Dallas L. Engelken wrote:
> resend again because SA is bouncing them..
>
>> -----Original Message-----
>> From: Matt Kettler [mailto:[EMAIL PROTECTED]
>> Sent: Tuesday, May 09, 2006 14:51
>> To: Chris Santerre
>> Cc: 'qqqq'; users@spamassassin.apache.org
>> Subject: Re: My only problem with URIBL_BLACK
>>
>> Chris Santerre wrote:
>>>
>>
>> Let's look at their IPs they are hosting their domain from:
>> -----------
>> $ host uhmcargo*MUNGED*.com
>> uhmcargo*MUNGED*.com has address 82.155.56.150
>> uhmcargo*MUNGED*.com has address 83.99.128.137
>> uhmcargo*MUNGED*.com has address 83.213.63.213
>>
>
> FWIW, you just did all the work on the .com, and his email states .net
> ;) appears .com is also bogus, and probably related. webhost also
> appears to agree.
You're right..
Using the .net:
Administrator:
name: Amber Furlong
mail: [EMAIL PROTECTED] tel: +1.6785283829
org: Private person
address: 20222 shadowood parkway
city: Atlanta
,province: GA
,country: UNITED STATES
postcode: 30339
Phone number, and address are consistent (678 is in Georgia)
However, if you do a search on "20222 shadowood parkway" Atlanta you'll find
that this address is a known-offender of money-transfer scams:
http://www.joewein.net/fraud/fraud-job-2006-04.htm
