ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations
Brian Kramer / Expedite Media Group

Evidence Menu:

Brian Kramer / Expedite Media Group Index

Country: United States
State: Illinois
Massive spamhaus. Kicked off of MCI, Anet, Mzima, Uninet, SingTel, Yipes, Servercentral, WilTel, Triara in Mexico, Broadwing, a Panamanian host, Schlund and lastly Speakeasy - just between Jul-Oct 2005!

Brian Kramer / Expedite Media Group SBL Listings History
Current SBL Listings
Archived SBL Listings

Hijacking Virus-infected PCs

Confirmed hijacking of trojan/virus-infected PCs to relay spam.
--------------------------------------------------------- IN A IN NS IN NS IN A IN A

[ Offending message ]
Envelope-to: x
Received: from localhost ([])
by with smtp (Exim 4.42)
id x
for x; Sun, 10 Apr 2005 07:xx:xx +0000
Received: from TROJAN-INFECTED-PC ([x.x.x.x]
by with smtp (Exim 4.42)
id x
for x; Sun, 10 Apr 2005 07:xx:xx +0000
From: "x" <>
Subject: reply from team
To: x
Content-Type: text/plain;
Date: Mon, 11 Apr 2005 20:xx:xx +0700
X-Priority: 3
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-BV-Spam-Score: 4.9 (++++)

4/10/2005 3:xx:xx PM
hello x,

Dear smoker or friend of smoker!

We have been penalised, long enough, it is time to fight back!, while surfing
the net, I found a great web page for you to look at, and to pass on to your family and
If you are fed up of being ripped off by a British government, who continually
raise taxes on tobacco, take away your rights of freedom by banning smoking in public
places, then
it is time to take a look at either of these websites: or
they can send you FREE info on where to join the british Smokers Club (free to
join), and details of online shops, where you can buy cigarettes at 2 pounds a


The Angry Smoker


The payload page consisted of hyperlinks to:

and a contact email of:

Most of these are have anonymized WHOIS through domains-by-proxy. Some of them have public registrations with this info:

Costa Business Bureau S.L.
Avda. El Gamonal,12
Local 09
Edificio Jupiter
Arroyo de la Miel, Malaga 29631
Administrative Contact:
Diamond, Max
Avda. El Gamonal,12
Local 09
Edificio Jupiter
Arroyo de la Miel, Malaga 29631

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2018 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy