FUCK, how do I filter this porn spammer out of my webmaster e-mail account?

post one sample

Are you getting the same fucker im getting? I get 100's of spam from one person. 100's of spam in 1 day. Most of them is cbill. And he/she seem to use yahoo domains.

http://www.sibazebo.net?wtfnGGLlKoqdhLlvzSDnYrtF
http://www.shetdochedyasze.biz/s115a.htm?EyVSDQaYTxGi
http://www.kultudrnyesed.biz/s122f.htm?NpLIeEGdfLtM
http://www.kultudrnyesed.biz/s122e.htm?RpjrXQdfytBT

And he/she always puts something random words (eg. RpjrXQdfytB) at the end of the domain.

Here is the source of the most recent (only altering is my username xxx'd out)

Return-Path: <[email protected]>
Received: from c-67-176-66-101.client.comcast.net ([67.176.66.101])
by imf14aec.mail.bellsouth.net
(InterMail vM.5.01.06.11 201-253-122-130-111-20040605) with ESMTP
id <20050327151051.IFXA2064.imf14aec.mail.bellsouth.n [email protected]>
for <[email protected]>; Sun, 27 Mar 2005 10:10:51 -0500
Received: from yahoo.com (mx3.mail.yahoo.com [64.156.215.18])
by c-67-176-66-101.client.comcast.net with esmtp
id C6526683D8 for <[email protected]>; Sun, 27 Mar 2005 23:10:30 -0500
From: "Jacobs U. Gladiators" <[email protected]>
To: Mgweb <[email protected]>
Subject: Fresh meat pounding
Date: Sun, 27 Mar 2005 23:10:30 -0500
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000
X-Virus-Scanned: by Ameriserv.net Anti-Virus E-Gateway
X-Antivirus: AVG for E-mail 7.0.308 [266.8.4]

Man testeed girlls by turns
Big tannned titties
Tighht Teeen Beauty With Tan Linees Sttrips In Bedroom
Virgin Chick Geets Doublle Pennetrateed Anal And Pussy
Dumb blonnde fucked
Mature wooman shhows pussy
Seexy mature babe

http://www.mesidajyferoki.com?TwFZxGRcRJZxEepRWeLHwQ

Latina cooed in fishhnet hose
Coollege brunettte sucking and geets hard anal

Yeah, usually Yahoo domains involved in the supposed remove link, and gibberish at the end of the URL, most recent: http://www.mesidajyferoki.com/?TwFZxGRcRJZxEepRWeLHwQ

Dude, your getting the same person as me. More samples.

http://www.bylaodnaruskaya.biz/s119b.htm?YOfclqFdHtg
http://www.tolkosechaspon.biz/s102d.htm?XfAQLyuHMrg
http://www.tolkosechaspon.biz/s102e.htm?odigTfdaIqp
http://www.tolkosechaspon.biz/s102c.htm?fpxadffjKyQr
http://www.chertezbergorod.biz/s93a.htm?RRGfotvTJoC
http://www.chertezbergorod.biz/s93c.htm?TGfjVEhyWkb
http://www.imnijenparjern.biz/s82d.htm?uzZAXtChfzA
http://www.vyzulevy.net/index.html?t...AcuuudmxyfgJqt

All domains are hosted under yahoo.

I'm getting them also, probably 50-100/day for nearly 60 days now.

yes, getting them as well ..

I don't think the domains are actually Yahoo, I'm thinking this is more a spoof script.

The nameservers say..

Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com

On all domains when you whois.

Yeah, I just did a whois on the oldest one I have

WHOIS information for sahenygomy.biz:

[whois.melbourneit.com]
Domain Name: SAHENYGOMY.BIZ
Domain ID: D9227140-BIZ
Sponsoring Registrar: MELBOURNE IT D/B/A INTERNET NAMES WORLD WIDE
Sponsoring Registrar IANA ID: 13
Domain Status: ok
Registrant ID: B111093823568928
Registrant Name: Dan Obrien
Registrant Organization: Dan Obrien
Registrant Address1: 1608 S Morrissey Dr.
Registrant City: Bloomington
Registrant State/Province: IL
Registrant Postal Code: 61704
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.3097385071
Registrant Email: [email protected]
Administrative Contact ID: B111093823568925
Administrative Contact Name: Dan Obrien
Administrative Contact Organization: Dan Obrien
Administrative Contact Address1: 1608 S Morrissey Dr.
Administrative Contact City: Bloomington
Administrative Contact State/Province: IL
Administrative Contact Postal Code: 61704
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.3097385071
Administrative Contact Email: [email protected]
Billing Contact ID: B111093817090879
Billing Contact Name: YahooDomains BillingContact
Billing Contact Organization: Yahoo! Inc
Billing Contact Address1: 701 First Ave.
Billing Contact City: Sunnyvale
Billing Contact State/Province: CA
Billing Contact Postal Code: 94089
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.6198813096
Billing Contact Facsimile Number: +1.6198813010
Billing Contact Email: [email protected]
Technical Contact ID: B111093817090880
Technical Contact Name: YahooDomains TechContact
Technical Contact Organization: Yahoo! Inc
Technical Contact Address1: 701 First Ave.
Technical Contact City: Sunnyvale
Technical Contact State/Province: CA
Technical Contact Postal Code: 94089
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.6198813096
Technical Contact Facsimile Number: +1.6198813010
Technical Contact Email: [email protected]
Name Server: YNS2.YAHOO.COM
Name Server: YNS1.YAHOO.COM
Created by Registrar: MELBOURNE IT D/B/A INTERNET NAMES WORLD WIDE
Domain Registration Date: Wed Mar 16 01:58:06 GMT 2005
Domain Expiration Date: Wed Mar 15 23:59:59 GMT 2006

I can't filter out all Yahoo

Same here. I normally only get around 5 spams a day(on private account) Now I get around 85 a day

Hot and spicy ass
Trio sexual escapade
bruntete amateur babe fuck hard and boojlbw Cute Young Lsebians Licking Pussies

http://www.ditiwitoqalasy.net?ZWZJuPlGhfFAVTaLCUDHTh

Asian Teen Fineegrd & Fucekd In Bdroeom Movies Thai girl fuck anal

Spamassassin catches that asshole. He's been spamming the shit out of emails that I use only for sponsors. Unfortunately I used to use the same address for all sponsors so I have no clue who leaked/sold the address.

I just checked my Deleted folder and the earliest one I have is Feb 9:

Return-Path: <[email protected]>
Received: from hanmir.com ([218.38.60.240]) by imf00aec.mail.bellsouth.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040209080647.BMUI26718.imf00aec.mail.bellsouth. [email protected]>
for <[email protected]>; Mon, 9 Feb 2004 03:06:47 -0500
Message-ID: <[email protected]>
From: "Zarla P. Truran" <[email protected]>
Subject: Free Female Ejaculations
Date: Mon, 09 Feb 2004 08:06:47 +0000
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<p>Come see extreme female ejaculations.<br>
<p><a href="http://www.hluispymhte.soofzocjrlfiip.mrzvvgbsrmk.xtfolgc ibn.anqhoklkkbyw.comyazcjtdphfprphref=www.tlyffycq cn.ugsfsedbvfcedd.bsmzecbjfandj.lbvheqdygtp.opltns irwwdobx.htgbmtbeyivvkb.pinearox.com/gc/?www.lowvzrdaokh.saukkmcdxvxqib.dqustlcyqpwdw.llom zqcrdtq.tzjcwwdlycuum.mgkojibols.com">Right here</a></p>
<br>
<br>
<a href="http://www.vyxzvddadi.guejqgpiztq.alrfjqdphhvj.sqvolkbxcd gwxa.comixccoedxbrqrqchref=www.xtqybedsoxnilnxvomd mkkbin.sjknvqbhfskxbrmrryxdkcertdm.agllkadbmvqrqpc ubskwiwsd.pinearox.com/xen.php?www.njkovrymkxydvusqdgbwuzfl.rcwvsvcyyvsvs lpewbnlisy.zqjozclropgkbwcpktfsbntqej.ntymufdslnmz rdeudhgpqkyx">Stop getting mail</a> </p>
<p>eQBc3QsSV2IjydCgtq</p>
<p>kuagfcdusgf ityisvdviu xcropcjkryt</p>
</body>
</html>

Thanks for the confirmation. I was certain the address being spammed had only ever been used for sponsors.

Would you like a gmail invite?

what?

What does that have to do with this thread?

Thanks TA, if I didn't already have one it would be most appreciated

I just hate to lose an address that has been secure for so many years to one idiot that is fucking us

yep i've got over 200 I saved, altogether must have gotten 400 or 500. Sent all of them 2 ccbill, they must still have an account. Paycom termed them a long time ago.

Did you ever sign-up for any of Hooper's program's?
conversion cash or quickbucks are 2 of'em