Irishwonder’s Black Hat SEO Blog A blog about blackhat, general SEO issues and other things related to the life on the web

I got a spam email today. Its title looked scary at first glance, all this stuff about PayPal and warning notifications, ya know… But I know better than that so I looked at the full headers and what do I see but:

From: PayPal Security Center
MIME-Version: 1.0
Message-ID:
Received:

* from [62.139.102.34] (helo=62.139.102.34) by *** with smtp (Exim 4.52) id 1FBXDI-00025a-Vc for irishwonder@***.com; Tue, 21 Feb 2006 08:05:57 -0500
* from 42.0.202.114 by ; Tue, 21 Feb 2006 11:05:38 -0200

Reply-To: PayPal
Return-path:
Subject: Warning Notification issued for your account
To: irishwonder@***.com
X-MSMail-Priority: High
X-Mailer: MIME-tools 5.503 (Entity 5.501)
Priority: High Priority 1

I remembered Greg Boser’s (a.k.a. Web Guerilla) post about comment spammers and thought I’d try and see  who the spammer  was and what I can find out using the full headers of this spam message. This is what I digged out in Whois:

The first IP mentioned in the headers:

62.139.102.34

Blacklist Status:	Listed (details)
Record Type:	IP Address
IP Location:	Egypt - Al Qahirah - Cairo - Egynet
Reverse IP:	Web server hosts 1 websites

The blacklist for this IP has two entries, dated today and 2006-02-18. The site hosted on that IP is :

Domain Name:LRCEGYPT.ORG
Created On:10-Dec-2003 13:03:37 UTC
Last Updated On:22-Nov-2005 17:23:33 UTC
Expiration Date:10-Dec-2007 13:03:37 UTC

Blacklist Status: Listed - Cached Today

****
Registrant City:Cairo
Registrant State/Province:Cairo
Registrant Postal Code:12411
Registrant Country:EG

Now, there is no way for me to tell whether it’s these Egyptians spamming me or somebody uses their server as a proxy - but if it was somebody else it still got the Egyptians effectively blacklisted for spam.

Oh yea, and the link in the phishing email (yes that’s what it was of course) was poining at a Korean server… What a collection!

I have been approached by a number of people asking me if I can “spread the word” about their tools if they offer them to me for free. This issue is especially itchy for those tool developers since spam advertising on syndk8 forums is strictly prohibited - the forums are maintained through paid advertising we offer those wishing to display their products in front of a large highly targeted audience that syndk8 members are. However, I thought about all this and decided to come up with this offer. I can review the black hat tools you want to introduce to our community and post my reviews on this blog that is part of the syndk8 web site and is read by many community members as well as other people that come from elsewhere. But bear in mind that I won’t endorse these tools unless I find something really unique and useful about them.

If you’re interested in this offer and wish to discuss the details contact me either through comments here or by emailing irishwonder at irishwonder dot com.