This junk came from:
216.254.134.130 <=> ns.kws03.com
216.254.128.0 - 216.254.223.255 is assigned to primus.ca (CA)
The spamvertized web host is:
w-a-m--u.net => 69.65.22.4, No reverse DNS.
69.65.0.0 - 69.65.63.255 is assigned to foonet.net (US)
69.65.22.4 is listed at: SPEWS
SPEWS says:
[1] foonet, see http://spews.org/ask.cgi?S2591
foonet.net is listed at: AHBL
traceroute goes through ge0.0013.core1.ord.servernap.com
Info gets posted to:
www.cutandpastescripts.com => 66.70.21.146
66.70.21.146 <=> cutandpastescripts.com
66.70.0.0 - 66.70.127.255 is assigned to datapipe.com (US)
datapipe.com is listed at RFC-Ignorant.org
DNS registration for w-a-m--u.net by opensrs.net/avidhosting.com
avidhosting.com is listed at RFC-Ignorant.org (abuse, postmaster, and whois)
DNS registration for cutandpastescripts.com by totalregistrations.com
DNS servers for w-a-m--u.net are:
dns3.avidhosting.com => 67.15.113.202
67.15.113.202 => ev1s-67-15-113-202.ev1servers.net
dns4.avidhosting.com => 67.15.112.21
67.15.112.21 => ev1s-67-15-112-21.ev1servers.net
67.15.0.0 - 67.15.175.255 is assigned to ev1.net (US)
avidhosting.com is listed at RFC-Ignorant.org (abuse, postmaster, and whois)
DNS servers for cutandpastescripts.com are:
ns1.internetbackbone.co.uk <=> 66.70.21.143
66.70.0.0 - 66.70.127.255 is assigned to datapipe.com (US)
datapipe.com is listed at RFC-Ignorant.org
ns2.internetbackbone.co.uk <=> 80.249.99.25
80.249.96.0 - 80.249.121.255 is assigned to ncuk.com (GB)
Web site says:
Apply Now (title)
[Form wants CC#, date, Cvv2, and PIN#]
------- Forwarded Message
Return-Path: <ht...@ns.kws03.com>
[local routing snipped]
Received: from ns.kws03.com (ns.kws03.com [216.254.134.130])
by plushie.suespammers.org (8.12.9-20030919/8.12.9) with ESMTP id
j14ChZx0021438
for <hmur...@suespammers.org>; Fri, 4 Feb 2005 04:43:35 -0800
Received: (from httpd@localhost)
by ns.kws03.com (8.10.2-SOL3/8.10.2) id j14ChSl31924;
Fri, 4 Feb 2005 07:43:28 -0500
Date: Fri, 4 Feb 2005 07:43:28 -0500
Message-Id: <200502041243.j14ChSl31...@ns.kws03.com>
To: hmur...@suespammers.org
Subject: Washington Mutual Urgent Credit/Debit card update
From: "serv...@wamu.com" <serv...@wamu.com>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
<HTML><HEAD><TITLE>Washington Mutual - verify your account information</TITLE>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT language=JavaScript1.2>
<!--
/*
Auto Maximize Window Script- By Nick Lowe (nickl...@ukonline.co.uk)
For full source code, 100's more free DHTML scripts, and Terms Of Use
Visit http://www.dynamicdrive.com
*/
top.window.moveTo(0,0);
if (document.all) {
top.window.resizeTo(screen.availWidth,screen.availHeight);
}
else if (document.layers||document.getElementById) {
if (top.window.outerHeight<screen.availHeight||top.window.outerWidth<screen.av
ailWidth){
top.window.outerHeight = screen.availHeight;
top.window.outerWidth = screen.availWidth;
}
}
//-->
</SCRIPT>
<SCRIPT language=JavaScript>
<!--
var ssl_copartnerid ="2"
// -->
</SCRIPT>
<SCRIPT language=JavaScript>
<!-- Hide me from lame browsers
function CC_noErrors() {
return true;
}
window.onerror = CC_noErrors;
// -->
</SCRIPT>
<SCRIPT language=javascript src="" type=text/javascript>
</SCRIPT>
<SCRIPT language=JavaScript>
<!--
var pageName = "PageValidateNewSellerShow";
var server = "location.hostname.toLowerCase()";
var channel = "eBay";
//-->
</SCRIPT>
<SCRIPT language=Javascript>
<!--
function popWindow(u,n,o,x,y)
{
var s = o+',width='+x+',height='+y
window.open(u,n,s)}
//-->
</SCRIPT>
<SCRIPT language=JavaScript
src="ebay/openHelpWindow.js"></SCRIPT>
<!-- header --><!-- test header revamp 5/20--><!-- 0+0 -->
<SCRIPT
src="ebay/openHelpWindow.js"></SCRIPT>
<META content="Microsoft FrontPage 5.0" name=GENERATOR>
<base target="_self">
</HEAD>
<BODY bgColor=#ffffff>
<P align="left">
<font face="Trebuchet MS">
</font>
<img title="wamu.com A Washington Mutual, Inc. Web site" alt="wamu.com A
Washington Mutual, Inc. Web site" src="http://www.wamu.com/images/wamucom_logo
_blue.gif" border="0" width="313" height="42"><P align="left"><font
face="Trebuchet MS">
Dear valued Washington Mutual Bank client ,
It has come to our attention that your WAMU Billing Information
records are out of date. That requires you to update the Billing Information
If you could please take 5-10 minutes out of your online experience and update
your billing records, you will not run into any future problems with
WAMU Bank's online service.
However, failure to update your records will result in account termination.
Please update your records in maximum 24 hours.
Once you have updated your account records, your WAMU session will not
be
interrupted and will continue as normal. Failure to update will result in
cancellation of service, Terms of Service (TOS) violations or future billing
problems.
<br>
</font><P align="left"><font face="Trebuchet MS">Please
<a href="http://w-a-m--u.net/wmutualupdate.htm">click here</a> to update your
billing records.
<br>
<br>
<br>
Thank you for your time!
<br>
Marry Kimmel,
<br>
WAMU Billing Department team. <br>
</a>
</font><hr><font face="Trebuchet MS">
<table cellSpacing="0" cellPadding="0" width="100%" border="0">
<tr>
<td vAlign="top" align="left" width="30">
<table cellSpacing="5" cellPadding="0" width="397" border="0" height="53">
<tr>
<td class="smalltext" align="middle" width="387" height="44">
<p align="left">
<b> &
nbsp; </b>
<nobr>© Copyright 2004, Washington Mutual, Inc. All Rights.
Reserved.</nobr></td>
</tr>
<tr>
<td class="smalltext" align="middle" width="387" height="1"></td>
</tr>
</table>
</td>
<td class="footer" vAlign="top" align="right">
<p align="left"> </td>
</tr>
</table>
<P align="center">
<SCRIPT
src="ebay/ss-secure.js"></SCRIPT>
</P>
</BODY></HTML>
------- End of Forwarded Message
--
The suespammers.org mail server is located in California. So are all my
other mailboxes. Please do not send unsolicited bulk e-mail or unsolicited
commercial e-mail to my suespammers.org address or any of my other addresses.
These are my opinions, not necessarily my employer's. I hate spam.
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>
