Analysis of sample spam
spamvertizer = kellymedz.biz
Sun, 26 Oct 2003 06:24:50 +0000
"Want a larger package uqucfvdchznhndjvsefudmt"

• spamvertizer = vpachka.biz "Thats what i heard"  (also received as "In your neighborhood")
• spamvertizer = spamsraahnet.biz Thur, 16 Oct 2003 "Xanax is ready nowO"  We don't know this was tabfor.biz as the domain was dead by the time we got their, but it looks like his work.
• spamvertizer = hosting4vegas.com & usosdland.biz Fri, 17 Oct 2003 "Che@ting House Wives: Quality Enjoyment for Days & Nights!..." We find this one VERY interesting as it associates the "tabfor.biz" garbage for the first time with a "Cheating House Wives" site, by virtue of having both links in the same spam.  We think Eddy screwed up.
• spamvertizer = kkuoher.biz Sat, 18 Oct 2003 "Xanax now part of the line g89ad23ldlxxf3s6clrf2e3e"
• spamvertizer = osaustech.biz Sat, 18 Oct 2003 "Valium now in the product line gwdahz2q1aagw29p4"
• spamvertizer = osauser.biz Sun, 19 Oct 2003 "Overnight the Valium ic7kfz163vcoe1l8zbrx2b"
• spamvertizer = osausist.biz Sun, 19 Oct 2003 "All Valium 5e9grc2tgk4vg2je"
• spamvertizer = ultraosaus.biz Sun, 19 Oct 2003 "Xanax in your inbox maj6m21rn6s9m1zsn"
• spamvertizer = extrakurasd.biz Sun, 19 Oct 2003 "tOtAl XaNAX 3yxkfs3irydy7d"
• spamvertizer = gojhaus.biz Tuesday, October 21, 2003 "Valium in your inbox kixhch3uk7jhq3"
• spamvertizer = ejdojf.biz Sat, 25 Oct 2003 "Fwd: ValiumOHV"
• spamvertizer = activeosaus.biz Sun, 26 Oct 2003 "Xanax is ready to goKKIYYZ"
• spamvertizer = realpouvr.biz Fri, 31 Oct 2003 "Order some prescription drugs, Zanaflex, zanaflex, viagrast tiwveaunqavldushoqybgjog"

We see from reading NANAE that these domains are the work of Eddy Marin. Ones he recently registered that we haven't seen the spams for yet are:
adosaus.biz casinosaustrai.biz casinosaustraia.biz derosausa.biz dildosaustralia.biz eosaus.biz extraosaus.biz fosaus.biz gasthofgosausee.biz goosaus.biz gosauschmied.biz gosausee.biz hyperosaus.biz interosaus.biz iosaus.biz magliosausage.biz malosaustralia.biz mimosausa.biz myosaus.biz osaus.biz osaus1.biz osausant.biz osausarium.biz osauscentral.biz osaused.biz osausent.biz osausing.biz osausion.biz osausland.biz osausnet.biz osauss.biz osausweb.biz overosaus.biz porcelanosausa.biz preosaus.biz proosaust.biz realosaust.biz sabatinosausage.biz suposaust.biz symosaust.biz techosaust.biz theosaust.biz transosaust.biz vamosausa.biz vosaus.biz

• spamvertizer = freeclicks.biz "You blocked my IM!"
• spamvertizer = ultimatepersonals.biz  Wed, 15 Oct 2003 05:18:11 +0000 "Find the ones that are looking for it hbkefs31brf8bxex8l"
• spamvertizer = hotdogfactory.info  Fri, 21 Nov 2003 11:08:03 +0000 "Paris Hilton Sex Video ewisysdtuelzzblqje" Our theory is that this lure of free pornography is what draws internet users to get their machines infected with the trojan program that turns their machines into spam spewing robots.
• spamvertizer = money-trees.biz Sun, 14 Dec 2003 18:06:58 +0100 "Keep the house payment money instead with the world wide web lvpirqccbzzsqcyccj"

As a result of this web site we are hearing from other domain owners who have also been subjected to having their domain names forged into spam messages from these people.  A partial list of some of the other spamvertizing domains registered to the Frerrics Domains gang includes: easy-loans-now.info fast-loans-now.info freewebtoken.info money-trees.info refi-today.info save-hundreds.info

In most cases, the spamvertizer has registered both a .biz and a .info version of the same domain name.

• spam spamvertizer = lunburrymeds.biz "Upgrade your tool"
• spam spamvertizer = singletonmeds.biz "Bigger Package oyvjwdbpzumucdvjxhawcwuj"
• spam spamvertizer = kellymedz.biz Sun, 26 Oct 2003  "Want a larger package uqucfvdchznhndjvsefudmt"

Spammer also has registered YOURPUBLICDNS.BIZ and runs own DNS servers, one hosted in Brazil and one with servepath.com in California.

spamvertizer = goldfingerrock.biz Sat, 25 Oct 2003 "this is what you wanted naibbvcpnslkquhvjxlbqhi"
spamvertizer = smackonthewall.biz Sat, 25 Oct 2003 "is this you zzmtxahudeyicddsdtdcolvwmm"
spamvertizer = rodotee.biz Sun, 26 Oct 2003 "Get in this way. xvieybdbjnxudtyjfdl"

registro.br
%  The data below is provided for information purposes
%  and to assist persons in obtaining information about or
%  related to domain name and IP number registrations
%  By submitting a whois query, you agree to use this data
%  only for lawful purposes.
%  2003-10-23 22:06:32 (BRST -02:00)

inetnum:      200.217/16
asn:          AS7738
ID abusos:    CGR13
entidade:     Telemar Norte Leste S.A.
documento:    002.558.134/0001-58
responsável:  Marcello Lugon
endereço:     Rua Humberto de Campos, 425, 7º andar
endereço:     22430-190 - Rio de Janeiro - RJ
telefone:     (021) 31311343 []
ID entidade:  MAL516
ID técnico:   CGR13
inetrev:      200.217.168/24
servidor DNS: NS4.TELEMAR.NET.BR 
status DNS:   20/10/2003 AA
último AA:    20/10/2003
servidor DNS: NS2.TELEMAR.NET.BR 
status DNS:   20/10/2003 AA
último AA:    20/10/2003

ID:           CGR13
nome:         Centro de Gerencia de Rede TELEMAR
e-mail:       abuse@TELEMAR.NET.BR
endereço:     Praia de Botafogo, 166, 7 andar
endereço:     22250-040 - Rio de Janeiro - RJ
telefone:     (21) 080028234 []
criado:       05/06/2000
alterado:     13/08/2003

ID:           MAL516
nome:         Marcello Lugon
e-mail:       mlugon@TELEMAR.COM.BR
endereço:     Rua Humberto de Campos, 425, 7º andar
endereço:     22430-190 - Rio de Janeiro - RJ
telefone:     (021) 3131-1343 [-]
criado:       09/10/2000
alterado:     12/09/2002

remarks:     Security issues should also be addressed to
remarks:     nbso@nic.br, http://www.nic.br/nbso.html
remarks:     Mail abuse issues should also be addressed to
remarks:     mail-abuse@nic.br
 
% whois.registro.br accepts only direct match queries.
% Types of queries are: domains (.BR), BR POCs, CIDR blocks,
% IP and AS numbers.