Broadcastingtoday.biz (and other domains) spam methods.  who be Robert (aka Bob) Soloway of NIM Corporation.

Fact from Fiction - a primer on Bob Solaway

This page is not 'fan' literature, but an attempt to put together the facts of how Robert spams you and me. - it is not all of my own work.  And an attempt to get people who are thinking of using Roberts 'services' as counter to his claims which a court has as part of the evidence against him.

I've never met Robert, or used his 'service' etc - but a lot people including Microsoft (of which im sure you have heard of) consider him a problem.

So if you thinking about taking Robert up on his offer consider this.

1. His list was not used when he spams
2. I never requested mailings from Robert - but I got them.
3. I have no idea if I am still on his list or not after opting out - its an academic point now
   
4. I include actual 'testimonials' from people who signed up for Roberts offer
5. Robert  is using spamware to mail his junk.
   
6. And spamware that appears to use windoze trojan  pc's
7. He hosts in China - who it appears don't mind spammers.
8. It it doubtfull that the 478 clients (not the thousands claimed) of Robert got the million plus mailings - Robert could not tell
   

Lets summarise, He spams, his mailings are not 'can-spam' compliant, and this is not me making these claims this information can be found throughout this document

For the record - I just list the spams that my Domain owner email gets. Robert for some strange reason kept appearing in my inbox.  So this is a 'homage' to his  business operation.  Should you think this just 'sour grapes' then I suggest you email some of the clients who  having taken up Robert  and paid him discovered the truth.

So before you send Robert money to his 'paypal' account - please read the experience of 'clients', court documents and so on.

Once equipped with the facts  - hope you  will 'do the right thing'. 

A wiki entry on Bob for those of you who like extra sources of information

What about this spamis nonsense.

Those of you lucky enough to  get a spamis spam (I was lucky) will know that Robert is having a go at the people who are taking him to court.  I have no idea of what Bob is on but it is weird stuff. 

Many 'spammers' become anti-spammers when they are rumbled.  How long it continues for is a debatable point.

Bob is still Bob - so he is still a spammer. 
As to Bob being 'persecuted'  well if Bob thinks that way - then his 'stupidity' helped started it. 

That I think is a fair assessment on Spamis which a domain registrar has now terminated for breaking some rules set out in their terms and conditions.

The text below explains how I was introduced to Bob Solaway and how this page was eventually created.

If you came from my spamming the domain owner page  then you know the background.  otherwise let me recap.

In 2002 a couple of domains I look after changed registrar, so this meant the contacts in the whois changed.  The whois lists information about the owner and the technical contacts various internet rfc's require you have these so people can contact you, the downside of this ideal system is that spammers can also spam you as most domains not owned by spammers follow the rules..

Since spammers can joe-job you it is best not to have filters on these email accounts as it might be a another domain warning you that a spammer is using your domain name (if you don't know it already)

So the billing, technical, and administrator plus the owner contacts changed in the year 2002 - for good measure a web page was setup advising persons of this.  In June 2004 Broadcastingtoday.biz raided the whois by some means and decided to send me spam. and to all of the accounts I created in 2002.  which is nice of them since these accounts don't send email.

Enough history - lets move to 2004.

So in June 2004 I got spammed via my whois entries so I renamed a few things and started my experiment.  I also renamed the billing and technical contacts. they have since rescanned the whois and have sent spam to these new names this has become experiment 2.  No web page was put up with the changes so they are definitely raiding the whois for there claimed 28 million email addresses.

The spams to the domain aliases are similar to the experiment (see link) I am running this is the 'body' of a freshly subscribed address from my whois entry - a spam example from the 15th September 2004..

<<>> DiG 9.2.4 <<>> www.broadcastemailcorp.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8845
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.broadcastemailcorp.org.    IN      A

;; ANSWER SECTION:
www.broadcastemailcorp.org. 1685 IN     CNAME   odo4.meibu.com.
odo4.meibu.com.         20      IN      A       218.88.44.247
email like this to 28 million people for free...

http://www.broadcastingtoday.biz



----------------

this email was sent to gain attention to non-profit 
organizations that aid low-income individuals gain
access to the internet and technology looking for
immediate exposure.  we make no profit on any of
these services, and we offer this service to help
organizations benefiting impoverished individuals
gain access to the internet throughout the world.

emailing is only zero amount if you are a non-profit 
organization that aids low-income individuals gain 
access to the internet.  at our web site above, simply 
contact us by mail for further details.

the primary purpose of this email is directed at non-profit
organizations that benefit low income individuals gain access
to the internet and technology in all countries worldwide.

several organizations worldwide have already taken
advantage of our free offer, and we look forward to
benefiting many more in the future.

if you are not a non-profit organization interested in our
non-commercial/non-profit email notifications that benefit
various world causes, please unsubscribe at: 

contact us at: po box 1259, seattle, wa 98111

(look familiar?) They are consistent in there attempts to spam me, since i have not unopted from the billing and technical contacts the spam is less than from the owner email which has had 30 ish spams after opting out of the Broadcastingtoday.biz list.  Surprisingly Robert does not appear to spam webmaster or postmaster accounts - but I'm sure that will change one day. 

Suspected operations of Bob Soloway.

This is pure speculation on the basis of the facts seen from this page (TO WRITE COME BACK SOON)

Being subscribed:
1, Spam Victim: registers an internet domain
2, Bob Soloway: Hires help, or looks up what was entered in step 1, either using a mining tool, or a box of spyware/virus spybots pc that mask the number of requests for  ahem 'sales leads' like email addresses.

Being spammed:
1, Bob Using non american internet companies (normally Korea, or China) Bob sets up the same website over and over again
2, Bob uses/or employs help or his own

1 Spybot network or
2 open proxy Microsoft windows exchange servers to send (example ip addresses here)

his spam using Darkmailer.

Trying to unsubscribe:
1, Means you get even more spam - a 'feature' yet to developed by Bob - well you wanted spam didn't you ? or a misunderstanding of the word 'no' really means 'yes'

Other things Bob does well:

1. Autocreation of yahoo geocities (free webspace) aliases/accounts that link to websites if Bob is having problems (I am only using for Bob dataset examples only here, other spam that employs the geocities redirect I would not make the call about) I assume a script of some kind is run

That covers it

Singalong to Bobs Spam

I'd like to credit basaltbuster who lives at gmail for this, I'm no songwriter - alas you cannot buy it on itunes, or if your into open source sing it yourself, if  anyboy wants to mp3 it, I'd willingly host it.

To the tune of the Beach Boys song Barbara Ann:

went for my mail .... had to get a pail
the inbox is full of all of his crappy bull

soloway ....  bob bob ... bob soloway
you got me clicking and a reading ...  larting and deleting
soloway ... bob bob .... bob soloway

bob is the man ham sending out the charity scam spam
special offers just for you ... who are dumb enough to choose

soloway ... bob bob ... bob soloway
you got me clicking and a reading ...  larting and deleting
soloway ... bob bob .... bob soloway

advertise to many ... for just a couple pennys
soon millions will regret the day you ever met

soloway .... bob bob ... bob soloway
you got me clicking and a reading ...  larting and deleting
soloway ... bob bob .... bob soilaway

some day in jail he will regret sending all the mail
and all the boxes that he crammed ... in violation of can spam

soloway ... bob bob .... bob soloway

newportcorp.cn

you got me larting and deleting ... clicking and a reading
soloway ... bob bob ... bob soloway

Its all part of the Soloway experience. - if the crazy frog can get to number 1....

Domains Owned (observed so far)

EMAILTODAY2004.COM  - details about them links for all on this page.
BROADCASTEMAILINGTODAY.BIZ - details about them located on this page.
BROADCASTINGTODAY.BIZ - details about them on this page.
BROADCASTEMAIL.ORG - details about them on this page.
newportmarketing.com - details about them on this page
BROADCASTEMAIL.US - details about them on this page.
broadcastadvertise.org - details about them on this page
spamis.net details about them on this page
spamis.cc details about them on this page
spamis.biz details about them on this page
broadcastemailadvertising.net details about them on this page.
optinemailing.net details about them on this page
optin2millions.com details about them on this page
optin2millions.net details about them on this page
optinemailingtoday.com details about them on this page
optinemails.org details about them on this page
optinemailtoday.biz details about them on this page
optinemailing.biz details about them on this page
optinemailings.us NEUSTAR seem to have shut it (external link to (NEUSTAR REGISTRAR) down
broadcastingemail.us details about them on this page
emailingtoday.org details abut them on this page
searchengineranking.cn details about them on this page
broadcastingemailing.org details about them on this page
security-validations.com details about them on this page
broadcastemailservices.biz details about them on this page
broadcastemailservices.org details about them on this page
3322.ORG details about them on this page
broadcastemailcorp.org details about them on this page
cyberservices.com details about them on this page
China here we come
newportcorp.cn details about them on this page.
jzgx.nydns.cn details about them on this page.
broadcastemailingcorp.cn details about them on this page


then: IP hosts (see the list below)

http://de.geocities.com/email24624broadcast65559/ to details -> http://83.69.46.224/wm/
http://83.237.66.218/wm/

http://uk.geocities.com/Griselda70698Sol20116/ redirects to -> http://210.179.190.250/wm/
http://uk.geocities.com/Ingamar91782Leoine31932/ also redirects to 
http://210.179.190.250/wm/
as does 
http://uk.geocities.com/Gabbie86388Ninetta16900  
http://de.geocities.com/Louis22093Tamma24664/

http://210.179.190.250/broadcastemail redirects to: http://uk.geocities.com/Fancy9059Cammy99965/
and http://de.geocities.com/Petronille78514Sarena78406/
and http://uk.geocities.com/Brina9829Krysta60333/
http://uk.geocities.com/Yasmeen25258Kaila54034/

etc - more stuff below.

* denotes active spamvertising

Spamming Method

Going back to broadcastingtoday.biz He has also 'lost' half million addresses in his latest spam (experiment 1 item 75) but I'm afraid I'm not one of them.  Then (on the 1st October)  However good news he's back to 28 million addresses.  So it seems one can never 'get off'

Jan 2005: Good news The webmaster has reported a spam from broadcastemailingtoday.biz that just leaves postmaster ...

Lets be 'Geeky' and take a look at the mail.log file:

01/10/2004 03:11:54 PM  pD9E51757.dip.t-dialin.net (217.229.23.87)
connected

01/10/2004 03:11:59 PM  Message 004E0061 (MessageID:
<JIUQTKJMWASOTLWYPXCURQ@fastestresponse.net>) received from
pD9E51757.dip.t-dialin.net (217.229.23.87) size 2466 bytes

01/10/2004 03:11:59 PM  SMTP Server: pD9E51757.dip.t-dialin.net
(217.229.23.87) disconnected. 1 message[s] received

01/10/2004 03:11:59 PM  Attempting delivery to: User
billing@Domain.name, admin@Domain.name admin@Domain.name from
donc@boardermail.com

Notice that broadcastingtoday.biz is nowhere to be found in in the headers but 'boardermail.com' or 'fastestresponse.net'  and instead of sending his junk from Korea Robert  is sending it from 217.229.23.87 which is somewhere in Germany  Which is not quite how Robert 'advertises' his package on his website as apparently they all have broadcastingtoday.biz in the headers.  Sorry to say i cannot see it - can you ?.

RANGE 217.224.0.0 - 217.237.161.47

?newportcorp.cn

netname: DTAG-DIAL15

descr: Deutsche Telekom AG

country: DE

remarks: ******************************************************************

remarks: * Abuse Contact: http://www.t-com.de/ip-abuse in case of Spam, *

remarks: * Hack Attacks, Illegal Activity, Violation, Scans, Probes, etc. *

remarks: ******************************************************************

source: RIPE

details about them

route: 217.224.0.0/11

descr: Deutsche Telekom AG, Internet service provider

address: Deutsche Telekom AG D-90492 Nuernberg Germany

phone: +49 180 5334332, fax-no: +49 180 5334252

e-mail: abuse@t-ipnet.de

So it appears he is using hacked windows pc's to send his email  You see this email marketing business is very legitimate indeed.  Lets be charitable and try another being the 4th October

details about them

04/10/2004 10:46:51 AM SMTP Server: 202-178-191-45.cm.dynamic.apol.com.tw (202.178.191.45) disconnected. 1 message[s] received

Now thats coming from Taiwan,  which certainly is not part of Korea, The next comes again from Germany and pD95D7049.dip.t-dialin.net (217.93.112.73)

What domain spams what role account (it will be updated on Roberts next domain rotation)

remote
report

EMAILTODAY2004.COM

new

y

      

BROADCASTEMAILINGTODAY.BIZ

column

      

Y

      

y

      

y

      

y

      

y

      

BROADCASTINGTODAY.BIZ

y

      

**** BROADCASTEMAIL.ORG

y

      

y

      

y

      

y

      

y

      

** BROADCASTEMAIL.us

y

y

y

y

broadcastadvertise.org

y

spamis.net

spamis.cc

broadcastemailadvertising.net 

spamis.biz ?

y

y

optinemailing.net

optin2millions.com 

Y

optin2millions.net 

Y

Y

optinemailingtoday.com

y

Y

optinemails.org

Y

optinemailtoday.biz

Y

Y

optinemailings.us - KILLED

Y

broadcastingemail.us

emailingtoday.org

Y

Y

Y

searchengineranking.cn

Y

broadcastingemailing.org

Y

security-validations.com (heard about)

broadcastemailservices.biz

Y

broadcastemailservices.org

Y

Y

3322.ORG

Y

broadcastemailcorp.org

Y

T

Y

http://de.geocities.com/email24624broadcast65559/
But redirects here: 
http://83.69.46.224/wm/
also
http://uk.geocities.com/Adi96471Rutter32324/
http://de.geocities.com/Viviene12522Billie34776/

Y

Y

Y

http://83.237.66.218/wm/ - via geocites (free websites)
Jan/2006 restarted: 
http://83.237.66.218/broadcastemail/
uri: http://au.geocities.com/christiane14285danice73145/
uri: http://sg.geocities.com/ross84151renaldo78077/
uri: http://asia.geocities.com/taffy92423jennette64105/
uri: http://sg.geocities.com/nettie88750charis26018/
uri: http://asia.geocities.com/remington17144dari12110/

Y

http://210.179.190.250/wm/ - via geocites again
http://210.179.190.250/broadcastemail 
 
uri: http://uk.geocities.com/Griselda70698Sol20116/
uri: http://uk.geocities.com/Ingamar91782Leoine31932/
uri: http://de.geocities.com/Dolph1663Hatti38832/
uri: http://de.geocities.com/Petronille78514Sarena78406/
uri: http://uk.geocities.com/Brina9829Krysta60333/
uri: http://uk.geocities.com/Yasmeen25258Kaila54034/
uri: http://de.geocities.com/Liva81348Yasmin50151/
uri: http://degeocities.com/Olvan27172Celka14168/ <- Bob bug!
uri: http://de.geocities.com/Ddene66341Arlie58920/      

Y

Y

Y

Y

http://83.237.66.218/broadcastemail/ <- renamed from wm
via geocites
uri: http://uk.geocities.com/Preston17058Charmain74309/
uri: http://de.geocities.com/Granger62094Lauryn10094/
uri: http://de.geocities.com/Nappie16328Dorian45917/
uri: http://de.geocities.com/Herschel64700Frasier42753/

Y

http://147.46.30.174/broadcastemail/
uri: http://uk.geocities.com/hedwiga78946vi64062/ 
(same link in email twice)
uri: http://uk.geocities.com/harland91562dianemarie24502/
uri: http://uk.geocities.com/lawrence89699flore17738/
uri: http://de.geocities.com/Malvina10647Garwood23990/
uri: http://de.geocities.com/Candide51857Fanchon45885/
uri: http://de.geocities.com/Adan70125Cecile5424/
uri: http://uk.geocities.com/Bev25884Fair61456/
uri: http://in.geocities.com/marlyn29638darya739/
uri: http://uk.geocities.com/sophey43411desmond75026/

Y

http://147.46.240.97/broadcastemail/
uri: http://ca.geocities.com/kassey52278symon70907/
uri: http://sg.geocities.com/vachel20600karil61129/

http://198.93.1.73/broadcastemail/ <- America!!
uri: http://uk.geocities.com/gideon6497trumaine14477/
uri: http://uk.geocities.com/lissi56181holmes35/

Y

http://147.46.135.180/broadcastemail/
uri: http://sg.geocities.com/helga34488dewey8633/
http://147.46.216.152/broadcastemail/
uri: http://uk.geocities.com/maurits59884minerva80565/

Y

http://219.136.53.13/broadcastemail/
uri: http://asia.geocities.com/ax55737titus16973/
uri: http://au.geocities.com/minne59928elihu63204/
uri: http://au.geocities.com/lorena76022clare70672/

broadcastemailcorp.odo.com.cn

Y

Y

Y

Y

http://210.66.241.1/broadcastemail/
uri: http://au.geocities.com/albie58684patrizio81985/
uri: http://uk.geocities.com/laurens12611francisco8457/
uri: http://ca.geocities.com/dorian63510leeanne2641/
uri: http://ca.geocities.com/maurene27548enrico51190/
uri: http://au.geocities.com/dorena6870eddie67768/
uri: http://au.geocities.com/ashlie55377shannon87205/
then again:
http://210.66.241.1/broadcastemail/ 
(h1-210-66-241.seed.net.tw 
internal page link)
uri: http://au.geocities.com/kaiser59996mirella87067/
uri: http://au.geocities.com/lindsay83917bobbie29498/
uri: http://au.geocities.com/kaiser59996mirella87067/
uri: http://ca.geocities.com/myra12307dorelia94407/
uri: http://ca.geocities.com/vevay33904emily13985/
uri: http://au.geocities.com/cathi62098marybelle66314/
uri: http://uk.geocities.com/brendon76690ally4991/
uri: http://au.geocities.com/catlin73390ramsey77106/
uri: http://au.geocities.com/catlin73390ramsey77106/
uri: http://au.geocities.com/herve39362denver10612/

Y

Y

http://securesite.odo.com.cn (seen evidence of spaming seen here)

Y

Y

Y

http://195.6.54.3/broadcastemail/

from nanas
uri: http://au.geocities.com/vinny45371corny32621/ 
uri: http://ca.geocities.com/ben96679elana92148/ 
uri: http://ca.geocities.com/mata55202jacinthe84242/ 

Y

http://217.74.161.86/broadcastemail/ (russia)

from nanas
uri: http://ca.geocities.com/filippa54782grover11025/ 
uri: http://ca.geocities.com/arch93554vinni74935/ 
uri: http://ca.geocities.com/karita91029kikelia28943/ 
uri: http://au.geocities.com/opal65982berta74613/
uri: http://au.geocities.com/currie50477dannie87600/
uri: http://uk.geocities.com/hamlen58035gabriele32842/
uri: http://au.geocities.com/melony8507kayle43814/
uri: http://au.geocities.com/sansone28259kippar39430/
uri: http://ca.geocities.com/rube55132fidelity2938/
uri: http://ca.geocities.com/cecilla59747vonny23020/
uri: http://ca.geocities.com/barny52108hanni35248/
uri: http://au.geocities.com/pierette2630rhodie89397/
uri: http://uk.geocities.com/terry88878odelia31888/
uri: http://ca.geocities.com/cortney68092raimondo66187/
uri: http://uk.geocities.com/aldridge98150wilfrid4076/
uri: http://ca.geocities.com/artur74689harp18490/
uri: http://au.geocities.com/olympia19940parsifal46310/
uri: http://au.geocities.com/johnny14789broderick63702/
uri: http://uk.geocities.com/ramona22912portie25673/
uri: http://au.geocities.com/tootsie62542nikita37436/
uri: http://uk.geocities.com/antonius14010waverly97461/

Y

http://62.119.28.243/broadcastemail/

uri: http://uk.geocities.com/louisette42897saudra96871/
uri: http://au.geocities.com/jessi2635corrianne64610/
uri: http://au.geocities.com/prinz51107blancha72518
uri: http://ca.geocities.com/adolph55110lona51107/
uri: http://uk.geocities.com/allyce41085tuesday30303/
uri: http://uk.geocities.com/roman99946lonna66099/
uri: http://uk.geocities.com/ginnie14697nonnah45520/

Y

http://broad.ztjm.com/ (china)

?not sure? but if i read spamcop report correctly
uri: http://uk.geocities.com/ramona22912portie25673/
uri: http://uk.geocities.com/antonius14010waverly97461/
uri: http://au.geocities.com/tootsie62542nikita37436/ 

NEWS: new WEBSITE 
China doma is now 'expired'

Y

http://62.149.193.221/broadcastemail/  (italy)

uri: http://uk.geocities.com/sibby2891janot79802/
uri: http://au.geocities.com/dina19963electra91067/
uri: http://au.geocities.com/guglielma15411romona79535/
uri: http://uk.geocities.com/paulita74406charlotta21884/

Y

http://83.17.42.146/broadcastemail/ (poland)

http://210.7.70.150/broadcastemail/ (india - very lower caste)
uri: http://au.geocities.com/beverlee78668marla31926/
uri: http://ca.geocities.com/ted35795falito33228/
uri: http://uk.geocities.com/sandy84914isaiah5479/
? http://uk.geocities.com/natty44690tammi64102/
? http://au.geocities.com/monah56549lincoln29484/
? http://uk.geocities.com/sandra88398ephrem4089/

Y

http://62.204.237.170/broadcastemail/ (cz,eu)
uri: http://uk.geocities.com/alvinia82960olvan76817/
uri: http://au.geocities.com/dionysus20558ambros44611/
uri: http://ca.geocities.com/merci13559carley92014/
uri: http://uk.geocities.com/alika8411wiley87321/
uri: http://ca.geocities.com/ted35795falito33228/
uri: http://uk.geocities.com/belicia60930bobbi557
uri: http://au.geocities.com/larina98788evonne28916/
uri: http://ca.geocities.com/berti75397orv90753/
uri: http://ca.geocities.com/berti75397orv90753/

Y

http://advertising.voddo.cn/ (China)

http://62.123.150.18/broadcastemail/ (Italy)
uri: http://uk.geocities.com/boot74365brigitta26464/
uri: http://ca.geocities.com/talbot36966eleanore31170/
uri: http://au.geocities.com/orville43112erena4619/
uri: http://ca.geocities.com/hilda56247piper52204/
uri: http://ca.geocities.com/horace45655silvano62082/
uri: http://uk.geocities.com/crysta67804emmanuel71305
uri: http://au.geocities.com/laney22743hale94335/
uri: http://uk.geocities.com/nesta39103enos89743/
uri: http://uk.geocities.com/wain70005carlin1020/

Y

http://217.40.152.75/broadcastemail/ (England)
uri: http://au.geocities.com/guglielma15411romona79535/
uri: http://au.geocities.com/monte41495robenia81545/
uri: http://au.geocities.com/margery43414miller98997
uri: http://uk.geocities.com/sibby2891janot79802/
uri: http://uk.geocities.com/natty44690tammi64102/
uri: http://au.geocities.com/simmonds61112frederic508/
uri: http://uk.geocities.com/miguelita3538christina90514/
uri: http://ca.geocities.com/bengt190auberta16185/
uri: http://au.geocities.com/hermann20025caroljean2274/
uri: http://ca.geocities.com/valentino55129yuri24758/
uri: http://uk.geocities.com/boot74365brigitta26464/
uri: http://uk.geocities.com/miguelita3538christina90514/
uri: http://au.geocities.com/simmonds61112frederic508/
uri: http://ca.geocities.com/bengt190auberta16185/
uri: http://ca.geocities.com/hilda56247piper52204/
uri: http://ca.geocities.com/talbot36966eleanore31170/
uri: http://ca.geocities.com/nita60800wolf58783/
uri: http://au.geocities.com/orville43112erena4619
uri: http://uk.geocities.com/orelia72474charisse34696/
uri: http://au.geocities.com/june47487timmy59996

Y

http://62.193.238.142/broadcastemail/ (France) - date entry

uri: http://uk.geocities.com/tiffy35215dyane77873/
uri: http://uk.geocities.com/misha37486cammi24695/

Y

http://broad.1122.ish.cn/ (China)
Blank page - terminated

newportcorp.cn pointed to -> 222.210.196.86 (china)
thn->  222.210.203.37 (china)
now->  ab508.vicp.net 60.0.157.29 (china)

Y

http://jzgx.nydns.cn/ 60.18.162.5 (china)

http://62.193.224.161/broadcastemail/

http://www.broadcastemailingcorp.cn/

await !

' * ' denotes active current spam domain.
'**' prior spamvertised domain name

'***' prior domain before that
text in red  denotes a remote observation from a report i've seen
Remote report column denotes the email address could not be determined by myself (but the spam was deemed to be a Bob 'classic') .

etc...

- Red seen by others
- Black This information is observed by me alone -
if you google hard enough im sure others will confirm these findings.

Executive Summary of up hosts

newportcorp.cn (et al)
broadcastemailingcorp.cn

http://217.74.161.86/broadcastemail/ (russia)
http://62.193.238.142/broadcastemail/ (France)
http://62.193.224.161/broadcastemail/ (France)

Moving along -  Since this page was once more dedicated to the Soloway Junk i get for our own domains technical contacts here is a list of the claimed ip addresses note that despite his domains being hosted in China/Korea  But we have ip's here from Japan, Australia, Brazil and New Zealand (and thats just the first couple).  the dns entry also seems to be telling me some of these appear to be dynamic ranges.

You have to admire the consistency of Roberts Operation - sorry I'm being sarcastic
As soon as I get confirmed Bob spam the table below will be updated

n/a

Listwashed it appears Sob!

BSN-210-250-53.dial-up.dsl.siol.net (BSN-210-250-53.dial-up.dsl.siol.net [195.210.250.53])

ifkzdbsm5.eon.net.au  (0.12.140.61) by tz2-jre46.interfree.it  
Received: from Tykd2rkl770pg52iq (203.55.34.112) by ztonhmvbamu870.mweb.co.zw 
id <7060298821562420.OU80.gypwgo93.mweb.co.zw @sovkhozssz7q895xxo6g>
          

Received: from pool-70-16-232-93.rich.east.verizon.net (pool-70-16-232-93.rich.east.verizon.net [70.16.232.93])

Reply-To: "Blake Thorne" <restonparker@coolgoose.com>
From: "Blake Thorne" <monksj@fastermail.com>

from pool-71-254-43-40.roa.east.verizon.net (pool-71-254-43-40.roa.east.verizon.net [71.254.43.40])

01.172.149.24 by bqpbz949-ji16.z9.pwgsc.gc.ca  with DAV;
Sun, 04 Dec 2005 20:09:49 -0700

Brandon Doherty timrolland @care2.com or
tomaskoock @ cheshiremail.com 

from 200-122-115-170.dsl.prima.net.ar (unknown [200.122.115.170])

dns1interfree.it  (150.192.91.240) by fzz5-sg42.umontreal.ca 
from bednbreakfast.nu  (127.0.0.1) by dnsopenface.ca

new members of staff ! 
Solomon@  us
Yazzie@  us

from h196.166.141.67.ip.alltel.net (h196.166.141.67.ip.alltel.net [67.141.166.196])

from slump (50.222.12.208) by ko4.downpour.draco.daly.adv.es
??.mnhs5-mail.peak.ditch.net.cable.rogers.com@grandeur>

Melody Hooper 

from 26-49-112.adsl.terra.cl (26-49-112.adsl.terra.cl [200.112.49.26])

rom week (154.232.64.159)
by jg5.mockernut.abuilding.captain.umontreal.ca
id <???.ixt767-mail.reserve.slug.net.cable.rogers.com@curiosity>

Becky Erwin donaldcrisp @ boardermail. com

26-49-112.adsl.terra.cl (26-49-112.adsl.terra.cl [200.112.49.26])

from week (154.232.64.159)
by jg5.mockernut.abuilding.captain.umontreal.ca 
<?767-mail.reserve.slug.net.cable.rogers.com@curiosity>

Becky

sl51B6348C.pool.t-online.hu (dsl51B6348C.pool.t-online.hu [81.182.52.140])

adv.es  (115.172.122.172) by zi4-q07.interfree.it  with Microsoft SMTPSVC(6.0.1024.9818);
umontreal.ca  (wzcmariahuis.be  147.205.109.90) by sxhealth.co.nz  (8.12.10/8.12.9)
WL272694 (modemcable52.76-22.ig.aaki.dk  84.42.219.182) (authenticated bits=2)by ghi.org.il  (8.12.10/8.12.9) 

me !

dialpool-210-214-204-58.maa.sify.net (dialpool-210-214-204-58.maa.sify.net [210.214.204.58])

ns3deacons.com.hk  (35.108.67.198) by jk3-mn05.wzcmariahuis.be
from inphomatch.com.br  (127.0.0.1) by dnssympatico.ca 

why i am sending spam to myself again

from xpflwn24.web.de  (4.38.5.7) by fa898-dhc.etnic.be 
from dealtboyuw06 (avow96.210.127.24)

why I sent it

from 200-233-176-225.xd-dynamic.ctbcnetsuper.com.br (200-233-176-225.xd-dynamic.ctbcnetsuper.com.br [200.233.176.225])

arboreal-dns.mweb.co.zw (208.48.66.146) by aha52-i385.sxhealth.co.nz 

us

from zaqdb737afe.zaq.ne.jp (zaqdb737afe.zaq.ne.jp [219.115.122.254])

no crap

Cullen, Gerry  <charityinfo @coolgoose.com>

from OUR IP ADDRESS  (unknown [202.158.187.170])
     interesting ...  but its really 

no crap - 

"Mrs. Lusk" <charityinfo@ m a i l .c o m >

Trojan.Spybot
 domain

200216103247.user.veloxzone.com.br (200216103247.user.veloxzone.com.br [200.216.103.247])

localhost.localdomain (HELO localhost.localdomain [127.0.0.1]) 
    	by assailant.allsaintsfan.com (Mostfix) with ESMTP

billing @ 'me'

cm6.gamma40.maxonline.com.sg (cm6.gamma40.maxonline.com.sg [202.156.40.6])

64 by zab3-aek95.vnmnh7.graffiti.net with DAV;

me again, but I 'love' Robert Spam

from sub51-128.uhh.hawaii.edu (sub51-128.uhh.hawaii.edu [132.160.51.128]

me but im apparently sending it from 
hawaii.

from rndf-146-55-196.telkomadsl.co.za (rndf-146-55-196.telkomadsl.co.za [165.146.55.196])

none apparently

im sending his spam to myself via south africa

stjhnf0123w-142163145101.nl.aliant.net (unknown [142.163.145.101])
details about them

(from qrb258cowbell@localhost)
     by nj437-traceable822.pc886dcy.mailpanda.com
X-Authentication-Warning: g49-bristle04.rr516t.mailpanda.com:

 

Tomas Gunter 

hlfxns0145w-142167143103.ns.aliant.net (hlfxns0145w-142167143103.ns.aliant.net [142.167.143.103])

osvg514.inmail24.com (106) by vl4-iy831.138mail.com
from Darylyrx58f3es90ong (15) by bdugnsx473.outgun.com

Demetrius Engle xrs.net

SHASTA189200.ig.com.br (unknown [200.151.189.200])

174 by yj73-tq919.fn2.yyhmail.com with DAV;
     Wed, 11 May 2005 16:43:55 -0500

graffiti.net

USER.36.178.5.201.dial-ip.telemar.net.br (unknown [201.5.178.36])

from nomogram (120)
     by nir397.coop.prorogue.chameleon.collegeclub.com
     (InterMail vK.3.83.97.12 2-0092-283-7259-46-363936644) with ESMTP
     id <7966133896.RNWGB0719.e7-mail.confluent.egg.net.cable.rogers.com@imperative>

gawab.com

ppp-0-110.dts.mg (ppp-0-110.dts.mg [193.251.140.110])

cns848mcnaughton@localhost 
     by xmc451-immoderate969.e89ctb.spamis.net (7.68.02/3.68.81) id d167YS66la05419

oh guess

BSN-210-230-216.dsl.siol.net (BSN-210-230-216.dsl.siol.net [195.210.230.216])

mail5085.otp.merseymail.com (234) by w9-f5.merseymail.com with Microsoft SMTPSVC(5.0.2195.6824);
     Thu, 28 Jul 2005 22:28:29 +0600
Received: from GK40 (lo160.kl71.m.merseymail.com 112) by mail547.a.merseymail.com (51.4.524nqr4/0.392.081)

casino.com (spot a pattern yet?)

ppp1349.va-east.my-users.ne.jp (ppp1349.va-eas69.46.224t.my-users.ne.jp [219.100.144.49])

khzgpc3.fresnomail.com (220) by d58-b.fresnomail.com 
with Microsoft SMTPSVC(5.0.2195.6824);Mon, 25 Jul 2005 09:15:37 +0100

lissamail.com

pool-141-153-229-140.nwrk.east.verizon.net (pool-141-153-229-140.nwrk.east.verizon.net 

92 by exdhf0-lz0.q57.xmail.net with DAV;
Mon, 25 Jul 2005 08:01:51 +0600

asheville.com

pool-138-88-176-85.res.east.verizon.net (pool-138-88-176-85.res.east.verizon.net [138.88.176.85])

from 118 by vz651-r6.rllx4.myway.com with DAV;
Fri, 22 Jul 2005 18:41:57 -0400

rom boyhood (12) by x7.emendable.inoffensive.belies.joinme.com
(InterMail vG.1.40.54.72 8-27735-18-701-46-05016) with ESMTP
id <97786845025574.UAH0929.nvgu5-mail.cromwell.jitter.net.cable.rogers.com@abovementioned>

207-18-135-4.flex.net (unknown [207.18.135.4])

assimilable-dns.doramail.com (72) by xn8-k89.doramail.com with Microsoft SMTPSVC(5.0.2195.6824);
Tue, 19 Jul 2005 20:44:20 -0700

201-011-224-137.cslce7007.dsl.brasiltelecom.net.br (unknown [201.11.224.137])

Trojan.Spybot
 domain

a84-0-197-145.adsl-pool.axelero.hu (a84-0-197-145.adsl-pool.axelero.hu [84.0.197.145])

talcum-dns.allsaintsfan.com (68) by kod81-sr23.graffiti.net with Microsoft SMTPSVC(5.0.2195.6824);
     Fri, 15 Jul 2005 21:46:03 -0700

canada-11.com

200-126-91-229.bk6-dsl.surnet.cl (200-126-91-229.bk6-dsl.surnet.cl [200.126.91.229])
BAD HEADER MIME error: error: unexpected end of preamble

Received: from mailpanda.com (20) by f64-u749.usa-11.com with Microsoft SMTPSVC(8.4.3737.5659);
     Sun, 17 Jul 2005 01:41:45 +0600
Received: from merseymail.com (outgun.com 112)
     by keromail.com (8.12.10/8.12.9) with ESMTP id n09OLZ147
     for <?@?.?>; Sat, 16 Jul 2005 20:43:45 +0100 (EST)
     (envelope-from freddarlong@joinme.com)
Received: from ZSS2449211974 (modemcable3.8-717.dy.linuxmail.org 216)
     (authenticated bits=9)
     by marketweighton.com

grafiti.net

rom mail4934.oxfrd.mailpanda.com (176) by q931-h91.mailpanda.com with Microsoft SMTPSVC(5.0.2195.6824);
     Sat, 16 Jul 2005 00:36:27 -0500

Received: from D84 (h197.gdy52.rm.mailpanda.com 31)
     by mail28.mbc.mailpanda.com (2.31.52ae290/6.833.781) with SMTP id iiz8U3MBnj1;
     Sat, 16 Jul 2005 01:35:27 -0400

mail360.gdoo.spamis.biz (177) by je4-lz4.spamis.cc with Microsoft SMTPSVC(5.0.2195.6824);
     Sat, 02 Jul 2005 07:39:06 +0300
Received: from MZ13 (maf207.vd639.rt.spamis.cc 95)

from sq8bedraggle@localhost)
	by ebz496-duncan073.b181ui.spamis.org (6.44.34/7.29.23) id gzk33BU78emb71;
	Mon, 13 Jun 2005 18:22:01 -0700 GMT
X-Authentication-Warning: hny26-decompression8.hu819siy.spamis.org: u1electret set sender to contact@spamis.org using -j

details about them

Received: from xih7.cashette.com  (91) 
by bqm636-kyy.lissamail.com with Microsoft SMTPSVC(5.0.2195.6824);
Received: from treasonouspathogenicx1 (swaziland148)
          by ureach.com  (dvv8) with SMTP
          id <5753464wls91209lj>
          (Authid: JacobJohnson);

Trojan.Spybot
 domain

details about them

? 
Trojan.Spybot
 domain

Trojan.Spybot
 domain

?

Trojan.Spybot
 domain

I will update this when new Junk from Robert comes in - Just that he loves sending me this 'gold'.  Further proper examples of Roberts spams (and to view his 'fortune 100 client' list) can be seen in experiment 1 , and experiment 2.

Domain Owner spam,

I've done some fun stuff with spam they get, but its time to stop but i will continue to list Bobs spam here

Return-Path: <JanellWeeks3@montevideo.com.uy>
Received: from Q-SI3TG06W0SN5N (eu100-163-8.clientes.euskaltel.es [82.130.163.8])
Received-SPF: fail (gmail.com: domain of JanellWeeks3@montevideo.com.uy does not designate 82.130.163.8 as permitted sender)
Received: from wrneer4.atlas.cz (211.88.172.41) by ox3-ckl.zmail.ru with Microsoft SMTPSVC(5.0.2195.6824);
From: "Customer Support Department" <JanellWeeks3@montevideo.com.uy>

Roberts clients apparently include these highly reputable areas of trading in:

• lottery scam merchants (advance fee fraudsters)
  
• internet pharmacies
• Nigerian 419 advance free fraudsters
• Western Samoa internet 'timeshare' / get rich quick scheme
• 'Cheap' software suppliers
• contentseed.com (see pdf document)
  
• you don't believe me or want me to continue ? - go see the experiment pages
  

Robert's 'Clients' also Include these stupid retards
http://success-4-u.biz/?refid=BcastEmail-123456789              affiliate: Helen Allen, Hamilton Island, Queensland, Australia

and see Poochieheaven.com (no this is not a joke) recommendation

Thats my experiment experience - don't 'opt-out'. I never wanted it to begin with or signed up for it  The only way I seemed to stop his junk to the domain owner (that was just one email address) was to write these web pages.

It seems to have section

Getting some spamcop reports with headers in (stored to)  - Im parsing what i can- since these are Bobs spams its interesting to note how there geting delivered, my lack of recenr Bob specific spam means this is something you can do to.

March 1 06

cc spamcop report

60.181.144.90

seems to have the  Trojan.spybot virus

March 2 06

cc spamcop report

March 2 06

cc spamcop report

211.33.79.125

211.33.79.125 has Mutt/1.5.1i seems to have the Trojan.spybot virus

March 2 06

cc spamcop report

221.139.207.34

221.139.207.34 has Sylpheed version 0.8.2 (GTK+ 1.2.10; i586-alt-linux) 
seems to have the Trojan.spybot virus

2 March

cc Spamcop report

220.125.192.85 KOREA TELECOM

has MailGate v3.0 seems to have the Trojan.spybot virus

2 March

cc Spamcop report

TOO MUNGED TO DECIPER

has MailGate v3.0 seems to have the Trojan.spybot virus

3 March

cc Spamcop report

87.0.195.186 ITALY

has malaysia.net and Internet Mail Service (5.5.2650.21) seems to have the Trojan.spybot virus

3 March

cc Spamcop report

70.101.151.228 CANADA/?says US?

has The Bat! (v1.60q) and ?cashette.com seems to have the Trojan.spybot virus

3 March

cc Spamcop report

24.63.250.136 Comcast Cable/US

Mutt/1.5.1i and ? snail-mail.net seems to have the Trojan.spybot virus

3 March

cc Spamcop report

211.177.66.70(x2)probably Korea

no mailer but malaysia.net seems to have the Trojan.spybot virus

3 March

cc Spamcop report

63.223.65.162 - US 
Beyond The Network America, Inc. 
Reston Executive Center,
12100 Sunset Hills Road,
Suite 300,Reston,VA

MIME-tools 5.503 (Entity 5.501) and ureach.com ? has ? exchange open proxy or xmailer ?

6 March

cc Spamcop report

211.56.136.174 probably Korea

Calypso Version 3.20.01.01 (4) seems to have the Trojan.spybot virus

6 March

cc Spamcop report

60.210.147.185 - China

MIME-tools 5.503 (Entity 5.501) seems to have the Trojan.spybot virus

6 March

cc Spamcop report

58.69.36.173 - Phillipino spam

MailGate v3.0 seems to have the Trojan.spybot virus

7 March

cc Spamcop report

61.73.165.25 - Korea

Microsoft Internet Mail 4.70.1155 seems to have the Trojan.spybot virus (india)

7 March

cc Spamcop report

221.192.216.207 - China

MIME-tools 4.104 (Entity 4.116) seems to have the Trojan.spybot virus

12 March 

18

cc Spamcop report

59.14.170.94 - Korea

X-Authentication-Warning: R53-alias2.ZQ6meo.ciberaula.infase.es 
[40.114.178.89]: ol03exclamation set sender to nilarme...@budweiser.com using 
-u X-Mailer: MIME-tools 5.503 (Entity 5.501)

Looks like * new  xmailer / 123 trojan 

12 March

cc Spamcop report

218.27.38.154 CNCGROUP-JL China

Calypso Version 3.30.00.00
@backstreet-boys.com 
I'm opting for the Trojan.spybot virus

12 March

cc Spamcop report 

40.232.92.121
Eli Lilly and Company Lilly
Corporate Center
Indianapolis,IN,US

mauimail.com Pegasus Mail for Win32 (v2.53/R1) 
the Trojan.spybot virus

12 March 2006

cc Spamcop report

138.217.21.239 Australia

Mutt/1.5.1i  Trojan.spybot virus

12 March 2006

cc Spamcop report

61.18.63.169 - HK (China)

Calypso Version 3.20.01.01 (4)  Trojan.spybot virus

15 March 2006

cc Spamcop report

adsl-67-114-113-210.dsl.bkfd14.pacbell.net
[67.114.113.210] - US SBC Internet Services
/Sears Roebuck San Francisco 

Internet Mail Service (5.5.2650.21) 
? Open Exchange Proxy ?

15 March 2006

cc Spamcop report

48.114.151.152 
Prudential Securities Inc 
1 New York Plaza New York NY 10004 US

Calypso Version 3.20.01.01 (4) Trojan.spybot virus

15 March 2006

cc Spamcop report

132.117.92.200 
Army National Guard Bureau 
8260 Willow Oaks Corporate Drive 7th Floor
Fairfax VA 22031 US

The Bat! (v1.53d)  Trojan.spybot virus

15 March 2006

cc Spamcop report

216.250.47.66 All West Communications 
PO Box 588 Kamas UT 84036 US

Mutt/1.5.1i  Trojan.spybot virus

15 March 2006

cc Spamcop report

88.243.240.9 Turk Telekom Turkey

Internet Mail Service (5.5.2650.21) 
? Open Exchange Proxy ?

15 March 2006

cc Spamcop report

102.16.24.65 - 
unassigned thoughts please? bogon ? term

Mutt/1.5.1i  Trojan.spybot virus 

19 March 

cc Spamcop report

80.243.245.135 - outremer-telecom.fr

Mutt/1.5.1i Trojan.spybot virus

* for the record our email boxes blocks any email request sent to it from south korea, or china - it solves the volume of spam problem for us, if you thinks that is hard - i suggest you ask to see the log file, china and korea love to fake whats they spend most of their  time sending - which is spam willingly, or unwillingly

Both take spammers money too.

The Blogish section

Yes This page is a mess but the gives you a time line for me to discovering Roberts activities

next

14 May: Quiet here (no Bob spam) An interesting url from the the BBB.org http://www.thebbb.org/commonreport.html?bid=22009796

Marketplace Experience

Based on BBB files, this company has an unsatisfactory record
	
 
	
	
BBB Definition:

unsatisfactory  record - A
company has an "unsatisfactory business performance record" with the
Bureau is based on the experiences reflected in BBB files. This file
condition results when the company has failed to resolve or respond to
complaints, repeatedly failed to respond or resolve issues in a timely
manner, failed to resolve the underlying issues for a pattern
	
 
	
	
BBB Definition:

pattern - More
than 2 complaints involving the same allegations usually within 12
months that are significant in relation to the company's size and
volume of business.
	
 of
complaints, failed to honor their commitment to mediate or arbitrate
disputes or honor mediated agreements or arbitrated decisions, failed
to substantiate, modify or discontinue false advertising claims that
are challenged by the BBB, or failed to discontinue unauthorized use of
the BBB name and logo, a Federally protected trademark.
	
 with the 
Bureau due to failure to respond to one or more complaints and or two or 
more otherwise unresolved
	
 
	
	
BBB Definition:

unresolved - The company failed to resolve the complaint issues.
	
 complaints.

more news from http://blog.opsan.com/archive/2005/07/29/1148.asp new domain for our cheeky spammer (its great to be a chinese citizen)

Parsing input: http://www.broadcastemailingcorp.cn/
Host www.broadcastemailingcorp.cn (checking ip) = 218.244.140.39 > abuse@hichina.com

Registrant Organization: ????
Registrant Name: ??
Administrative Email: cnreg@hichina.com
Sponsoring Registrar: ??????????(??)????
Name Server:dns9.hichina.com
Name Server:dns10.hichina.com
Registration Date: 2006-05-11 11:26
Expiration Date: 2007-05-11 11:26
inetnum: 218.244.128.0 - 218.244.159.255
netname: HICHINA
country: CN
descr: 3/F,HiChina Mansion,No.27 Gulouwai Avenue,Dongcheng District, Beijing 100011,China
admin-c: ZX103-AP
tech-c: ZX163-AP
status: ALLOCATED PORTABLE
changed: shenzhi@cnnic.cn 20050606
mnt-by: MAINT-CNNIC-AP
source: APNIC

person: Zhang Xiangdong
nic-hdl: ZX103-AP
e-mail: abuse@hichina.com
address: 3/F,HiChina Mansion,No.27 Gulouwai Avenue
address: Dongcheng District, Beijing 100011, China
phone: +86-10-64242299-8602
fax-no: +86-10-64242299-8354
country: CN
changed: ipas@cnnic.net.cn 20050413
mnt-by: MAINT-CNNIC-AP
source: APNIC

person: Song Yingqiao
address: 3/F,HiChina Mansion,No.27 Gulouwai Avenue
address: Dongcheng District, Beijing 100011, China
country: CN
phone: +86-10-64242299-8328
fax-no: +86-10-64242299-8354
e-mail: songyq@hichina.com
nic-hdl: ZX163-AP
mnt-by: MAINT-CNNIC-AP
changed: ipas@cnnic.net.cn 20050413
source: APNIC

inetnum: 218.244.128.0 - 218.244.159.255
netname: HICHINA
country: CN
descr: 3/F,HiChina Mansion,No.27 Gulouwai Avenue,Dongcheng District, Beijing 100011,China
admin-c: ZX103-CN
tech-c: ZX163-CN
status: ALLOCATED PORTABLE
changed: shenzhi@cnnic.cn 20050606
mnt-by: MAINT-CNNIC-AP
source: CNNIC

person: Zhang Xiangdong
nic-hdl: ZX103-CN
e-mail: abuse@hichina.com
address: 3/F,HiChina Mansion,No.27 Gulouwai Avenue
address: Dongcheng District, Beijing 100011, China
phone: +86-10-64242299-8602
fax-no: +86-10-64242299-8354
country: CN
changed: ipas@cnnic.net.cn 20050413
mnt-by: MAINT-CNNIC-AP
source: CNNIC

person: Song Yingqiao
address: 3/F,HiChina Mansion,No.27 Gulouwai Avenue
address: Dongcheng District, Beijing 100011, China
country: CN
phone: +86-10-64242299-8328
fax-no: +86-10-64242299-8354
e-mail: songyq@hichina.com
nic-hdl: ZX163-CN
mnt-by: MAINT-CNNIC-AP
changed: ipas@cnnic.net.cn 20050413
source: CNNIC

> How those Chinese hate spam ....

Blonde reports

"The person that returned my call was friendly until I explained I'd not received my package, then immediately turned kinda rude. Told me to email support at newportcorp@mailshack.com.

Then it occured to me that the number on the caller id was Robert Soloway, (I'm a little slow catching on sometimes) so I asked the guy why the number was listed as Robert Soloway instead of Newport Broadcasting. He hung up on me."

> And rude to a customer .... - oh my He seems to be using http://62.193.224.161/broadcastemail/ (old style site - FRANCE) for specials, These guys 62.193.224.0 - 62.193.239.255 AMEN-EUROPE-NETWORK abuse@amenworld.com seem to like him (2nd ip)

inetnum:         62.193.224.0 - 62.193.239.255
netname:         AMEN-EUROPE-NETWORK
descr:           AMEN European Network
descr:           For Spam/Abuse requests please send mail to abuse@amenworld.com
country:         FR
admin-c:         AN1108-RIPE
tech-c:          AN910-RIPE
status:          ASSIGNED PA 
mnt-by:          AMEN-MNT
mnt-lower:       AMEN-MNT
mnt-routes:      AMEN-MNT
rev-srv:         ns1.amenworld.com
rev-srv:         ns2.amenworld.com
source:          RIPE # Filtered

role:            AMEN NOC
address:         AMEN - Agence des Medias Numeriques
address:         12/14, rond-point des champs elysees
address:         75008 Paris, France
phone:           +33 8 92 55 66 77
e-mail:          abuse@amen.fr
nic-hdl:         AN910-RIPE
admin-c:         JD2263-RIPE
tech-c:          AN1018-RIPE
tech-c:          AN1019-RIPE
mnt-by:          AMEN-MNT
source:          RIPE # Filtered

person:          Gorun RENAULT
address:         AMEN - Agence des Medias Numeriques
address:         12/14, rond-point des champs elysees
address:         75008 Paris, France
phone:           +33 8 92 55 66 77
fax-no:          +33 1 40 87 76 89
e-mail:          gorun.renault@amen.fr
nic-hdl:         AN1108-RIPE
mnt-by:          AMEN-MNT
source:          RIPE # Filtered

% Information related to '62.193.224.0/22AS28677'

route:           62.193.224.0/22
descr:           AMEN Networks
origin:          AS28677
mnt-by:          AMEN-MNT
source:          RIPE # Filtered

1 May: April was 'interesting' Three Soloway hosts down

http://210.7.70.150/broadcastemail/ (india)
http://broad.1122.ish.cn/ 
jzgx.nydns.cn/

I expect some movement on Bob 'bulking up' on hostnames soon - the india host stopped responding after two months - seems rather spam friendly that indian isp , that is unless the rumours about spammer Ralsky come true.  Our friends the French still seem to be clueless but  then again the french with computers seems plain strange.

I will continue to mirror this page just in case a repeat of April happens again.

22 April: Funny things a happening and not just here

Just in case you think im the only one complaining or documenting mr soloway Im not - blog.opsan.com (mentioned before) got an honourable mention in a recent Bob Soloway spam run as an 'impediment to him spamming' - the site above has a proper comment system rather than my sorry yahoo guestbook.  Despite this being a boring webpage i try and verify the info i get, I got an above average page hit rate to in April over easter, make of that what you will. 

From that site: Acebirddog reports that Bobs 'spam me forever lists' - have been sold to he thinks to phishers who if you dont know are those very nice people who ask you for your id just before they raid your bank account - A casual glance at the spam I saved (all three experiments 'evidence') show that I've won the lottery, had 419 scams etc although low in number compared to drugs and software spam I got so I'm sure pointing a finger to Bob Soloway could not be too hard  .

While I'd not say he did (having not seen it), I'm sure he could have, alas my spam filtering is vicious, and with Max (mentioned elsewhere) not helping I pass this bit of info on.  Effective sales leads are targeted to people, just becuase you have an contact means there is a duty of care how you treat it - for instance you would not sell the list of mafia informers to the mafia.

The 'duty of care' never existed  as far as im concerned - client case studies whatever  (and not written by me) can be  found throughout this document.

20 April: New Chinese domain reported hosting Mr Spam (no China really is 'anti spam') Mirror of this page also setup, If China is 'anti spam' then G.W Bush, and all members of the Chinese communist party and the new german Pope are homosexuals.

Couple of Chinese terminations reported (or did Bob fail to pay the bill ?)

Meet jzgx.nydns.cn (thanks to Tomez)

nydns.cn
Domain Name: nydns.cn
ROID: 20050414s10001s06775213-cn
Domain Status: ok
Registrant Organization: 楠羽网络科技公司
Registrant Name: 王洪羽
Administrative Email: why_119@tom.com
Sponsoring Registrar: 北京新网数码信息技术有限公司
Name Server:ns.xinnetdns.com
Name Server:ns.xinnet.cn
Registration Date: 2005-04-14 16:12
Expiration Date: 2007-04-14 16:12

inetnum:      60.16.0.0 - 60.23.255.255
netname:      CNCGROUP-LN
country:      CN
descr:        CNCGROUP Liaoning province network
admin-c:      CH455-AP
tech-c:       GZ84-AP
status:       ALLOCATED PORTABLE
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP-LN
mnt-routes:   MAINT-CNCGROUP-RR
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks:      This object can only be updated by APNIC hostmasters.
remarks:      To update this object, please contact APNIC
remarks:      hostmasters and include your organisation's account
remarks:      name in the subject line.
remarks:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed:      hm-changed@apnic.net 20040416
changed:      hm-changed@apnic.net 20060124
source:       APNIC

route:        60.16.0.0/13
descr:        CNC Group CHINA169 Liaoning Province Network
country:      CN
origin:       AS4837
mnt-by:       MAINT-CNCGROUP-RR
changed:      abuse@cnc-noc.net 20060118
source:       APNIC

role:         CNCGroup Hostmaster
e-mail:       abuse@cnc-noc.net
address:      No.156,Fu-Xing-Men-Nei Street,
address:      Beijing,100031,P.R.China
nic-hdl:      CH455-AP
phone:        +86-10-82993155
fax-no:       +86-10-82993102
country:      CN
admin-c:      CH444-AP
tech-c:       CH444-AP
changed:      abuse@cnc-noc.net 20041119
mnt-by:       MAINT-CNCGROUP
source:       APNIC

person:       Guangyu Zhan
nic-hdl:      GZ84-AP
e-mail:       abuse@online.ln.cn
address:      DATA Communication Bureau of Liaoning Province,China
address:      38 Lianhe Road,Dadong District Shenyang 110044,China
phone:        +86-24-22800096
fax-no:       +86-24-22800368
country:      CN
changed:      zhangy@lntelecom.com 20030122
mnt-by:       MAINT-CNCGROUP-LN
source:       APNIC

15 April: We where popular the last couple of days

Alas geocities stats are not very good but it seems that 26 browsers tried over and over again to access this page for every hour,   - So Im assuming it  Bob and his 'army' of spambot pc's.  I see no refering url or page of entry so perhaps i can now infer to you that Bob is ddosing geocities now ?.

Does that mean his geocites redirect days are over ? time will tell

Geocities got fed up and blocked the ip's it seems.

12 April:  No eu activity activity yet, quite on the spam front too.

Tomez (report to nanae) discovers newportcorp.cn - guess where

inetnum:      222.208.0.0 - 222.215.255.255
netname:      CHINANET-SC
descr:        CHINANET Sichuan province network
descr:        China

Let see whois at whois.cnnic.net.cn:

Domain Name: newportcorp.cn
ROID: 20060330s10001s47212991-cn
Domain Status: ok
Registrant Organization: ????
Registrant Name: ??
Administrative Email: cnreg@hichina.com
Sponsoring Registrar: ??????????????????
Name Server: dns9.hichina.com [218.30.103.100]
Name Server: dns10.hichina.com [218.244.143.64]
Registration Date: 2006-03-30 11:21
Expiration Date: 2007-03-30 11:21

See also:
only4testinter.vicp.net  IP 222.210.196.86
ns2.vicp.net [210.51.180.211]
ns1.vicp.net [202.105.21.217]

only4testinter.vicp.net has no MX records -> vicp.net has no MX records

Let see whois:
Registrar: ONLINENIC, INC.

Registrant:
     ORAY Network Resource Co., Ltd. domainreg@oray.net +86.2061073333
     Vavic Network Technology, Inc.  1F Office,NO 15,Jiangong Road,Tianhe S&T Zone Guangzhou,510655P.R.C
     Guangzhou,Guangdong,CN 510655

Domain Name: vicp.net
Record last updated at 2006-02-16 23:44:34
Record created on 2001/8/15
Record expired on 2011/8/15

Domain servers in listed order:
     ns1.vicp.net      ns2.vicp.net

Administrator:
     Name-- Vavic Network Technology, Inc.
 EMail-: (domainreg@oray.net)
 tel --: +86.2061073333
     org: Vavic Network Technology, Inc.
     1F Office,NO 15,Jiangong Road,Tianhe S&T Zone Guangzhou,510655P.R.C
     Guangzhou,Guangdong,CN 510655

Technical Contactor:
     Name-- Vavic Network Technology, Inc.
 EMail-: (domainreg[]oray.net)
 tel --: +86.2061073333
     org: Vavic Network Technology, Inc.
     1F Office,NO 15,Jiangong Road,Tianhe S&T Zone Guangzhou,510655 P.R.C
     Guangzhou,Guangdong,CN 510655

Billing Contactor:
     Name-- Vavic Network Technology, Inc.
 EMail-: (domainreg@oray.net)
 tel --: +86.2061073333
     org: Vavic Network Technology, Inc.
     1F Office,NO 15,Jiangong Road,Tianhe S&T Zone Guangzhou,510655P.R.C
     Guangzhou,Guangdong,CN 510655

See original spam in sightings:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/936e3d380c28c656

And see also DNS dnsfamily.com used by Soloway for
nebc.dazh.cn IP 220.166.64.52 (at CHINANET-SC)

ns2.dnsfamily.com [218.107.216.80]
(at CNCNET-CN / dns-xm1.fjxm.cncnet.net)
ns1.dnsfamily.com [218.85.132.246]
(at CHINANET-FJ / dns.fz.fj.cn)

Let see whois:
Registrar: XIN NET TECHNOLOGY CORPORATION
Domain Name: dnsfamily.com

DNS Servers:
NS1.4EVERDNS.COM 218.5.77.19
NS2.4EVERDNS.COM 61.151.252.240
NS1.DNSFAMILY.COM 218.85.132.246
NS2.DNSFAMILY.COM 218.107.216.80

Registrant:
huiyu chen
    xiamen
    361004

Administrative Contact:
huiyu chen
    huiyu chen
    xiamen
    xiamen Fujian 361004
    China
    tel: 86 596 6637835
    fax: 86 596 6637835
    kittyyuc@hotmail.com

Technical Contact:
huiyu chen
    huiyu chen
    xiamen
    xiamen Fujian 361004
    China
    tel: 86 596 6637835
    fax: 86 596 6637835
    kittyyuc@hotmail.com

Billing Contact:
huiyu chen
    huiyu chen
    xiamen
    xiamen Fujian 361004
    China
    tel: 86 596 6637835
    fax: 86 596 6637835
    kittyyuc@hotmail.com

Registration Date: 2006-01-09
      Update Date: 2006-03-02
  Expiration Date: 2007-01-09

Primary DNS: ns1.DNSFAMILY.com 218.85.132.246
Secondary DNS: ns2.DNSFAMILY.com 218.107.216.80

See original spam in sightings:
http://groups.google.com/group/news.admin.net-abuse.sightings/msg/1a28a5ee6aa40155

Credit to Tomez for the above,

Admin note to any spammers - comment spam to the guestbook feature will not help your seo ratings, it is not displayed. - so if you hired an seo spammer (better results in Google for 5 seconds) and you wonder why nobody is visiting you now know why.

Valid comments eg dealing with Bob will not be displayed either they will be added to this page. tips are anon and welcome..

3 April: No website termination to log recently, which allows to me to make a point about France and there employment issues (in the news) if a french isp cannot terminate a well known rokso spammers site (i'm not asking for miracles, and note i dont make those demands on the spam friendlyness of India, and China isp's) - while those sites might not currently spamvertised (see 29 march entry for the current host with the most), its still Bob Soloway.

So the question is there nobody at abuse@amenworld.com who is sufficienty educated enough to kill the site ? it seems there is work in france but nobody seems to

a know how to do it,
or
b or is paid to do it.

They've had some spamcop reports too.

admin note: new section for Domain owner spam analysis that Bob should send to me - why ? I'm packing up the spam statistical analysis 'experiments'.  well when you go document 700 spams + (a 5mb webpage)  and you will know the answer, alas Bob cannot celebrate, I'm still going to continue writing this page.

1 April: This is no joke but Bob Soloway spammed me! lucky me - hes using flickr.com too

http://static.flickr.com/51/113583781_17411093f6_m.jpg

Lots of other garbage too, once on, never off with our Bob

29 March: - eight days of nothing - then new (broad.1122 account ?) on host http://broad.1122.ish.cn/ (China)

; <<>> DiG 9.2.4 <<>> broad.1122.ish.cn
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10284
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;broad.1122.ish.cn.             IN      A

;; ANSWER SECTION:
broad.1122.ish.cn.      3094    IN      A       60.191.23.122

whois ish.cn
Domain Name: ish.cn
ROID: 20040920s10001s02686110-cn
Domain Status: ok
Registrant Organization: 杭州森蓝计算机网络有限公司
Registrant Name: 钱永强
Administrative Email: myqyq@yahoo.com.cn
Sponsoring Registrar: 北京新网数码信息技术有限公司
Name Server:ns.xinnetdns.com
Name Server:ns.xinnet.cn
Registration Date: 2004-09-20 09:12
Expiration Date: 2006-09-20 09:12

60.191.23.96 - 60.191.23.127
netname:      HANGZHOU-WANGTONG-LTD
country:      CN
descr:        HangZhou WangTong Technology CO.,LTD
descr:
admin-c:      YX315-AP
tech-c:       CH122-AP
status:       ASSIGNED NON-PORTABLE
changed:      auto-dbm@dcb.hz.zj.cn 20050429
mnt-by:       MAINT-CN-CHINANET-ZJ-HZ
source:       APNIC

role:         CHINANET-ZJ Hangzhou
address:      No.352 Tiyuchang Road,Hangzhou,Zhejiang.310003
country:      CN
phone:        +86-571-85157929
fax-no:       +86-571-85102776
e-mail:       anti_spam@mail.hz.zj.cn
trouble:      send spam reports to anti_spam@mail.hz.zj.cn
trouble:      and abuse reports to anti_spam@mail.hz.zj.cn
trouble:      Please include detailed information and times in UTC
admin-c:      CH54-AP
tech-c:       CH54-AP
nic-hdl:      CH122-AP
mnt-by:       MAINT-CHINANET-ZJ
changed:      master@dcb.hz.zj.cn 20031204
source:       APNIC

person:       YuanDong Xu
nic-hdl:      YX315-AP
e-mail:       dkhxtb@mail.hz.zj.cn
address:      Floor 17th,ChangDiHuoJu Mansion,No.259 WenSan Road,Hangzhou,Zhejiang.Postcode:310000
phone:        +86-571-85511187
country:      CN

21 March: A short analysis of new website (non techy), lets discuss opting out first.

first question is: how did I 'opt' to get Bob spam ? unknown ? i have my ideas.
second question is:  how do i know what email list(s) im on ?
third question is: will i get more spam after removing myself ? - probably

Now: Moving on to the success stories of NIM - It seems that many of the spam claims made by Bob have been removed from the new website for instance uskia et all, and he is urging his spammy clients to donate to The Salvation Army,Doctors Without Borders,Mercy Corps and not forgetting Child Help USA. - Perhaps what is means is when Bob mentions a donation was made in a spam email/website - he did not contribute but somebody else did ?

I wonder what happened to the 'success' (found on the old website, and in his spam emails) the stories of

america remembers: killed in action - notes: think is http://usakia.org/ they never replied to my query either.
foundation, his grace: evangelistic ministries - notes: ?
north valley aikikai: aikido education academy - notes: ? Information: (760) 788-3267 or www.ramona-aikikai.com (dead url)

lars ranch: abused children's sanctuary notes: ? the neverland moonwalking dance school ?

musici europae: classic music foundation notes: ? husband and wife duo of Tony Brychta and
Marianna Alaberdova ? from Google cache

coleman broadcasting: youth education network . notes: Kansas somewhere, can only find a address,
Coleman Broadcasting Network Po Box 300165,Kansas City, MO 64130 no url  a phone of (816) 861-378seven

Perhaps charity spam email does not work after all ?

I note (technical) he is using a counter script from rapidcounter.com

20 March: Images of Bob (our spammer comes out of the the closet) from the new website ? see below

Site seems to be dead  http://advertising.voddo.cn/ (China) - see if they stay down

Leaves France, China, and India up

The remaining Chinese site (http://broad.ztjm.com/) has a new website see:

I like the spam to be numero 1 spammer " NEBC Founder Ranked as The #1 Broadcast Emailer in The World by Wikipedia; The World's Largest Online Encyclopedia. "  Class! - Bet Forrester like there name being used to.

The site needs more investigation but Im sure the owner of poochieheaven.com would take issue for the satisfaction cliam.

I got fooled and payed for Soloways broadcast email that was supposed to be all opt in.
Well now I have nothing but complaints about spam and am receiving virus' in my email all the time. 
I asked for a refund but they said no. 
Still I get complaints about emails being sent out after I told them to stop sending them.
So I wonder what can we do about this. 
My business has slowed so much and I think my site's reputation is at stake.

Other 'recomendations' are here.

India, France have old website designs which looked like:

19 March:  'e' larts me to France - bonjour to http://62.193.238.142/broadcastemail/

inetnum:         62.193.224.0 - 62.193.239.255
netname:         AMEN-EUROPE-NETWORK
descr:           AMEN European Network
descr:           For Spam/Abuse requests please send mail to abuse@amenworld.com
country:         FR
admin-c:         AN1108-RIPE
tech-c:          AN910-RIPE
status:          ASSIGNED PA 
mnt-by:          AMEN-MNT
mnt-lower:       AMEN-MNT
mnt-routes:      AMEN-MNT
rev-srv:         ns1.amenworld.com
rev-srv:         ns2.amenworld.com
source:          RIPE # Filtered

role:            AMEN NOC
address:         AMEN - Agence des Medias Numeriques
address:         12/14, rond-point des champs elysees
address:         75008 Paris, France
phone:           +33 8 92 55 66 77
e-mail:          abuse@amen.fr
nic-hdl:         AN910-RIPE
admin-c:         JD2263-RIPE
tech-c:          AN1018-RIPE
tech-c:          AN1019-RIPE
mnt-by:          AMEN-MNT
source:          RIPE # Filtered

Humour - yahoos guestbook alerter email is being deemed as spam by yahoo webmail - so before anybody pays (ahem spams) to have there mail put in our inboxes instead of bul - which aol are going to do  - its nice to know that parts of yahoo wont be paying it.  Thats good enough for me.

Admin note: Tables differenciated  between our spam, and spamcop reports

15 March: http://62.123.150.18/broadcastemail/ (Italy) down after six days. What a list of infected pc's retail/civil defence/wall stree/china  If Bob Soloways using it must be legit....

India (very spammy) /  China / and Russia current homes for bobs 'webhosting'.

14 March:  http://217.40.152.75/broadcastemail - England is down

new section web hosts up

13 March: advertising.voddo.cn is still up - not down the tour continues - Danke for the cc on the list of redirects at http://blog.opsan.com/archive/2005/07/29/1148.aspx

Lets have a Bob world spam tour logo.

12 March: Confusion cleared up - spamcop reports added - bob down to one geocities url in those reports, (not the three one expects)  1st senderbase infected pc used by Bob identifed too.

but now one green box to add too....

Bobs in England now at http://217.40.152.75/broadcastemail/ - man can he Globetrot

Of note here to any people still thinking - Bob seems a 'genuine businessman' - perhaps you might ask why is he ordering english broadband internet connections when his office is not available to get english (european) broadband from British Telecom.

His address Executive Residence, Inc. 1200 Western Avenue Room 17E Seattle, Washington - which Im sure the english broadband checker at bt.com would say something along the lines of 'no service possible'.

My thanks to 'e'

% Information related to '217.40.152.72 - 217.40.152.79'

inetnum:         217.40.152.72 - 217.40.152.79
netname:         Mary-MEADOWS-000000006186527
descr:           BT-ADSL
remarks:         Please send abuse notification to abuse@btopenworld.com
country:         GB
admin-c:         DY128-RIPE
tech-c:          DY128-RIPE
status:          ASSIGNED PA 
mnt-by:          BTNET-MNT
mnt-lower:       BTNET-MNT
source:          RIPE # Filtered

person:          Robin Griffith
remarks:         *******************************************************
remarks:         * Please send abuse reports to abuse@btopenworld.com  *
remarks:         *******************************************************
address:         Openworld
address:         British Telecommunications plc
address:         81 Newgate Street
address:         London
address:         EC1A 7AJ
address:         UK
phone:           +44 1473 647774
abuse-mailbox:   abuse@btopenworld.com
nic-hdl:         DY128-RIPE
mnt-by:          BTNET-MNT
source:          RIPE # Filtered

% Information related to '217.32.0.0/12AS2856'

route:           217.32.0.0/12
descr:           BT Public Internet Service
origin:          AS2856
mnt-by:          BTNET-MNT
source:          RIPE # Filtered

10 March:

update: I'm  getting confused

where back in in Italy (last there 4th March)  on http://62.123.150.18/broadcastemail/

inetnum:         62.149.192.0 - 62.149.223.255
netname:         TECHNORAIL-NET
descr:           Technorail srl
descr:           Internet Service and Access Provider
country:         IT
admin-c:         SC279-RIPE
tech-c:          SC279-RIPE
status:          ASSIGNED PA 
mnt-by:          TECHNORAIL-MNT
source:          RIPE # Filtered

person:          Stefano Cecconi
address:         Aruba S.p.A.
address:         Piazza Garibaldi 8
address:         52010 soci (AR)
phone:           +39 0575 51571
fax-no:          +39 0575 561831
e-mail:          hostmaster@technorail.com
nic-hdl:         SC279-RIPE
source:          RIPE # Filtered

% Information related to '62.149.128.0/17AS31034'

route:           62.149.128.0/17
descr:           Technorail S.r.l. - Aruba.it
origin:          AS31034
mnt-by:          TECHNORAIL-MNT
source:          RIPE # Filtered

New domain http://advertising.voddo.cn/ in China, 'E' reports that czech is down, that leaves China, and India up I need a traffic light system as to what is up, and how long it was up views please. - but now on with the new

Domain Name: voddo.cn
ROID: 20060223s10001s45519825-cn
Domain Status: ok
Registrant Organization: 苏风
Registrant Name: 苏风
Administrative Email: cnreg@hichina.com
Sponsoring Registrar: 创联万网国际信息技术（北京）有限公司
Name Server:dhserver.sharella.com
Name Server:dhserver2.sharella.com
Registration Date: 2006-02-23 13:45
Expiration Date: 2007-02-23 13:45

;; ANSWER SECTION:
voddo.cn.               60      IN      A       218.88.45.202

Which is our anti-spam friends at Chinanet

inetnum:      218.88.0.0 - 218.89.255.255
netname:      CHINANET-SC
descr:        CHINANET sichuan province network
descr:        Data Communication Division
descr:        China Telecom
country:      CN
admin-c:      CH93-AP
tech-c:       XS16-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-SC
status:       ALLOCATED NON-PORTABLE
changed:      hostmaster@ns.chinanet.cn.net 20020408
changed:      hm-changed@apnic.net 20040927
changed:      hm-changed@apnic.net 20041126
source:       APNIC

person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      lqing@chinatelecom.com.cn 20051212
mnt-by:       MAINT-CHINANET
source:       APNIC

person:       Xiaodong Shi
nic-hdl:      XS16-AP
e-mail:       ipadmin@my-public.sc.cninfo.net
address:      No.72,Wen Miao Qian Str.
address:      Data Communication Bureau Of Sichuan Province
address:      Chengdu
address:      PR China
phone:        +86-28-6190785
fax-no:       +86-28-6190641
country:      CN
changed:      ipadmin@my-public.sc.cninfo.net 20030317
mnt-by:       MAINT-CHINANET-SC
source:       APNIC

6 March: Spamcop reports added to respective sections, Its seems safe to say that Bob 'loves' Trojan.Spybot, a song too here (thanks Basault) - if you want it removed its no problem

4 March: Hell Im getting Soloway Jetlag! - imagine if i got airmiles ...

India and Czech now, Poland reportely 'dead' - Thanks 'E' - 

sleazy countries 'hosting' Bob websites are still up -

Hi India http://210.7.70.150/broadcastemail/ welcome to the club Bishwo Chhetri & DIRECT INTERNET LTD.

inetnum:      210.7.64.0 - 210.7.95.255
netname:      DIL
descr:        DIRECT INTERNET LTD.
descr:        42 Dakshineshwar
descr:        10 Hailey Road
descr:        New Delhi - 110 001
country:      IN
admin-c:      YK161-AP
tech-c:       BC176-AP
remarks:      FOR SPAM & SECURITY INCIDENTS,
remarks:      SEND EMAIL TO - abuse@primus-india.com
mnt-by:       APNIC-HM
mnt-lower:    MAINT-IN-DIL
changed:      hm-changed@apnic.net 20020517
status:       ALLOCATED PORTABLE
source:       APNIC

person:       Yashpal Kapoor
nic-hdl:      YK161-AP
e-mail:       ykapoor@primus-direct.com
address:      42/10, Hailey Road,
address:      New Delhi - 110001
phone:        +91.11.2373.7270
fax-no:       +91.11.2373.7280
country:      IN
remarks:      FOR SPAM & SECURITY INCIDENTS,
remarks:      SEND EMAIL TO - abuse@primus-direct.com
changed:      bchhetri@primus-direct.com 20031001
mnt-by:       MAINT-IN-DIL
source:       APNIC

person:       Bishwo Chhetri
nic-hdl:      BC176-AP
e-mail:       bchhetri@primus-direct.com
address:      274, Captain Gaur Marg,
address:      Sriniwaspuri, New Delhi
address:      110 065, India.
phone:        +91-11-2692-4281
fax-no:       +91-11-2692-4278
country:      IN
remarks:      FOR SPAM & SECURITY INCIDENTS,
remarks:      SEND EMAIL TO - abuse@primus-direct.com
changed:      bchhetri@primus-direct.com 20031001
mnt-by:       MAINT-IN-DIL
source:       APNIC

Czech (eu) now meet  http://62.204.237.170/broadcastemail/

:         62.204.236.0 - 62.204.237.255
netname:         TTN-THSOFT-NET1
descr:           THSOFT  network
country:         cz
admin-c:         JS3270-RIPE
tech-c:          TH101-RIPE
status:          ASSIGNED PA 
mnt-by:          CZTTNET-MNT
source:          RIPE # Filtered

person:          Jiri Stefek
address:         TTNET s.r.o.
              Raisova 232
              Zamberk 564 01
phone:           +420465612567
fax-no:          +420465612567
e-mail:          jirka@tyhan.cz
nic-hdl:         JS3270-RIPE
mnt-by:          CZTTNET-MNT
remarks:
source:          RIPE # Filtered

person:          Tomas Holenda
address:         TTNET s.r.o.
              Raisova 232
              Zamberk 564 01
phone:           +420465612567
fax-no:          +420465612567
e-mail:          tomas@thsoft.cz
nic-hdl:         TH101-RIPE
mnt-by:          CZTTNET-MNT
source:          RIPE # Filtered

% Information related to '62.204.224.0/19AS34040'

route:           62.204.224.0/19
descr:           TTNET Route
origin:          AS34040
mnt-by:          CZTTNET-MNT
source:          RIPE # Filtered

Now poland too  and Polish Telecom !-!-!-!-! to you to

http://83.17.42.146/broadcastemail/  (apparently Dead saturday pm)

inetnum:         83.0.0.0 - 83.31.255.255
org:             ORG-PT1-RIPE
netname:         PL-TPSA-20031203
descr:           Polish Telecom
descr:           PROVIDER Local Registry
country:         PL
admin-c:         KP21-RIPE
admin-c:         TK569-RIPE
admin-c:         JS1838-RIPE
tech-c:          TPHT
status:          ALLOCATED PA 
remarks:         In case of abuse contact abuse@telekomunikacja.pl
mnt-by:          RIPE-NCC-HM-MNT
mnt-lower:       TPNET
mnt-lower:       AS5617-MNT
mnt-routes:      AS5617-MNT
source:          RIPE # Filtered

organisation:    ORG-PT1-RIPE
org-name:        Polish Telecom
org-type:        LIR
address:         Nowogrodzka 47A
address:         00-695
address:         Warszawa
address:         Poland
phone:           +48 22 625 74 96
phone:           +48 44 4480030
fax-no:          +48 22 625 23 83
fax-no:          +48 44 47 35 72
admin-c:         KP21-RIPE
admin-c:         JS1838-RIPE
admin-c:         TK569-RIPE
admin-c:         TW880-RIPE
admin-c:         EHD2-RIPE
mnt-ref:         TPNET
mnt-ref:         RIPE-NCC-HM-MNT
mnt-by:          RIPE-NCC-HM-MNT
source:          RIPE # Filtered

role:            TP S.A. Hostmaster
address:         TP S.A. "POLPAK"
address:         ul. Nowogrodzka 47A
address:         00-695 Warszawa
address:         Poland
phone:           +48 22 6252383
fax-no:          +48 22 6225182
remarks:         trouble:      Network problems: hostmaster@tpnet.pl
remarks:         trouble:      Abuse and spam notification: abuse@telekomunikacja.pl
remarks:         trouble:      DNS problems: dns@tpnet.pl
remarks:         trouble:      Routing problems: registry@tpnet.pl
admin-c:         TK569-RIPE
tech-c:          TK569-RIPE
tech-c:          JS1838-RIPE
nic-hdl:         TPHT
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
remarks:         Please send spam and abuse notification only to abuse@telekomunikacja.pl
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
mnt-by:          TPNET
source:          RIPE # Filtered
abuse-mailbox:   abuse@telekomunikacja.pl

person:          Tomasz Kielb
address:         TP S.A. - POLPAK
address:         ul. Nowogrodzka 47A
address:         00-695 Warszawa
address:         POLAND
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
remarks:
remarks:         In case of abuse (intrusion attempts, hacking,
remarks:         spamming or other unaccepted behavior) from
remarks:         TP S.A. address space, please contact only to:
remarks:
remarks:         abuse@tpnet.pl
remarks:
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
phone:           +48 800 120 810
phone:           +48 800 120 811
fax-no:          +48 22 5230178
nic-hdl:         TK569-RIPE
mnt-by:          TPNET
source:          RIPE # Filtered

person:          Jaroslaw Salamon
address:         TP S.A. -POLPAK
address:         ul. Nowogrodzka 47A
address:         00-695 Warszawa
address:         POLAND
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
remarks:
remarks:         In case of abuse (intrusion attempts, hacking,
remarks:         spamming or other unaccepted behavior) from
remarks:         TP S.A. address space, please contact only to:
remarks:
remarks:         abuse@telekomunikacja.pl
remarks:
remarks:         ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
phone:           +48 800 120 810
phone:           +48 800 120 811
fax-no:          +48 22 5230178
nic-hdl:         JS1838-RIPE
mnt-by:          TPNET
source:          RIPE # Filtered

person:          Konrad Plich
address:         TP S.A. CST POLPAK
address:         ul. Sienkiewicza 9
address:         97-300 Piotrkow Tryb.
address:         Poland
remarks:         ---------------------------------------------
remarks:         In case of abuse (intrusion attempts, hacking,
remarks:         spamming or other unaccepted behavior) from
remarks:         TP S.A. address space, please mail only to:
remarks:         abuse@tpnet.pl
remarks:         ----------------------------------------------
phone:           + 48 44 6480030
fax-no:          + 48 44 6473572
nic-hdl:         KP21-RIPE
mnt-by:          AS5617-MNT
source:          RIPE # Filtered

 Email to uskia - (internal link) no reply yet 'but fingers crossed'
 ....  and thanks to 'E' - China and Italy Bob websites

'broad' - seems to be new so is ztjm.com  > broad.ztjm.com

  Domain Name: ZTJM.COM
   Registrar: BIZCN.COM, INC.
   Whois Server: whois.bizcn.com
   Referral URL: http://www.bizcn.com
   Name Server: NS5.CNMSN.NET
   Name Server: NS6.CNMSN.NET
   Status: REGISTRAR-LOCK
   Updated Date: 24-mar-2005
   Creation Date: 24-mar-2005
   Expiration Date: 24-mar-2006

China = spam freindly folks - hangzhou ztjm co.,ltd. Yongqiang Qian myqyq@yahoo.com.cn 0571-28819615 fax: 0571-28812367 hz hz zj 310000 cn

And Italy time (geocites redirects) meet http://62.149.193.221/broadcastemail/ - 'killed' by out Italian friends in a few hours  nice quick termination Italy !.

inetnum:         62.149.192.0 - 62.149.223.255
netname:         TECHNORAIL-NET
descr:           Technorail srl
descr:           Internet Service and Access Provider
country:         IT
admin-c:         SC279-RIPE
tech-c:          SC279-RIPE
status:          ASSIGNED PA 
mnt-by:          TECHNORAIL-MNT
source:          RIPE # Filtered

person:          Stefano Cecconi
address:         Aruba S.p.A.
address:         Piazza Garibaldi 8
address:         52010 soci (AR)
phone:           +39 0575 51571
fax-no:          +39 0575 561831
e-mail:          hostmaster@technorail.com
nic-hdl:         SC279-RIPE
source:          RIPE # Filtered

% Information related to '62.149.128.0/17AS31034'

route:           62.149.128.0/17
descr:           Technorail S.r.l. - Aruba.it
origin:          AS31034
mnt-by:          TECHNORAIL-MNT
source:          RIPE # Filtered

'E' reports that some geocities sites are also apparently down - .se and .ru - but Ive not bothered to check.
Once you host Bob, you stay in the list. - theres got to be some 'fame' for hosting Robert Soloway.

3 March: meet a dumb isp - and a dumb scheme to stop spam - it wont stop Bob - trust me.

2 March: Let introduce 'the its got a virus section' Getting a numbe rof cc'ed spamcop reports and not to confuse its origin, from the spams we get its going get its on section

ip 211.200.129.39 has MIME-tools 4.104 (Entity 4.116) seems to have the  Trojan.spybot virus

211.33.79.125 has Mutt/1.5.1i seems to have the  Trojan.spybot virus
221.139.207.34 has Sylpheed version 0.8.2 (GTK+ 1.2.10; i586-alt-linux) 
seems to have the  Trojan.spybot virus

Are you thinking what im thinking ? no then take a peek.

1 March: In following up on how did the spam get there (see below entry) I have added a column to the domain roles spamed with Bob Soloways spam  table, should it be easy to 'match' then i will indicate how the spam was delivered by our esteemed spammer.

During a rather dull day doing some non productive office nonsense, I went onto one of those high school friend finder sites, nothing 100% definitive but this chap hits our profile pretty close not many Soloways aged '26'  can you do better ?  drop me a line ?
 
Robert Soloway     Cotati CA     26    
Robert Soloway     Rohnert Park CA     26    

So I think I know where he might have gone to school.

RANCHO BODEGA SCHOOL
8297 OLD REDWOOD HWY
COTATI CA

or in the Rohnert Park area

BEREAN BAPTIST CHRISTIAN ACADEMY
CONSECUTIVE INSTRUCTIONS SCH
DEFOREST HAMILTON JUV HALL SCH
EL CAMINO CONT HIGH SCHOOL
EREAN BAPTIST CHRISTIAN ACADEM
PHOENIX HIGH SCHOOL
RANCHO COTATE HIGH SCHOOL
ROHNERT PARK COMMUNITY SCHOOL

The Pheonix high school had some members but  the others did not have much of a membership, if somebody a little more local than I am could dig (1996-1998) then it might be worthwhile persuing - might be wrong but I'd love a mugshot of Bob to put here.

Move to another website (thanks for the tip off) say hi to Fredrik Skold and http://62.119.28.243/broadcastemail/

inetnum:         62.119.28.0 - 62.119.28.255
netname:         FSDATA-NET
descr:           FS DATA
descr:           Uppsala
country:         SE
admin-c:         FS1367-RIPE
tech-c:          FS1367-RIPE
status:          ASSIGNED PA 
mnt-by:          AS8434-MNT
source:          RIPE # Filtered

person:          Fredrik Skold
address:         F S DATA
address:         Box 140
address:         S-265 Astorp
address:         Sweden
phone:           +46 42 57500
fax-no:          +46 42 57575
e-mail:          fredrik@fsdata.se
nic-hdl:         FS1367-RIPE
source:          RIPE # Filtered

% Information related to '62.119.0.0/16AS8434'

route:           62.119.0.0/16
descr:           UTFORS-BLK
origin:          AS8434
member-of:       AS8434:RS-PA-BLK
remarks:         *** Contact abuse@utfors.se regarding ABUSE please! ***
mnt-by:          UTFORS-MNT
source:          RIPE # Filtered

admin note: This page was finally spell checked, bad spelling (mine) starts from here again! 

27 Feb: Thanks for the extra yahoo redirects,  some user agents too report 1 and 2 claim .

Microsoft Internet Mail 4.70.1155  --> Trojan.SpBot
PObox II beta1.0 --> Trojan.SpBot

60.181.144.90, seems to have the  Trojan.spybot virus

From my associates site at http://blog.opsan.com/archive/2005/07/29/1148.aspx leave comments there, or use my contact form I'm easy - but if its got any interest about Bob then we'd love to hear about it, be it unpaid bills, disputes, sex problems etc - if you can point to online court documents/other stuff to back it up even better.

 Talk to Bob, have a desire to know more?

Mr. Soloway ICQ 171-437-039

Robert Alan Soloway with a DOB of 7/10/79 and a California DL of B5133985 has a couple of traffic tickets that show an address of 1547 Upland Pl., Medford, OR 97501, with a license plate of 4AKK886. He also has a speeding ticket from 8/31/01 with the 279 Granite St. address, an Oregon DL of 9678932, and a license plate of ROBCR4 and ROBCR2.

For those of you unable to put the dots together,  Bob had a website in France (using geocites redirects) which got cancelled, and then took up 'house' in russia, but he is spamming from China.  if you can justify using a spambotted pc in china to send spam about spammer with a website in russia (currently) then I salute you.

My view of the matter is - its something only a spammer would do

Now back to 60.181.144.90 - Meet the citizen comrades ...

inetnum:      60.181.0.0 - 60.181.255.255
netname:      CHINANET-ZJ-WZ
country:      CN
descr:        CHINANET-ZJ Wenzhou node network
descr:        Zhejiang Telecom
admin-c:      CZ4-AP
tech-c:       CW27-AP
status:       ALLOCATED NON-PORTABLE
changed:      auto-dbm@dcb.hz.zj.cn 20050429
mnt-by:       MAINT-CHINANET-ZJ
mnt-lower:    MAINT-CN-CHINANET-ZJ-WZ
source:       APNIC

role:         CHINANET ZHEJIANG
address:      No.378 Yan'an Road,Hangzhou,Zhejiang.310006
country:      CN
phone:        +86-571-87080702
fax-no:       +86-571-87027816
e-mail:       antispam@dcb.hz.zj.cn
trouble:      send spam reports to antispam@dcb.hz.zj.cn
trouble:      and abuse reports to antispam@dcb.hz.zj.cn
trouble:      Please include detailed information and times in UTC
admin-c:      CZ61-AP
tech-c:       CZ61-AP
nic-hdl:      CZ4-AP
remarks:      http://www.zjtelecom.com.cn
mnt-by:       MAINT-CHINANET-ZJ
changed:      hjh@dcb.hz.zj.cn 20050914
source:       APNIC

role:         CHINANET-ZJ Wenzhou
address:      No.2-1 Huancheng Road(East),Wenzhou,Zhejiang.325000
country:      CN
phone:        +86-577-88818629
fax-no:       +86-577-88818635
e-mail:       anti_spam@wz.zj.cn
trouble:      send spam reports to anti_spam@wz.zj.cn
trouble:      and abuse reports to anti_spam@wz.zj.cn
trouble:      Please include detailed information and times in UTC
admin-c:      CH117-AP
tech-c:       CH117-AP
nic-hdl:      CW27-AP
mnt-by:       MAINT-CHINANET-ZJ
changed:      master@dcb.hz.zj.cn 20031204
source:       APNIc

Thats not going to be sorted out soon as it is in china.

26 Feb: Vodka time boys and girls ! Bobs gone and got hosting with our friends the Russians - seems  dead now though, A big 'hi' to krsn.ru

All Redirected to:
 http://217.74.161.86/broadcastemail/  (sound familiar)
 
 IP 217.74.161.86    kompas.krsn.ru
 (at krsn.ru / intertax.ru)

IP 217.74.161.86 on intertax.ru

217.74.161.86 PTR record: kompas.krsn.ru
at ns.krsn.ru

inetnum:        217.74.160.0 - 217.74.162.255
netname:        Intertax-Net
descr:          JSC Intertax
descr:          78, K.Marksa st.
descr:          Krasnoyarsk 660049, Russia
country:        RU

route:          217.74.160.0/20
descr:          JSC Intertax - ISP in Krasnoyarsk region of Russia.
descr:          ru.intertax address space

 
25 Feb: Puis j'avoir un certain Spam de Bob de France svp ? or if your english 'ALO ALO we hate Bob' click

Not responding either (either a bob fuckup, or nice kill by friends the French) unseen website but spam report seen - and good enough for me Thanks Tomez for this and the other article

New URL:
http://195.6.54.3/broadcastemail/

IP 195.6.54.3

No PTR records exist for 195.6.54.3
at bow.rain.fr / francetelecom.net

inetnum:      195.6.54.0 - 195.6.54.7
netname:      FR-CIEME-INFORMATIQUE
descr:        CIEME INFORMATIQUE
country:      FR

ASN:         3215
ASN Name:    AS3215 (France Telecom Transpac)

He gets around our Bob.

24 Feb: After emailing child help usa,direct relief international and doctors without borders I've yet to hear anything, so either they don't give a shit, or  never had any donation from Mr Soloway.  Go make up your own mind, or ask the charities yourself

20 Feb: Internet Mail Service (5.5.2650.21) from here - seems to be classed as an 'Exchange Open Proxy' abuse  in Google - Never used a exchange server as an production mail server for obvious reasons. If true then its an illegal use of somebody else's server, and Bob loves Billy Gates products to spam spybots which is funny since the 'spamis' debacle done by Bob and covered here in this page.

The other query I had was for %XMAILER - is ?

xmailer - xmailer.exe - Process Information

  Process File:     xmailer.exe
  Process Name:     123 hidden sender

Description:     xmailer.exe is an advertising program by 123 hidden sender. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.

A further search in Google reveals

Anonymous bulk email software for email marketing, 123 Hidden Sender
Real anonymous bulk email software, Super Email Harvester, extractor, harvester for online advertising, marketing.
www.123hiddensender.com/ 

Download 123 Hidden Sender 3.40 Free Trial - 123 Hidden Sender ...
Download 123 Hidden Sender 3.40 for free - 123 Hidden Sender ends real ANONYMOUS bulk emails.

Comrades search on "123 hidden sender" I rest my case. with this

" Sends absolute ANONYMOUS bulk emails. You won't lose your ISP service. It is trouble free! Your IP will will never be shown in the email headers.

Description

123 Hidden Sender Screenshot
View full-size screenshot

123 Hidden Sender sends absolute ANONYMOUS bulk emails. You won't lose your ISP service. It is trouble free! Your IP address will not be shown in the email headers! All you do is input your message, subject, and email addresses, and then 123 Hidden Sender does all the rest. No relays to deal with anymore. No need for expensive bulk ISPs. Port 25 is not a problem.

123 Hidden Sender is a anonymous bulk email software program based on a unique know-how sending technology. It provides real anonymous instant delivery - you can use your regular Internet connection because your IP address will never be shown in the email headers.

faq of bulk email software. Frequesntly Asked Questions of 123 Hidden Sender
faq of bulk email software. Download the help document of 123 Hidden Sender
faq of bulk email software. Order 123 Hidden Sender NOW!

Feature and Benefits

Send absolute ANONYMOUS bulk emails. Real anonymous (using proprietary proxy routing - the next wave in bulk email stealth technology, New technology, not a conventional port 25 mailer). You will not lose your ISP service. Your IP will will never be shown in the email headers.
Sending speed depends on your connection only (thread count control - up to 500).
Lowest prices.
Free client software.
All required data client software retrieves from our center automatically (no more hunting for relays or paying hundreds ofdollars for open relays).
No port 25 needed (not affected by port 25 blocking ISPs).
No SMTP servers needed.
Free support, Free upgrade. "

The pot calls the kettle black.

18 Feb: Off topic humour to start with from our spammy friends at Roach Runner (rr.com) - it made me smile

[Note added by 24.170.23.242 (cpe-24-170-23-242.jam.res.rr.com)]
I don't know why we were contacted about this. I can't seem to find any info on your page that relates to us. Our company is telebay.com -- and when I did a control F on your page and searched for "telebay" I couldn't find it. I see a bunch of other posts about other websites and spam issues, but not ours.

On another note:

1) Telebay does not even utilize emailing as part of our marketing efforts. The only people we send email to would be our affiliates, and this is about to be changed to a RSS feed, instead.

2) If any spam was sent, it could only be one of our affiliates violating our strict NO SPAM POLICY. If you have anything to report, please let us know the affiliate's ID. This can be found immediately after the URL the affiliate would be marketing, such as either of these two examples:
* http://www.telebay.com/IDhere
* http://www.telebay.com/IDhere/page.html

Being serious again: Der where rr users - and naturally stupid.

From a list of emails for Bobs list and the emailer iding itself as

MIME-tools 5.503 (Entity 5.501)
Mozilla 4.61 [en]C-CCK-MCD C-UDP; (Win98; I)
Sylpheed version 0.8.2 (GTK+ 1.2.10; i586-alt-linux)

seen here  yet to id these

Internet Mail Service (5.5.2650.21)
%XMAILER

Im sure something will 'popup'.

17 Feb: Remote News Bobs moving (yes again)

More Geocities(au) redirects:- http://210.66.241.1/broadcastemail/

Meet some of Bob's friends again in Taiwan.

Last there on the 4th Feb 2006 same ip too and active again,  My 'blindness' to getting Bobs stuff is beginginning to irritate me - perhaps when I hit 1000 spams, or do a years worth of spam here my 'eye sight' will return.

To my other mutual 'friend' Max who works with the commision in Seattle - did you sell me out ? or are you working both sides ? For the record your not the 'Better Business Bureau' but if you make me think about doing that your organisation should be reclassified then I will be happy to.

You know the routine.

inetnum:      210.66.0.0 - 210.66.255.255
netname:      SEEDNET
descr:        Digital United Inc.
descr:        9F, No. 125, Song Jiang Road
descr:        Taipei, Taiwan
country:      TW
admin-c:      CY74-AP
tech-c:       CY74-AP
mnt-by:       MAINT-TW-TWNIC
changed:      hostmaster@twnic.net 20000113
changed:      hm-changed@apnic.net 20021219
status:       ALLOCATED PORTABLE
source:       APNIC

person:       Chyi-Chuan Yang
nic-hdl:      CY74-AP
e-mail:       ccyang@du.net.tw
address:      9F, 125, song jiang road
address:      Taipei, 104, R.O.C
phone:        +886-2-2737-7298
fax-no:       +886-2-2739-7512
country:      TW
changed:      hostmaster@twnic.net.tw 20050531
mnt-by:       MAINT-TW-TWNIC
source:       APNIC

inetnum:      210.66.240.0 - 210.66.241.255
netname:      SEEDNET-NET
descr:        Digital United Inc.
descr:        9F, No. 220, Gangchi Road,Taipei 114, Taiwan, R.O.C.
descr:        Taipei Taiwan
country:      TW
admin-c:      RN472-TW
tech-c:       RN472-TW
mnt-by:       MAINT-TW-TWNIC
remarks:      This information has been partially mirrored by APNIC from
remarks:      TWNIC. To obtain more specific information, please use the
remarks:      TWNIC whois server at whois.twnic.net.
changed:      michaelc@du.net.tw 20040827
status:       ASSIGNED NON-PORTABLE
source:       TWNIC

person:       Seednet Seednet
address:      Seednet
address:      TAIPEI
address:      N/A Taiwan
country:      TW
phone:        +886-2-0800-073330
e-mail:       root123@seed.net.tw
nic-hdl:      RN472-TW
changed:      hostmaster@twnic.net 20020124
source:       TWNIC

16 Feb: Charity Time boys and girls, for those of you who really 'read' the Soloway spams will notice that there are a  lot of charities listed

For your benefit I have gone and done some 'Googling' and put in the the urls, these are perhaps charities you might like to avoid donating to,  Some of these are large organisations. A lot of these take credit cards via websites for what its worth,  so may means that the donation was for not a lot and the charity mention means absolutely nothing as well

Questions I like to know include:

1. how large the donation was,
   
2. or if Bob really donated to them
3. and do they approve of being listed in a Bob Soloway spam 
   
   

is something i will be asking each charity listed.  When time permits, should they respond i will put the answer here, or if you can find out as well so much the the better

Thats a strange list of organisations Bobs claimed to spammed for most appear to be 'dead' in internet space as of writing this, or very 'local' to Washington State. 

child help usa,  http://www.childhelpusa.org/ 'e'
direct relief international http://www.directrelief.org/ 'e'
doctors without borders, http://www.doctorswithoutborders.org/ 'e'

list 2
only 'kia' looks like its working - 6/1 failure rate ? when you use Bob ? make up your own mind.

administrative note: I'm getting reports from other now text denoting remote observation will be shown by using the red colour

14 Feb: Thank goodness Valentines day is over - my spam load should contain more warez mircosoft offerings  than fake 'potions'

This is to confirm this entry (9 feb), A friend sent me this, - I am still looking forward to my own personal copy though (line breaks mine, http url links removed.)

EMAIL ADVERTISE YOUR SITE TO 3,000,000 INTERNET USERS FOR FREE

http://securesite.odo.com.cn


------ ----- ---- --- -- -  -

..for all charity/non-profit organization contacts...

..as a new year thank you to the world and all the good that nonprofits 
and charities are doing to assist society, our corporation is doing what it 
can to help and has decided to give away a non-commercial email sending 
service without cost to charities and nonprofits in need, which is the primary 
and only purpose of this non-commercial email.

simply visit our company web site above, fill out any of the order 
forms on the web site with your nonprofit/charity contact details, but do not press 
submit. instead, print out what is displayed on the screen and send a letter to 
the mailing address on our company web site above with your nonprofit/charity 
mission 
statement, a copy of the paperwork from your governmental authority 
confirming your nonprofit/charity status in your city/state/province/country of 
origin enclosed, and we will then contact you with all you need to know to have your 
special non-commercial, non-transactional, non-relationship, courtesy 
charity/nonprofit emailing message sent out to 3 million people without cost.

this non-commercial, non-transactional, non-relationship, courtesy 
emailing has an important primary purpose of helping society by assisting nonprofits 
and charities have their nonprofit/non-commercial mission statement/special 
message/web site sent out to a large number of emails as a courtesy to help worldwide in 
national & global relief efforts for various causes in need of non-commercial, 
non-transactional, non-relationship support.

thanks to the technology of email, here are only a few of the countless 
chrities & nonprofit organizations we have countributed to in the past year: 
adventist develop & relief agency international, child help usa, direct relief 
international, doctors without borders, episcopal relief and development, international medical corps, 
mercy corps, operation usa, red cross hurricane relief division, red cross 
washington state chapter,  the salvation army, among countless others in need of global 
assistance. 

on one day alone at our organization, six nonprofits/charities 
responded to one of our nonprofit emailings and then subsequently received their noncost, 
non-commercial emailing without charge to them: america remembers: killed in action 
foundation, his grace: evangelistic ministries, north valley aikikai: aikido education 
academy, lars ranch: abused children's sanctuary, musici europae: classic music foundation, 
coleman broadcasting: youth education network . we hope to assist countless 
nonprofits and charities have their special non-commercial email sent out in 2006. 
Help us fulfill our goal, in that we believe emailing can be a beneficial worldwide 
contribution to millions. 

disclaimer: please note that this non-commercial, non-transactional, 
non-relationship email originated from a computer outside of the united states of 
america by a citizen of a foreign country and obeys all non-commercial email laws of the 
country of the citizen that initated this non-commercial email that does not offer any product 
or service available for purchase/lease/trade/barter for any commercial nature of 
any kind. 

if you are not associated with a nonprofit/charity and/or this is not a 
nonprofit/charity contact email address and/or you are not interested in our occassional 
non-commercial, non-transactional, non-cost, non-relationship, courtesy emailings we 
perform to assist various nonprofits and charities interesting in sending out their 
special non-commercial message and/or non-commercial web site, press the delist option at our 
company web site at http://broadcastemailcorp.odo.com.cn

Starting to write a new intro section here  

13 Feb: Rumours true ? I make no comment, just pass along

Re: Soloway spamming again...www.ottislan.com
From: davesjunk1<nospam>@gmail.com
Date: Sunday 12 February 2006 07:02:05
Groups: news.admin.net-abuse.email

Hi,
Maybe this is the wrong place for this but I found the newsgroup
through a search on ottislan.com

I'm the poor fool who's credit card info was stolen and used to
register www.ottislan.com and (12) other sites at www.bookyourname.com.

The registrar has not responded to any of my emails, faxs, or phone
calls about canceling these registrations.

ICANN and Versign have not been much help either and referred me back
to www.bookyourname.com

My question is how do I have the WHOIS info corrected. I have already
reported the errors on ICANN's website

Other question is how do I find out what other sites were reqistered in
my name.

Any help is appreciated
Thanks,
David

whois ottislan.com

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Domain Name: OTTISLAN.COM
   Registrar: ONLINE SAS
   Whois Server: whois.bookmyname.com
   Referral URL: http://www.bookmyname.com
   Name Server: NS0.SIMPLELOO.COM
   Name Server: NS0.ALBEITI.COM
   Status: ACTIVE
   Updated Date: 07-feb-2006
   Creation Date: 06-feb-2006
   Expiration Date: 06-feb-2007


>>> Last update of whois database: Sun, 12 Feb 2006 02:41:17 EST <<<
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
%% BookMyName Whois version 1.0
%%
%% NOTICE: Access to this information is provided to assist persons
%% in determining the contents of a domain name registration record in
%% our database. The data in this record is provided by BookMyName for
%% informational purposes only.
%% You agree that you will use this data only for lawful purposes and
%% that, under no circumstances will you use this data to: (a) allow,
%% enable, or otherwise support the transmission by e-mail, telephone, or
%% facsimile of mass unsolicited, commercial advertising or solicitations
%% to entities other than the data recipient's own existing customers;
%% or (b) enable high volume, automated, electronic processes that
%% send queries or data to the systems of Registry Operator or any
%% ICANN-Accredited Registrar, except as reasonably necessary to register
%% domain names or modify existing registrations.
%% All rights reserved. BookMyName reserves the right to modify these
%% terms at any time. By submitting this query, you agree to abide by
%% this policy.
DOMAIN
Domain Name       : ottislan.com (OTTISL2-BMN-DOM)
Registrar         : BookMyName
Whois Server      : whois.bookmyname.com
Referral URL      : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
David STYNES (STYNES2-BMN-PE)

 30 cameron ave

 02140 cambridge
 UNITED STATES MA
 phone            : 7816469250
 fax              :
 e-mail           : trancettee@yahoo.com


Billing Contact   :
PERSON
David STYNES (STYNES2-BMN-PE)

 30 cameron ave

 02140 cambridge
 UNITED STATES MA
 phone            : 7816469250
 fax              :
 e-mail           : trancettee@yahoo.com


Technical Contact :
PERSON
David STYNES (STYNES2-BMN-PE)

 30 cameron ave

 02140 cambridge
 UNITED STATES MA
 phone            : 7816469250
 fax              :
 e-mail           : trancettee@yahoo.com


Domain servers    :
ns0.simpleloo.com (NSC167-BMN-HST)

ns0.albeiti.com (NAC193-BMN-HST)


Created on 02/06/2006 20:21:08
Updated on 02/07/2006 13:16:20
Expires on 02/06/2007 15:21:08

9 Feb: Rumours of movement to http://securesite.odo.com.cn from broadcastemailcorp.odo.com.cn (internal page link) Not had one yet - but i am looking forward to it.

7 Feb: From spam 906 (how they fly by)

SmartMailer Version 1.56 -German Privat License-

Bob seems to changed 'anonymous' remailers, (perhaps the demo time on the shareware was up?) see 6 feb 2006 those of you with a political bone in your body will find this ironic - imagine for a moment that you trade with the chinese government and its agents in the telecom industry there, but you use a private anonymous remailer as well, so Bob on one hand is saying any political expression (or religious) is ok, but then supports they very same people in China that repress the said individuals above.

Thats 'Class' Bob, I hope you too see the irony

This actually gets even better for the con men (virus writers) wrote a description of it:

This also means Bob is still using botnet pc's

Trojan.SpBot

Trojan.Spbot is a Trojan horse program that allows a compromised computer to be used as an email relay. Computers compromised in this way are often used to relay spam.

Type:	Trojan Horse
Systems Affected:	Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Virus Definitions (LiveUpdate™ Weekly) April 06, 2005 Virus Definitions (Intelligent Updater) April 05, 2005

Wild Number of infections: 0 - 49 Number of sites: 0 - 2 Geographical distribution: Low Threat containment: Easy Removal: Moderate

Threat Metrics Wild: Low Damage: Medium Distribution: Low

Damage

• Payload Trigger: n/a
• Payload: Acts as a spam relay.
  • Large scale e-mailing: n/a
  • Deletes files: n/a
  • Modifies files: n/a
  • Degrades performance: n/a
  • Causes system instability: n/a
  • Releases confidential info: n/a
  • Compromises security settings: Lowers security settings by modifying registry entries.

Distribution

• Subject of email: n/a
• Name of attachment: n/a
• Size of attachment: n/a
• Time stamp of attachment: n/a
• Ports: UDP port 256
• Shared drives: n/a
• Target of infection: n/a

When the Trojan is executed, it performs the following actions:

1. Creates the following file:
   
   %System%\smp.dll
   
   Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
   
   
2. Adds the value:
   
   "(Default)" = "%System%\smp.dll"
   
   to the registry subkey:
   
   HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0211C4D9-BC71-8916-38AD-9DEA5D213614}\InProcServer32
   
   so that Trojan.Spbot is loaded into Windows Explorer every time Windows starts.
   
   
3. Adds the value:
   
   "{0211C4D9-BC71-8916-38AD-9DEA5D213614}" = "OLE Module"
   
   to the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
   
   so that Trojan.Spbot is loaded into Windows Explorer every time Windows starts.
   
   
4. Modifies the value:
   
   "DoNotAllowXPSP2" = "1"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
   
   to lower security settings.
   
   
5. Modifies the values:
   
   "AntiVirusDisableNotify" = "1"
   "FirewallDisableNotify" = "1"
   "AntiVirusOverride" = "1"
   "FirewallOverride" = "1"
   "UpdatesDisableNotify" = "1"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
   
   to lower security settings.
   
   
6. Modifies the value:
   
   "AUOptions" = "1"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
   
   to lower security settings.
   
   
7. Modifies the value:
   
   "EnableFirewall" = "0x0"
   
   in the registry subkeys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
   
   to disable the Microsoft firewall.
   
   
8. Modifies the value:
   
   "Start" = "4"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
   
   to disable the Microsoft Security Center.
   
   
9. Modifies the values:
   
   "1001" = "1"
   "1004" = "1"
   "1200" = "0"
   "1809" = "3"
   
   in the registry subkeys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
   
   to lower security settings.
   
   
10. Sends notifications of its status via the following URLs:
    
    
    • rsp.btthost.com/alive.php
    • rsp.btthost.com/inst.php
    • rsp.btthost.com/report.php
    • rsp.btthost.com/num.php
    • rsp.btthost.com/resend.php
    • rsp.btthost.com/task.php
      
      
11. Opens a back door on UDP port 256.
    
    
12. Works as an email relay for SPAM.
    
    
13. Uses a randomly created sender address from one of the following domains:
    
    
    • @yyhmail.com
    • @wongfaye.com
    • @wartaponsel.com
    • @ultrapostman.com
    • @u2club.com
    • @tlcfan.com
    • @tenchiclub.com
    • @surfy.net
    • @southparkmail.com
    • @shaniastuff.com
    • @sammimail.com
    • @roxette.org
    • @rickymail.com
    • @ranmamail.com
    • @qdice.com
    • @purinmail.com
    • @otakumail.com
    • @norikomail.com
    • @nctta.org
    • @myfunnymail.com
    • @malaysia.net
    • @lovecat.com
    • @lopezclub.com
    • @lissamail.com
    • @leonlai.net
    • @kichimail.com
    • @kellychen.com
    • @jpopmail.com
    • @hingismartina.net
    • @grungecafe.com
    • @fffan.com
    • @dogmail.org
    • @chocofan.com
    • @celineclub.com
    • @britneyclub.com
    • @boyzoneclub.com
    • @badtzmail.com
    • @backstreetboysclub.com
    • @amuromail.com
    • @amuro.net
    • @amrer.net
    • @allsaintsfan.com
    • @aaronkwok.net
    • @168city.com
    • @zipolite.com
    • @zapopan.com
    • @veracruz-llave.com
    • @ustedopina.com
    • @universo.com
    • @tuxtla.com
    • @tlaxcala.com
    • @tepasasdeveras.com
    • @tegucigalpa.com
    • @tamaulipas.com
    • @surrealismo.com
    • @surfeador.com
    • @supersonicos.com
    • @superdirectorio.com
    • @sexxxo.com
    • @sanluis.com
    • @saladeprensa.com
    • @rotario.com
    • @regiomontano.com
    • @rdominicana.com
    • @radiomexico.com
    • @radioactivo.com
    • @quintanaroo.com
    • @queretaro.com
    • @puertorrico.com
    • @puebla.com
    • @programador.com
    • @postaldigital.com
    • @pormexico.com
    • @picanteperosabroso.com
    • @osopanda.com
    • @ondagrupera.com
    • @oficinadecorreo.com
    • @nuevoleon.com
    • @notimexico.com
    • @nayarit.com
    • @mundoanimal.com
    • @morelos.com
    • @michoacan.com
    • @mexxxico.com
    • @mejico.com
    • @m3xico.com
    • @lujuria.com
    • @lapalabra.com
    • @jerusalen.com
    • @islasmarias.com
    • @infantil.com
    • @ilusionista.com
    • @horafeliz.com
    • @guanajuato.com
    • @guadalupano.com
    • @grandesligas.com
    • @gobiernofederal.com
    • @garzagarcia.com
    • @futbolsoccer.com
    • @futbolamericano.com
    • @fumador.com
    • @filantropia.com
    • @fiestabrava.com
    • @femenino.com
    • @exalumnos.com
    • @esoterico.com
    • @elturista.com
    • @elchavo.com
    • @ejecutivo.com
    • @edomex.com
    • @derechoshumanos.com
    • @deportista.com
    • @depelicula.com
    • @cuernavaca.com
    • @costarrica.com
    • @correo1.com
    • @comidamexicana.com
    • @colima.com
    • @coahuila.com
    • @cinemexicano.com
    • @cienciaficcion.com
    • @chihuahua.com
    • @chido.com
    • @cartonista.com
    • @capitalino.com
    • @busquedas.com
    • @buenhumor.com
    • @billonario.com
    • @belice.com
    • @barriolatino.com
    • @bajacalifornianorte.com
    • @asistencia.org
    • @artesmarciales.com
    • @ardiente.com
    • @anuncia.com
    • @antronomia.com
    • @altacocina.com
    • @alcoholicosanonimos.com
    • @albur.com
    • @alacarta.com
    • @aguascalientes.com
    • @acuario.com
    • @juno.com
    • @pacific.net.hk
    • @worldnet.att.net
    • @mcimail.com
    • @263.net
    • @163.net
    • @libero.it
    • @hot.ee
    • @gmx.de
    • @geocities.com
    • @gateway.net
    • @ns.sympatico.ca
    • @mindspring.com
    • @atlanta.com
    • @cs.com
    • @erols.com
    • @webtv.net
    • @t-online.de
    • @pacbell.net
    • @earthlink.net
    • @usa.net
    • @server.com
    • @server.n@arkansas.net
    • @softhome.net
    • @zzn.com
    • @home.com
    • @compuserve.com
      
      
14. Uses an X-Mailer randomly choosen from the following:
    
    
    • Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1
    • Mutt/1.5.1i
    • Sylpheed version 0.8.2 (GTK+ 1.2.10; i586-alt-linux)
    • Pegasus Mail for Win32 (v2.53/R1)
    • SmartMailer Version 1.56 -German Privat License-
    • MIME-tools 4.104 (Entity 4.116)
    • Calypso Version 3.20.01.01 (4)
    • Mozilla 4.61 [en]C-CCK-MCD C-UDP; (Win98; I)
    • QUALCOMM Windows Eudora Pro Version 4.0
    • The Bat! (v1.51) Educational
    • AOL 6.0 for Windows US sub 10551
    • AOL 7.0 for Windows UK sub 52
    • The Bat! (v1.53d)
    • Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0rc2) Gecko/20020513 Netscape/7.0b1
    • MailGate v3.0
    • The Bat! (v1.60q)
    • Microsoft Internet Mail 4.70.1155
    • Mozilla 4.7 [en] (X11; I; FreeBSD 4.0-20000103-CURRENT i386)
    • Microsoft Outlook Express 4.72.3110.5
    • The Bat! (v1.61)
    • Calypso Version 3.30.00.00
    • PObox II beta1.0
    • AOL 7.0 for Windows US sub 118
    • eGroups Message Poster
    • Microsoft Outlook Express 5.50.4133.2400
    • Microsoft Outlook Express 5.00.2919.6700
    • Internet Mail Service (5.5.2650.21)
    • QUALCOMM Windows Eudora Version 5.1
    • Microsoft Outlook, Build 10.0.2627
    • Microsoft Outlook, Build 10.0.2616
    • Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
    • Microsoft Outlook Express 6.00.2462.0000
    • MIME-tools 5.503 (Entity 5.501)
    • Microsoft Outlook Express 5.00.2615.200
    • Microsoft Outlook Express 6.00.2600.0000
    • The Bat! (v1.52f) Business
    • Microsoft Outlook Express 5.50.4522.1200
      
      
15. Creates the following files from data downloaded from rsp.btthost.com domain:
    
    
    • %temp%\url.sys
    • %temp%\mailz.dat
    • %temp%\tsk.sys
    • %temp%\body.dat
      
      Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).
      
      
16. Uses those files to send spam e-mail then deletes the files.
    
    
17. Attempts to download an additional file from rsp.btthost.com domain to %temp%\file.exe and runs it.