On Wednesday, May 18, 2005, 9:44:10 AM, List User wrote:

...

...

spam link.

http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564

Dan Zachary

    Despite hiding behind a "private registration":

    % nslookup -type=any fresh-deals.net ns1.fresh-deals.net
    Server:         ns1.fresh-deals.net
    Address:        206.131.233.2#53

    fresh-deals.net
            origin = ns1.fresh-deals.net
            mail addr = hostmaster.fresh-deals.net
            serial = 2005050501
            refresh = 86400
            retry = 3600
            expire = 777600
            minimum = 3600
    fresh-deals.net nameserver = ns1.fresh-deals.net.
    Name:   fresh-deals.net
    Address: 206.131.233.2
    fresh-deals.net mail exchanger = 10 max.fresh-deals.net.

    % nslookup -type=any max.fresh-deals.net ns1.fresh-deals.net
    Server:         ns1.fresh-deals.net
    Address:        206.131.233.2#53

    Name:   max.fresh-deals.net
    Address: 206.131.233.2

    % nslookup -type=any 206.131.233.2 ns1.madplus.com
    Server:         ns1.madplus.com
    Address:        206.131.233.2#53

    2.233.131.206.in-addr.arpa      name = max.madplus.com.

    % telnet max.fresh-deals.net 25
    Trying 206.131.233.2...
    Connected to max.fresh-deals.net.
    Escape character is '^]'.
    220 max.madplus.com ESMTP Merak 7.4.5; Wed, 18 May 2005 12:11:27 -0400
    quit

    Same registrant also owns gmbdream. com and uses the company name

of "GMB Direct".

Thanks Paul. Does any of this help inform us about how spammy this critter is?

Jeff C. -- Don't harm innocent bystanders.