Sponsored by..

Tuesday 5 August 2014

.us scumbag spammers, part 3

These are the same scumbags as found here and here.They are burning through hosting accounts at a fearsome rate. The latest two IPs are in the Worldstream address space:

217.23.14.153
217.23.14.13

Spamvertised domains:

reservenow.enroll-in-medicare-14.us
startnow.protect-your-surface01.us

Sample emails:

From:     enrollment_period.12352763
Date:     5 August 2014 17:32
Subject:     Hey, Medicare Enrollment Begins Soon. Notice #11262474

Notice:  Medicare Open Enrollment Starts Soon
**********************************************************

Medicare Recipient:  [redacted]

Open Enrollment for 2015 Medicare Programs begins October 15, 2014 to December 7, 2014.

You can only change your Medicare or Prescription Drug plan during this Annual Election Period.  .

Find the best, most affordable Medicare plan.

**Aetna, Humana, BlueCross, AARP and more**


Don't Miss Your Chance to Change Plans.  Find the Best Plan & Save up to 40% Online: http://reservenow.enroll-in-medicare-14.us

Notice: 11262474


======================================

From:     Protective.Coating.3879421
Date:     5 August 2014 17:14
Subject:     Re: Garage Floor Coatings before Winter Rain and Snow


-------- Start Notice #3879421 --------------

Surface Protect Plus Summer Savings

Attn: snowshoe2@dynamoo.com

Don't let rain and the coming snow ruin your deck and garage.

Summer is the time to protect your garage and wood floors.

Amazing deal for homeowners looking to preserve their deck and garage surfaces.

Go Here Now to Protect Your Floors for Years and Years: http://startnow.protect-your-surface01.us


--------------- End Notice ----------------

Manage_your_preferences: http://end.protect-your-surface01.us

PO Box: #19258
Falterstrasse., 12 97318--Kitzingen., Germany.
Click paths:

http://reservenow.enroll-in-medicare-14.us/
http://affiliate.adgtracker.com/rd/r.php?sid=7748&pub=331259&c1=exm805
http://www.medicare-providers.net/plans/index.php?Referrer=FM&Subreferrer=331259&Subid=273621705&utm_source=flex&utm_medium=email&utm_content=medicare&utm_campaign=24560

http://startnow.protect-your-surface01.us/
http://silvertrkn.com/?a=125&c=2907&s1=nf805
http://genetix420.com/?a=125&c=2907&s1=nf805&ckmguid=a8d5f09a-ceb2-47ec-9ba7-c4e42fd7afaa
http://www.enzjptkr.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://affiliate.gwmtracker.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://valuedealshopper.com?subid1=200001&subid2=6389

Some of these affiliate networks and sites have no contact details at all, all the other ones have been notified of the problem.

Recommended blocklist (for this spam run and the one earlier today):
217.23.14.153
217.23.14.13
109.201.135.21
109.201.135.35
109.201.135.47
109.201.135.108
109.201.148.11
109.201.148.24
77.93.204.105
enroll-in-medicare-14.us
protect-your-surface01.us
readcriminalsearch.us
pluscarsearch.us
bumpcredit.us
expectlowmortgage.us
citizensmedicare.us
closedfoodstorage.us
silvertrkn.com
genetix420.com
enzjptkr.com
navytrkn.com
autoaffiliatenetwork.com

No comments: