Silent noise - about spam, trojans and other nasty stuff

Re: ...your organization may be able to use this...
Received: from [213.45.29.44] (helo=host44-29.pool21345.interbusiness.it)
by che.c0d3w4lk3r.com with smtp (Exim 4.34)
id 1C1Wyd-0001Oc-3g
for domreg@x; Sun, 29 Aug 2004 16:12:39 -0500
Received: from 66.32.64.40 by 213.45.29.44; Sun, 29 Aug 2004 18:06:36 -0400
Message-ID: <YKHFKCNPQGJKHEHQCPKK@msn.com>
From: "Bart Bruno" <aburkhart@myway.com>
Reply-To: "Bart Bruno" <tomspaits@rediffmail.com>
To: domreg@x
Subject: Re: ...your organization may be able to use this...
Date: Mon, 30 Aug 2004 03:03:36 +0500
X-Mailer: AOL 4.0 for Windows US sub 225
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--886117180555371"
X-Priority: 3
X-MSMail-Priority: Normal
X-IP:180.238.94.98
X-Spam-Exim: NLRDBIUAvcVbeYyUkgPhHX0G

Content-Type: text/plain;

" Many business people are finding out that they can now advertise
in ways that they never could have afforded in the past. The cost
of sending mass e-mail is extremely low, and the response rate
is high and quick. " - USA TODAY

Seems a bit strange first; No link. But putting "tomspaits@rediffmail.com" in a google groups search makes it obvious it is Soloway again.
Wonder if that is a working address?

This just in again. Today he is "Lucille Keys" with the emailaddress doughiggins@fastermail.com.
Again from Korea, 211.61.104.152.
broadcastingtoday.biz hosted at 221.143.42.180 which is hanaro in Korea.
Rumours are that hanaro is cleaning up.
This time I sent a complaint.
Soloway sure likes Korea.
Wonder if he brought his Mercedes with him? Original posting here (by robbiedawgdawg).

Posting in nanas here
I suspect that subject is one of Soloways fingerprints. He also likes to do something with the date in his spams. This one says Tue, 25 Mar 2003 05:47:23 +0300, but I actually got it today. Maybe his spamware is very slow?
Spamvertising seniorsworld.com. Sent from Korea. Soloway must like the weather in Korea.

Stuff is on its way, I am a bit lazy.
In the mean time have a look at theffacollective.com and intropy101.net

See http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK1096 for more info.
Been hit by his spam to most of the few domains I have lately. Always to roleaccounts, mostly from whois info.
Most of the spam originating from his spamvertises his own site broadcastingtoday.biz which advertises his "services", spamming.
And sometimes I get spam from him spamvertising other sites. He obviously get customers.
Here is one answer I got after I suspected he was behind the spam:

I am so sorry. I paid a service to email my message, and they guaranteed
that they have permission to send to the addresses they use. I won't be
using them again! (Actually, this is the first time I've tried this (and
last time)).
Again, I am very sorry and I will send this on the them.

I had to ask what "service" she used:

I used broadcast emailing, which lists their address as
broadcastingtoday.biz

Todays spam came from "Trinidad Velasquez", dlong@flashmail.com.
It was sent from 218.167.8.128 which seems to be 218-167-8-128.dynamic.hinet.net.
The spamvertised site is http://www.broadcastingtoday.biz.
Well, of course it was not from Trinidad Velasquez, it was from Robert Soloway/ Robert Alan AKA NIM Corporation.
You can read more about him here:
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK1096