123STORE.BIZ, 1SECURESTORE.INFO, 123SECURESTORE.COM, SALEZSITE.INFO spammer
"Anonymous" <[email protected]>
| Newsgroups | gmane.mail.spam.spamcop.email |
|---|---|
| Organization | SpamCop |
| Message-ID | <[email protected]> |
If you're tired of getting spam day in and day out from these spammers (offering a device to steal cable TV signals, and credit repair), then please feel free to load up the SpamVampire and hit them for all their worth. SpamVampire: http://www.hillscapital.com/antispam/ They use several tricks to remain in operation... 1) They use redirect domains (see below), so automated parsers such as SpamCop can't report the actual spamvertised website. 2) They heavily Javascript-munge their websites. In order to view their websites, you must have Javascript enabled. You can learn more about that in one of my posts here: http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/b4490e9b8062440c 3) They delay DNS resolution of their end-of-the-redirect-chain spamvertised websites just long enough that it tricks SpamCop into thinking that the websites are not resolving. 4) In the redirect chain, if you follow it manually, you'll find that you have to set proper referrers for each hop in the redirect chain, otherwise you're redirected off to nowhere. They've been spamming away for months now, it's time they're stopped. They've used the following websites in their spam, all of which redirects to one of the domains mentioned in the Subject line: http://123ez.org/ http://www.1safeshop.net/ http://cacti5.shopsafe33.com/ http://annuli9k.whatadeal4me.com http://heroin6v.whatadeal4me.com http://dunedin9c.whatadeal4me.com http://plump8w.whatadeal4me.com http://bowfin4z.whatadeal66.com http://disdain2l.whatadeal66.com http://durango8l.whatadeal66.com http://colorimeter5d.whatadeal66.com http://skye7r.whatadeal66.com http://skye7r.whatadeal66.com http://crosswort7b.whatadeal66.com http://volstead9c.whatadeal66.com http://hour0e.whatadeal66.com http://polyphony4g.whatadeal88.com http://drink4u.whatadeal88.com http://block8s.aboutmarket.info http://oviform0c.aboutmarket.info http://walrus5x.aboutmarket.info http://seventeenth1t.aboutmarket.info http://omicron1u.aboutmarket.info http://anode1r.aboutmarket.info http://junco3n.aboutmarket.info http://indiscriminate7g.aboutmarket.info http://aboutmarket.info http://terminology6v.aboutmarket.info http://weasel1x.aboutmarket.info http://downstream2p.shopadvisor.info http://immovable6o.shopadvisor.info http://UWfreeway.quickwww.info The most telling 'mark' of their spam at the moment is that there is always the name "lisa" somewhere in the URL.