<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.0.7" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Comments on: Norwegian spammer</title>
	<link>http://spamhuntress.com/2005/11/17/norwegian-spammer/</link>
	<description>Just another WordPress weblog</description>
	<pubDate>Fri, 08 Aug 2008 21:22:34 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.0.7</generator>

	<item>
		<title>by: Administrator</title>
		<link>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-3236</link>
		<pubDate>Wed, 08 Feb 2006 10:50:24 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-3236</guid>
					<description>Now that you tell me, I had a few messages whiz by on my server as well. Not as many as last time.

Domenet plastsekker.com ble registrert 6 februar. Men

The domain plastsekker.com was registered February 6 for one year, according to whois.sc. But the registrar claims it wasn't registered with them. Chances are they've suspended or removed the domain already.

Here's the output from whois.sc today:

PLASTSEKKER.COM

	
Alexa Trend/Rank: 	Not Ranked
Website Status: 	not active
Blacklist Status: 	Clear
Record Type: 	Domain Name
Name Server: 	NS1.DNS-WEB2.NET NS2.DNS-WEB2.NET
ICANN Registrar: 	DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Created: 	06-feb-2006
Expires: 	06-feb-2007
Status: 	ACTIVE
plastsekker.com is not registered by us.</description>
		<content:encoded><![CDATA[<p>Now that you tell me, I had a few messages whiz by on my server as well. Not as many as last time.</p>
<p>Domenet plastsekker.com ble registrert 6 februar. Men</p>
<p>The domain plastsekker.com was registered February 6 for one year, according to whois.sc. But the registrar claims it wasn&#8217;t registered with them. Chances are they&#8217;ve suspended or removed the domain already.</p>
<p>Here&#8217;s the output from whois.sc today:</p>
<p>PLASTSEKKER.COM</p>
<p>Alexa Trend/Rank: 	Not Ranked<br />
Website Status: 	not active<br />
Blacklist Status: 	Clear<br />
Record Type: 	Domain Name<br />
Name Server: 	NS1.DNS-WEB2.NET NS2.DNS-WEB2.NET<br />
ICANN Registrar: 	DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM<br />
Created: 	06-feb-2006<br />
Expires: 	06-feb-2007<br />
Status: 	ACTIVE<br />
plastsekker.com is not registered by us.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Ronny</title>
		<link>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-3231</link>
		<pubDate>Wed, 08 Feb 2006 08:14:55 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-3231</guid>
					<description>He's back .. as of 8th of February 2005. I got his mail today ... Here are some headers (my email has been censored to aaa@bbb.cc):

From - Wed Feb 08 08:38:39 2006
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
From salg@plastsekker.com Wed Feb 08 01:26:24 2006
Return-path: 
Received: from [10.9.9.162] (helo=pepper.runbox.com)
	by fenris.runbox.com with esmtp  (Exim 4.50)
	id 1F6dA8-0006Q1-1U
	for aaa@bbb.cc; Wed, 08 Feb 2006 01:26:24 +0100
Received: from exim by pepper.runbox.com with spamfilter  (Exim 4.50)
	id 1F6dA6-0003l1-Pa
	for aaa@bbb.cc; Wed, 08 Feb 2006 01:26:23 +0100
Received: from [209.59.175.26] (helo=host2.domenepartner.com)
	by pepper.runbox.com with esmtps  (TLS-1.0:DHE_RSA_AES_256_CBC_SHA:32)
	(Exim 4.50)
	id 1F6dA4-0003k9-S3
	for aaa@bbb.cc; Wed, 08 Feb 2006 01:26:22 +0100
Received: from 216-140-159.0101.adsl.tele2.no ([193.216.140.159]:4413 helo=PC09)
	by host2.domenepartner.com with esmtpa (Exim 4.52)
	id 1F6cpt-0003Ia-1i; Wed, 08 Feb 2006 01:05:37 +0100
Reply-To: 
From: "Salg av avfallssekker" 
To: 
Subject: =?iso-8859-1?Q?Tilbud_p=E5_avfallssekker_-_kr_5=2C50_Pr._Rull_-_Kr_110=2C?=
	=?iso-8859-1?Q?-_Pr._Kartong._?=
Date: Wed, 8 Feb 2006 00:52:00 +0100
Message-ID: 
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_0206_01C62C4B.F221F980"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4024
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-ClamAntiVirus-Scanner: This mail is clean
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host2.domenepartner.com
X-AntiAbuse: Original Domain - runbox.no
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - plastsekker.com
X-Source: 
X-Source-Args: 
X-Source-Dir: 
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on pepper.runbox.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.6 required=5.0 tests=DCC_CHECK,HTML_90_100,
	HTML_EMBEDS,HTML_FONT_BIG,HTML_MESSAGE,HTML_TAG_EXIST_MARQUEE 
	autolearn=disabled version=3.0.3

This is a multi-part message in MIME format.</description>
		<content:encoded><![CDATA[<p>He&#8217;s back .. as of 8th of February 2005. I got his mail today &#8230; Here are some headers (my email has been censored to <a href="mailto:aaa@bbb.cc):">aaa@bbb.cc):</a></p>
<p>From - Wed Feb 08 08:38:39 2006<br />
X-Mozilla-Status: 0001<br />
X-Mozilla-Status2: 00000000<br />
From <a href="mailto:salg@plastsekker.com">salg@plastsekker.com</a> Wed Feb 08 01:26:24 2006<br />
Return-path:<br />
Received: from [10.9.9.162] (helo=pepper.runbox.com)<br />
	by fenris.runbox.com with esmtp  (Exim 4.50)<br />
	id 1F6dA8-0006Q1-1U<br />
	for <a href="mailto:aaa@bbb.cc;">aaa@bbb.cc;</a> Wed, 08 Feb 2006 01:26:24 +0100<br />
Received: from exim by pepper.runbox.com with spamfilter  (Exim 4.50)<br />
	id 1F6dA6-0003l1-Pa<br />
	for <a href="mailto:aaa@bbb.cc;">aaa@bbb.cc;</a> Wed, 08 Feb 2006 01:26:23 +0100<br />
Received: from [209.59.175.26] (helo=host2.domenepartner.com)<br />
	by pepper.runbox.com with esmtps  (TLS-1.0:DHE_RSA_AES_256_CBC_SHA:32)<br />
	(Exim 4.50)<br />
	id 1F6dA4-0003k9-S3<br />
	for <a href="mailto:aaa@bbb.cc;">aaa@bbb.cc;</a> Wed, 08 Feb 2006 01:26:22 +0100<br />
Received: from 216-140-159.0101.adsl.tele2.no ([193.216.140.159]:4413 helo=PC09)<br />
	by host2.domenepartner.com with esmtpa (Exim 4.52)<br />
	id 1F6cpt-0003Ia-1i; Wed, 08 Feb 2006 01:05:37 +0100<br />
Reply-To:<br />
From: &#8220;Salg av avfallssekker&#8221;<br />
To:<br />
Subject: =?iso-8859-1?Q?Tilbud_p=E5_avfallssekker_-_kr_5=2C50_Pr._Rull_-_Kr_110=2C?=<br />
	=?iso-8859-1?Q?-_Pr._Kartong._?=<br />
Date: Wed, 8 Feb 2006 00:52:00 +0100<br />
Message-ID:<br />
MIME-Version: 1.0<br />
Content-Type: multipart/related;<br />
	boundary=&#8221;&#8212;-=_NextPart_000_0206_01C62C4B.F221F980&#8243;<br />
X-Priority: 3 (Normal)<br />
X-MSMail-Priority: Normal<br />
X-Mailer: Microsoft Outlook, Build 10.0.4024<br />
Importance: Normal<br />
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180<br />
X-ClamAntiVirus-Scanner: This mail is clean<br />
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report<br />
X-AntiAbuse: Primary Hostname - host2.domenepartner.com<br />
X-AntiAbuse: Original Domain - runbox.no<br />
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]<br />
X-AntiAbuse: Sender Address Domain - plastsekker.com<br />
X-Source:<br />
X-Source-Args:<br />
X-Source-Dir:<br />
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on pepper.runbox.com<br />
X-Spam-Level: ***<br />
X-Spam-Status: No, score=3.6 required=5.0 tests=DCC_CHECK,HTML_90_100,<br />
	HTML_EMBEDS,HTML_FONT_BIG,HTML_MESSAGE,HTML_TAG_EXIST_MARQUEE<br />
	autolearn=disabled version=3.0.3</p>
<p>This is a multi-part message in MIME format.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Spam Huntress  &#187; Blog Archive   &#187; Norwegian spammer at it again</title>
		<link>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-1983</link>
		<pubDate>Mon, 05 Dec 2005 21:21:35 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/11/17/norwegian-spammer/#comment-1983</guid>
					<description>[...] porting to Alestra 			 		 	 		 			Norwegian spammer at it again 	 			 					I wrote about a Norwegian spammer a while back. He&#8217;s at it again. And this time he says it&#8217;s no [...]</description>
		<content:encoded><![CDATA[<p>[&#8230;] porting to Alestra 			 		 	 		 			Norwegian spammer at it again 	 			 					I wrote about a Norwegian spammer a while back. He&#8217;s at it again. And this time he says it&#8217;s no [&#8230;]
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
