Saturday, September 01, 2007

Sydney Car Center job offers again...

Subject: vacant position in the Sydney Car Centre
Date: July 25, 2007 7:31:15 PM GMT+01:00
To: [someone's email]

While we may have high expectations of our associates, we also give them high rewards. Imagine being part of a stable organization with a sterling reputation - a place where the Sydney Car Centre is an integral part of all that we do. With our car centre personality, you'll not just succeed - you'll thrive. And, with our strong commitment to promoting from within, you'll definitely enjoy your rise to the top.

Today the Sydney Car Centre is looking for an industrious regional assistant to fasten the process of the delivery of customer payments to the suppliers. The position offered is a part-time job, and will only require from you to be available for 1-2 hours a day.

As a regional assistant, you will be supposed to operate with the payments from those customers, based in your country. You will be expected to accept 2-3 transactions to your bank account every week, make certain calculations about every transaction (you will be precisely instructed about it), & transfer the funds to the suppliers by means of western Union/Money Gram less your fee & the charges of the Western Union/Money Gram. You will be continuously communicating with the manager from the head office, who will instruct you & give advice regarding every new payment.

The ideal candidate will be industrious, goal-oriented person, with the availability of a personal/business bank account suitable to be used for the company needs. Knowledge of English, computer literacy and sociability are appreciated.

The company guarantees to pay NET 10% fee out of the amount of every payment you dealt with and to provide you with the regular income & flexible schedule. All the related expenses you might have (like the Western Union/Money Gram chargers, related expenses on traveling) are covered by the company.

The more detailed information is available on our web-site, where you can fill in the on-line application form for this position.

We would be glad to welcome you in our team!

We are looking forward to hearing from you as soon as possible!

Yours sincerely, Polly Lyles

common: 0x4, 0x3, 0x4300, 0x32818886, 0x5, 0x85379018, 0x071, 0x022, [etc, white on white background]

Sydney car centre, eh?

Earlier, same story and more about them

A car sales job in Sydney, Australia, when the domain is registered in Kyrgystan or however it's spelled?

The email is sent from - a big no. I have never received a legitimate email from anyone using

Sender and return path are different, both free email services. And the mail is signed by another name than is on the sender field.

Their jobs list 401K as a benefit, even though they claim to be in Australia.

And so on. All these details don't match.

+ Google (4,860,000 hits)
+ Sydney Car Centre Fraud (a lot about these Sydney Car Center jobs history and background).

Sydney Car Centre is the replacement money laundering/transfer fraud site for the Lux Capital money laundering fraud - exactly the same Serenitynet / / Eonix Corporation hosted nameserver/botnet controller, exactly the same modus operandi, i.e. a stolen website offering an illegal 'Regional Assistant' so-called 'job' as a money laundering mule/transfer fraud victim and generally hosting the stolen site using a zombie botnet, (some domains use the Yahoo/Geocities 'small business' network as seen before), often with a host that apparently has no scruples about hosting thieves and fraudsters, the latest being Convergent Network Services of Hicksville NY, aka who do not respond to abuse reports concerning this criminal botnet on their network.

HOTXTINA again, this time searching for her fuckbuddies at

From : Increadible Dating
Reply-To :
Sent : Thursday, August 2, 2007 3:18 PM
To :
Subject : Free Online Search

Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668); Thu, 2 Aug 2007 10:10:43 -0700
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668); Thu, 2 Aug 2007 08:18:08 -0700
Received: by id hm7qqk0afgkl for ; Thu, 2 Aug 2007 08:18:01 -0700 (envelope-from )
Received: by (Postfix, from userid 0) id 269B17D7A73; Thu, 2 Aug 2007 08:18:01 -0700 (ART)
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: g+YnDTwJTP4ObfgplAbNAybZSuhtVRrwl0n7RO1Zcvl3ODcrovgVXCiAm/ZwDjWNppd0o1mmeSk=
Precedence: list
X-Spam-Check: igzdqos.egd$kgfixfztk04=
X-OriginalArrivalTime: 02 Aug 2007 17:10:43.0819 (UTC) FILETIME=[0F76A3B0:01C7D528]

The same hotxtina that was in the other emails too..

whois for

Referral URL:
Domain Name..........
Creation Date........ 2007-07-12 23:13:51
Registration Date.... 2007-07-12 23:13:51
Expiry Date.......... 2008-07-12 23:13:51
Organisation Name.... wang jing
Organisation Address. NO.75 PINGTAN XIAN PU DONG ZHUANG
Organisation Address.
Organisation Address. Fuzhou
Organisation Address. 210222
Organisation Address. FJ
Organisation Address. CN

De lotto online - one more lottery scam, as original as all these yahoo microsoft msn aol lottery notifications out there

From : Info Desk < >
Reply-To :
Sent : Monday, August 20, 2007 11:35 PM
Subject : PP 3502 /8707-01.

MIME-Version: 1.0
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668); Mon, 20 Aug 2007 16:35:05 -0700
Received: from [] (account by (CommuniGate Pro WEBUSER 5.1.10) with HTTP id 72853902; Tue, 21 Aug 2007 01:35:01 +0200
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: N4u0pqWW+O2oFq5Mbu0IBjQaTW9L0ZrHRvLwX/O+wN8ZykD9/Fsx2lo6Y1tpc/6adDPdRJX7PTS83yuxE2yIDA==
X-Cloudmark-Score: 0.000000 []
X-Mailer: CommuniGate Pro WebUser v5.1.10
Organization: Info Desk
X-OriginalArrivalTime: 20 Aug 2007 23:35:05.0855 (UTC) FILETIME=[BCF190F0:01C7E382]

De Lotto Nl Email Result;

Dear Email User,

We are pleased to inform you of the result of the last final annual
draw of our LOTTERY INTERNATIONAL Programs. De Lotto online
cyber lotto draws was conducted from an exclusive list of 25,000,000 e-
mail addresses of individuals and corporate institutions,picked by an
advanced automated random computer search from the internet.
tickets were sold.After this automated computer ballot, your e-mail
address emerged as a winner in the category "A" with the following
numbers Email Informations below.

Your prize award has been insured with your e-mail address and will be
transferred to you upon meeting our requirements,statutory
obligations,verifications, validations and satisfactory report.

It is important to note that your award information was released today
the 20th of August 2007 with the following particulars attached to it.

(I) Award numbers: TL 22/15409
(ii) Email ticket number: PP 3502 /8707-01.
(iii) Lotto code number: TL09622NL
(iv) The file Ref number: TL/0534/30/07

To file in for the processing of your prize winnings, you are advised
to contact our Certified and Accredited claims agent for category "A" winners with the information below To file for your claim, please contact our /your processing
Mr.Steve Litzin
DIRECTLINE: 0031-616-725-622

Promotions Manager
Netherlands the Letter company
European promotions.

Dear Email User? Wow, is that me?

This is as bad and without imagination as these yahoo microsoft msn lotteries out there. email address used for some big lottery in Netherlands? As likely as any bank manager anywhere on this planet sending you any email from yahoo or hotmail.

My favorite part in this one is though "De Lotto online
cyber lotto draws was conducted from an exclusive list of 25,000,000 e-
mail addresses of individuals and corporate institutions,picked by an
advanced automated random computer search from the internet.". So what they are effectively saying is that this big lottery used an email harvesting bot to get the addresses ...
I think what they should have said is that they sent this same email to these 25,000,000 email addresses.

Stock spam, cytv.ob

From : < fake email>
Sent : Monday, August 6, 2007 8:06 AM
To : < same fake email>
Subject : RE: Weekly News
MIME-Version: 1.0
X-Originating-IP: []

Cytv.ob would resolve to China YouTV Corp. [snippet]

Never trust stock advice that you didn't ask for, that arrives in your inbox, and that appears that you have even sent yourself from your email address (the fake email part).

Joey Jones, an American soldier in Iraq, fluent in Chinese, with millions of dollars to offer to Hello Pal...

From : Sgt.Joey Jones. < >
Reply-To :
Sent : Monday, August 6, 2007 12:27 AM
To : [my email]
Subject : CAN I TRUST YOU?(Assistance Needed From Iraq)

MIME-Version: 1.0
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668); Sun, 5 Aug 2007 17:32:01 -0700
Received: (qmail 21834 invoked by uid 30); 6 Aug 2007 02:27:06 +0200
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: JGTYoYF78jGrtPiMsbkWHeFOfu0UTMWNk75KwY6EJLv0RgxjUL0NeZS8MVeTDBweM+6V/OPh1CZh4GCH5tQi1Q==
X-OriginalArrivalTime: 06 Aug 2007 00:32:01.0953 (UTC) FILETIME=[34E68110:01C7D7C1]

Content-Type: text/plain
Content-Transfer-Encoding: 8bit

Hello Pal,

I hope my email meets you well. I am in need of your assistance. My name is
Sgt. Joey Jones. I am an American soldier serving in the military of the 1st
Armored Division in Iraq, we have just been posted out of Iraq and to return in
a short while. My colleague and I need your help to transfer out the sum of
Twnety Five Mllion U.S Dollars (US25.0M).

The money which is now in the custody of a Security Company is part of the
money we seized from late Saddam Hussein but was not declared. Right now I am
in the Bagdad trying to sort out things with the Security Company to ensure a
smooth and unhindered transfer of the money to you,Therefore be assured that the
transfer is safe and risk free.

My colleague and I need a good partner someone we can trust to actualize this
venture.But we are moving it through diplomatic means to your house directly or
a safe and secured location of your choice using a shipping company.But can we
trust you? Once the funds get to you, you take your 40% out and keep our own
60%. Your own part of this deal is to find a safe place where the funds can be
sent to. Our own part is sending it to you.

If you are interested I will furnish you with more details,
Awaiting your urgent response.

Your Buddy.
Sgt. Joey Jones.

God Bless America!!!!

Maybe these scammers have realized that while the general public gets more xenophobic and does not trust that much all these Abdul Al Abdullah who have the Hundreds of Millions of Euro Dollars to offer you (whom they found in the internet and trust you with their millions ..), so all these American soldiers in Iraq are now hten norm then?

At least the spelling isn't as retarded as the majority of the Nigerian scammers have.

I just find it very very odd that an American soldier named Joey Jones would have enough Chinese skills to use Yahoo chinese email... also if he did know enough Chinese to actually use it, what would he be doing in Iraq? And with all these millions, "Hello Pal"? Odd choice of words there...

CEPU spam, from

From : Cepu
Reply-To :
Sent : Tuesday, August 21, 2007 7:14 AM
To : [my email]
Subject : Cepu c'è! Nello studio è con te!

Quando ...

non riesci a superare un esame, Cepu c'è.
vuoi sentirti più sicuro, Cepu c'è.
vuoi acquisire un metodo di studio, Cepu c'è.
desideri un bel voto all'esame, Cepu c'è.
vuoi finire prima l'università, Cepu c'è.
sogni la laurea, Cepu c'è.
arrivi alla laurea, Cepu c'è.

... e gioisce con te.

Inoltre nelle sedi cepu trovi Campus Privati Universitari per le facoltà di Giurisprudenza, Psicologia, Ingegneria e Economia,
con stage, inglese, e pratica per la tua futura professione.

Messaggio inviato in ottemperanza al Decreto legislativo 196/03.
Clicca qui per cancellare la registrazione e non ricevere piu' messaggi.

With some link for the cancel. Sure.
You can say you are using whatever points behind Italian spam legislation. Nevertheless, I have never agreed to get a single CEPU spam from you. I have used a few times while it didn't suck, that was over 5 years ago. Now the email is doomed in receiving still all these CEPU and other @#%%. I for sure have NEVER agreed to received even a single CEPU related notification. Oh did I mention the frequency I get the CEPU spam? It makes it qualify for hte annoying, repetitive category

Hotmail joys - "Meet a new fuck buddy",

X-Message-Status: n:0
X-Message-Info: LsUYwwHHNt2679teDQ0I1ujVGG18SjEEV61J4QCsJCDe8Q49HfWXczIrUawpA+FR
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.2668);
Thu, 12 Jul 2007 13:15:07 -0700
Date: Thu, 12 Jul 2007 18:35:40 -0400
From:Meet A New FuckBuddy
Subject: Search Your Area
Mime-Version: 1.0
Content-Type: text/html;
X-OriginalArrivalTime: 12 Jul 2007 20:15:07.0833 (UTC) FILETIME=[57747290:01C7C4C1]






personal-compose [snip]

And more of that that mindless junk.

Whois for

Referral URL:
Domain Name..........
Creation Date........ 2007-07-12 23:14:46
Registration Date.... 2007-07-12 23:14:46
Expiry Date.......... 2008-07-12 23:14:46
Organisation Name.... wang jing
Organisation Address. NO.75 PINGTAN XIAN PU DONG ZHUANG
Organisation Address.
Organisation Address. Fuzhou
Organisation Address. 210222
Organisation Address. FJ
Organisation Address. CN
Admin Name........... wang jing
Admin Address........ NO.75 PINGTAN XIAN PU DONG ZHUANG
Admin Address........
Admin Address........ Fuzhou
Admin Address........ 210222
Admin Address........ FJ
Admin Address........ CN
Admin Email..........
Admin Phone.......... +86.5913210023
Admin Fax............ +86.5913210023

This is just one of the reasons why I would not suggest anyone to let hotmail be their children's email choice. This kind of junk goes always to my inbox, no matter how many times it is indicated to be spam.

More graphic spam containing male organs and Russian women measuring them

Subject: She will love you more than any other guy
Date: August 1, 2007 11:40:26 PM GMT+01:00
To: [my email

Contained a very gross graphic picture of a male organ, and a Russian looking black haired lady measuring said white male organ with a tape measure on it's right side. I don't feel like uploading that graphic to the web as it is just gross. Maybe some desperate males who want to attract money leeching Russian ladies who want to have a huge while male organ in addition to your wallet might like it, I'm obviously not in the target group.

The picture was linked to

Whois gives

Domain Name: VETRIB.COM
Registrar: BIZCN.COM, INC.
Whois Server:

Registrant Contact:
liu dong
dong liu
0891-32563256 fax: 0891-32563256
NO.23 xin road qiche xin road
haikou hainan 891000

Well, at least it's Liu Dong and not a Dick Wang.

I have got several graphic spams about the same subject, always the same ugly male organ and that same Russian looking lady. Being exposed more to this graphic might make an average lady to turn lesbian rather than to order these male enhancement pills to their man. Since I'm not average and just not into ladies at all, this turns me off and very badly.

Voce recebeu um Tim VideoMensagem ! from phone number 99854211

Subject: Voce recebeu um Tim VideoMensagem !
Date: August 11, 2007 4:50:15 PM GMT+01:00

Você recebeu um TIM VideoMensagem!
VideoMensagem foi enviado de um celular para seu e-mail, do número


TIM agora do seu celular para seu e-mail.
Importante: VideoMensagem ficará disponível na Web durante 7 dias.
TIM - Viver sem fronteiras.

Brazilians seem to go crazy for these free video messages. I have been getting these at least one a day for the past month. Sure, to view your free video message all you need is to download and execute some shady on your computer. Excellent idea.

Never mind even the fact that I have not subscribed ever to any service that would allow any video messages.

Subject: Voce recebeu um Tim VideoMensagem !
Date: August 9, 2007 7:38:51 AM GMT+01:00

Você recebeu um TIM VideoMensagem!
VideoMensagem foi enviado de um celular para seu e-mail, do número


TIM agora do seu celular para seu e-mail.
Importante: VideoMensagem ficará disponível na Web durante 7 dias.

All these free TIM video messages some Brazilian has left to my service that I have never even subscribed to allways appear coming from number 99854211.
How about for authenticity add some region code in the number? Just as good as getting a phone call from US from 123-4567. There are a few prefix options there you know.
Well, this number hasn't left messages only for me...
Oh, it has some graphics too, so it looks like the TIM messages, however I'm just too lazy to load any graphics on my emails unless they are from my manager.

Banca di Roma scam

Subject: Oggetto: Comunicazione nr. 53841 del 13 08 2007 - Leggere con attenzione

Date: August 13, 2007 7:24:38 AM GMT+01:00
Received: [...] from ( []) by isp (Xserve/smtpin026/MantshX 4.0) with ESMTP id l7D6LjD2006504for [email]; Sun, 12 Aug 2007 23:21:45 -0700 (PDT)
Received: from ( [])by (8.13.6/8.12.11) with ESMTP id l7D6IShr008859; Mon, 13 Aug 2007 06:18:34 +0000 (GMT)
Received: from User ([]) by with Microsoft SMTPSVC(5.0.2195.6713); Mon, 13 Aug 2007 01:19:34 -0500
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [my email]
X-Originalarrivaltime: 13 Aug 2007 06:19:34.0234 (UTC) FILETIME=[EAB853A0:01C7DD71]

Gentile Cliente,

Il codice segreto del suo conto on-line e stato inserito incorretto piu di tre volte.
Per proteggere suo conto abbiamo sospeso il acceso.
Per recuperare il acceso prego di entrare e completare la pagina di attivazione.

Se scegliete di ignorare la nostra richiesta, purtroppo non avremo altra scelta che bloccare temporaneamente il suo account.

Grazie ancora per aver scelto i servizi on-line di Banca di Roma.

Banca di Roma garantisce il corretto trattamento dei dati personali degli utenti ai sensi dell'art. 13 del D. Lgs 30 giugno 2003 n. 196 'Codice in materia di protezione dei dati personali'.

Considerazioni migliori.

With a few images added for the authentic look.

Sure, Banca di Roma obviously uses some shady scriptkiddy address for authentication...

OEM scammer - aka Jacqueling Tomaszewski

Subject: User favorites software
Date: August 31, 2007 2:45:03 PM GMT+01:00
To: [someone else's email address]
[Received: from [] by; Fri, 31 Aug 2007 08:45:03 -0500
Message-Id: <>
Mime-Version: 1.0
X-Mailer: The Bat! (v3.71.14) Professional]

User favorites software
Adobe Photoshop CS3 Extended $89.95
Microsoft Windows XP Professional with SP2 $49.95
Microsoft Office 2003 Professional with Business Contact Manager for Outlook $69.95
Microsoft Windows Vista Business $79.95
Microsoft Office 2007 Enterprise $79.95
Adobe Acrobat 8.0 Professional $79.95
Macromedia Studio 8 $99.95
Microsoft Office XP Professional $49.95
and other

Whois gives

Registration Service Provided By: CRISP NAMES, INC.
Contact: +1.3104837168


Registrant, technical, admin etc:
Tel. +6.2319292893

Creation Date: 18-Jul-2007
Expiration Date: 18-Jul-2008

Michigan phone number starting with +6? Sure. This "Jacqueling" gives already some google hits.

500,000 Euros with LSLUK/4034/8161/04 winning code from Holland

And back after some downtime - been too absorbed in the real life work.

Date: August 30, 2007 6:20:09 PM GMT+01:00
[Received: from ( by (7.3.122) id 46B6E4A8002DC49F; Thu, 30 Aug 2007 19:20:09 +0200


Dear sir/madam,

We are happy to inform you that you have
emerged a winner under the First Category of our promotion,Winners were
picked by computerized system, drawn from company and individual e-mail
addresses worldwide.The draws is officially announced today 29th of
August, 2007.You have therefore been awarded alump sum pay out of
500,000(Five hundred thousand Euros), which is the winning payout for
Category A winners.

NOTE: For easy reference and identification,find
below your Reference and Batch numbers. Remember to quote these numbers
in your correspondence to our claim Department.

Please contact Staatsclaim
department immediately for due processing and remittance of your prize
money to a designated account of your choice:

Dr. Peter Hans
0031- 626381909
Fax: 0031- 847103194

Sincerely Yours,
Mrs Betty Rice
N.B: Disclaimer - This email is confidential and contain privileged or
copyright information. You must not present this message to another
party.If you are not the intended recipient you must not copy,
distribute or use this email or the information contained in it for any
purpose other than to notify us.
If you have received this message in
error, please delete this email from your system.

Sure, a Five Hundred Thousand Euros is alumpofmoney.
How about they even once would forge their email addresses to be something that actually has even remotely something to do with any lottery?
Why is this particular scammer using if he is still physically located in Netherlands?