Originally Posted by eroticsexxx

A spambot swarm seems to be using the name Menshealth.com in the "from" field, but the actual return address usually matches the address that the spam was sent to.

I've been tracking them and the links in the message body have been changed several times, but all lead to online pharmaceutical sites.

This is the registrant of the latest version (vipeager.com - 220.248.186.101 (chinese IP)):

DONGFANGCHANGQIN
HUACAOGONGYINGGONGSI
[email protected]
YINYUE, 2005451

A DNS trace for that domain leads to this guy:

Name : GAOLU
Organization : GAOLU
Address : GANGSHENLU72
City : huaianshi
Province/State : jiangsusheng
Country : china
Postal Code : 223058
Phone Number : 86-0517-58621036
Fax : 86-0517-58621036
Email : [email protected]

Sohu.cn is actually sohu.com - a chinese portal