Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
watchsound.com porn spam abusing our email addresses as fake sender
On May 22, 2004 we started receiving bounces for porn spam advertising the domain watchsound.com. The bounces were delivered to us because the sender address in each spam was one of our email addresses (we have seen more than one address being used). The spams had been send using several hosts in China, Argentina, the United States and other countries. Below is a typical example. We don't know if our addresses were picked at random or if this is related to the fact that we fight spam. In December and February we were already the object of a Joe-Job attack.
We have seens bounces from spams originating at the following hosts:
The spamvertized domain watchsound.com was registered by a company in Taiwan:
The IP-address for this domain was blacklisted by Spamhaus.org on May 16, 2004.
We first received a spam advertising this domain on 2004-05-01 and added it to our published blacklist.
The watchsound.com website is hosted by Chinanet, Shanghai, a notorious "bulletproof" webhoster. See the SPEWS evidence file. Complaints to the hosting company are highly unlikely to have any effect.
Received: from compuserve.com (unknown [200.74.132.190])
by mwinf3103.me.freeserve.com (SMTP Server) with SMTP id 7AE5D18001FA
for <perki@ntfc2k.freeserve.co.uk>; Sat, 22 May 2004 09:29:17 +0200 (CEST)
Date: Sat, 22 May 2004 22:34:30 +0000
From: Joewein <joewein@pobox.com>
Subject: *** SPAM *** RE: Gussing Movies for Perki
To: Perki <perki@ntfc2k.freeserve.co.uk>
References: <8G5AL6D41D0G0957@ntfc2k.freeserve.co.uk>
In-Reply-To: <8G5AL6D41D0G0957@ntfc2k.freeserve.co.uk>
Message-ID: <KI94C2JG46LK29FB@pobox.com>
Reply-To: Joe <joe@interspeed.net>
MIME-Version: 1.0
Content-Type: text/html; charset=Windows-1251
X-me-spamlevel: med
X-me-spamrating: 99.335705
Content-Transfer-Encoding: quoted-printable
<HTML>
<HEAD>
<TITLE>Amazing</TITLE>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Diso-885=
9-1">
</HEAD>
<BODY BGCOLOR=3D#FFFFFF LEFTMARGIN=3D0 TOPMARGIN=3D0 MARGINWIDTH=3D0 MARG=
INHEIGHT=3D0>
<center><BR>please wait ... loading message ...<BR>
<A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D154&ape=3D=
gt2715">
<font size=3D5 color=3Dblue>Have you ever seen female ejaculation movies?=
<BR>They are 100% AUTHENTIC ! :)</font></a><BR><BR>
<TABLE BORDER=3D0 CELLPADDING=3D0 CELLSPACING=3D0>
<TR><TD>
<A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D154&ape=3D=
gt2715">
<img src=3D"http://www.watchsound.com/gen_ads/gushing-movie_1/index_01.gi=
f" BORDER=3D0></A></TD>
</TR><TR><TD>
<A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D154&ape=3D=
gt2715">
<img src=3D"http://www.watchsound.com/gen_ads/gushing-movie_1/index_02.jp=
g" BORDER=3D0></A></TD>
</TR><TR><TD>
<A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D154&ape=3D=
gt2715">
<img src=3D"http://www.watchsound.com/gen_ads/gushing-movie_1/index_03.gi=
f" BORDER=3D0></A></TD>
</TR>
</TABLE><BR><BR><BR><BR><BR><BR><BR><BR><BR>
<a href=3D"http://www.watchsound.com/takemeoff">No thanks, please unsubsc=
ribe me...</a>
</center>
</BODY>
</HTML>
Registrant:
Ring Global Inc.
121 Chung Shan North Road
Taipei,
TW
Domain name: WATCHSOUND.COM
Administrative Contact:
Lai, Sui admin@ringglobal.com
121 Chung Shan North Road
Taipei,
TW
+1.886225631243
Technical Contact:
Lai, Sui admin@ringglobal.com
121 Chung Shan North Road
Taipei,
TW
+1.886225631243
Registrar of Record: TUCOWS, INC.
Record last updated on 18-Mar-2004.
Record expires on 12-Mar-2005.
Record created on 12-Mar-2004.
Domain servers in listed order:
NS1.WATCHSOUND.COM 61.152.157.53
NS2.WATCHSOUND.COM 61.152.157.53