Did you put copy in Sightings? If not, does the word IFRAME (in either
upper or lower case) appear any where in the spammail?

This sounds much like an IFRAME compromise spam. The current Zlob epidemic
is getting pretty close to being out of control.

Sites found as of 3/29/2008 5:53:43 PM CST
csv format with header

----
Domain, IP, DNS, Registrar
drugstorevip.com,[botnet],RENEWWDNS.COM,ESTDOMAINS INC.
brillianeffects.com,[216.189.223.85],MEDIPLUSHEALTH.COM,XIN NET TECHNOLOGY CORPORATION
brillianoutcomes.com,[70.164...

http://www.spamsuite.com/node/384

This came up this week too.

I realize that Mark isn't as fun to watch as Comcast, but its just as
funny.

On a side note to Mark... You need to work on your writing. I read the
filing and if you reread it, you kind of jump from NANAE and then the
chi.* newsgroups. I understood your point, but it wasn't as purdy as
the Comcast lawyers.

It looks like Lindhardt could probably get named a vexious litigant
after Mark and Comcast are through.

Hello,

It is now disabled.

Lex Tutor wrote:

The Kat katxyzkave.net> writes:

Phishing

Spamhaus has been tracking a spammer from Argentina that we'd like
more local information on. The spammer is a sort of 'Wayne Mansfield'
of Argentina. He spams a lot from ciudad.com.ar and he was hosted for
a long time by paginadigital.com (who I must say went out of their way
to keep him and only let him go once they got blocked for support
services). He also spams a lot from hijacked proxies and sometimes
from IPs he rents in China. Like many spammers he predominantly uses
Gmail addresses as his dropboxes.

His spam outfits are "DNS Marketing", aka dnsmarketing.com.ar and
datanetsearch.com.ar. We have various names for him, including
"Maxilopez" but we mainly know him by his ROKSO entry:

Enrique Perez Novas - The Holistico Spammer

<http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Enrique%%20P
erez%%20Novas%%20-%%20The%%20Holistico%%20Spammer>

If any spamfighters in Argentina have more information about this guy,
we're interested.

http://replica-ebags.com/Wholesale.html

Wholesale fashion handbags
We're a supplier of a large array of Wholesale fashion handbags that
will help you grow your business with lowest price only for 15.USD per
items. We are your distribution warehouse...

It is another *presentation format* with added per country and ASN summaries
of data published at http://www.spamcop.net/w3m?action=hoshame
* ASN info: asn.routeviews.org http://www.routeviews.org/
* Country info: zz.countries.nerd.dk http://countries.nerd.dk/

Top 200 targets of spamcop.net spam reports
For *the week* ending Sat Mar 29 07:06:32 2008 UTC
----------------------------------------------------
Total spamcop.net spam reports volume: 80965054
Top200 share of all spamcop.net spam reports: 6.21%% (5027085/80965054)

*Top12 IP Adresses (The Dirtiest Dozen)*
#;IP;Country;ASN;prefix;spamcop.net spam reports;age;duration;reverse DNS
1 202.75.56.212 MY AS17971 202.75.56.0/22 252907 0.0 h 46.9 d
2 202.75.56.216...