I’m subscribing to some comment feeds of spammed blogs. Two of them had fresh comments today.

One was for a viagra spammer. Whois info:

NA
NA Donald (Kirkkirkdonald2003@yahoo.com)
+1.5554235234
South Brooklyn, 29th str. 34
New York, NY 10002
US

That e-mail address doesn’t exist, BTW. I think it was misspelled. kirkdonald2003@yahoo.com is an address I’ve seen in this context before..

I checked the website, like I often do, and found that it had a 403 error disguised as a 404 error, when checking in Sam Spade. I rechecked the spam, and I had the right URL. So, what was wrong?

The whois info reveals that the domain is suspended for abuse. It had these name servers:
ns1.suspended-for-abuse.com
ns2.suspended-for-abuse.com

But I’m suspicious by nature, so I digged a bit further. Whois info for that domain:

Andy Hoffman (andyhoffman2005@yahoo.com)
+2.6524513646
Fax: +2.6524513646
Malibu dr. 19
Panama, UR 98532
UY

Hmmm, known spammer. So, the suspended for abuse thingy is just for show. BTW, I’ve never seen a 403 error when an account has been suspended.

You know, I tried that page in my browser, and THEN it works! I think they’ve blocked Sam Spade! Yep, switch the user agent, and I get access to the page!

I think they’ve devised a tactic to keep me and people like me in the dark…

Update
I found one domain registered to this spammer that had this e-mail address:
kollins_fill@yahoo.com
That connects this spammer with at least some of the domains on the server I’m talking about in the Genaholincorporated post. I also noted that I found genaholincorporated spam on the same posts as this spammer. Making it probably that it’s the same guy.

I also found some other variants:

no-one
Mister Simpson (imsmith173@yahoo.com)
North Brooklyn, 29th str. 34
no-one
New York, NY 10002
US

Same spammer, same name servers.

ruinn
kate ruinn (kate_ruinn@yahoo.com)
11 chemin du Pla: 11190 Montazels - France - EU
Montazels,
FR

This one’s on the genaholincorporated server.

This entry was posted on Thursday, April 21st, 2005 at 9:06 am and is filed under Comment spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.