This one is kind of festive. There's no reverse lookup. The spam is coming from unSWIPed IP addresses in a /18. There's not even any forward lookup for the claimed host names. Normally I wouldn't do this, but these lovely folks are morphing envelope senders, so given the irresponsibility of the ISP with respect to rDNS and SWIP, into the IP address blocks with them.
They're moving around in a largish (/18) block belonging to Tristar communications. If this keeps happening, I'll throw the entire block in.
They've moved again. The whole /18 goes in NOW.
Now they seem to be in bed with Naviant/Market Knowledge. Click here to see the new listing.
Moved again. No SWIP, no whois, no reverse lookups. I'll just block the /32 for now. Latest spam added at end of this page.
Oh yes, they're calling it eScriptions now.
Return-path: <sweetoffers@sweetoffers.artifici.net>
Envelope-to: rwelty@krusty-motorsports.com
Delivery-date: Fri, 22 Nov 2002 01:00:36 +0000
Received: from [66.232.29.153] (helo=mail153.raboof.com)
by krusty1.krusty-motorsports.com with smtp (Exim 4.10)
id 18F2BQ-0001r4-00
for rwelty@krusty-motorsports.com; Fri, 22 Nov 2002 01:00:36 +0000
To: rwelty@krusty-motorsports.com
Date: Thu, 21 Nov 2002 20:04:24 -0500
Message-ID: <1037927064.8616@mail153.raboof.com>
X-Mailer: Mozilla 4.61 [en] (X11; I; Linux 2.2.12-20 i586)
From: SweetOffers<SweetOffers@sweetoffers.artifici.net>
Reply-To: SweetOffers<SweetOffers@sweetoffers.artifici.net>
Subject: Sears Cabinet Refacing: Free Estimate & Save $500*
Mime-Version: 1.0
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<META name=Ad content=LS038XI00181642FD>
<HTML><HEAD><TITLE>Sears Cabinet Refacing Email</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4134.600" name=GENERATOR></HEAD>
<BODY text=#000000 bgColor=#003399 leftMargin=0 topMargin=0 marginheight="0"
marginwidth="0">
<TABLE cellSpacing=0 cellPadding=0 width=500 align=center border=0>
<TBODY>
<TR>
<TD><a href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926"><IMG height=96 src="http://banners.affiliatefuel.com/e/sears/cabinets/new/sears_01.gif"
border=0 width=500></a></TD></TR></TBODY></TABLE>
<TABLE cellSpacing=0 cellPadding=0 width=500 align=center bgColor=#ffffff
border=0>
<TBODY>
<TR>
<TD width=27
background="http://banners.affiliatefuel.com/e/sears/cabinets/new/sears_left.gif"><a href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926"><IMG
height=38 src="http://banners.affiliatefuel.com/e/sears/cabinets/new/sears_left.gif"
border=0 width=27></a></TD>
<TD vAlign=top width="100%">
<TABLE cellSpacing=0 cellPadding=2 width="100%" border=0>
<TBODY>
<TR vAlign=top>
<TD>
<P><FONT face="Arial, Helvetica, sans-serif" size=2>Would you like
to get a brand new kitchen in about 4 to 6 days? You can with
<B>SEARS KITCHEN CABINET REFACING.</B> </FONT></P>
<P><FONT face="Arial, Helvetica, sans-serif" size=2>Choose from
hundreds of decorator styles of cabinet doors, drawer fronts and
hardware. You'll transform your kitchen into the <I>kitchen of your
dreams</I> without the cost, time or mess of total remodeling.
Satisfaction Guaranteed or Your Money Back. Save $500*! </FONT></P>
<P><FONT face="Arial, Helvetica, sans-serif" size=3><B>To find out
more click <A href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926">here</A>!</B></FONT></P></TD>
<TD width=161><a href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926"><IMG height=240
src="http://banners.affiliatefuel.com/e/sears/cabinets/new/before_after.jpg"
border=0 width=180></a></TD></TR></TBODY></TABLE><FONT
face="Arial, Helvetica, sans-serif" size=2><A href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926">Click
here</A> to request a FREE in-home design consultation and estimate.
Respond now and save $500* on Kitchen Cabinet Refacing!</FONT>
<P><FONT face="Arial, Helvetica, sans-serif" size=1>* Offer not valid on
prior sales or in combination with any other offer. Ask your Sears Kitchen
Cabinet Refacing Specialist for details. Kitchen Cabinet Refacing not
available in all areas. Offer available to U.S. homeowners
only.</FONT></P></TD>
<TD width=28
background="http://banners.affiliatefuel.com/e/sears/cabinets/new/sears_right.gif"><a href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926"><IMG
height=46 src="http://banners.affiliatefuel.com/e/sears/cabinets/new/sears_right.gif"
border=0 width=28></a></TD></TR></TBODY></TABLE>
<TABLE cellSpacing=0 cellPadding=0 width=500 align=center border=0>
<TBODY>
<TR>
<TD><a href="http://www.sweetoffers.net/c.asp?LK=19775&EM=18164253&Q=10926"><IMG height=42 src="http://banners.affiliatefuel.com/e/sears/cabinets/new/footer.gif"
border=0 width=500></a></TD></TR></TBODY></TABLE>
<DIV align=center></DIV><!--DISCLAIMER-->
<br>
<center>
<table width="60%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td><font face="Verdana, Arial, Helvetica, sans-serif" size="-2" color="orange"><br>
The preceding message was sent to you as an opt-in subscriber to SweetOffers.
We will continue to bring you valuable offers on the products and services
that interest you most. If you wish to unsubscribe please click here: <a href="http://www.sweetoffers.net/remove.asp?E=rwelty@krusty-motorsports.com"><font color="orange">http://www.sweetoffers.net/remove.asp?E=rwelty@krusty-motorsports.com</font></a><br>
</font></td>
</tr>
</table>
<img src="http://www.sweetoffers.net/o.asp?SC=10639&Q=10926&EM=18164253" width=1 height=1>
</center>
<!--/////18164253///&*to;///54/////-->
<!--DISCLAIMER--></BODY></HTML>
Return-path: <sweetoffers@sweetoffers.passr.net>
Envelope-to: rwelty@krusty-motorsports.com
Delivery-date: Mon, 09 Dec 2002 01:06:53 +0000
Received: from [66.232.53.101] (helo=smtp101.gooberfoob.com)
by krusty1.krusty-motorsports.com with smtp (Exim 4.10)
id 18LCNp-0001YQ-00
for rwelty@krusty-motorsports.com; Mon, 09 Dec 2002 01:06:53 +0000
To: rwelty@krusty-motorsports.com
Date: Mon, 9 Dec 2002 07:09:17 -0500
Message-ID: <1039435757.4981@smtp101.gooberfoob.com>
X-Mailer: Mozilla 4.77 [en] (X11; U; Linux 2.4.6-pre2-xfs i686)
From: SweetOffers<SweetOffers@sweetoffers.Passr.net>
Reply-To: SweetOffers<SweetOffers@sweetoffers.Passr.net>
Subject: Reduce Your Debt in 3 Minutes!
Mime-Version: 1.0
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<META name=Ad content=LS038XI00181642FD>
<HTML>
<HEAD>
<TITLE>Reduce Your Debt In 3 Minutes!</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY HCode="&HCode;" BGCOLOR="#FFFFFF">
<CENTER>
<TABLE HCode="&HCode;" BORDER="0" CELLPADDING="0" CELLSPACING="0">
<TR HCode="&HCode;">
<TD HCode="&HCode;">
<IMG HCode="&HCode;" SRC="http://www.click-on-this.net/cimages/naviantdebt/index_01.jpg" WIDTH="259" HEIGHT="285"></TD>
<TD HCode="&HCode;">
<A HCode="&HCode;" HREF="http://www.sweetoffers.net/c.asp?LK=20618&EM=18164253&Q=11424"><IMG HCode="&HCode;" SRC="http://www.click-on-this.net/cimages/naviantdebt/copy.gif" WIDTH="351" HEIGHT="285" BORDER="0"></A></TD>
</TR>
<TR HCode="&HCode;">
<TD HCode="&HCode;" COLSPAN="2">
<A HCode="&HCode;" HREF="http://www.sweetoffers.net/c.asp?LK=20618&EM=18164253&Q=11424"><IMG HCode="&HCode;" SRC="http://www.click-on-this.net/cimages/naviantdebt/clickhere.gif" WIDTH="610" HEIGHT="30" BORDER="0"></A></TD>
</TR>
</TABLE>
</CENTER>
<!--DISCLAIMER-->
<br>
<center>
<table width="60%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td><font face="Verdana, Arial, Helvetica, sans-serif" size="-2"><br>
The preceding message was sent to you as an opt-in subscriber to SweetOffers.
We will continue to bring you valuable offers on the products and services
that interest you most. If you wish to unsubscribe please click here: <a href="http://www.sweetoffers.net/remove.asp?E=rwelty@krusty-motorsports.com">http://www.sweetoffers.net/remove.asp?E=rwelty@krusty-motorsports.com</a><br>
</font></td>
</tr>
</table>
<img src="http://www.sweetoffers.net/o.asp?SC=11045&Q=11424&EM=18164253" width=1 height=1>
</center>
<!--/////18164253///&*to;///54/////-->
<!--DISCLAIMER--></BODY>
</HTML>
Received: from localhost (127.0.0.1) by skipper.averillpark.net with POP3 for
<postmaster@skipper.averillpark.net>; 19 Mar 2003 06:50:04 -0000
Return-path: <mmbob@es1.2tues5.passr.net>
Envelope-to: rwelty@krusty-motorsports.com
Delivery-date: Wed, 19 Mar 2003 07:40:17 +0000
Received: from [66.101.183.175] (helo=smtp175.gooberboink.com)
by krusty1.krusty-motorsports.com with smtp (Exim 4.14)
id 18vYBN-0001Jj-E9
for rwelty@krusty-motorsports.com; Wed, 19 Mar 2003 07:40:17 +0000
To: rwelty@krusty-motorsports.com
Date: Wed, 19 Mar 2003 01:47:46 -0500
Message-ID: <1048056466.8193@smtp175.gooberboink.com>
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32)
From: Bet On Basketball<mmbob@es1.2tues5.passr.net>
Reply-To: Bet On Basketball<mmbob@es1.2tues5.passr.net>
Subject: $1 Million March Madness Opportunity
Mime-Version: 1.0
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<META name=Ad content=LS059XI00181642FD>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>SportingbetUSA.com</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body leftmargin="0" topmargin="0">
<table width="590" border="1" align="center" cellpadding="0" cellspacing="0" bordercolor="navy">
<tr>
<td>
<table width="590" border="0" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2"><a href="http://www.eScriptions.net/c.asp?LK=29634&EM=18164253&Q=17450"><img src="http://www.sportingbetusa.com/graphics/mail/mail35_head.gif" border="0"></a></td>
</tr>
<tr>
<td width="308" valign="top"><a href="http://www.eScriptions.net/c.asp?LK=29634&EM=18164253&Q=17450"><img src="http://www.sportingbetusa.com/graphics/mail/mail35_mainpic2.jpg" border="0"></a></td>
<td width="282" valign="top"><p align="center"><font size="3" face="Arial, Helvetica, sans-serif" color="#cf0000"><strong>
FREE $1,000,000 Bracket BUSTER</strong></font>
<p align="left"><font size="2" face="Arial, Helvetica, sans-serif"><strong>
</strong></font><font size="2" face="Arial, Helvetica, sans-serif">You
have a shot at <B>$1,000,000</B> with <a href="http://www.eScriptions.net/c.asp?LK=29634&EM=18164253&Q=17450">SportingbetUSA's</a>
<B>FREE</B> College Bracket Buster. Pick all 63 tourney games correctly
and you will walk home with <B>$1,000,000!</B></font>
<p><strong><font size="2" face="Arial, Helvetica, sans-serif" color="#CF0000">Who
will grab the title at the end?</font></strong>
<table width="88%" border="0" align="center" cellpadding="1" cellspacing="1">
<tr bgcolor="#000066">
<td colspan="2"> <div align="center"><font color="#FFFFFF" size="2" face="Arial, Helvetica, sans-serif"><B>ODDS
TO WIN THE NCAA TITLE</B></font></div></td>
</tr>
<tr bgcolor="#CCCCCC">
<td width="61%"><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">Arizona</font></strong></div></td>
<td width="39%"><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">9-2</font></strong></div></td>
</tr>
<tr bgcolor="#eeeeee">
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">Kansas</font></strong></div></td>
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">15-1</font></strong></div></td>
</tr>
<tr bgcolor="#CCCCCC">
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">Florida</font></strong></div></td>
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">12-1</font></strong></div></td>
</tr>
<tr bgcolor="#eeeeee">
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">Kentucky</font></strong></div></td>
<td><div align="center"><strong><font size="1" face="Arial, Helvetica, sans-serif">8-5</font></strong></div></td>
</tr>
</table>
<BR>
<font size="2" face="Arial, Helvetica, sans-serif"><strong>
<div align="center" ><a href="http://www.eScriptions.net/c.asp?LK=29634&EM=18164253&Q=17450" style="color: navy; ">Login
NOW and bet on March Madness!</a></div>
</strong></font></td>
</tr>
</table>
</td>
</tr>
</table>
<P>
</P>
<!--DISCLAIMER-->
<br>
<center>
<table width="60%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td><font face="Verdana, Arial, Helvetica, sans-serif" size="-2"><br>
The preceding message was sent to you as an opt-in subscriber to eScriptions.
We will continue to bring you valuable offers on the products and services
that interest you most. If you wish to unsubscribe please click here: <a href="http://www.eScriptions.net/Remove.asp?E=rwelty@krusty-motorsports.com">http://www.eScriptions.net/Remove.asp?E=rwelty@krusty-motorsports.com</a><br><br>
</font>
<font face="Verdana, Arial, Helvetica, sans-serif" size="-2">To unsubscribe via postal mail, please send request to:<br>
14000 Military Trail #208<br>
Delray Beach, FL 33484</font><br>
</td>
</tr>
</table>
<img src="http://www.eScriptions.net/o.asp?SC=16811&Q=17450&EM=18164253" width=1 height=1>
</center>
<!--/////18164253///&*to;///11/////-->
<!--DISCLAIMER-->
<qwe io urk dfaj;{1162F449-A080-4EA5-8481-3C21E36EF6FE}asdfuil;gjo;ajua>
<uareo dhfla {1162F449-A080-4EA5-8481-3C21E36EF6FE} ksjdflaskdf{{01}djfha>
<ghirpwks 18164253 rwelty@krusty-motorsports.com rwelty@krusty-motorsports.comdmfahls>
<fldak; lu{1162F449-A080-4EA5-8481-3C21E36EF6FE} dfk asj asdlf kja;sdklfj>
<d;argd,aqje ridvap jas df18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pg a;kldh ja; najk ghlkajfh ldk>
<ldoqpea ads d f18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pg a;kldh ja; naj kgh lka jfhldk>
<asd f18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}p ga;kldhja; na jkghlkajfh ldk>
<erfsl;fsu dt r;awei ofj;jk;cmv pd ofji[aq dlakw uertonhf;gaerp>
<sdgfe rogh;adfjaer;{1162F449-A080-4EA5-8481-3C21E36EF6FE}ldkl;as;>
<ewqasdf jkf;lakjdf ;vnlak a;jv;klbvjd;ohiw';wgojk'bam gpja'fkm>
<qiealdjf asdw qweesdf18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pga;kl dhja; najkghlk ajfhldk>
<asdf18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pga;kldhja; najkghl kajfhldk>
<fsdaf{1162F449-A080-4EA5-8481-3C21E36EF6FE}dkl afjaio;rha;lfrwelty@krusty-motorsports.comsad;sdfgktr upgna;lgj>
<ag v;erigl/a; legm jal;k vjal;hjf ;acj;qogjirn/;vamadl;kj>
<dfl; ais fuiwqt[u wjf al;sdk;asdl kfj;a oisdflakaf>
<uareo dhfla {1162F449-A080-4EA5-8481-3C21E36EF6FE} ksjdflaskdf{{01}djfha>
<ghirpwks 18164253 rwelty@krusty-motorsports.com rwelty@krusty-motorsports.comdmfahls>
<asdf18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pga;kldhja; najkghlkajfhldk>
<ljvg arwelty@krusty-motorsports.comasdfa sdf sdfrwelty@krusty-motorsports.com>
<fasfas dfrwelty@krusty-motorsports.comfasegf ava rwelty@krusty-motorsports.comasdfas fadfrwelty@krusty-motorsports.comcv asdf>
<adfads fasdfrwelty@krusty-motorsports.coma sdfa{1162F449-A080-4EA5-8481-3C21E36EF6FE}sdfrwelty@krusty-motorsports.comas>
<dfas dfa rwelty@krusty-motorsports.coma sdfrwelty@krusty-motorsports.com{1162F449-A080-4EA5-8481-3C21E36EF6FE}>
<adnh ghri jmv[aqrgrwelty@krusty-motorsports.com gfas dj;oi rwelty@krusty-motorsports.comgj ajkl;g hn ero uirwelty@krusty-motorsports.com>
<uareo dhfla {1162F449-A080-4EA5-8481-3C21E36EF6FE} ksjdflaskdf{{01}djfha>
<ghirpwks 18164253 rwelty@krusty-motorsports.com rwelty@krusty-motorsports.comdmfahls>
<m;arj bg[agrwelty@krusty-motorsports.comfgak l;gj paiorwelty@krusty-motorsports.comakl;jdf ga l;prwelty@krusty-motorsports.comf;lkag dfo;g>
<klajf sjkahg frwelty@krusty-motorsports.comajklaj gl;kz svj{1162F449-A080-4EA5-8481-3C21E36EF6FE}ajkl;>
<dlfja;fjkasdffjal;kdfjrwelty@krusty-motorsports.com>
<akdl;jf;lak gjav;mkfna;lkgjfg adf;gjk{1162F449-A080-4EA5-8481-3C21E36EF6FE}rwelty@krusty-motorsports.com>
<flkasj asdlf kja;sdklfj>
<iueqalas df18164253{1162F449-A080-4EA5-8481-3C21E36EF6FE}pg a;kld hja; najkg hlkajfh ldk>
<uareo dhfla {1162F449-A080-4EA5-8481-3C21E36EF6FE} ksjdflaskdf{{01}djfha>
<ghirpwks 18164253 rwelty@krusty-motorsports.com rwelty@krusty-motorsports.comdmfahls></BODY>
</html>