Greetings Jeff:
These are live examples; but it appears the porn spam all follow the same hex (?) directory structure after the domain name.
Hence, wanting a pattern for that purpose.
Thank you.
At 09:15 AM 3/11/2005, you wrote:
On Friday, March 11, 2005, 6:01:58 AM, DNI Department wrote: > However, I did notice in the HTML source code a common theme:
> <IMG > src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/Nf3KZuBf0T/file_name"; > alt="rundowns" border="0"><BR> > <IMG src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/file_name"; border='0'>><BR> > <IMG src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/Y/eZ/file_namef"; > alt="ouch" border="0"><BR>
> <IMG src="http://tatighk.com/ae3019e288e5a5902958a62de/IWutqQ/filename";
border=0>><BR>
> <IMG src="http://tatighk.com/ae3019e288e5a5902958a62de/filename";
> alt="Antipas" border=0><BR>
> <IMG
> src="http://tatighk.com/ae3019e288e5a5902958a62de/fT66kl/KK0tcw71p/filename";
> alt="strengthen" border=0>
> <IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/YriLMz/filename"; border="0">><BR> > <IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/filename"; border='0'>><BR> > <IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/txU/t1q/filename"; border=0>>
These three domains appear to belong to the same spammer. Joker shut down tatighk.com for having an invalid address on the registration, but the other two remain up at Tucows and Primus Domain/Planetdomain.
Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
________________________________________________ Peter M. Abraham Support and Customer Care Department Dynamic Net, Inc. Helping companies do business on the Net 420 Park Road; Suite 201 Wyomissing PA 19610 Toll Free Voice: 1-888-887-6727 International: 1-610-736-3795 FAX: 1-610-736-3798 Support Email: [EMAIL PROTECTED] Company Email: [EMAIL PROTECTED] Web: http://www.dynamicnet.net/ http://www.wemanageservers.com/ ________________________________________________
