Web Hosting Talk : Web Hosting Main Forums : Web Hosting : Spammer Alert

[gearworx]

Yet another idiot attempting to the spam the world:

1F169t-0001F5-CC-H
nobody 99 32003
<email@servername.com>
1138039877 0
-deliver_firsttime
-body_linecount 48
-auth_id nobody
-local
-allow_unqualified_sender
-received_protocol local
-ident nobody
-allow_unqualified_recipient
-auth_sender email@servername.com
XX
1
jianxinqi@hotmail.com

161P Received: from nobody by gear-l20.Servername.com with local (Exim 4.52)
id 1F169t-0001F5-CC
for jianxinqi@hotmail.com; Mon, 23 Jan 2006 10:11:17 -0800
026T To: jianxinqi@hotmail.com
078* Subject: Great gift idea- find out how you could get a designer purse on us
018 MIME-Version: 1.0
044 Content-type: text/html; charset=iso-8859-1
049R Reply-To: Designer Gift
<offers@mylexicons.com>
045F From: Designer Gift
<offers@mylexicons.com>
064I Message-Id: <E1F169t-0001F5-CC@gear-l20.Servername.com>
038 Date: Mon, 23 Jan 2006 10:11:17 -0800
090 X-Servername-MailScanner-Information: Please contact the ISP for more information
052 X-Servername-MailScanner: Found to be clean
045 X-Servername-MailScanner-SpamCheck:
078 X-Servername-MailScanner-From: email@servername.com
076 Subject: Great gift idea- find out how you could get a designer purse on us

Name: John Carrington
Company: Moultrie Ecommerce
Email: moultrieinc@gmail.com

Used PayPal for the monthly sign-up.

[ByteMaster]

Thanks for the heads up!

[njean]

thank you!

[markjut]

lol - thanks

[AYS-RobG]

Thanks
*adds characters to make minimum post length*

[ScottJ]

He has tried signing up with me a few times. Never got any emails out.

[net-trend]

I think I posted about this guy before. He seems to be hitting everyone he can.

[SROHost]

Name: Aurelius Enterprise
Email: referapal@gmail.com
Domain: carmel8.com

Signed up via Paypal on 09/01/06. View whois for carmel8.com for more info.

Note: Same customer signed up to host 'convivialgroup.com' in December 2005. Account was deactivated a few days after signup when remote mailer scripts were uploaded.

[2Macs Jim]

Thanks for the heads up gearworx.

[sgarbus]

This thread was created in January.

Time for a closing?

[2Macs Jim]

Yes it was, then updated today.

[TurbulentMedia]

Yaye for us!
They just attempted to sign up for service on one of our shared platforms, but failed the tripple anti-fraud checks we use.. Good stuff..

I'm thinking this is another case of someone trolling around WHT looking for their next victim..
SROHost, do you have a partial IP address on their signup today?

[1 & 1 = 3]

Why not a full IP address? These spammers don't deserve any protection, do they?

[TurbulentMedia]

Originally Posted by 1 & 1 = 3

Why not a full IP address? These spammers don't deserve any protection, do they?

Because, as many in this industry with some knowlege of how spammers work their magic, there is a very real possibility of:

A. The spammer used a proxy to sign up (Another server's IP Address)
B. The spammer used a dial-up ISP to sign up (AOL/NZ/whatever..)

So, letting the world know the full IP address, when in all likelyhood that another person is now using that IP address (that isn't trying to cause trouble) could spell alot of trouble for an innocent person.

Letting us know the IP block, and not the full IP, will at least allow other providers to be more careful for a day or two (or more) of signups coming from whatever company owns that block...

[rocketcity]

I'm glad I saw this tonight. This person signed up with us earlier today. Looks like we will be closing the account right away. He used two email adddresses with us.

Name: Aurelius Enterprise
Email: referapal@gmail.com
2nd Email: aureliusinc.winn@gmail.com
Domain: cassarole.com


Thaks for the heads up.