Analysis of sample spam
spamvertizer = hotdogfactory.info
Fri, 21 Nov 2003 11:08:03 +0000
"Paris Hilton Sex Video ewisysdtuelzzblqje"

Here is the spam message, with its links disabled so nobody will accidentally click and end up in spam hell.

From: Cherise Haddad [cherisehaddad_qb@terrific.com]
Sent: Friday, November 21, 2003 5:08 AM
To: siller@ameritech.net
Subject: Paris Hilton Sex Video ewisysdtuelzzblqje
"Paris Hilton is steaming mad over a steamy sex video that may soon go public," her spokeswoman said. The recording was made three years ago while Solomon and Hilton, then 19, were dating, Garber said. "It was for themselves," Garber added. "Not everybody indulges in that, but couples do it sometimes and it's just for themselves, for fun. She never intended for it to be seen by anybody other than the two of them."
Watch it here

sgtbrqcnlnlonktpshtlxikmca yxchsknhenimo uyiaiibbsyhb wrozyudyweql bjfumjjxnj qspzenbxiih zquhohdotu semsvljkxk

(This links to spamhttp://www.wequdncfssukktudabjojvbe.fcnwgouxupqpcyxdfafrclrq.oofjbknjdoctcfmyzdncbjvcjccr.hotdogfactory.info/ -Ed. )

The site has a web form enticing you to sign up in order to see a porno video.  The web form submits your info to spamhttp://www.stiffycash.com/join-bridge.php if you are naive enough to fill in the form.

Here is the header from the spam message

Return-path: <cherisehaddad_qb@terrific.com>
Received: from tcp-daemon.mta10.srv.hcvlny.cv.net by mta10.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
id <0HOP00JL189HOY@mta10.srv.hcvlny.cv.net>
(original mail from cherisehaddad_qb@terrific.com); Fri,
21 Nov 2003 06:08:05 -0500 (EST)
Received: from fanatic.com (ool-18b8a316.dyn.optonline.net [24.184.163.22])
by mta10.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
with ESMTP id <0HOP00JJ388UIU@mta10.srv.hcvlny.cv.net> for
siller@ameritech.net; Fri, 21 Nov 2003 06:08:04 -0500 (EST)
Date: Fri, 21 Nov 2003 11:08:03 +0000
From: Cherise Haddad <cherisehaddad_qb@terrific.com>
Subject: Paris Hilton Sex Video ewisysdtuelzzblqje
To: siller@ameritech.net
Message-id: <b2e401c3b01f$4f3dc11f$b36bce19@kotxyji>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
Content-type: multipart/alternative;
boundary="Boundary_(ID_E8UBWiMsoeIHLhKIGuDLPA)"
X-Priority: 3
X-MSMail-priority: Normal

really from 24.184.163.22 ool-18b8a316.dyn.optonline.net

Here we find "whois" the domain which sponsored the spam (hotdogfactory.info) registered to

This registration is substantially similar to the registrations for the spamvertizing sites freeclicks.biz (see sample spam from them) and ultimatepersonals.biz (see sample spam from them).

Now what IP is the spamvertizer at right now.

11/21/03 06:51:45 dns hotdogfactory.info
Mail for hotdogfactory.info is handled by mail.hotdogfactory.info
Canonical name: hotdogfactory.info
Addresses:
81.180.98.253

And who has the IP block for the spamvertizer registered?

inetnum:      81.180.98.0 - 81.180.99.255
netname:      SC-INFOGATE-TELECOM-SRL
descr:        S.C. Infogate Telecom S.R.L.
descr:        Bd. Constructorilor nr. 20
descr:        Bucuresti, ROMANIA
descr:        phone: +40-21-3126746
descr:        fax: +40-21-3126706
country:      ro
admin-c:      CV529-RIPE
tech-c:       CV529-RIPE
status:       ASSIGNED PA
mnt-by:       AS3233-MNT
mnt-lower:    AS3233-MNT
mnt-routes:   TAXIGRUP-MNT
notify:       domain-admin@rnc.ro
changed:      cristih@rnc.ro 20031111
source:       RIPE

route:        81.180.98.0/24
descr:        NetAccess01
origin:       AS29397
mnt-by:       TAXIGRUP-MNT
changed:      anet@negru.net 20031105
source:       RIPE

person:       Cristian VARVAS
address:      Infogate Telecom SRL
address:      Bd. Constructorilor Nr. 20
address:      Bucuresti, Romania
phone:        +40-1-303-19-47
fax-no:       +40-1-303-19-39
e-mail:       jolly@infogate.ro
nic-hdl:      CV529-RIPE
remarks:      object maintained by ro.rnc local registry
notify:       domain-admin@rnc.ro
mnt-by:       AS3233-MNT
changed:      cristih@rnc.ro 20031113
source:       RIPE