Tuesday, December 26, 2006

Beautifulswiss.com War - Part II

Beautifulswiss.com War - Part I

Today 8 AM : discovery that this spammer has invaded my inbox, using my email address as his reply-to.
First spam reports and TOS violations were reported hours ago; no reply yet.

Today 9 PM :
Second round of war.
More spam on my inbox.
Again I am used as reply-to fields. F-ers.


Again as in the previous spam post, again the beautifulswiss.com domain.
This time the only difference : the spammer has used a new aol account to spam :

Message-ID: <0AB1981F.70D59CEA@mac.com>
Date: Wed, 27 Dec 2006 02:53:26 +0600
From: "King, Catherine"
User-Agent: eGroups Message Poster
MIME-Version: 1.0
To: "Daniel"
Subject: ROLEX at unbelievable prices cu
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

High Quality Rrol,x Re*lica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more re.lica watches.

http://members.aol.com/amandagld/

Their stone, nursing a baby in the paradise, wasn't tearfully wax.
Her devil, crying in the toolbox, is silently piggy.



Today around 10 PM,
my response to this last spam attack :


From: me
Subject: Fwd: Undeliverable Mail
Date: December 26, 2006 9:56:17 PM GMT+00:00
To: spam@my email provider, TOSReports@aol.com, support@namecheap.com

This spammer (http://members.aol.com/amandagld/ ) continues to abuse my email address.
My email address in the reply-to field, making me angry...

This aol account forwards to http://beautifulswiss.com/

of which whois:

Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=

Domain registrant,
TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Cheapnames.com, please deactivate.

Mac.com, please do something to help deactivate these irrelevant spam forwards.

Angrily,

ME

[with full spam and its headers followed]

Beautifulswiss.com - invading my emails means WAR

Dear spammers, the fact that you use MY email address in your spams reply-to field means war.

War, 8 AM on 26 December 2006.
My inbox :


From: Postmaster@post4.tele.dk
Subject: Mail System Error - Returned Mail
Date: December 26, 2006 8:50:43 AM GMT+00:00
To: [my email]
Reply-To: Postmaster@post4.tele.dk
Return-Path: <>
Received: from mac.com (smtpin11-en2 [10.13.10.81]) by ms121.mac.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005)) with ESMTP id <0JAV005BHHXQ11@ms121.mac.com> for [my email]; Tue, 26 Dec 2006 00:51:26 -0800 (PST)
Received: from fep34.mail.dk (fep34.mail.dk [80.160.76.198]) by mac.com (Xserve/smtpin11/MantshX 4.0) with ESMTP id kBQ8oj0D023645for ; Tue, 26 Dec 2006 00:50:46 -0800 (PST)
Message-Id:
Mime-Version: 1.0
Content-Type: multipart/report; Boundary="===========================_ _= 6371765(15235)1167123043"; report-type=delivery-status
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]

This Message was undeliverable due to the following reason:

Dansk forklaring, klik her:
http://tdc.mail.dk/cgi-bin/redirect.pl?MsLimitNumMsgs

The user(s) account is temporarily over quota.



Please reply to
if you feel this message to be in error.
Reporting-MTA: dns; fep34.mail.dk
Arrival-Date: Tue, 26 Dec 2006 09:50:42 +0100
Received-From-MTA: dns; fep24.mail.dk (211.59.78.182)

Final-Recipient: RFC822;
Action: failed
Status: 4.2.2

From: "Williams, Joyce"
Date: December 27, 2006 1:56:02 AM GMT+00:00
To: "Brown, Julie" , "Karen" < some user @post4.tele.dk>, "Lisa Davis" , "Smith, Margaret" , "Andrew" , "Anthony Brown" , "White, Brenda"
Subject: An Affordable Rolex [random letters]
Reply-To: "Johnson, Joseph"

High Quality Rro*ex Rep*ica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more repl,ca watches.

http://hometown.aol.com/steed249/

Her vampire, ruling the world in the Shire, nicely nasty.
Her devil, crying in the toolbox, is silently piggy.

The paper, sitting under the roof, was briefly hellish.
His programmer, standing in your house, is quietly slim.
Her ancestor, stealing money in the shadows, isn't perseveringly yellow.

Your dancer, talking crap behind the window, wasn't generously barren.


War, 11 AM
My response :

From: [my email]
Subject: SPAM Fwd: Mail System Error - Returned Mail
Date: December 26, 2006 5:42:26 PM GMT+00:00
To: TOSREPORTS@aol.com, abuse@bol.com.br, support@namecheap.com
Mime-Version: 1.0 (Apple Message framework v752.2)
Message-Id:
Content-Type: multipart/alternative; boundary=Apple-Mail-1--130814484
References: <20061226085043.somenumbers.fep34.mail.dk@fep34>

I forward this spam report to you AOL Tosreports since it IS relevant.

Someone - user steed249 - is forging my email to be used for sending out these emails. the emails with forget details are in the bottom of this email.
I have received several of these emails today.

The URL http://hometown.aol.com/steed249/ is in this spam advertising.
User steed249 is breaking his TOS.
The site is forwarding to replicas of brand products and that is a violation of your TOS, http://help.aol.com/aimhelp/search.do?cmd=displayKC&docType=kc&externalId=http--helpchannelsaolcom-kjumpadparticleId219305&sliceId=&dialogID=63390544&stateId=1%200%2063416598

Needless to say, I am angry that my email is used in these spams as reply-to.

And bol.com.br and the bulk domain support used for registering these domain are in to field too.
I would think that the TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Here are the registrant details I have found out using whois searches for who registered the domains that website redirects to :

Domain Name: FINESWISS.NET
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: fineswiss.net

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.mygoodswiss.net
ns2.mygoodswiss.net

Creation date: 30 Oct 2006 12:12:26
Expiration date: 30 Oct 2007 12:12:26

It also redirects to :
Domain Name: BEAUTIFULSWISS.COM
[whois.enom.com]
=-=-=-=
Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=
The data in this whois database is provided to you for information
purposes only, that is, to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is," and do not guarantee its accuracy. By submitting a
whois query, you agree that you will use this data only for lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume, automated, electronic processes that stress or load
this whois database system providing you this information; or (2) allow,
enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by telephone. The compilation, repackaging, dissemination or
other use of this data is expressly prohibited without prior written
consent from us.

[and in the bottom the full full headers and full text of the spam I had bounced in my email inbox]

Regards,

ME

----- to be continued as soon as I get answers for this spam.

Saturday, December 16, 2006

Nomarriage.com isn't that much about hating women than it's about making money

Nomarriage.com is funny on the first look. And to a big percent I agree on what's the point of marrying anyway. Well - the valid points to marry would be ... getting a visa or visas for either or both,or getting a socially acceptable environment for the reproductional needs, or to just get the tax breaks of the married people, or just to go public with the relationship itself.

But reading thru even the titles on the links of the main page of that site is depressing and disturbing on the same time. So the men are all victims, and all American women are the evil? All men are innocent, and all the American women are just trying to get married, pop out a kid or two, only to become severely post-partum depressed psycho bitches who will force their poor victim husband go years with no sex with them and thus get these East European girlfriends to satisfy the bodily needs... ummh, yea.

But the opinions are interesting.. they tell a lot about the author too. Not that I would have had a real need to run whois on the domain, I was still curious who would want to have his name behind all these opinions. The site was registered by someone called Jan Herzog, whose address was in Venice CA, and contact address in Austin, TX. A geek or a scam for a long time for sure to be also able to own a 3-letter domain as well (never mind its content). Further digging around found some weird results with this relatively unique name, such as some text on Church of Seven Dolors, Minnesota website. And a lot about the family tree, and a listing of 2005 Teacher of the Year nominees for the area of Austin, TX. So an elementary school honor teacher at Huey, or a Montessori school at Wichita Falls? And doesn't this veganism all the carnivores are teh evil-style speech sound comparable to no marriage site? My favorite type of vegetarians and vegans is the one that tolerates other people and their opinions, not the vegenazi. And I think I can use that word in this case after reading all these pearls in nomarriage site, as below. You'd think they have fired teachers for less diverse opinions ... even though here he says he doesn't have kids and on the school website he has a daughter. Well, it could be all miracles and coincidences that there are three people with the same name in the same area, with the exact same rant style too. -- and some other searches found another variant for spelling his name actually as Jon Herzog, and being a Russian or ex Soviet born emigrant residing nevertheless in Austin area.

Why marriage no longer makes sense : "Traditional marriage balances different privileges and obligations for men and women. Modern woman wants all the benefits of "equality" without any of the responsibilities. " and so on. Hm. Why is it that not 100 % of men that I know take the full responsibility of their life? Or maybe those who do take it, are not attracted to women who don't.
Any American man can find a good foreign girlfriend or wife - umh. These men whose identities have been covered look all so perfect.

"Give me one good reason why a man should sign the marriage contact with an American woman. With a foreign bride, I guess you need to sign the marriage contract so she can get her green card and move to the United States." Ok, fine.
"But with an American woman, why not just live with her and fuck her. Verbally commit for life if you want."
"The ONLY thing that signing that marriage contract will do is ensure that the man receives a solid ass raping in divorce court if the relationship doesn't work out. And since American-American marriages have a 60% divorce rate, that's a very real possibility."

What your future wife will be thinking a few years after you have children. .. why marry a leech like these anyway? The mere existence of the people thinking like that would be enough to turn me a gay if I was male.
Majority of American women have Histrionic and Narcissistic disorders - and the majority of the men are sane and angels in comparison...

"The one constant of life is that women, after you marry them, will always change. You think they are sexy and fair now? They will probably change after the wedding.
That's just the way it is, folks, no way to change it. Best thing is to look at the women's mom, married sisters, and how she was raised. That is a much better indicator than what she says when you date her
." (and this would not be the same for the advertised foreigner women? Or look at the dad and married brothers of the broom ... all look sane, happy, in shape and not to be too psychos...) "Do you ever sense that your wife sees you as a means to an end rather than a person? Sometimes I feel like my wife loves me for what I can do for her (kids, security, whatever) but does not really care about me specifically. Many woman who are getting older want to get married, but who they marry seems less important than actually being married." Wise hint for you mr Herzog then : don't ever marry a German wife either. The reason you just gave above is why another American divorced of the German... not being a person anymore, only a tool. It was all about her, her, her...

"It's amazing how many people think that a guy looking for a good woman should do what's "fair" or what's socially responsible. Fuck that. It's each guy's responsibility to find a woman that's the best possible choice for HIM. Who will make HIM happy. This one time, when he's choosing his future wife, he needs to focus exclusively on his own needs and making sure they are satisfied." ... "The "wifely" skills are those that the woman needs to have, or learn darned quick, if she's going to make you happy." (which explained are : Cooking, cleaning, mothering, nurturing, wants kids, loves kids, loyal, trustworthy.) Ha. Your opinion on these wifey skills makes you a breeder. Go on, please marry these foreign, mothering, nurturing, breeder women. Or just make money telling other people how to.

More pearls : "99.9% of the single women in this country are not even marriageable.
Take away the women beyond the marriageable age (over 30).
Take away the fat women.
Take away the ugly women.
Take away the psycho Zoloft / Prozac women.
Take away the raped women.
Take away the women with STDs / HIV.
Take away the women who can't cook.
Take away the women who already have kids.
And you've eliminated 99.9% of the single women in this country."
while on the same page preaching big that "So quite honestly, it doesn't matter if they're fat/skinny/ugly. It's not about what's fair. It's about what you can get. American men get what they want" So it doesn't matter if YOU, the MAN, is ugly, old sick psycho but the womb you want to marry MUST be under 30, a certain attractiveness, weight, size, shape, color, ...

Other pearls - there is a link in the source to fireyourwife.com. It doesn't come as any surprise that this site as well is registered by this same Jan Herzog, this time with the registrant addresses in Silver Spring, MD, and in Austin, TX.

And the big great ass banner to singleabroad.com is registered by Jan Herzog, Silver Spring, MD, and Austin, TX. So it's all about making money, sir Herzog. Somehow I have NEVER seen lusers like you get women like this, this, this, this (ever seen an Eastern European girl like these? I haven't), this, or this ... ONLY for the sake of your passport. And the womben you have added in the pictures are probably not that likely type of being mothering, nurturing, breeder type you were just advocating for. You are only doing this preaching for money. For selling your books (that are that successful that even amazon.com hasn't heard of you??), and your web services. But never mind Amazon since the people's need of love is usually even bigger than their need of religion, I'm sure you will not run out of business. And you sure keep trying and entertaining people, even traditionalwife.com is yours as it appears on whois.
But that is enough for digging out the weird people and ideas and products in the Internet for one evening.



So it's not all about hating American women, it's about making money.

Tuesday, December 12, 2006

Bruce Schneier on spam

Bruce Schneier has brilliant points on combating spam, taken to his freshest blog entry also today. To fight spam better would really need reingeneering the internet.
Even if the spam filters are well in place and working on the server side, I just keep getting all these scam emails. All Nigerians with the millions of dollars to donate to us poor, non-Africans, all the MSN&Yahoo&Google $ 50 million lottery tickets that only are waiting for my passport and bank account details in that yahoo, hotmail, lycos, tripod, or walla email account ... well well. The day the spam filters will be efficient, and there will not be a single scam, a pointless .gif for marketing some weird shares, I will be glad to eliminate this blog as unneeded. Or transform it to a museum of an era in the Internet.

Ms Aisha Hassan, Lebanese concentration camp, offering business deals..

Another of these oh I am emailing you about business deals while I am in a refugee camp with fast speed internet access...
Then another interesting detail with all of this type of emails : the money is always 10 millions or more (this being slightly less) and it is always deposited in some cheap third world country you might not want to travel to (like anywhere in Africa alone). None of these dead poor scammer's dads had ever thought about making it simple and opening a bank account in Switzerland or in US. If they would have the account already in Switzerland, all these poor people in the concentration camps with these fast speed internet access could just go to Switzerland to get their money whenever they would want.
If these really were business deals, and they offered really 30 % of the money, this would save them easily $ 3 million per a scam. I mean per inheritance.

From: aishahassan@rediffmail.com
Subject: PLEASE LET ME KNOW IF YOU GOT THIS MAIL & GOD BLESS AS YOU DO SO [then some random letters]
Date: December 11, 2006 12:42:50 PM GMT+00:00
To: [my email]
Return-Path:
Received: [...] from mx4.hotmail.com (11.red-83-41-171.dynamicip.rima-tde.net [83.41.171.11]) by [domain] (Xserve/smtpin44/MantshX 4.0) with ESMTP id kBBC77SK002790for [my email]; Mon, 11 Dec 2006 04:42:50 -0800 (PST)
Message-Id: <200612111242.kBBC77SK002790@[domain]>
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
Content-Type: text/plain
X-Msmail-Priority: Normal
Original-Recipient: [my email]

From Aisha Hassan
C/O: Refugee camp-Beirut
Republic Of Lebanon
23/11/2006

EMAIL: aishahassan@rediffmail.com

Dearest One,

I came across your contact and have Decided to get in touch with you after the prayer, to see if you can help me solve my problem . Firstly, i wish to introduce myself as Aisha Hassan, The Daughter of (Late Alhaji Hussien bin Hassan) who lost his life in the course of the crisis here in Lebanon on the 24th of July this year during Israeli bomb attack to Lebanon, which claim the lives of my family members and left me without any body to lien on.
My father willed in cash, the sum of $8.7 Million US Dollars which he put in a trunk box and deposited with a bank in Malaysia and with enabling conditions for the release of t he fund which are as follows.

(1) That I must be 30 years or above.

(2) That upon request for the release of the fund, there must be intentions of investment especially outside the Lebanon.

I contact you therefore to confirm if you can accept me into your life as my guardian and possibly advise me on any investment opportunity in your country. If after this mail you get back to me and I reach agreement with you, the Bank/Finance firm will release the consignment into your care and I will come over to you to commence business partnership with you and the fund.
Please forgive me if you find this message offended in anyway, but i am just searching for assistance, because i have lost all my people during this crisis here

I expect your urgent response with assurance that you will help me.

God Bless You.
Ms.Aisha Hassan

Sunday, December 10, 2006

Alex Rodrigez aka xsalsa@gmail.com - leave me alone

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs380024qbf;
Sun, 10 Dec 2006 00:12:11 -0800 (PST)
Received: by 10.48.254.1 with SMTP id b1mr2922416nfi.1165738330674;
Sun, 10 Dec 2006 00:12:10 -0800 (PST)
Return-Path:
Received: from mail.garyzobb.com ([195.114.9.119])
by mx.google.com with ESMTP id k9si5975398nfc.2006.12.10.00.12.09;
Sun, 10 Dec 2006 00:12:10 -0800 (PST)
Received-SPF: neutral (google.com: 195.114.9.119 is neither permitted nor denied by domain of bc@garyzobc.com)
DomainKey-Status: bad
Received: (qmail 47846 invoked from network); 10 Dec 2006 08:09:09 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=garyzobc.com;
b=LjMxnD1eif9y5Yn0S+TYaPbuOxnlnaPfvCECjVGdtXpWrsfieOczodYN8bMiGEBmom/bt5mQBTDOqLqMKIozk4+m0pWDF/CG8N/+WYP5W7YygulXWo/5I+LIYayh2FH3ZHW8SqBOI6S24XZZyMLmVEPkU5r4+yej0UCG0CQXqas= ;
Received: from localhost (HELO localhost.localdomain) (127.0.0.1)
by localhost with SMTP; 10 Dec 2006 08:09:06 -0000
Received: (qmail 8933 invoked by uid 80); 10 Dec 2006 06:26:43 -0000
Date: 10 Dec 2006 06:26:43 -0000
From: DS Team special offers
To: [my email]
Reply-To: DS Team special offers
X-Priority: 3
List: DST
List-Archive:
List-ID:
List-Owner:
List-Subscribe:
List-Unsubscribe:
List-URL:
Message-ID: <20061210074153.91246766@garyzobc.com>
X-Mailer: Dada Mail 2.10.9
Content-type: multipart/alternative; boundary="----------=_1165725713-69542-0"; charset=iso-8859-1
MIME-Version: 1.0
Subject: VIP gift prices on Adobe CS, Macromedia, Adobe Photoshop, Acrobat, Roxio, MS Office web bundles

This is a multi-part message in MIME format...

------------=_1165725713-69542-0
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
Content-Length: 4011

(Mailing list information, including unsubscription instructions,
is located at the end of this message.)

�Dear customers and
friends of DS Team,

Please let us represent our new special discount deals created especially for
you. In accordance to these deals you'll be able to order some products from our
online software store saving up to 80% off on each purchase. Watch for our
weekly special discount offers to get what you really need at discount prices
and to receive your free-of-charge bonuses as well. We're always working on this
issue to make our cooperation more interesting and useful for both of us. Your
satisfaction is very important, therefore please feel free to contact us in case
you're in need of some specific software which isn't in our store at the moment.
We'll try to make it available in a short time period for your satisfaction.
Make your choice, don't miss a chance, work with us, enjoy.� OnDemand
Software Group is always at your service.
[snip] same kind of list than in this post

The following information is a reminder of your current mailing
list subscription:
You are subscribed to the following list:
DS Team special offers
using the following email: [my email] (and no, I have NOT).
You may automatically unsubscribe from this list at any time by visiting the following URL:
If the above URL is inoperable, make sure that you have copied the entire address. Some mail readers will wrap a long URL and thus break this automatic unsubscribe mechanism.
You may also change your subscription by visiting this list's main screen:
If you're still having trouble, please contact the list owner at:

The following physical address is associated with this mailing list:
PO Box U342 Woods Centre
St. Johns, Antigua
Ahem - no you have not. You have still the same invalid address associated with your domain than in that other post:

Domain name: okunsoft.com (this time these scam software were linked to be sold at gifts.okunsoft.com/something...
Domain name: OKUNSOFT.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA@GMAIL.COM) (for other his business you can also find (XSALSA@ETN.ORG) as registrant email)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSALSA@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.ZOPUSINFINITUS.COM
Name Server: NS2.ZOPUSINFINITUS.COM
Domain creaton date: 2006-12-05 22:14:27.0
Domain expiration date: 2007-12-06 03:31:14.0

Again, this domain registrant address is invalid. If you search more about thi Alex Rodrigez in Lappeenranta, you'll find a lot of interesting posts out there.

Tuesday, December 05, 2006

Mr. Roland Benneth - the "British" living in Africa donating all his money...

So this British gentleman lives in Africa, and uses a Spanish email provider. And interesting choices of words and spelling such as organizations, helpless needies, hospitalized, .. Ten Million Three Hundred Thousand dollars ($10.3million but not bothering to mention what it is in UK pounds. (Italics below mine) Oh - and even the God Bless You isn't that British thing to say.

Congratulations on your US spelling, sir.
I don't understand why you would even want to sit on your prostate and die when the cure for sure costs less than what you say you have on your account, and prostate cancer isn't fatal. And how come you have time to send these spam mails while you lie hospitalized in a bed? You even have the same template all these Africans and Lottery Winner Notifications use - the same nationality, passport number etc all litany, right away pasted and even all capitol letters like in every single other scam.

Or why you never considered e.g. making a donation to Oxfam. Maybe you are not British enough.

From: roland_benneth4@terra.es
Subject: From Mr. Roland Benneth
Date: December 5, 2006 5:40:06 AM GMT+00:00
Reply-To: roland_benneth4@terra.es
Return-Path:
Received: [...]
Received: from cps5 (213.4.149.20) by csmtpout3.frontal.correo (7.2.056.6) id 45740FA60005A709; Tue, 05 Dec 2006 06:48:58 +0100
Received: from [195.166.237.42] by correo10.terra.es with HTTP (authenticated as roland_benneth4@terra.es); Tue, 05 Dec 2006 06:40:06 +0100
Message-Id: <21184699.1165297207001.JavaMail.root@cps5>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_225_5775010.1165297206999"
Original-Recipient: [my email]

Dear Friend,

I sincerely hope that after you read this mail you will respond to my
call. let me start by introducing myself my name is Roland Benneth. I am 70
years old, a British living in West Africa. I am a businessman and own two
companies here in Ouagadougou, married with two children. My wife and
two children had a fatal car accident subsequently died six years ago.
Before this incident my life internally depend on my business for self
sustenance as well, for I appreciate life as well never really cared about other
values in life since the loss of my family, I have found a new
philanthropic desire to assist helpless needies.

I have been dedicating my service in helping orphans in motherless
homes; I visit and donate money to orphans in Sudan, America And some Asian
countries. Before I became ill, I kept some money, Ten Million Three
Hundred Thousand dollars ($10.3million)
to be precise in a long term
deposit account in a Finance House.

Presently, I'm suffering from an illness and hospitalized my doctor told
me I have prostate cancer that I living by grace, few months to live. It is
my last wish to see that I disburse the money I kept to charity
organizations?
Because so much of my wealth has been plundered by relatives and friends
since my protracted illness, hence I cannot live with the agony of
entrusting this huge responsibility to any of them since the funds in
the Finance House is the last money that I have left. Right now I am
partially stranded in the hospital due to the nature of my sickness so I am
appealing to you to help, assist me collect ,retrieve the deposit from the Finance
House and disburse or use it for philanthropic purposes amongst
charitable institutions.

I would want you to use your discretion to disburse the money and keep
20% of it for your gratuity. Feel free to reimburse yourself when you have
the money for any cost you might have incurred during the process of
collecting and distributing the money to charity organizations. May the good Lord
bless you and your Family.
Please reply to this mail as I can only communicate through my laptop
which is by my bed, as soon as I get your response I shall then give you the
necessary information you need to collect this money.If you really want
to asist me please send in your information to proceed:

FULL NAME:
AGE:
OCCUPATION:
PHONE:
FAX:
NATIONALITY:

God bless you.
Mr. Roland Benneth.


Prueba el Nuevo Correo Terra; Seguro, rápido, fiable.

Monday, December 04, 2006

Way too much spam is repetitive




How sad is this? Actually at the moment over 1500 spams in my gmail. And all are repetitive - there don't seem to be any entertaining ones.
As bad as hotmail, except the ones that arrive at all in gmail aren't all in remote or added .gif images but in text.

In hotmail spams there aren't many spam emails left that would have actual text - it's all remote or added images.

In gmail it's all about these [random letters].ph or .pk financial advice that don't have anything to do with the subject line, or fake rolexes, 10,000 creative ways of spelling viagra and cialis, or a number of ways to make my woman enjoy. Oh too bad I am not a lesbian. Or I could make my male body part 4" longer if I had one... however that seems to be a bit passe' as the spam object.

So among the few enjoyable subjects seems to be running whois on all these illegal software ads.

Sunday, December 03, 2006

Mac software scammer aka XSALSA@GMAIL.COM

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs124699qbf;
Wed, 29 Nov 2006 04:48:27 -0800 (PST)
Received: by 10.49.55.13 with SMTP id h13mr13651538nfk.1164804507158;
Wed, 29 Nov 2006 04:48:27 -0800 (PST)
Return-Path:
Received: from transit-r1.garyzooe.com (pptpoe-pool-195-114-8-102.rustel-dsl.com [195.114.8.102])
by mx.google.com with ESMTP id q28si28990862nfc.2006.11.29.04.48.26;
Wed, 29 Nov 2006 04:48:27 -0800 (PST)
Received-SPF: pass (google.com: domain of bc@garyzooe.com designates 195.114.8.102 as permitted sender)
DomainKey-Status: bad
Received: (qmail 39415 invoked from network); 29 Nov 2006 12:48:18 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=garyzooe.com;
b=TEcyYq/I3fjAvTTmM3Jdrv2Ln7Ezse tS8oPHm42QEV0Zrq6DIL2N2pzfB8 iU/dioicqLUZUcltecKEh C7jbUsJM4mJy2JB5Ko/MTZZ7m6TCYuN9qtyneOyxknBb8rBypLsJg5SjlVjyKYV/oo6esm2d9EhHcD+K6M0fKucrx9I= ;
Received: from localhost (HELO localhost.localdomain) (127.0.0.1)
by localhost with SMTP; 29 Nov 2006 12:48:13 -0000
Received: (qmail 34625 invoked by uid 80); 29 Nov 2006 12:47:23 -0000
Date: 29 Nov 2006 12:47:23 -0000
From: DS Team special offers
To: [my email]
Reply-To: DS Team special offers
X-Priority: 3
List: DST
List-Archive:
List-ID:
List-Owner:
List-Subscribe:
List-Unsubscribe:
List-URL:
Message-ID: <20061129113425.25332096@garyzooe.com>
X-Mailer: Dada Mail 2.10.9
Content-type: multipart/alternative; boundary="----------=_1164789265-60776-0"; charset=iso-8859-1
MIME-Version: 1.0
Subject: 80%off on MAC versions of iView, Adobe, Macromedia, Symantec 2006 titles I

This is a multi-part message in MIME format...

------------=_1164789265-60776-0
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
Content-Length: 4249

(Mailing list information, including unsubscription instructions,
is located at the end of this message.)
__

� New Mac updates available ! Order any title of your
choice, contact our support via *members
support form* and get any other Mac title for free. This offer valid for
next 10 days only.
Ableton Live 5.0.1 for Mac
Retail Price $499.00
Our Price $49.95
You save $449.05
Adobe Acrobat 7.0 Pro for Mac
Retail Price $449.90
Our Price $69.95
You save $379.95
Adobe After Effects V 6.5 for Mac
Retail Price $699.00
Our Price $49.95
You save $649.05
Adobe Creative Suite 2 Premium for Mac
Retail Price $1199.00
Our Price $149.95
You save $1049.05
Adobe Creative Suite for Mac
Retail Price $1130.00
Our Price $99.95
You save $1030.05
Adobe InDesign CS for Mac
Retail Price $499.00
Our Price $49.95
You save $449.05
Adobe Photoshop CS for Mac
Retail Price $500.00
Our Price $49.95
You save $450.05
Adobe Photoshop Elements 3.0 for Mac
Retail Price $89.99
Our Price $39.95
You save $50.04
Adobe Photoshop Elements V 2.0
Retail Price $99.00
Our Price $19.95
You save $79.05
Corel Painter IX for Mac
Retail Price $429.00
Our Price $39.95
You save $389.05
Extensis SUITCASE X1 for Mac
Retail Price $99.95
Our Price $19.95
You save $80
Macromedia Contribute 3.11 for Mac
Retail Price $149.00
Our Price $39.95
You save $109.05
Macromedia Director MX 2004 for Mac
Retail Price $1199.00
Our Price $49.95
You save $1149.05
Macromedia Dreamweaver 8 for Mac
Retail Price $399.99
Our Price $49.95
You save $350.04
Macromedia Dreamweaver MX2004 for Mac
Retail Price $499.00
Our Price $39.95
You save $459.05
Macromedia Fireworks MX2004 for Mac
Retail Price $360.00
Our Price $29.95
You save $330.05
Macromedia Flash MX2004 for Mac
Retail Price $550.00
Our Price $39.95
You save $510.05
Macromedia Flash Pro 8 for Mac
Retail Price $699.00
Our Price $49.95
You save $649.05
Macromedia FreeHand MX for Mac
Retail Price $399.00
Our Price $39.95
You save $359.05
Macromedia Studio 8 for Mac
Retail Price $999.99
Our Price $99.95
You save $900.04
Macromedia Studio MX2004 for Mac
Retail Price $339.99
Our Price $69.95
You save $270.04
Roxio Popcorn
Retail Price $49.95
Our Price $19.95
You save $30
Roxio Toast 7.0 Titanium
Retail Price $99.95
Our Price $29.95
You save $70
StuffIt Deluxe 10 for Mac
Retail Price $79.99
Our Price $19.95
You save $60.04
Symantec Norton Antivirus 10.1 for Mac
Retail Price $49.95
Our Price $29.95
You save $20
Virtual PC 7.0 for Mac
Retail Price $249.99
Our Price $49.95
You save $200.04
iView Media 3 Pro
Retail Price $199.00
Our Price $0.00
You save $199
The full software list is available at DS Team website
Every effort
has been made to ensure the accuracy of all information contained
herein. DS Team makes no warranty expressed or implied with respect to
accuracy of the information, including price, product editorials or
product specifications. Product and manufacturer names are used only
for the purpose of identification. We appreciate your cooperation with
us and we'll be glad to see you as our clients in the future.
(C)
2003-2006, onDemand PTE. All rights reserved. All logos,
trademarks, etc. are property of their respectful owners.�
--
The following information is a reminder of your current mailing
list subscription:
You are subscribed to the following list:
DS Team special offers
using the following email:
[my email]
You may automatically unsubscribe from this list at any time by
visiting the following URL:
http://garyzooe.com/cgi-bin/dada/mail.cgi/u/DST/
If the above URL is inoperable, make sure that you have copied the
entire address. Some mail readers will wrap a long URL and thus break
this automatic unsubscribe mechanism.
You may also change your subscription by visiting this list's main screen:
http://garyzooe.com/cgi-bin/dada/mail.cgi/list/DST
If you're still having trouble, please contact the list owner at:
< mailto:news@garyzooe.com >
The following physical address is associated with this mailing list:
PO Box U342 Woods Centre
St. Johns, Antigua

[html content removed]
New Mac updates available ! Order any title of your
choice, contact our support via members
support form
and get any other Mac title for free. This offer valid for
next 10 days only.
The full software list is available at href="http://mac.popansoft.com"> DS Team website

Every effort has been made to ensure the accuracy of all information contained
herein. DS Team makes no warranty expressed or implied with respect to
accuracy of the information, including price, product editorials or
product specifications. Product and manufacturer names are used only
for the purpose of identification. We appreciate your cooperation with
us and we'll be glad to see you as our clients in the future.
(C) 2003-2006, onDemand PTE. All rights reserved. All logos,
trademarks, etc. are property of their respectful owners. 
The following information is a reminder of your current mailing
list subscription:
You are subscribed to the following list:
DS Team special offers
using the following email:
[my email]
You may automatically unsubscribe from this list at any time by
visiting the following URL:

http://garyzooe.com/cgi-bin/dada/mail.cgi/u/DST/

If the above URL is inoperable, make sure that you have copied the
entire address. Some mail readers will wrap a long URL and thus break
this automatic unsubscribe mechanism.
You may also change your subscription by visiting this list's main
screen:

http://garyzooe.com/cgi-bin/dada/mail.cgi/list/DST>

If you're still having trouble, please contact the list owner at:

news@garyzooe.com

The following physical address is associated with this mailing list:
PO Box U342 Woods Centre

St. Johns, Antigua
------------=_1164789265-60776-0--

Of which we get :

www.popansoft.com
Registrar: CAPITAL NETWORKS PTY LTD
[whois.pacnames.com]
PacNames WHOIS Server Version 1.1.0
Domain name: POPANSOFT.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA@GMAIL.COM)

Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSALSA@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.ZOPUSINFINITUS.COM
Name Server: NS2.ZOPUSINFINITUS.COM
Domain creaton date: 2006-11-24 21:00:38.0
Domain expiration date: 2007-11-25 02:18:23.0

The address of the domain registrant is illegal and inexistant.
And surprise surprise

PacNames WHOIS Server Version 1.1.0
Domain name: GARYZOOE.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: TOTALNIC-128733 (XSALSA@GMAIL.COM)

Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Administrative, Technical Contact: TOTALNIC-128733 (XSALSA@GMAIL.COM)
Alex Rodrigez
Alex Rodrigez
PO box 109 WP 1432
Lappeenranta NA 53101
FI
Telephone: +358.207818027
Fax: +358.207818027
Name Server: NS1.ZOPUSINFINITUS.COM
Name Server: NS2.ZOPUSINFINITUS.COM
Domain creaton date: 2006-11-28 20:00:21.0
Domain expiration date: 2007-11-29 01:17:46.0

Bulp purchased domains using http://www.pacnames.com as registrant. Illegal addresses.
What I would LIKE to do is to inform the software writers about these spammers, but after reporting has (ten attempts) never got any results, why bother.

You won flight tickets again

Umh.

So, I have won fligth tickets for free.
Great. How come this spam is trying to tell it was coming from yahoo groups? That I don't even belong to.
This pisses me off. So, off you go to the internet now, to get your own medicine, with the added for convenience a href mailto tags.

X-Message-Status: n:0
X-SID-PRA: newsletter-bounces@dealsforeach.com
X-Message-Info: LsUYwwHHNt25DSl5BTYbNBSdBGHBh1ce2wlc9pUtsSg=
Received: from dealsforeach.com ([216.83.214.205]) by bay0-mc3-f4.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444);
Sun, 3 Dec 2006 02:44:41 -0800
Received: by dealsforeach.com id he9i3s09bo45; Sat, 2 Dec 2006 22:42:44 -0700 (envelope-from )
Message-ID: <31209568.4732982905890.JavaMail.SYSTEM@DESLLO11>
Date: Sat, 2 Dec 2006 22:42:44 -0700
To: [my email]
Mime-Version: 1.0
From: Reservation Dept.
Subject: Airline Flight Reservation_Participation_Confirmation
List-Unsubscribe: ,

List-Archive:
List-Post:
List-Help:
List-Subscribe: ,

Content-Type: text/html
Content-Transfer-Encoding: 7bit
Sender: newsletter-bounces@dealsforeach.com
Errors-To: newsletter-bounces@dealsforeach.com
Return-Path: flight@dealsforeach.com
X-OriginalArrivalTime: 03 Dec 2006 10:44:41.0313 (UTC) FILETIME=[09913510:01C716C8]

The Daily Enlightenment
Complete Being | Mantras | Taking Praise | Good or Bad News? | Heari
From:
NamoAmituofo
Message

amituofosg

Fri Dec 1, 2006 8:34 pm (PST)
TheDailyEnlightenment.comWeekly 02.12.06

Quote:

See http://thedailyenlightenment.com/pjnew for Chinese TDE. To subscribe to the above, email thedailyenlightenment-subscribe@yahoogroups.com TDE-Weekly (TheDailyEnlightenment.com) is a free multi-traditional Dharma inspiration e-newsletter (members:25,000+) run by kmspks.org. Please support us by contributing articles and encouraging friends to subscribe. Contributions, suggestions and queries are welcomed at comment@TheDailyEnlightenment.com The opinions in the articles, and those of event organisers do not necessarily reflect ours. The copyright of the articles belong to the authors and are not to be reproduced without permission. (Ads are not placed by TDE-Weekly.)
Yahoo! Groups
Change settings via the Web (Yahoo! ID required)

Change settings via email: Switch delivery to Individual | Switch format to Traditional


Visit Your Group
|

Yahoo! Groups Terms of Use
|

Unsubscribe

Thursday, November 30, 2006

YAHOO/MSN INC AND THE MICROSOFT WINDOWS LOTTERY OF £500,000.00

Oh, this is a hilarious spam.
Yahoo, MSN, and Microsoft Windows collaborating for lotteries... a £500,000.00 price, and they use a yahoo email address??


From: fallbrookgirl@adelphia.net
Subject: YOU HAVE WON THE YAHOO/MSN INC AND THE MICROSOFT WINDOWS LOTTERY OF £500,000.00
Date: November 30, 2006 2:09:58 AM GMT+00:00
To: undisclosed-recipients: ;
Reply-To: windows04_boardagents@yahoo.com
Return-Path:
Received: [...]
Received: from web19 ([68.168.75.45]) by mta16.adelphia.net (InterMail vM.6.01.05.04 201-2131-123-105-20051025) with ESMTP id <20061130015349.JXTW26381.mta16.adelphia.net@web19>; Wed, 29 Nov 2006 20:53:49 -0500
Message-Id: <25949024.1164852599077.JavaMail.root@web19>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
Sensitivity: Normal
X-Brightmail-Tracker: AAAAAA==
Original-Recipient: [....]

Yahoo/MsnLottery Incoperation
Baley House, Har Road
Sutton, Greater London
SM1 4te
United Kingdom

This is to inform you that you have won a prize money of(£500,000) FIVE HUNDRED THOUSAND GREAT BRITAIN POUNDS STERLINGS for the month of NOVEMBER 2006 Lottery promotion which is organized by YAHOO/MSN LOTTERY INC & WINDOWS LIVE.
YAHOO/MSN AND MICROSOFT WINDOWS, collects all the email addresses of the people that are active online, among the millions that subscribed to the web. we only select five people every Month as our winners through electronic balloting System without the winner applying,we congratulate you for being one of the people selected.
PAYMENT OF PRIZE AND CLAIM
You are to contact your Claims Agent on or before your date of Claim, Winners Shall be paid in accordance with his/her Settlement Centre.
Yahoo/Msn Lottery Prize must be claimed no later than 15 days from month of Draw Notification after the Draw date in which Prize was won.Any prize not claimed within this period will be forfeited.
These are your identification numbers:

Batch number.....................YM 09102XN
Reff number.......................YM35447XN
Winning number...................YM09788
These numbers fall within your Location file,you are requested to contact EVENTS AGENT MANAGER,send your winning identification numbers to them at this contact address below.
(CONTACT EVENTS AGENT MANAGER)
Mr.Peter Davidson
EMAIL:windows04_boardagents@yahoo.com

You are therefore advised to send the following information to the EVENTS AGENT Manager for him to process your wins.
1. Full name..............
2. Sex..............
3. Country................
4. State.............
5. Contact Address........
6. Telephone Number.......
7. Marital Status.........
8. Occupation.............
9. Age....................
10.Nest Of Kin..........
11.Zip Code.............
Congratulations once again.
Dr. Samson Bent
(Lottery Co-ordinator)

Wednesday, September 20, 2006

Internet connection in Zimbabwe shut down - if only in Nigeria too...

The internet connections in Zimbabwe are closed due to unpaid debt of the customer's of the government owned TelOne.

Now if this news only would have been for Nigeria, it would have reduced the spams in the inboxes by a lot.

Or wait .. I haven't received that many spams by all these Nigerian scammers for the past few days. Maybe some of them were in Zimbabwe then...

Sunday, July 30, 2006

Natwest Bank, London with a spammy email address offering millions for me...

After a long time offline, and only seeing stock spam (of which I WILL find the originator of spam, and do evil things to his/theirs emails), this felt at least different.

So NATWEST BANK PLC (will all capital letters) sends me email using walla.com email address, and sending the spam via terra.mx?
As good as all these people emailing from Central Bank of Nigeria using any free email service such as lycos, hotmail, or yahoo.

Hm ... so if I would have had such millions payments from Nigeria, shouldn't tehy have called me? Or how about a t least using your Natwest Bank PLC supplied email address, not using an email provider that I have yet not been seen used by anyone else than spammers?

Here ya go anyway, anyone want to receive these millions from UK? Free free to email these people.

I also love how they don't bother adding an address to this "bank". Of course London is so small, it's just as good as having a 34th Spammer cafe on 4th Street on West, Some Slum in Lagos outskirts, Lagos.

From: natwest_bank_plc@terra.com.mx
Date: July 25, 2549 BE 5:09:58 AM GMT+01:00
To: undisclosed-recipients: ;
Return-Path: natwest_bank_plc@terra.com.mx
[....]
Received: from terra.com.mx (xnmwebmail4.terra.com [66.231.227.74]) (authenticated user natwest_bank_plc!terramx)by xnmsmtp1.terra.com (Postfix) with ESMTP id 630692240E6; Tue, 25 Jul 2006 00:09:58 -0400 (EDT)
Message-Id:
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="_=__=_XaM3_.1153800598.2A.395783.42.19376.52.42.007.1847162469"
Received-Spf: none (xnmsmtp1.terra.com: 66.119.66.67 is neither permitted nor denied by domain of terra.com.mx) client-ip=66.119.66.67; envelope-from=natwest_bank_plc@terra.com.mx; helo=terra.com.mx;
X-Terra-Karma: 0%
X-Terra-Hash: 1eed97e6dabd2c7cacc7f2d8cf2409f8
X-Sensitivity: 3
X-Xam3-Api-Version: 4.1 (B108)
X-Senderip: 86.62.8.178
Original-Recipient: [my email]

ahmed@ahmedtest.net NATWEST INTERNATIONAL BANK PLC LONDON UNITED KINGDOM.
Tel: 447024014666
Tel: 447040111097

Dear Friend,
This is to notify you about the status of your fund right
now in our desk. After due vetting and evaluation of your
contract file, which The Ministry Of Finance Of Federal
Republic of Nigeria Forwarded and contracted us to see to
your immediate payment.
From our findings, you have been going through hard ways by
paying a lot of charges to see to the release of your fund,
which has been delayed. Please, from now henceforth stop
further communication with any correspondence from Nigeria.
You are not to pay any charges to receive your contract fund
anymore as you have meet up with the whole requirements.
Your representatives in Nigeria will tell you to still go
ahead with them but on your own risk.
The only thing required from you is to forward your
Non-Resident Clearance Form/Receipt to this office. The
Government of Nigeria has paid us for handling/processing of
your payment with other contractors. As soon as we receive
the form from you, We (NATWEST INTERNATIONAL BANK PLC, LONDON)
will effect your payment immediately.
Will you follow up our directives, your fund will reflect in
your account within seven working days from the day you we
receive the form from you. Do not respond to a ny
correspondence again but only to this offshore payment
office here in London if you're really the beneficiary and
want you contract fund to be released immediately.

Direct all message email address ID: natwest_bank_plc11@walla.com
Dr. Joshua Larry
Payment Coordinator
Natwest International Bank Plc.
London U.K

natwest_bank_plc11@walla.com

Thursday, July 20, 2006

A collection of the more amusing and strange porn spams

Porn spam is once again on the rise. Here's a summary of what I'm seeing these days broken down in to neat categories.


Confusing


New start out specific nest of y0ung girls


I wasn't aware that young girls lived in nests. I wonder what they build them out of? I'm guessing discarded cloth, twigs and saliva. That web site probably isn't safe for work viewing, that idea makes Japanese porn seem boring.


Brutal d01ls worldwide


Not sure this is porn actually, I think I already own one of these brutal dolls. It's a toy (okay, it's a doll) based on a the character Grom Hellscream. A pretty brutal toy even if his rubber axe has a habit of bending a bit.


Success!

(This is a series of spam emails who's subjects always consist of "Success, ". This has led to subject likes "Success, world war" (yeah, we're all happy when another of those comes along), "Success, way freight" and so on.


Subject: Success, writing lesson

Your cre dit doesn't matter to us! If you OWN real est ate
and want IMMEDIATEK cash to spend ANY way you like, or simply wish
to LOWER your monthly paym ents by a third or more, here are the dea ls
we have TODAY (hurry, these ofers will expre TONIGHT):

$488,000.00 at a 3.67,% fixed-rateL
$372,000.00 at a 3.90,% variable-rateA
$492,000.00 at a 3.21,% interest-onlyS
$248,000.00 at a 3.36,% fixed-rate1
$198,000.00 at a 3.55,% variable-rateY

Hurry, when these deals are gone, they are gone Simply fill out this one-min ute form...

Don't worry about approval, your cre dit will not disqualify you!


I think they spoke to early. I'm happy that the spam writer considers their writing lessons to be a success but on reading their mail I doubt they were paying much attention in class. Mind you, a they aren't as stupid as the twats who'd fall for such an obvious scam.

"Wow, a bank I've never heard of before sent me an email typed by baboons and proof-read by a professional footballer which promised me a mortage without knowing where I live, who I am or what my current financial situation is. I'd better be quick and go to this web site and give them my personal financial details including my bank account number and any other information a criminal would need to rob me blind. Reminds me, I need to buy some lottery tickets later, better stop at the fortune teller to see what numbers I'll use."


Mum?

These are emails from a chap who's mother and girlfriend add up to fewer than two people. Problem still only two if you add his sister. They're particularly amusing since they seem like very poorly translated lyrics from a hentai film theme tune.



Withb my shot on inside mothers rear wide outlet I had eat seeds running falling out of her.


Okay, the idea itself is pretty unpleasant but you've got to enjoy the English. Rear wide outlet? Does anyone in the world actually refer to their arse in this way or does his mother have some kind of special arse that alone deserves this name?


Because with mome indeed allows
myself to desrtoy all enters with strongr attacks.


They're keeping it in the family still but what the fuck are they keeping in the family? I am honestly baffled by this text.

Tuesday, July 11, 2006

LETS WORK OUT THE TRANSFER OF $25MILLION TO YOUR PRIVATE ACCOUNT CONTACT ME FOR MORE DETAILS (NNPC) NIGERIA

This week's delight ... imagine, I had totally forgotten that some Nigerian banker with a UK Singaporean yahoo email address, needed my banking details to arrange the transfer of these $ 25 million ....

From: gregmute2000@yahoo.com.sg
Subject: LETS WORK OUT THE TRANSFER OF $25MILLION TO YOUR PRIVATE ACCOUNT CONTACT ME FOR MORE DETAILS (NNPC) NIGERIA
Date: July 11, 2549 BE 10:20:52 AM GMT+01:00
To: [my email]
Reply-To: greggreg58@yahoo.co.uk
Return-Path:
Received: [..[ (qmail 9951 invoked by uid 60001); Tue, 11 Jul 2006 09:20:52 +0000
Received: from [196.3.62.3] by web55805.mail.re3.yahoo.com via HTTP; Tue, 11 Jul 2006 02:20:52 -0700 (PDT)
Message-Id: <20060711092052.xxxxxx.qmail@web55805.mail.re3.yahoo.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="0-894308545-1152609652=:6560"
Content-Transfer-Encoding: 8bit
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com.sg; h=Message-ID:Received:X-RocketDSI:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=ac6arCE/au2cGiJTmWDfpK2BoaOWBMHWjxUkHvTDa+gMt/9PKCCU[...]RjxVBcGbus8EIr98Ae/YBCLlGuxfQdkrOJ41XVqo+VnXgAnE+k7obhWrT0z3WKndjEQ= ;
X-Rocketdsi: i=216.252.110.51;s=w
X-Spam-Flag: YES
X-Brightmail-Tracker: AAAADQL/OgsC/zoxAv890gL/PcsC/0OvAv87bAL/QTsC/znQAv84agL/QL4C/zh7Av84bQL/RS0=
Original-Recipient: [an email]

I have a new email address!
You can now email me at: gregmute2000@yahoo.com.sg

Dear Friend


Am contacting you for this transfer of money to your Bank Account

Greg Mute

- Greg Mute

Monday, May 22, 2006

Sensattion'alll revolution #2

Spam hunting for Sensatttional revolution in medicine # 2


X-Gmail-Received: 38f6828ae5da9d57dd80f414d77f064be6d79ed5
Delivered-To: [my email]
Received: by 10.70.69.11 with SMTP id r11cs321099wxa;
Mon, 22 May 2006 12:30:08 -0700 (PDT)
Received: by 10.78.51.16 with SMTP id y16mr1200803huy;
Mon, 22 May 2006 12:30:07 -0700 (PDT)
Return-Path:
Received: from 72.14.215.27 ([210.218.232.119])
by mx.gmail.com with SMTP id 37si1295812hub.2006.05.22.12.30.00;
Mon, 22 May 2006 12:30:07 -0700 (PDT)
Received-SPF: neutral (gmail.com: 210.218.232.119 is neither permitted nor denied by best guess record for domain of UYRDBWEFVTYN@csaw.com)
Received: from draftsmanpeternixon.net [76.112.255.149] (helo=composition.vergenet.net)
by smtp0.cistron.nl with esmtp (beach)
id 5AQ6iH-2992CR-00; Mon, 22 May 2006 15:29:59 -0500
Date: Mon, 22 May 2006 18:29:59 -0200
Message-ID: <6834B67C.3929107@larynx.peternixon.net>
From: "Anderson Lynn"
To: [another email address]
Subject: Fwd: REPLY
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031013 Thunderbird/0.3
X-Accept-Language: en-us, en


-S'ensationall revoolution in m'edicine!

-E'n'l'a'r'g'e your p''enis up to 10 cm or up to 4 inches!

-It's herbal solution what hasn't side effect, but has 100% guaranted results!

-Don't lose your chance and but know wihtout doubts, you will be impressed with results!

Clisk here: http://associationexchange.info



bitterroot thatch homology journey regretful nolo irresolution armhole dreamboat amethystine
curd scabious archetype polymorph elder postulate grater dosimeter sectarian
complexion muzak concurred crummy grizzly snuggle balzac ticklish whitetail embarrass sunbonnet
kiss raze baleful salvatore fiasco mattson speed lost
portia evaluate staid longtime textile margo duplex afresh
behind congressman incise bifurcate mosque testes disquietude pulitzer




Domain Name:ASSOCIATIONEXCHANGE.INFO
Created On:20-May-2006 21:47:12 UTC
Last Updated On:21-May-2006 08:45:34 UTC
Expiration Date:20-May-2007 21:47:12 UTC
Sponsoring Registrar:RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_3042873
Registrant Name:emmanuel muller
Registrant Organization:emmanuel
Registrant Street1:rue des colimacons 15
Registrant Street2:
Registrant Street3:
Registrant City:clermont
Registrant State/Province:NA
Registrant Postal Code:60600
Registrant Country:FR
Registrant Phone:+1.33344503520
Registrant Phone Ext.:
Registrant FAX:+1.33344503520
Registrant FAX Ext.:
Registrant Email:muller@perovo.net
Admin ID:DI_3042873
Admin Name:emmanuel muller
Admin Organization:emmanuel
Admin Street1:rue des colimacons 15
Admin Street2:
Admin Street3:
Admin City:clermont
Admin State/Province:NA
Admin Postal Code:60600
Admin Country:FR
Admin Phone:+1.33344503520
Admin Phone Ext.:
Admin FAX:+1.33344503520
Admin FAX Ext.:
Admin Email:muller@perovo.net
Billing ID:DI_3042873
Billing Name:emmanuel muller
Billing Organization:emmanuel
Billing Street1:rue des colimacons 15
Billing Street2:
Billing Street3:
Billing City:clermont
Billing State/Province:NA
Billing Postal Code:60600
Billing Country:FR
Billing Phone:+1.33344503520
Billing Phone Ext.:
Billing FAX:+1.33344503520
Billing FAX Ext.:
Billing Email:muller@perovo.net
Tech ID:DI_3042873
Tech Name:emmanuel muller
Tech Organization:emmanuel
Tech Street1:rue des colimacons 15
Tech Street2:
Tech Street3:
Tech City:clermont
Tech State/Province:NA
Tech Postal Code:60600
Tech Country:FR
Tech Phone:+1.33344503520
Tech Phone Ext.:
Tech FAX:+1.33344503520
Tech FAX Ext.:
Tech Email:muller@perovo.net
Name Server:DNS1.REGISTERFLY.COM
Name Server:DNS2.REGISTERFLY.COM
Name Server:DNS3.REGISTERFLY.COM


Which gives us back to the registerfly and the sensatttional revolution in medicine #1

- same, not valid registrar details as in the #1.

Bookmyname.com again ....

X-Gmail-Received: 57e23de077f925ef264ad7e5ad55d3547ad7c76d
Delivered-To: [my email]
Received: by 10.70.69.11 with SMTP id r11cs315277wxa;
Mon, 22 May 2006 10:16:11 -0700 (PDT)
Received: by 10.36.75.6 with SMTP id x6mr5715619nza;
Mon, 22 May 2006 10:16:10 -0700 (PDT)
Return-Path:
Received: from interbusiness.it (69-171-233-239.clspco.adelphia.net [69.171.233.239])
by mx.gmail.com with SMTP id 16si1855077nzo.2006.05.22.10.16.10;
Mon, 22 May 2006 10:16:10 -0700 (PDT)
Received-SPF: neutral (gmail.com: 69.171.233.239 is neither permitted nor denied by domain of cowlmar@interbusiness.it)
Message-ID: <000001c67dc3$657be170$5381a8c0@fht24>
Reply-To: "Marissa Cowley"
From: "Marissa Cowley"
To: [my email]
Subject: Re: test VvtAGGRA
Date: Mon, 22 May 2006 10:16:00 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C67D88.B91D0970"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C67D88.B91D0970
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,
=20
L E V / T R A
M E R / D / A
S O M ^
P R O Z ^ C
X ^ N A X
V / A G R A
V A L / U M
A M B / E N
C / A L / S
=20
http://www.bunotacke.com
=20
=20
=20
=20
=20
below because of the overhang of the cliff, nor from further off because
it was so small that it looked like a dark crack and no more. It was not
a cave and was open to the sky above; but at its inner end a flat wall=20
rose up that in the lower I part, close to the ground, was as smooth and
upright as masons work, but without a joint or crevice to be seen.=20
No sign was there of post or lintel or threshold, nor any sign of=20


------=_NextPart_000_0001_01C67D88.B91D0970
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


L E V / T R A

M E R / D / A

S O M ^

P R O Z ^ C

X ^ N A X

V / A G R A

V A L / U M

A M B / E N

C / A L / S
 

=
 

 

 

 

 

below because of the overhang of the =
cliff, nor from further off because
it was so small that it looked =
like a dark crack and no more. It was not
a cave and was open to the =
sky above; but at its inner end a flat wall
rose up that in the =
lower I part, close to the ground, was as smooth and
upright as =
masons work, but without a joint or crevice to be seen.
No sign =
was there of post or lintel or threshold, nor any sign of =


------=_NextPart_000_0001_01C67D88.B91D0970--

#########

Gives

Domain Name : bunotacke.com (BUNOTA2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Billing Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Technical Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Domain servers :
ns0.anothegisa.com (NAC230-BMN-HST)

ns0.sigumebersi.com (NSC202-BMN-HST)

Created on 05/20/2006 17:00:03
Updated on 05/21/2006 10:19:21
Expires on 05/20/2007 13:00:03

Our friend bookmyname gets some mail again ...

Sensatttttionnnaaalll revolution in medicine with typos, #1

Of the kind that I was annoyed by earlier.
Of the billion different ways to typo sensational revolution in medicine.

Here we go, let's hunt them back one by one.

X-Apparently-To: [my email address] via 206.190.48.153; Mon, 22 May 2006 12:05:13 -0700
X-YahooFilteredBulk: 70.127.155.110
X-Originating-IP: [70.127.155.110]
Return-Path:
Authentication-Results: mta306.mail.scd.yahoo.com from=messe-duesseldorf.de; domainkeys=neutral (no sig)
Received: from 70.127.155.110 (HELO 110-155.127-70.tampabay.res.rr.com) (70.127.155.110) by mta306.mail.scd.yahoo.com with SMTP; Mon, 22 May 2006 12:05:11 -0700
Received: from micro.webhost8.alterusa.com id CFB67284DE; Mon, 22 May 2006 18:00:16 -0200
Received: by desultory.webhost1.starnetusa.net (Postfix, from userid 308) id CFB63724DE; Mon, 22 May 2006 21:03:16 +0100
Date: Tue, 23 May 2006 02:03:16 +0600
Message-Id: <21041130090241.CFB3859DE@age.starnetusa.net>
From: "Brady Carr" Add to Address Book Add Mobile Alert
To: [another email address showing here]
Subject: Order Delivery
Content-Length: 749
-S'ensationall revoolution in m'edicine!

-E'n'l'a'r'g'e your p''enis up to 10 cm or up to 4 inches!

-It's herbal solution what hasn't side effect, but has 100% guaranted
results!

-Don't lose your chance and but know wihtout doubts, you will be
impressed with results!

Clisk here: http://yaoph.info


chariot convair pitchfork bullock taos sake rectify nine chou christy
propylene scapegoat brindisi deplore emit franchise bluebird silty tic
spin mathews field energy pottery chemisorption transverse freetown
anhydrite apparent census
cagey knickerbocker vita somers supply postpone aspire chosen
gretchen centerpiece coercion dragnet rebuke interception thiocyanate
bombard
caveman fin rotc ink sculptor staircase switchboard sextuple




Of which we can find out the following :

Domain ID:D13489530-LRMS
Domain Name:YAOPH.INFO
Created On:20-May-2006 22:14:42 UTC
Last Updated On:21-May-2006 07:52:05 UTC
Expiration Date:20-May-2007 22:14:42 UTC
Sponsoring Registrar:RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_3042873
Registrant Name:emmanuel muller
Registrant Organization:emmanuel
Registrant Street1:rue des colimacons 15
Registrant Street2:
Registrant Street3:
Registrant City:clermont
Registrant State/Province:NA
Registrant Postal Code:60600
Registrant Country:FR
Registrant Phone:+1.33344503520
Registrant Phone Ext.:
Registrant FAX:+1.33344503520
Registrant FAX Ext.:
Registrant Email: muller@perovo.net
Admin ID:DI_3042873
Admin Name:emmanuel muller
Admin Organization:emmanuel
Admin Street1:rue des colimacons 15
Admin Street2:
Admin Street3:
Admin City:clermont
Admin State/Province:NA
Admin Postal Code:60600
Admin Country:FR
Admin Phone:+1.33344503520
Admin Phone Ext.:
Admin FAX:+1.33344503520
Admin FAX Ext.:
Admin Email: muller@perovo.net
Billing ID:DI_3042873
Billing Name:emmanuel muller
Billing Organization:emmanuel
Billing Street1:rue des colimacons 15
Billing Street2:
Billing Street3:
Billing City:clermont
Billing State/Province:NA
Billing Postal Code:60600
Billing Country:FR
Billing Phone:+1.33344503520
Billing Phone Ext.:
Billing FAX:+1.33344503520
Billing FAX Ext.:
Billing Email: muller@perovo.net
Tech ID:DI_3042873
Tech Name:emmanuel muller
Tech Organization:emmanuel
Tech Street1:rue des colimacons 15
Tech Street2:
Tech Street3:
Tech City:clermont
Tech State/Province:NA
Tech Postal Code:60600
Tech Country:FR
Tech Phone:+1.33344503520
Tech Phone Ext.:
Tech FAX:+1.33344503520
Tech FAX Ext.:
Tech Email: muller@perovo.net
Name Server:DNS1.REGISTERFLY.COM
Name Server:DNS2.REGISTERFLY.COM
Name Server:DNS3.REGISTERFLY.COM


Of which ...

http://registerfly.com/ shows the following ... bulk registrations - "Bulk registrations. Search and register up to 300 names at once
Bulk Transfers - Transfer up to 100 names at once
Bulk renewals - Renew a single, multiple or all of your names at once" - now please someone come up with ONE legitimate reason for bulk registrations? Apart of spam, I can't find any, not a single reasson.


Well, as they promise the following
"We provide you your own unique spam-filtered email address. We scrub and spam/virus filter all emails sent to your Spam Filtered email address" the least we could expect from them is to not host sites that send me spam.

The minimum we can come up with the domain registration details is the following:

- the phone number is not valid. It is not a valid phone number for nor USA neither France.
- the address is not valid. Again a confusion by registrant about the country they were residing in.
- email address MAY be valid but it's on a Russian site, which makes both the phone and physical address details even less affidable.


part #2

How to chase spam

A great simple how to chase spam instructions.

Unfortunately I haven't found any good spam recently, it's all this sensattionnal revoluttttion in medicine with more typoes than I have ever seen. Maybe 120 different versions of that viagra and related spam in the past 2 weeks - who knows, maybe I get bored enough to actually start to hunt these rrrr'e"vvvolutTTiiioonal pe0pl3. Stay tuned.

Friday, May 12, 2006

All these software spam sites seem to be registered as bulk sites via bookmyname.com

So, a typical software spammer and scammer ... that keeps going on and on and on and on and on. I wonder how long it will be before http://www.bookmyname.com would have to care? According ot the website, they don't. No anti-spamming policies on the domains registered via them. Too bad.
But what could you expect from a domain that allows bulk domain registrations? Would desk@BookMyName.com really care?

So would a compilation of the previous spam spam spammety spam by the people registered their bulk of spam and scam domains using bookmyname.com as registrar service, with regular enough updates do? Let's see - at least as long as gmail doesn't completely block these e@##@%$^ spams even out of my spam folders.

Thus updating ...

Mail, today:

X-Gmail-Received: eb71238aebe7e1fdf0bf5427c28ef3fb5b4e419d
Delivered-To: [my email]
Received: by 10.70.71.13 with SMTP id t13cs97601wxa;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Received: by 10.36.108.5 with SMTP id g5mr88809nzc;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Return-Path:
Received: from -1212939104 (vsg94-1-82-234-116-246.fbx.proxad.net [82.234.116.246])
by mx.gmail.com with SMTP id c12si11401602nzc.2006.05.12.01.29.13;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Received-SPF: neutral (gmail.com: 82.234.116.246 is neither permitted nor denied by best guess record for domain of settle@globalmedtech.com)
Received: from globalmedtech.com (-1210574040 [-1211124016])
by vsg94-1-82-234-116-246.fbx.proxad.net (Qmailv1) with ESMTP id FAB147FAE7
for ; Fri, 12 May 2006 17:30:33 -0400
Date: Fri, 12 May 2006 17:30:33 -0400
From: "Mastodon O. Masqueraders"
X-Mailer: The Bat! (v2.00.3) Personal
X-Priority: 3
Message-ID:
To: [my name and email]
Subject: Software
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-AntiVirus: Checked by Dr.Web (http://www.drweb.net)

some software u need!
75% Off for All New Software. microsoft, adobe, macromedia!

New software on our site:

Creative Suite Premium (5 CD) - $149.95
Office XP Professional - $79.95
Encarta Encyclopedia Delux 2004 (3CD) - $89.95
Office 2003 Professional (1 CD Edition) - $89.95
Flash MX 2004 - $69.95
InDesign CS - $69.95
Photo Painter 8 - $59.95
Acrobat 6 Professional - $79.95
Photoshop 7 - $69.95
Quark Xpress 6 Passport Multilanguage - $69.95
Windows 98 Second Edition - $49.95
Premiere 7 - $69.95
InDesign CS - $69.95
Premiere 7 - $69.95

Our site:
http://6duvb0u7udcj7oo1b66jbooo.unstaidda.com/


Of which whois run:

Domain Name: UNSTAIDDA.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: FF.GENOSMG.COM
Name Server: DD.GENOSMG.COM
Status: ACTIVE
Updated Date: 10-may-2006
Creation Date: 10-may-2006
Expiration Date: 10-may-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

DOMAIN
Domain Name : unstaidda.com (UNSTAI2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)
417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Billing Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)
417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Technical Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)

417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Domain servers :
ff.genosmg.com (FGC2-BMN-HST)
dd.genosmg.com (DGC14-BMN-HST)

Created on 05/10/2006 11:11:28
Updated on 05/10/2006 12:15:01
Expires on 05/10/2007 07:11:28


Of which you know what? I don't believe Slumminas SLUMMINAS or Tram TELPIL are real names.
I don't think phone numbers with inexistent region codes, and with registrar mailing addresses being in USA while their phone numbers are in Poland and other countries, are anywhere near valid argument for registrant details.
Well, time to like Rick's spam digest for best howto.

As a minimum, still totally ignoring the no-spam and no scam-sites hosting policies mentioned, at least I can say the whois data for the domains registered via bookmyname, is suspect.

And this based only on a sample of spams that I have received, and whois run on the domains the spams were for.

Thursday, May 11, 2006

A typical software scammer

X-Gmail-Received: 9f2a37f63e8ea5e9c7b9d541d3c5812c8d5e5556
Delivered-To: [my email]
Received: by 10.70.71.13 with SMTP id t13cs286502wxa;
Wed, 3 May 2006 21:42:31 -0700 (PDT)
Received: by 10.49.36.20 with SMTP id o20mr346861nfj;
Wed, 03 May 2006 21:42:30 -0700 (PDT)
Return-Path:
Received: from -1212146352 ([220.74.2.100])
by mx.gmail.com with SMTP id d2si2212133nfe.2006.05.03.21.42.28;
Wed, 03 May 2006 21:42:30 -0700 (PDT)
Received-SPF: neutral (gmail.com: 220.74.2.100 is neither permitted nor denied by best guess record for domain of heksterb@gijonmotorclub.com)
Received: from gijonmotorclub.com (-1208692080 [-1208674456])
by greenleafforestry.com (Qmailv1) with ESMTP id A281C243B7
for ; Thu, 04 May 2006 00:53:41 -0400
Date: Thu, 04 May 2006 00:53:41 -0400
From: "Stereotypes V. Loudmouths"
X-Mailer: The Bat! (v2.00.4) Personal
X-Priority: 3
Message-ID:
To: [my name and email]
Subject: Software
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by Ameriserv.net Anti-Virus E-Gateway

All best software!
some software u need!

New software on our site:

Creative Suite Standard (3 CD) - $129.95
Windows NT 4.0 Server - $49.95
FileMaker 7.0 Professional - $69.95
Photoshop CS with ImageReady CS - $99.95
InDesign CS PageMaker Edition (2CD) - $69.95
Flash MX 2004 - $69.95
Windows 98 Second Edition - $49.95
Studio MX 2004 with Director MX 2004 - $139.95
Photoshop CS with ImageReady CS - $99.95
Acrobat 6 Professional - $79.95
SQL Server 2000 Enterprise Edition - $69.95
Money 2004 - $69.95
Fireworks MX 2004 - $69.95
Windows 98 - $49.95

Our site:
http://im6b6vncoqnd10id5iiv50ii.energydd.com/

####

Great. What is it with these software sites that they NEVER ever publish the address of where they themselves are located? Maybe because what they claim to be doing, would not be legal in USA, or in any western world country.

Know what? You can't buy this OEM software legally, no matter if it was claimed to be sold and manufactured to you by Adobe, Dell, Apple, HP, Sony, or Macromedia. It's not legal.

So, if these sites never want to announce who they really are, whois your friend...

####

Domain Name: ENERGYDD.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: WE.REDAMAGEDG.COM
Name Server: ST.REDAMAGEDG.COM
Status: ACTIVE
Updated Date: 02-may-2006
Creation Date: 02-may-2006
Expiration Date: 02-may-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

DOMAIN
Domain Name : energydd.com (ENERGY4-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Billing Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Technical Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Domain servers :
we.redamagedg.com (WRC5-BMN-HST)

st.redamagedg.com (SRC6-BMN-HST)


Created on 05/02/2006 14:48:38
Updated on 05/02/2006 17:41:27
Expires on 05/02/2007 10:48:38

Interesting. USA and Oregon as a state, so why do these "Americans" have a phone number listed and located in Poland?

If you buy pirated software from an "American" company located in Poland or whoever knows where, why would that be less illegal than buying just "regular" illegal software?

At leaast get some more sympathy points from me, and list the location (mailing address) in the next software scamming site.

... and guess what? Checking some other recent spams, I found this

Domain Name: PALAITECE.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: QO.NEEDINGEI.COM
Name Server: MO.NEEDINGEI.COM
Status: ACTIVE
Updated Date: 27-apr-2006
Creation Date: 27-apr-2006
Expiration Date: 27-apr-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

Domain Name : palaitece.com (PALAIT2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Billing Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Technical Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Domain servers :
qo.needingei.com (QNC2-BMN-HST)

mo.needingei.com (MNC5-BMN-HST)

Created on 04/27/2006 16:39:24
Updated on 04/27/2006 18:00:39
Expires on 04/27/2007 12:39:24

Tram Telpil? What the heck of name is that? That sounds like a name for a tram driver in a Polish c-category movie from the 1930s. At least the billing address and phone number of this guy this time aren't in Poland.


####

Hmm... so all this data such as

ENERGY4-BMN-DOM
MILLER14-BMN-PE
PALAIT2-BMN-DOM
TELPIL2-BMN-PE
QNC2-BMN-HST
MNC5-BMN-HST
PTISAN2-BMN-DOM
BENZLE2-BMN-PE
QNC2-BMN-HST

Comes to interesting stuff. Indeed.
And wide spamming by can be googled easy by the same person or society already last year. The same people here, here, here, here... so I would be too late to suggest this spammer to try something new such as trying to sell other than software. He's been already a Nigerian, "paying" via private persons bank accounts, and sending normal cialis and viagra spam.

Really, I should bother to hunt down this guy, and sue him for $ 1,000 for each spam I have ever received from him.

It would be easier if http://www.bookmyname.com would have an antispam policy - according ot the website, they don't. Too bad. But what could you expect from a domain that allows bulk domain registrations? Would desk@BookMyName.com really care?