Since NANAS postings are unmunged, it is also possible that this address
was harvested from usenet.
This IP address is RBL listed: SPEWS [1] ReliaHost/Camargo, see http://spews.org/ask.cgi?S3046
This message has been assigned a unique identifier by the receiving SMTP server: ScubaSteve-1101301244-11711
On Wed Nov 24 13:01:32 2004 -0000 a message was received from
200.165.184.63 [200165184063.user.veloxzone.com.br] which said HELO as 200165184063.user.veloxzone.com.br
and left the following turdlet for all to see:
Received: from 200165184063.user.veloxzone.com.br (HELO 200165184063.user.veloxzone.com.br) (200.165.184.63)
by ScubaSteve-1.13 with SMTP; Wed Nov 24 13:01:32 2004 -0000
Message-ID: <8085164550379...@web98759.mail.yahoo.com>
Received: from [200.165.184.63] by web98759.mail.yahoo.com via HTTP; Wed, 24 Nov 2004 05:54:02 -0600
Date: Wed, 24 Nov 2004 05:54:02 -0600
From: "Tracey Lovett" <eue...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: sid...@10000housedesigns.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-7933975156-4372643513=:40132"
--0-7933975156-4372643513=:40132
Content-Type: text/plain; charset=us-ascii
<a href="http://www.yingom.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.karmakamper.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yingom.com/unsub/">un-su bscr1b3</a>
--0-7933975156-4372643513=:40132
Content-Type: text/html; charset=us-ascii
<a href="http://www.yingom.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.karmakamper.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yingom.com/unsub/">un-su bscr1b3</a>
--0-7933975156-4372643513=:40132--
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>
Since NANAS postings are unmunged, it is also possible that this address
was harvested from usenet.
This IP address is RBL listed: Dynamic IP Address See: http://www.dnsbl.sorbs.net/lookup.shtml?200.154.173.33
This message has been assigned a unique identifier by the receiving SMTP server: ScubaSteve-1101301022-11653
On Wed Nov 24 12:57:41 2004 -0000 a message was received from
200.154.173.33 [dl-lns3-poa-c89aad21.dialterra.com.br] which said HELO as dl-lns3-poa-C89AAD21.dialterra.com.br
and left the following turdlet for all to see:
Received: from dl-lns3-poa-c89aad21.dialterra.com.br (HELO dl-lns3-poa-C89AAD21.dialterra.com.br) (200.154.173.33)
by ScubaSteve-1.13 with SMTP; Wed Nov 24 12:57:41 2004 -0000
Message-ID: <6782616823304...@web11115.mail.yahoo.com>
Received: from [200.148.99.85] by web11115.mail.yahoo.com via HTTP; Wed, 24 Nov 2004 05:48:39 -0600
Date: Wed, 24 Nov 2004 05:48:39 -0600
From: "Hallie Maurer" <vhsgiy...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: haro...@10000housedesigns.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-4828741998-6217381826=:28601"
--0-4828741998-6217381826=:28601
Content-Type: text/plain; charset=us-ascii
<a href="http://www.yuyumant.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yuyumant.com/unsub/">un-su bscr1b3</a>
--0-4828741998-6217381826=:28601
Content-Type: text/html; charset=us-ascii
<a href="http://www.yuyumant.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yuyumant.com/unsub/">un-su bscr1b3</a>
--0-4828741998-6217381826=:28601--
Cl1ck h3re for best pen1s enlarg3ment p1lls
[ http://www.brillimojo.com/0/4/4-18.jpg ] »
[ http://www.wringman.com/unsub/ ] un-su bscr1b3
----------------------
From rrad...@yahoo.com Thu Nov 25 19:07:42 2004
Received: from mx0.public.com (mx0.public.com [66.112.160.20])
by public.com (8.12.10/8.12.10) with ESMTP id
iAQ07fOe019037 for <x...@public.com>; Thu, 25 Nov 2004 19:07:41
-0500 (EST)
Received: from 200-096-199-063.roice202.dial.brasiltelecom.net.br
(200-096-199-063.roice202.dial.brasiltelecom.net.br [200.96.199.63]) by
mx0.public.com (8.11.6/8.11.6) with SMTP id iAQ06xf29758 for
<hor...@fw.merk.com>; Thu, 25 Nov 2004 19:07:06 -0500
Message-Id: <1108197333576...@web67067.mail.yahoo.com>
Received: from [200.96.199.63] by web67067.mail.yahoo.com via HTTP;
Thu, 25 Nov 2004 18:06:09 -0600
Date: Thu, 25 Nov 2004 18:06:09 -0600
From: "Hunter Singh" <rrad...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: hor...@fw.merk.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-9060459230-6692114065=:53348"
--0-9060459230-6692114065=:53348
Content-Type: text/plain; charset=us-ascii
<a href="http://www.wringman.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.karmakamper.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.wringman.com/unsub/">un-su bscr1b3</a>
--0-9060459230-6692114065=:53348
Content-Type: text/html; charset=us-ascii
<a href="http://www.wringman.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.karmakamper.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.wringman.com/unsub/">un-su bscr1b3</a>
--0-9060459230-6692114065=:53348--
ab...@dialuol.com.br, postm...@dialuol.com.br, ab...@uol.com.br,
secu...@uol.com.br
Message abstract:
Message ID: <9232423506484...@web14609.mail.yahoo.com>
Originating IP address:
200.147.11.192 (200-147-11-192.tlm.dialuol.com.br)
ASN: 15201
ASN Description: UOL Inc
CIDR: 200.147.0.0/18
CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=15201
The following (if any) queryable spam-related information is
associated with the originating IP and/or domain:
IP 200.147.11.192 (200-147-11-192.tlm.dialuol.com.br) is known to
SpamHaus as a source or relay of spam.
See: http://www.spamhaus.org/
Classification(s):
- Illegal 3rd party exploits, including proxies, worms and trojans.
For more information on this host, see:
http://www.spamhaus.org/query/bl?ip=200.147.11.192
Please address these issues.
- Composite Blocklist: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=200.147.11.192
- SORBS Open Relay: Dynamic IP Address See: http://www.dnsbl.sorbs.net/lookup.shtml?200.147.11.192 Exploitable Server See: http://www.dnsbl.sorbs.net/lookup.shtml?200.147.11.192
Additional resources of possible interest:
http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=200.147.11.192
http://openrbl.org/lookup?i=200.147.11.192
http://groups.google.com/groups?scoring=d&q=200.147.11.192+group:*abuse*
Among potential contact addresses found for this spam are:
IPW: l-regist...@corp.uol.com.br, mail-...@nic.br, nb...@nic.br, secu...@uol.com.br
D: postm...@dialuol.com.br ab...@dialuol.com.br
WI: l-ad...@uolinc.com, l-regist...@corp.uol.com.br, mail-...@nic.br, nb...@nic.br
AN: secu...@uol.com.br, postm...@dialuol.com.br, ab...@uol.com.br
RD:
AA:
The following addresses are not reachable per remote query or
local experience:
IG:
Full unmunged headers and body follow.
Karsten M. Self <kms...@ix.netcom.com>
+------------------------------------------------------------------+
| This report produced by the SpamTools reporting kit licensed |
| under the GNU GPL and available at: |
| |
| http://linuxmafia.com/~karsten/Download/SpamTools.tar.gz |
| |
+------------------------------------------------------------------+
Version: 1.32
Last updated: 2004/10/10 03:43:37
---------------------------------------------------------------------
From gst...@yahoo.com Thu Nov 25 18:42:47 2004
Received: from localhost ([127.0.0.1] ident=karsten)
by localhost with esmtp (Exim 3.36 #1 (Debian))
id 1CXJYS-0005M2-00
for <karsten@localhost>; Thu, 25 Nov 2004 05:21:00 -0800
Status: U
Received: from popd.ix.netcom.com [207.217.120.161]
by localhost with POP3 (fetchmail-6.2.5)
for karsten@localhost (single-drop); Thu, 25 Nov 2004 05:21:00 -0800 (PST)
Received: from 200-147-11-192.tlm.dialuol.com.br ([200.147.11.192])
by mx-a065b28.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1cwKEf6gR3NZFpQ0
Tue, 23 Nov 2004 16:03:46 -0800 (PST)
Message-ID: <9232423506484...@web14609.mail.yahoo.com>
Received: from [200.147.11.192] by web14609.mail.yahoo.com via HTTP; Tue, 23 Nov 2004 18:03:00 -0600
Date: Tue, 23 Nov 2004 18:03:00 -0600
From: "Elvira Koenig" <gst...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: kmmcd<at>15508.ix.netcom.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-8891083641-1007292473=:26163"
X-ELNK-AV: 0
Lines: 18
X-SenderIP: 200.147.11.192
X-ASN: ASN-15201
X-CIDR: 200.147.0.0/18
--0-8891083641-1007292473=:26163
Content-Type: text/plain; charset=us-ascii
<a href="http://www.yuyumant.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yuyumant.com/unsub/">un-su bscr1b3</a>
--0-8891083641-1007292473=:26163
Content-Type: text/html; charset=us-ascii
<a href="http://www.yuyumant.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.yuyumant.com/unsub/">un-su bscr1b3</a>
--0-8891083641-1007292473=:26163--
---------------------------------------------------------------------
Since NANAS postings are unmunged, it is also possible that this address
was harvested from usenet.
This message has been assigned a unique identifier by the receiving SMTP server: ScubaSteve-1101446269-19540
On Fri Nov 26 05:18:50 2004 -0000 a message was received from
200.216.89.250 [[200.216.89.250]] which said HELO as 137.118.8.16
and left the following turdlet for all to see:
Received: from [200.216.89.250] (HELO 137.118.8.16) (200.216.89.250)
by ScubaSteve-1.13 with SMTP; Fri Nov 26 05:18:50 2004 -0000
Message-ID: <8584058528681...@web81819.mail.yahoo.com>
Received: from [200.216.89.250] by web81819.mail.yahoo.com via HTTP; Thu, 25 Nov 2004 22:10:30 -0600
Date: Thu, 25 Nov 2004 22:10:30 -0600
From: "Carolyn Parks" <tngts...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: bernad...@10000housedesigns.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-0896335019-3734822075=:92225"
--0-0896335019-3734822075=:92225
Content-Type: text/plain; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-0896335019-3734822075=:92225
Content-Type: text/html; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-0896335019-3734822075=:92225--
--0-1956420861-1832027521=:32556
Content-Type: text/plain; charset=us-ascii
<a href="http://www.wringman.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.wringman.com/unsub/">un-su bscr1b3</a>
--0-1956420861-1832027521=:32556
Content-Type: text/html; charset=us-ascii
<a href="http://www.wringman.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.wringman.com/unsub/">un-su bscr1b3</a>
--0-1956420861-1832027521=:32556--
The address this was sent to was harvested
from Usenet.
Received: from CableLink37-241.INTERCABLE.net (CableLink37-241.INTERCABLE.net [207.248.37.241])
by mail.nwsup.com (8.13.1/8.13.1) with SMTP id iAQL5TOV003020;
Fri, 26 Nov 2004 16:05:54 -0500
Message-ID: <6552607385691...@web89372.mail.yahoo.com>
Received: from [207.248.37.241] by web89372.mail.yahoo.com via HTTP; Fri, 26 Nov 2004 15:04:57 -0600
Date: Fri, 26 Nov 2004 15:04:57 -0600
From: "Anibal Bruno" <pxwxe...@yahoo.com>
Subject: Pen1s enlarg3ment p1lls
To: mun...@nwsup.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-4645676815-6212185974=:11196"
X-Virus-Scanned: ClamAV 0.80/325/Wed Dec 31 19:00:00 1969
clamav-milter version 0.80j
on localhost
X-Virus-Status: Clean
--0-4645676815-6212185974=:11196
Content-Type: text/plain; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-4645676815-6212185974=:11196
Content-Type: text/html; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-4645676815-6212185974=:11196--
The address this was sent to was harvested
from a domain registration.
The address this was sent to has NEVER been
opted-in to anything.
--0-8255258472-8203829049=:34163
Content-Type: text/plain; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-8255258472-8203829049=:34163
Content-Type: text/html; charset=us-ascii
<a href="http://www.umbridol.com/9/4/index.php?ai=7781&com=35">
Cl1ck h3re for best pen1s enlarg3ment p1lls<br>
<img src="http://www.brillimojo.com/0/4/4-18.jpg" border="0"></a>
<br><br><br><br>
<a href="http://www.umbridol.com/unsub/">un-su bscr1b3</a>
--0-8255258472-8203829049=:34163--