I’ve seen some people wonder out loud why I haven’t been blogging about the tigerspice spammer. Well, I haven’t been hit! During the last week or so I’ve heard a few mumblings about it, and have been waiting to find it in my logs, but so far nothing.

Without any log material to work from, it’s hard to speculate, so for now I’ll just wait and see.

I was looking at Cindy’s site to see if she’d come up with a ban. Nope, only for the domain name. And I’ve seen Andy Hoffman start using other domains lately, so that won’t do it.

The only observations I can contribute, is that his e-mail address was registered as early as July 7, 2004. The last few days he’s started using the alias Milly Brown. Her e-mail address was registered February 16, 2005.

However, the server hosting tigerspice, 219.153.9.11, hosts three sites, according to whois.sc (not reliable, but interesting):
Andrewsaluk dot com (recently spammed, and now registered to Milly Brown
Carabidule dot net (owned by a Kirk Donald, with the same pattern e-mail address registered June 28, 2004. I think this one is going to be spamvertized soon, if it hasn’t been already)
Eddiereva dot com (recently spammed, with the same pattern)

These domains are previously owned. One by a financial advisor, one was a French forum (computer related). Not sure about eddiereva. No sign of previous ownership, and it was first registered late October last year.

The custom nameservers are also hosted on that same box. I’m guessing it’s a colocated server. And it’s in China. Abuse address:
abuse at cta.cq.cn

This entry was posted on Thursday, February 24th, 2005 at 12:35 am and is filed under spamhuntress. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.