Juicy Help Please Spammer Info Inside
 

Saw your offer of deciphering in another thread, and decided to show you what I'm getting. I have gotten hundreds of these in the last week, all in the same format.

Header Example #1
*****
Received: from google.com (unknown[220.81.184.182](misconfigured sender))
by sccqmxc93.asp.att.net (sccqmxc93) with SMTP
id <20050917073120q93003aov1e>; Sat, 17 Sep 2005 07:31:31 +0000
X-Originating-IP: [220.81.184.182]
From: "Collaborates I. Pervade" <[email protected]>
To:
Subject: Busty asian fucks
Date: Sun, 18 Sep 2005 10:33:00 -0700
Message-ID: <[email protected]>
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2605
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2505.0000
X-Virus-Scanned: by amavisd-milter at google.com
X-Antivirus: AVG for E-mail 7.0.344 [267.11.1]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
*****
Text of mail:
Hardcore Mask FFM 3some Doggystyle Fucking
The Two Most Wanted Big Breasts And Beauty Models
Black Amateur With Glasses Bending Over
Hot Babe Good Sucking Cumshot & Gargling Movies
Nice asian chick posing naked
http://www.ubegayusevlerx.biz/s28-1.htm?VDJtzxdWDp

whois info on ubegayusevlerx.biz
Domain Name: UBEGAYUSEVLERX.BIZ
Domain ID: D10899349-BIZ
Sponsoring Registrar: MELBOURNE IT D/B/A INTERNET NAMES WORLD WIDE
Sponsoring Registrar IANA ID: 13
Domain Status: clientTransferProhibited
Registrant ID: A112651988353581
Registrant Name: Antonette Howbert
Registrant Organization: Antonette Howbert
Registrant Address1: Box 90111
Registrant City: Dayton
Registrant State/Province: OH
Registrant Postal Code: 45490
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.9376676858
Registrant Email:
Administrative Contact ID: C112652001813411
Administrative Contact Name: Antonette Howbert
Administrative Contact Organization: Antonette Howbert
Administrative Contact Address1: Box 90111
Administrative Contact City: Dayton
Administrative Contact State/Province: OH
Administrative Contact Postal Code: 45490
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.9376676858
Administrative Contact Email:
Billing Contact ID: C112652001813412
Billing Contact Name: YahooDomains BillingContact
Billing Contact Organization: Yahoo! Inc
Billing Contact Address1: 701 First Ave.
Billing Contact City: Sunnyvale
Billing Contact State/Province: CA
Billing Contact Postal Code: 94089
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.6198813096
Billing Contact Email:
Technical Contact ID: C112652001813413
Technical Contact Name: YahooDomains TechContact
Technical Contact Organization: Yahoo! Inc
Technical Contact Address1: 701 First Ave.
Technical Contact City: Sunnyvale
Technical Contact State/Province: CA
Technical Contact Postal Code: 94089
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.6198813096
Technical Contact Email:
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Created by Registrar: MELBOURNE IT D/B/A INTERNET NAMES WORLD WIDE
Last Updated by Registrar: MELBOURNE IT D/B/A INTERNET NAMES WORLD WIDE
Domain Registration Date: Mon Sep 12 10:13:56 GMT 2005
Domain Expiration Date: Mon Sep 11 23:59:59 GMT 2006
Domain Last Updated Date: Mon Sep 12 10:13:58 GMT 2005

>>>> Whois database was last updated on: Sat Sep 17 08:49:17 GMT 2005 <<<<



Header Example #2
*****
Received: from 222.102.7.58 ([222.102.7.58])
by sccqmxc92.asp.att.net (sccqmxc92) with SMTP
id <20050917074128q9200k6961e>; Sat, 17 Sep 2005 07:41:29 +0000
X-Originating-IP: [222.102.7.58]
Received: from mailserver.patrickengineering.com
by 222.102.7.58 (8.12.11/8.12.11) with ESMTP id Of58Mrw2he0o1S
for ; Sat, 17 Sep 2005 03:41:50 -0400
Received: from nobody (10.35.249.75)
by mailserver.patrickengineering.com (qmail-ldap-1.03) with SMTP
for Sat, 17 Sep 2005 03:41:50 -0400
Reply-To: "Greta Adams" <[email protected]>
From: "Greta" <[email protected]>
Message-ID: <2975324655.20050917034150@kuqyso>
Date: Sat, 17 Sep 2005 03:41:50 -0400
To: Subject: brunette granny playing with huge red dildo
X-Antivirus: AVG for E-mail 7.0.344 [267.11.1]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=iso-8859-1
******
Text of mail:

Salut!
beauty teen girl fucked in the pool
cute brunette teen shows her deliciously round ass
cumshot action redhead cum all over her
asian teen masturbating with banana
Mfmf orgy next pool
beautiful asian fetish babe in pink lingerie
Hard hentai toons
http://www.wicurovifyci.com/incest.h....bWRbdcQii,hVX

whois info on wicurovifyci.com
Domain Name.......... wicurovifyci.com
Creation Date........ 2005-09-16
Registration Date.... 2005-09-16
Expiry Date.......... 2006-09-16
Organisation Name.... Steve Tucker
Organisation Address. 15708 Tiger Mtn. Rd. S.E.
Organisation Address.
Organisation Address. Issaquah
Organisation Address. 98027
Organisation Address. WA
Organisation Address. UNITED STATES

Admin Name........... Steve Tucker
Admin Address........ 15708 Tiger Mtn. Rd. S.E.
Admin Address........
Admin Address........ Issaquah
Admin Address........ 98027
Admin Address........ WA
Admin Address........ UNITED STATES
Admin Email..........
Admin Phone.......... +1.4254782552
Admin Fax............

Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email...........
Tech Phone........... +1.6198813096
Tech Fax.............
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com


That is as far as I can go. I don't know how to tell if it is the same person, or if there is information in there that tells who I could contact to report it.
Any help you or anyone else can give would be greatly appreciated as I am getting hit with a ton of these things.

KK i have t run to bank be back in 20 or so.....

Who is info is useless , they are using bp domains registered with bs info.

[email protected]


they are using random from's before the "@" sign and a list of domains that rotate that have valid MX entries.

Judging by the below header:

Received: from google.com (unknown[220.81.184.182](misconfigured sender))
by sccqmxc93.asp.att.net (sccqmxc93) with SMTP
id <20050917073120q93003aov1e>; Sat, 17 Sep 2005 07:31:31 +0000
X-Originating-IP: [220.81.184.182]
From: "Collaborates I. Pervade" <[email protected]>
To:
Subject: Busty asian fucks
Date: Sun, 18 Sep 2005 10:33:00 -0700
Message-ID: <[email protected]>
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2605
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2505.0000
X-Virus-Scanned: by amavisd-milter at google.com
X-Antivirus: AVG for E-mail 7.0.344 [267.11.1]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain



they are using a very sophisticated mailer out there.

ill be back in afew for more.

looks like its the same technique where they use yahoo hosting to bypass filters. BS CC's are used to register these . Geocities being there favorite.

I will check the thread later in the day. I have to take the munchkin to taekwondo classes. But if you can make any sense of that gibberish, it would rock, because these people are being a pain in my ass.

And I've seen enough threads on boards to know I'm not the only one getting them.

Back later :)

the whois info is all BS.

tbh. Not much you can do about it.

Selena tbh , i would just ignore it. The spammer might read GFY and retaliate as we have seen in the past. One thing I can tell ya is that he is a experienced mailer and might be part of a team.

TBH just ignore it . If he retaliates , its gonna be hell to pay.

I got deeper info on it , but tbh let it be.

Just ignore it.

Okay, I will take your expert advice, because I know nothing about this kind of stuff.

I just hope whoever it is burns out quickly.

Thanks again, babe. :)

Last week it was NScash that he spammed but his accounts got closed quickly.
This week its royal-cash along with some smaller programs others.

He fucked up by buying/stealing webmaster lists the spams are being checked and the programs contacted about it.
Those programs not terminating him will be exposed.