this spam was sent to spamtrap address nts-fdjebgbc04e23o03@munged.ext
which decodes to 64.105.27.23 2004-05-23 15:03

Aug 30 07:58:54 www sendmail[32466]: i7UBwm032466: from=<tergnlulrueiu@certifiedmail.com>, size=4058, class=0, nrcpts=1, msgid=<850325410424.22282@tergnlulrueiu@certifiedmail.com>, proto=SMTP, daemon=MTA, relay=84.94.27.28.forward.012.net.il [84.94.27.28]
Aug 30 07:58:55 www sendmail[32468]: i7UBwm032466: ctladdr=<nts-fdjebgbc04e23o03@munged.ext> (8/0), delay=00:00:06, xdelay=00:00:01, mailer=prog, pri=32720, dsn=2.0.0, stat=Sent

[23/May/2004:15:02:49 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /articles/ HTTP/1.1" 200 3140 http://www.munged.ext/stupid/
[23/May/2004:15:02:49 -0400] cw h-64-105-27-23.lsanca54.covad.net "GET /advert/cwlogo.gif HTTP/1.1" 200 3503 http://www.munged.ext/articles/
[23/May/2004:15:02:52 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /cgi-bin/cwcount?d=toastedarticles&c=ib HTTP/1.1" 200 72 http://www.munged.ext/articles/
[23/May/2004:15:02:58 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /articles/disptext/munged.ext_0001 HTTP/1.1" 200 11828 http://www.munged.ext/articles/
[23/May/2004:15:02:59 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /cgi-bin/cwcount?d=toastedarticles&c=ib HTTP/1.1" 200 72 http://www.munged.ext/articles/disptext/munged.ext_0001
[23/May/2004:15:03:39 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /nettest/ HTTP/1.1" 200 9596 http://www.munged.ext/articles/disptext/munged.ext_0001
[23/May/2004:15:03:39 -0400] cw h-64-105-27-23.lsanca54.covad.net "GET /advert/cardshop.gif HTTP/1.1" 200 5183 http://www.munged.ext/nettest/
[23/May/2004:15:03:39 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /cgi-bin/cwcount?d=toastednettest&c=ib HTTP/1.1" 200 71 http://www.munged.ext/nettest/
[23/May/2004:15:10:41 -0400] ts h-64-105-27-23.lsanca54.covad.net "GET /favicon.ico HTTP/1.1" 200 3262 -

  Search results for: 64.105.27.23

OrgName:    Covad Communications
OrgID:      CVAD
Address:    2510 Zanker Rd
City:       San Jose
StateProv:  CA
PostalCode: 95131-1127
Country:    US

ReferralServer: rwhois://rwhois.covad.net:4321

NetRange:   64.105.0.0 - 64.105.255.255
CIDR:       64.105.0.0/16
NetName:    COVAD-IP-1-NET
NetHandle:  NET-64-105-0-0-1
Parent:     NET-64-0-0-0-0
NetType:    Direct Allocation
NameServer: NS3.COVAD.COM
NameServer: NS4.COVAD.COM
Comment:    for abuse issues, please contact abuse-isp@covad.com
Comment:    Reassignment information for this block of addresses can
Comment:    be found at rwhois://rwhois.laserlink.net:4321/
RegDate:    2000-06-07
Updated:    2004-03-11

AbuseHandle: CART-ARIN
AbuseName:   Covad abuse reporting team
AbusePhone:  +1-703-376-2830
AbuseEmail:  abuse-isp@covad.com

TechHandle: ZC178-ARIN
TechName:   Admin
TechPhone:  +1-888-801-6285
TechEmail:  ip_admin@covad.com

OrgAbuseHandle: CART-ARIN
OrgAbuseName:   Covad abuse reporting team
OrgAbusePhone:  +1-703-376-2830
OrgAbuseEmail:  abuse-isp@covad.com

OrgNOCHandle: CIN-ARIN
OrgNOCName:   COVAD IP NOC
OrgNOCPhone:  +1-888-801-6285
OrgNOCEmail:  noc-ipservices@covad.com

OrgTechHandle: TJW4-ARIN
OrgTechName:   Williamson, Todd J
OrgTechPhone:  +1-408-434-4826
OrgTechEmail:  twilliam@covad.com

# ARIN WHOIS database, last updated 2004-08-29 19:10

this sender requested network testing services with the following email:

------------------------------------------------------------

Return-path: tergnlulrueiu@certifiedmail.com Mon Aug 30 07:58:54 2004 [2004-08-30 07:58:54 89566]
Received: from 84.94.27.28.forward.012.net.il (84.94.27.28.forward.012.net.il [84.94.27.28])
   by www.munged.ext (8.11.6/8.11.6) with SMTP id i7UBwm032466
   for <nts-fdjebgbc04e23o03@munged.ext>; Mon, 30 Aug 2004 07:58:49 -0400
X-Message-Info: AAS/rev+70+wwc/RLT+75/07879579208
Received: from smtp-conserve.brian.tergnlulrueiu@certifiedmail.com ([84.94.27.28]) by y88-cyy3.tergnlulrueiu@certifiedmail.com with Microsoft SMTPSVC(5.0.6425.2968);
Tue, 31 Aug 2004 04:53:01 +0100
Received: from boastful284.sob.tergnlulrueiu@certifiedmail.com (inoperable365.tergnlulrueiu@certifiedmail.com [84.94.27.28])
   by smtp-turnery.ambitious.tergnlulrueiu@certifiedmail.com (Postfix) with SMTP id 68N2A2V
   for <nts-fdjebgbc04e23o03@munged.ext>; Tue, 31 Aug 2004 00:55:01 -0300
Received: from smtp-stripe.pyrrhic.tergnlulrueiu@certifiedmail.com ([84.94.27.28]) by gk76-t92.tergnlulrueiu@certifiedmail.com with Microsoft SMTPSVC(5.0.1805.3639);
Mon, 30 Aug 2004 21:00:01 -0700
X-Message-Info: LVJT+%ND_LC_CHAR[1-3]7+i+JU+1/9379414488486
Received: from acquit.tergnlulrueiu@certifiedmail.com ([134.222.179.202]) by mayflower.tergnlulrueiu@certifiedmail.com with MailEnable ESMTP; Tue, 31 Aug 2004 02:52:01 -0100
Date: Tue, 31 Aug 2004 02:54:01 -0100
Message-Id: <850325410424.22282@tergnlulrueiu@certifiedmail.com>
From: Annette <tergnlulrueiu@certifiedmail.com>
To: Nts-fdjebgbc04e23o03 <nts-fdjebgbc04e23o03@munged.ext>
Subject: Want to Enlarge your Pen1s?
X-spamfilt: Chienworks* SpamFilt - 2004-08-30 07:58:54 - [89566]
X-spamfilt: Long HTML tags: 19
X-spamfilt: Excessive use of HTML: 3.03470975463794
X-spamfilt: a-/b - 1 - ejaculat
X-spamfilt: a-/s - 1 - pen1s
X-spamfilt: a-/b - 1 - pen1s
X-spamfilt: b-/b - 1 - doctor approved
X-spamfilt: b-/b - 1 - erection
X-spamfilt: b-/b - 1 - no pumps
X-spamfilt: b-/b - 1 - no surgery
X-spamfilt: b-/b - 1 - premature\W?ejaculation
X-spamfilt: b-/b - 1 - produce stronger
X-spamfilt: bay hits: +0 -29
X-spamfilt: bay head: +12.2 -59.9
X-spamfilt: bay body: +21.5 -434.3
X-spamfilt: bay html: +27 -451.4
X-spamfilt: bay index: 0.941361125062782
X-spamfilt: #0 +0 -29 =0

<html>

<head>

<title> </title>
</head>

<body>


<p>Want to Enlarge your Pen1s?</p>
<p><font color=3D"#0066FF">
<a href=3D"http://www.ppillsnow.com/pgf/track.php?id=3D23">This Brand new =
formula will enlarge you organ 3+ inches</a></font></p>
<p>
<font face=3D"Times New Roman">* 100% Co<k3wbbg53bsqe>st Ba<=
kksliuboc8c431s>ck
Gua<kwuyuq4kexq>ran<kvzlzv31o59bdp1>tee <br>
* Fa<k36545z1wuhl>st P<kksrasw2bt5h2>rior<kctedz32hcj5v>ity =
Sh<k2ar16z2s80>ipp<kufpdy81xfcm>ing
Wo<k7x1d3rdmdjh>rldWid<kz4ndlr1pmoxq93>e <br>
* Doctor App<k4xwwj33jymk5c1>ro<knzt7eg2bac7>ved And Re<ka0e=
40j3psm>comm<kyqd7cis0skr>ended
<br>
* Ga<kdke0sv2qhkg0p>in Mult<kduo5cj1vdi7>iple Inc<k4dtr6i3c0=
blbec>hes
In Le<kl60sdb3p4tn852>ngth <br>
* NO PUMP<ka02tcs3pp9s9>S! NO SU<ktq8j2p33k5l4>RGE<k3o53w73i=
wmv>RY!
<br>
* In<kk6bmo42tvb>cre<k3djs7u9ppyl>ase Yo<k73togs3cjesmj>ur O=
r<k6kzemn2qmba>gan
Wid<k1k50w52moz>th (G<k25ma5h3hf6>irth) <br>
* Pro<kqfgirz18q3y>duc<kmkxbmi2f71tnw>e Str<kzxe912kwp5>on<k=
sgos8b8vr8223>ger,
R<k4mdmyp3ddya>ock Har<kkwqmfz2wadvg>d Er<k3m72bv206augp>ect=
i<kynnq3n21nh>ons<br>
* Re<kkbphke1hzl0k53>duc<ksp1cjb15x55>es Pre<kfglp483dbs46t>=
matu<kuhyu3x1jk7s>re
Ej<kt3wn1s2z8ys74>ac<kg33rmz35b8>ul-at<k3kbwp6qquio>ion</k3k=
bwp6qquio></kg33rmz35b8></kt3wn1s2z8ys74></kuhyu3x1jk7s></kfglp483dbs46t><=
/ksp1cjb15x55></kkbphke1hzl0k53></kynnq3n21nh></k3m72bv206augp></kkwqmfz2w=
advg></k4mdmyp3ddya></ksgos8b8vr8223></kzxe912kwp5></kmkxbmi2f71tnw></kqfg=
irz18q3y></k25ma5h3hf6></k1k50w52moz></k6kzemn2qmba></k73togs3cjesmj></k3d=
js7u9ppyl></kk6bmo42tvb></k3o53w73iwmv></ktq8j2p33k5l4></ka02tcs3pp9s9></k=
l60sdb3p4tn852></k4dtr6i3c0blbec></kduo5cj1vdi7></kdke0sv2qhkg0p></kyqd7ci=
s0skr></ka0e40j3psm></knzt7eg2bac7></k4xwwj33jymk5c1></kz4ndlr1pmoxq93></k=
7x1d3rdmdjh></kufpdy81xfcm></k2ar16z2s80></kctedz32hcj5v></kksrasw2bt5h2><=
/k36545z1wuhl></kvzlzv31o59bdp1></kwuyuq4kexq></kksliuboc8c431s></k3wbbg53=
bsqe></font></p>
<p><font face=3D"Times New Roman">
<a href=3D"http://www.ppillsnow.com/pgf/track.php?id=3D23">MORE INFO</a></=
font></p>
<p> </p>
<p>
<font size=3D"1"><a target=3D"_blank" href=3D"http://www.ppillsnow.com/r/"=
>Ta<k6oek2se41190 />ke m<k5vxdlx2vpfa3 />e of<khh7keu3lh1 />f the l<ksczt9=
qqhhs />is<k6o8nvd2ngn />t!</a></font></p>

</body>

</html>

------------------------------------------------------------

http://www.ppillsnow.com/pgf/policy.htm

Vortex Media Solutions, LTD.
9-19 Caroline Street | London, E1 0JG | United Kingdom

Contact Us
This site is owned and operated by:
Vortex Media Solutions, LTD.
9-19 Caroline Street
London, E1 0JG
United Kingdom
supportpills@hotmail.com 

------------------------------------------------------------

[whois.gandi.net]
% GANDI Registrar whois database for .COM, .NET, .ORG., .INFO, .BIZ, .NAME
%
% Access and use restricted pursuant to French law on personal data.
% Copy of whole or part of the data without permission from GANDI
% is strictly forbidden.
% The sole owner of a domain is the entity described in the relevant
% 'domain:' record.
% Domain ownership disputes should be settled using ICANN's Uniform Dispute
% Resolution Policy: http://www.icann.org/udrp/udrp.htm
%
% Acces et utilisation soumis a la legislation francaise sur
% les donnees personnelles.
% Copie de tout ou partie de la base interdite sans autorisation de GANDI.
% Le possesseur d'un domaine est l'entite decrite dans
% l'enregistrement 'domain:' correspondant.
% Un desaccord sur la possession d'un nom de domaine peut etre resolu
% en suivant la Uniform Dispute Resolution Policy de l'ICANN:
% http://www.icann.org/udrp/udrp.htm
%
% Date: 2004/08/30 17:16:41

domain:         PPILLSNOW.COM
owner-address:  Harris Rodriguez
owner-address:  Papeleria Labritja 42, Sant Joan De Labritja
owner-address:  na
owner-address:  Ibiza
owner-address:  Spain
owner-phone:    +34.650797607
owner-e-mail:   big123@gohip.com
admin-c:        HR251-GANDI
tech-c:         HR251-GANDI
bill-c:         HR251-GANDI
nserver:        ns5.autonameservers.com 220.175.8.55
nserver:        ns6.realdnssystem.com 222.233.52.32
reg_created:    2004-08-18 15:37:31
expires:        2005-08-18 15:37:31
created:        2004-08-18 21:37:31
changed:        2004-08-20 22:07:50

person:         Harris Rodriguez
nic-hdl:        HR251-GANDI
address:        Papeleria Labritja 42, Sant Joan De Labritja
address:        na
address:        Ibiza
address:        Spain
phone:          +34.650797607
e-mail:         big123@gohip.com
lastupdated:    2004-08-23 18:49:36

ppillsnow.com has address 200.153.17.108
www.ppillsnow.com has address 200.153.17.108

inetnum:     200.128/9
status:      allocated
owner:       Comite Gestor da Internet no Brasil
ownerid:     BR-CGIN-LACNIC
responsible: Frederico A C Neves
address:     Av. das Nações Unidas, 11541, 7° andar
address:     04578-000 - São Paulo - SP
country:     BR
phone:       +55 11 9119-0304 []
owner-c:     CGB
tech-c:      CGB
inetrev:     200.128/9
nserver:     NS.DNS.BR 
nsstat:      20040828 AA
nslastaa:    20040828
nserver:     NS1.DNS.BR 
nsstat:      20040828 AA
nslastaa:    20040828
nserver:     NS2.DNS.BR 
nsstat:      20040828 AA
nslastaa:    20040828
remarks:     These addresses have been further assigned to Brazilian users.
remarks:     Contact information can be found at the WHOIS server located
remarks:     at whois.registro.br and at http://whois.nic.br
created:     19950104
changed:     20020902

nic-hdl:     CGB
person:      Comite Gestor da Internet no Brasil
e-mail:      blkadm@NIC.BR
address:     Av. das Nações Unidas, 11541, 7° andar
address:     04578-000 - São Paulo - SP
country:     BR
phone:       +55 19 9119-0304 []
created:     20020902
changed:     20020902