSfvFIjy
Received: from sdyhq8.hotmail.com (64.180.31.68) by q5-thr.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824);
Tue, 02 Nov 2004 13:36:59 +0200
Received: from corduroyasc4 (orthography153.0.133.114)
by hotmail.com (sqo883) with SMTP
id <73002f925ouo>
(Authid: MitchelHolliday);
Tue, 02 Nov 2004 17:31:59 +0600
From: "Audrey Blair" <ZOERXCA...@hotmail.com>
To: "'Jodee493'" <jode...@10000housedesigns.com>
Subject: 100% natural viagra, get it and get hard!
Date: Tue, 02 Nov 2004 07:32:59 -0400
Message-ID: <717ngn066xow4$927xx71eiz95$1mga5ss@grossmanthroughzvj5177>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--797103664580396"

----797103664580396
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<title>TiberiusErectus</title>
</head>
<body>
<a href=3D"http://bba-boyner-com.info/index.php?id=3D173&affid=3D6893"><im=
g src=3D"http://bba-boyner-com.info/ads/bigad4te.jpg" border=3D"0" width=3D=
"500" height=3D"600"></a>click
<a href=3D"http://bba-boyner-com.info/gone.php">here</a> if you would not=
like to receive future mailings.
</body>
</html>

----797103664580396--

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>

jas...@openbrick.kicks-ass.net

unread,

Nov 2, 2004, 8:00:27 AM11/2/04

to

Received: from [200.74.40.105] by openbrick.kicks-ass.net
(ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.6.0)); Tue, 2 Nov 2004 08:00:03 -0500
Received: from 10.184.249.221 by mail.diebold.denny.cacti.net ([200.74.40.105]) with SMTP for <dev...@hansonsux.homeip.net>; Tue, 02 Nov 2004 04:59:22 -0800
Message-ID: <9593854.1632489593828.JavaMail.gallery@aurigabizarre>
Reply-To: "Miranda " <irkfa...@alloymail.comal>
From: "Miranda " <irkfa...@alloymail.comal>
To: dev...@hansonsux.homeip.net

Subject: 100% natural viagra, get it and get hard!

Return-Path: <irkfa...@alloymail.comal>
Date: Tue, 2 Nov 2004 08:00:03 -0500

Date: Tue, 02 Nov 2004 04:59:22 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_005E_39093983511470620"

------=_NextPart_000_005E_39093983511470620
Content-Type: text/html;
Content-Transfer-Encoding: 7Bit

<title>TiberiusErectus</title>
</head>
<body>

<a href="http://bba-boyner-com.info/index.php?id=173&affid=6893"><img src="http://bba-boyner-com.info/ads/bigad4te.jpg" border="0" width="500" height="600"></a>click
<a href="http://bba-boyner-com.info/gone.php">here</a> if you would not like to receive future mailings.
</body>
</html>

------=_NextPart_000_005E_39093983511470620--

Karsten M. Self

unread,

Nov 2, 2004, 10:25:00 AM11/2/04

to

An accompanying mail was sent to the following addresses which
are thought to be responsible for domain(s), IP blocks, ASN, or
nameservers associated with the origin point:

ab...@comcast.net

Message abstract:

Message ID: <KFRKQJKLQGH...@yahoo.com>
Originating IP address:
24.218.59.18 (h00a0cc612f8c.ne.client2.attbi.com)

ASN: 7015
ASN Description:
CIDR: 24.218.0.0/16

CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=7015

The following (if any) queryable spam-related information is
associated with the originating IP and/or domain:

attbi.com does not support abuse@domain mail.
attbi.com does not support postmaster@domain mail.

IP 24.218.59.18 (h00a0cc612f8c.ne.client2.attbi.com) is known to
SpamHaus as a source or relay of spam.
See: http://www.spamhaus.org/

Classification(s):

- Illegal 3rd party exploits, including proxies, worms and trojans.

For more information on this host, see:

http://www.spamhaus.org/query/bl?ip=24.218.59.18

Please address these issues.

The originating IP is listed in the following spam and open
relay lookup services:

- SpamCop: Blocked - see http://www.spamcop.net/bl.shtml?24.218.59.18
- Composite Blocklist: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=24.218.59.18
- SPEWS Level 1: ! [1] comcast/attbi, see http://spews.org/ask.cgi?S2963

Additional resources of possible interest:

http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=24.218.59.18
http://openrbl.org/lookup?i=24.218.59.18
http://groups.google.com/groups?scoring=d&q=24.218.59.18+group:*abuse*

Among potential contact addresses found for this spam are:

IPW: ab...@comcast.net, cips_ip-re...@cable.comcast.com
D:
WI:
AN: ab...@attbi.com
RD: ab...@comcast.com, postm...@comcast.com
AA:

The following addresses are not reachable per remote query or
local experience:

IG: ab...@attbi.com cips_ip-re...@cable.comcast.com postm...@attbi.com

Full unmunged headers and body follow.

Karsten M. Self <kms...@ix.netcom.com>

+------------------------------------------------------------------+
| This report produced by the SpamTools reporting kit licensed |
| under the GNU GPL and available at: |
| |
| http://linuxmafia.com/~karsten/Download/SpamTools.tar.gz |
| |
+------------------------------------------------------------------+

Version: 1.32
Last updated: 2004/10/10 03:43:37

---------------------------------------------------------------------

From bmccm...@hotmail.com Tue Nov 2 07:24:21 2004
Received: from localhost ([127.0.0.1] ident=karsten)
by localhost with esmtp (Exim 3.36 #1 (Debian))
id 1COwD2-0008JE-00
for <karsten@localhost>; Tue, 02 Nov 2004 02:48:16 -0800
Status: U
Received: from popd.ix.netcom.com [207.217.120.161]
by localhost with POP3 (fetchmail-6.2.5)
for karsten@localhost (single-drop); Tue, 02 Nov 2004 02:48:16 -0800 (PST)
Received: from h00a0cc612f8c.ne.client2.attbi.com ([24.218.59.18])
by mx-a065a10.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1coWcj3OS3NZFpB0
Tue, 2 Nov 2004 02:47:28 -0800 (PST)
Received: from 76.72.56.224 by 24.218.59.18; Tue, 02 Nov 2004 09:50:57 -0100
Message-ID: <KFRKQJKLQGH...@yahoo.com>
From: "Ferdinand Mcleod" <bmccm...@hotmail.com>
Reply-To: "Ferdinand Mcleod" <bmccm...@hotmail.com>
To: kmself<at>28527.ix.netcom.com

Subject: 100% natural viagra, get it and get hard!

Date: Tue, 02 Nov 2004 07:45:57 -0300
X-Mailer: AOL 9.0 for Windows US sub 185
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--958717910835841359"
X-Priority: 3
X-MSMail-Priority: Normal
X-IP:92.144.176.171
X-ELNK-AV: 0
Lines: 22
X-SenderIP: 24.218.59.18
X-ASN: ASN-7015
X-CIDR: 24.218.0.0/16
X-Mozilla-Status: 0004

----958717910835841359
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<title>TiberiusErectus</title>
</head>
<body>

<a href=3D"http://dreamcast-bba.info/index.php?id=3D173&affid=3D6893"><img=
src=3D"http://dreamcast-bba.info/ads/bigad2te.jpg" border=3D"0" width=3D"=
500" height=3D"600"></a><font color=3D"#000000" size=3D"2" face=3D"aria=

l, helvetica, sans-serif">click

<a href=3D"http://dreamcast-bba.info/gone.php">here</a> if you would not =

like to receive future mailings.
</body>
</html>

----958717910835841359--

---------------------------------------------------------------------

Blacklist Administrator

unread,

Nov 2, 2004, 6:23:50 PM11/2/04

to

NOTE: This message is the result of web or usenet address harvesting.
Addresses are created dynamically for address harvesters by Seed
Spambots: http://freshmeat.net/projects/seedspambots/

Since NANAS postings are unmunged, it is also possible that this address
was harvested from usenet.

This IP address is RBL listed: http://www.spamhaus.org/query/bl?ip=83.16.173.154

This message has been assigned a unique identifier by the receiving SMTP server: ScubaSteve-1099437401-10481

On Tue Nov 2 23:17:08 2004 -0000 a message was received from
83.16.173.154 [agr154.internetdsl.tpnet.pl] which said HELO as agr154.internetdsl.tpnet.pl

and left the following turdlet for all to see:

Received: from agr154.internetdsl.tpnet.pl (HELO agr154.internetdsl.tpnet.pl) (83.16.173.154)
by ScubaSteve-1.13 with SMTP; Tue Nov 2 23:17:08 2004 -0000
X-Message-Info: 3mopma84mfpZ/yzZjDLClWaPCH83PIusj
Received: from lopseed (194.200.81.0)
by xn5.bernie.round.ban.yahoo.com
(InterMail vM.4.87.01.85 44-05-55-88-3951-20428015) with ESMTP
id <555836.JIA3159.lxd3-mail.exonerate.wappinger.net.cable.rogers.com@permit>
for <lajua...@10000housedesigns.com>; Tue, 02 Nov 2004 22:07:20 -0100
Message-ID: <92010lpew0cva$6778382crk5$75817tuh177paa538@studebaker>
Reply-To: "Olin Enriquez" <YGZGN...@msn.com>
From: "Olin Enriquez" <YGZGN...@msn.com>
To: <lajua...@10000housedesigns.com>

Subject: 100% natural viagra, get it and get hard!

Date: Tue, 02 Nov 2004 18:04:20 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--303478239417319587"

----303478239417319587
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<title>TiberiusErectus</title>
</head>
<body>

<a href=3D"http://bba-boyner-com.info/index.php?id=3D173&affid=3D6893"><im=
g src=3D"http://bba-boyner-com.info/ads/bigad4te.jpg" border=3D"0" width=3D=

"500" height=3D"600"></a>click
<a href=3D"http://bba-boyner-com.info/gone.php">here</a> if you would not=

like to receive future mailings.
</body>
</html>

----303478239417319587--