finally those farkers shown up again with spams. i've recorded their IPs and browser info.
it turned out that most of them are from italy. but also some from poland, us and other unresolved ips.
but all of them have a single common thing, which is the browser info. it is:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)
i am not very sure if that's the real browser or some sort of spywarez with pre-defined browser version data. anyway, if it's real browser info, then it's WinXP without service pack installed... which means popup blocker is not installed.
so i've put in some filters. if the msg is more than 1000 chars, contains "<h1>", "poker", "viagra", "casino", "debt" and "loans", then it will launch a new browser window to yahoo.com
every 1 millisecond.
until the pc is out of memory.
so i hope those are real browsers.
let's see how it goes...