Stupid Spammers

Adobe-pdf-upgrades.com

2011-02-16T18:54:00.000-08:00

A relatively enough innocent looking email:

New Version Release : Adobe Acrobat Reader 2011, Upgrade Available Now !
From: Adobe
To: [my email address]

ADOBE ACROBAT READER 2011 UPDATE NOTIFICATION

This is to remind that a new version of Adobe Acrobat Reader 2011 with enhanced features for viewing, creating, editing, printing and internet-sharing PDF documents has been released.
To check and download the latest version , go to :

http://www.adobe-pdf-upgrades.com

Start downloading the update right now and let us know what you think about it.

We're working on making Adobe Acrobat Reader better all the time !

Thanks and best regards,

Adobe Support

© 2011 Adobe Systems Incorporated. All rights reserved.
Adobe Systems Incorporated | 343 Preston Street | Ottawa | ON | K1S 1N4 | Canada

But wait - since when does Adobe email customers?

Especially since I don't bother to mess my system with Adobe Acrobat?

Something fishy here...

Whois for adobe-pdf-upgrades.com returns

Domain name:             ADOBE-PDF-UPGRADES.COM Name Server:             ns1.adobe-pdf-upgrades.com 91.220.62.133 Name Server:             ns2.adobe-pdf-upgrades.com 91.220.62.133 Creation Date:           2011.02.17  Status:                  DELEGATED  Registrant ID:           CRABZUX-RU Registrant Name:         Shawn Sijnstra Registrant Organization: Shawn Sijnstra Registrant Street1:      2938 Avenue Street Registrant City:         New York Registrant Postal Code:  20394 Registrant Country:      US  Administrative, Technical Contact Contact ID:              CRABZUX-RU Contact Name:            Shawn Sijnstra Contact Organization:    Shawn Sijnstra Contact Street1:         2938 Avenue Street Contact City:            New York Contact Postal Code:     20394 Contact Country:         US Contact Phone:           +1 877 8663849 Contact E-mail:          Shawn@yahoo.com  Registrar:               Regional Network Information Center, JSC dba RU-CENTER  Last updated on 2011.02.17 05:51:59 MSK/MSD

Hopefully no one downloads anything from a domain like that - claiming to be Adobe, yet being very fishy, on a newly registered domain.

ARE YOU A SCAM VICTIM, CLAIM YOUR FUNDS NOW!!!

2009-06-17T23:34:00.000-07:00

ARE YOU A SCAM VICTIM, CLAIM YOUR FUNDS NOW!!!
From Mrs. Farida Waziri Thu Jun 18 09:13:29 2009 scam.victims@efcc.net
Message-Id 200906180110.n5I19o2M004592@bngmail.cbayindia.com
Reply-To efcc.gov@msn.com
To: undisclosed-recipients

ECONOMIC AND FINANCIAL CRIMES COMMISSION.

EFCC Head Office.
Plot 1017 & 1018 Coree Bay Crescent,
Adetokunbo Ademola Crescent,
Lagos Nigeria.
Motto: No Body is Above the LAW.

FROM THE DESK OF: Mrs. Farida Waziri, AIG (Rtd),

RE: BE CAREFUL OF THE HUD LOOMS
Following the recent broadcast of the president and the commander in chief of armed forces of the federal republic of Nigeria during the visit to the America President Mr. George W. Bush, his speech to the united nation, couple with recommendation and resolution of his last visit to
It has therefore become imperative for us to explore our options for reducing our debt servicing policy to affordable and sustainable levels. On the order of the president as a mark of his reconciliation and image laundering exercise toward sanitizing the battered image of the federal republic of Nigeria abroad.

I am Mrs. Farida Waziri, AIG (Rtd), Chairman Economic and Financial Crime Commission, a committee set up by the military dictatorship of Late General Sani Abacha, many abnormalities had happened in the Central Bank of Nigeria and Union Bank of Nigeria where some top official of the apex Bank collaborate with imposters and abandon our contractor half way with levies and taxes.

Consequently, we received a directive from the office of the president, ordering the above office to settle all genuine contractors whose debts has been outstanding for a long time now. These are those who have shown sufficient proof regarding the release of their fund, and we wish to inform you that in our record here, you have fulfilled such conditions.

But the reasons why your own Transfer has to be delayed is because, there is presently a counter claims on your funds by one Mr. Peter Woo, who is presently trying to make us believe that you entered into an agreement with him, to help you in receiving your fund, in his bank account in China . So here comes the big question. Did you sign any Deed of Assignment in favor of Mr. Peter Woo, thereby making him the current beneficiary with the following account details: Account Name: Indo-China Group Ltd, A/C #: USD114-102-5567-8, Bank Name: Standard Chattered bank, 138-141 1st Floor, Edinburgh Tower, the Landmark, 15 Queens Road, Central Hong Kong, Swift Code: SCBL 11k111.

If you did not sign, nor authorize Mr. Peter Woo to receive your payment on your behalf, kindly reconfirm to us, your genuine bank account details, to avoid making payment to a wrong person, attempt to divert your payment to a new account without your knowledge may have been done by your local representative with the assistance of some (Union Bank of Nigeria) Officials, of whom most of them are presently under our custody and will face prosecution under section 35A sub section 1-2-4 of the criminal code of Nigeria, pending on when we finish with our investigation.

This office is glad to inform you that your payment shall be made as soon as international instant wired transfer submits this information needed from you, either by Telegraphic Transfer or. We are sorry to inform you that the Federal Government of Nigeria had made it clear to all foreign contractors whose payment is overdue, to be paid immediately hence all the modality relating to the release of your contract fund had been completed. You are advised to stop any further communication with your local representative(s) any officials (s) department of the CBN or Union Bank or any Government parasitical. This is to forestall new effort towards a diversion of your payment.

This office supersedes every other department in the CBN, every other bank in Nigeria and correspondence bank abroad and is thus responsible for the final payment. The consequences of not heeding to this warning would be yours.

Although we have been able to come up with some good result about the people that have been trying to extorted this fund from you illegally and i wish to list them so that you will personally indicate them by writing back because we want to make your payment to you without any delay but we must surely deal and bring this names to book if only you will indicate correctly any of them.

The names of the Touts that have been arrested are as follows:

1) Dr. Ken in U S A
2) PROF CHARLES SOLODO
3) CHIEF JOSEPH SANUSI
4) DR. R.RASHEED
5) BARRISTER AWELE
6) BARRISTER UCHEUZO WILLIAMS.
7) DR. HANZ MUSSA
UNION BANK ( NIGERIA ) PLC
8) Mr. Ernest Chukwudi Ebi
9) Mr. Eric William
Deputy Governor - Policy / Board Member
10) Mr. Tunde Lemo Deputy Governor - Financial Sector Surveillance /
Board Member
11) MR CUPPA ACOKA
FEDERAL GOVERNMENT OF NIGERIA .
12) Mrs. W. D. A. Mshelia
Deputy Governor - Corporate Services / Board Member

The above listed names are been traced/investigated by our team and some of them have elope the country and note that if any of them is caught and find guilty he/she will go to jail for 25 years (twenty five years) as it is under the Degree 47 of the constitution of Nigeria under section of criminal law..

So we are waiting for you to write us and inform us if any of the above names have once contacted you in respect to your fund if yes donвЂ™t waste time to indicate it immediately.

We apologize on behalf of the President and the good citizens of Nigeria for any delay and lost this most have coursed you and promise that such thing will not happen again. And if you are dealing with any one of them regarding this payment we urge you to STOP because you are taking a big risk and you never find your money because your funds in the total sum $2.5M (Two Million Five Hundred Thousand United States Dollars) is now with us the {ECONOMIC AND FINANCIAL CRIMES COMMISSION} to fulfill all foreign payments.

Considering the circumstances at hand, you are advice not to accept any fax or telephone calls that does not come from this office.

As soon as we hear from you, the remittance of your payment will commence.

Regards,

Mrs. Farida Waziri

Always so convincing when it's sent from hotmail or something similar, and sent to undisclosed recipients, and when their punctuation is what it is.

Even if there was such a claims department - no, sorry, it just makes no sense. Rotten individuals scam, so now you set up a claims department for it? Um - sure, so similarly if medical insurance companies scam users in US (or sign them off when they would need payments for their ailments), would US government make a medical scams department? Dream on (and maybe wait for all these scammers to start to think about it). No, just not going to happen.

And if there was such department - you would not be asking the undisclosed-recipients about whether they sent something to this particular account.

Craigslist room ad scam replies

2009-05-27T03:57:00.000-07:00

I've still got to get up to speed with the new spams - but unfortunately I've both been busy and most of the spams I've received recently are rather boring and unimaginative.

But there are two that merit being here.

Craigslist scam attempts. I mean reasonable and perfectly ideal housemates, just the ones we were looking for, rrright?

1. "helen smith"

Urgent reply needed
From: "helen smith" helen.smith82@yahoo.com

Hello,
I will like to know if your apartment is still available for rent,
kindly get back to me as soon as you read my mail,
Looking forward to read from you.

Regards
Helen

Rright. Fine. Yes if the ad was put on less than 24 hours before, you got your urgent reply that you kindly requested. But we got back nothing for 3 days.

Meanwhile we got a second interested one. One who sent 3 x the same email (the "helen smith" above only sent her email twice)

2. "frank smith"

I wonder if they are related?

room wanted
"frank smith" franksmth79@gmail.com

My Name is frank smith,im 25yrs old i am a zoologist by
profession and also a professional miner,i will like to know
if the room is still for rent i am currently working in Rip of
benin in for a private mining offshore Firm on
contract,about my parent. Dad is from south Dakota and
my mum is from Elizabeth city NJ.She now lives in
london.I would have really love to call you about the
place but calls can't be made out or received down
here due to the off shore location were the site is
located. There some few things i would love to know
about theplace...things like what is the rent for
amonth?and the security of the place?and i hope paying
month to month will be ok for you?i love cleaning very
much and maybe sometime i also like to cook if i have
a chance.i don't stay out late and i don;t have late
night guest as well.i love pet but i don't have one.im
looking for a 1 bedroom to rent for 3,6 to a year,i
respect other people privacy a lot.what do you think i
will need to bring when coming?I will be starting my
masters along with a professional exams coming
soon.

Oh, very good mister frank smith. I'm impressed at anyone being a zoologist, professional miner, AND getting their MSc started at the age of 25 - and with those articulated grammar skills.

While I was silently wondering if I should reply him explaining I need someone for the room as my millionaire wife (or husband? which one will sell better..) just died and I really need him to help me get the HUNDRED MILLION US dollars abroad, Ii'll just need his bank details...
Well, then we hear again from this "helen smith" again.

"helen smith" again

Re: Urgent reply needed
"helen smith" helen.smith82@yahoo.com

Hello,
Thanks for the quick responds, and am very sorry for the late reply is due to my occupation, I will like you to know much about me.
I'm female, and i am from United State ,I speak English,and i am 28years of age.I am
I currentely working with the Federal Agency of Works and Environmental in United State.
am on a research programmed,and i am desperately looking for a place to
stay, Am the neat type,honest,responsible,trustworthy and hardworking person
I love music and pets so much, am quiet, easy going person and fun to live
with. I'm 5"7' tall . I always love to go on date but seldom party. I swim
for fun and sometimes play tennis ,i also like watching football,basketball,
i don't keep late nights neither will i have overnight guest around and i
know that you will like the kind of person i am.I read about the room on
your add and i would really want to secure the room before my arrival, more
so to know if it would be possible for me to pay for the room before my
arrival,So i will like to know the total amount of the room per month and
the utility included. All these information are very important so that i can
submit my proposal to my Organization. My Organization will be responsible
for all the fees so,i will like to know the mode of payment,to know the nest thing to do before my arrival. I dont mind seeing more pics of the room and surrounding and I will need the following information to get the payment to you.
1 Full name as it will appear on the payment.
2 Address.
3 phone number.
I would be glad to see your quick response.

BEST REGARD
Helen

Now, just to have fun what should I do? Hi helen, sorry the room is gone but my friend frank has a room..
Hi helen, please send me FIVE THOUSAND UK POUNDS and call me to this number in Nigeria and I will help you make MILLIONS of dollars...

Free advice: set up an online store (so you don't have to offer these cheque casher 'jobs' anymore)

2009-02-01T02:55:00.001-08:00

Let me give one free piece of information mister McIeen: most Americans don't offer these forms of payment for goods. It is only the folks like yourself who even think about such. Why don't you just give them your bank details such as IBAN and SWIFT, or if you are selling via the internet, set up a working online store?
And make up your mind how you want to be called, a mcieen or leem...

Company Representatives Is Needed (Job Offer )
From: "Kine@yahoo.com"
To: [my email]

Dear Sir/Madam.
I hope this email meets you in good health. I feel quite safe dealing with you in this mutual beneficial transaction. Though, this medium Internet has been greatly abused, I choose to reach you through it because it still remains the fastest way to get in touch with people.
I am Mr. kine Mcleen and am an artist, I am 40 years old and paint for a living, and have been painting for the past 18 years. I am married with a wife and 2 lovely kids. I have a vacancy opening available in my studio. I am just setting up in the USA and will need a Representative to work on a part time basis for me.
I sell Arts all over the world and have sold to both galleries and private collectors. I am always facing serious difficulties selling my art works to my American clients; most times they offer to pay with either Money orders or certified checks which are difficult for me to cash here in United Kingdom.
I need someone in the states to work as my representative and assist me in processing these payments and I will be willing to pay 10% for every transaction made.
First step in this job is for you to wait at home for checks sent by my clients via regular mail or FedEx to get to you. For this to be possible I need your basic personal info such as:
1. Full Name,
2. Contact Address,
3. City,
4. State,
5. Zip Code,
6. Occupation,
7. Phone Number,
If you are interested in working for me, please kindly send the needed information to my email: kine.leem@gmail.com
I await your reply
Regards
Kine Mcleen
Note: YOU ARE NOT UNDER ANY OBLIGATION TO APPLY FOR THIS POST. ONLY SINCERE AND STRAIGHT FORWARD INDIVIDUALS ARE NEEDED.
X-Server-Name: www.brindematiere.com
X-Remote-Addr: 41.219.235.22
X-Script-Name: /components/com_expose/expose/img/bug.php
X-Virus-Scanned: ClamAV using ClamSMTP

Not too original Nigerian one - style points: 2

2009-02-01T02:41:00.000-08:00

Somewhat original. Maybe I should do some scale to score them, 0 = fail to 10 = a masterpiece.
So let's try... this one

1. Style with having a from address as something .org. That looks impressive and takes at least 5 $ to register a domain usually, but doing a whois doesn't return an eaglerockcc.org.
2. Going with a more modest amount of money - should this score more? Maybe more people's alarms go off seeing the usual hundreds of millions of $.
3. The usual BS - a free email address to reply to, all utterly confidential while you send it to undisclosed-recipients...
Meh. Score: 2 - not very impressive or original.

UTTERLY CONFIDENTIAL/
From: "Anthony"
To: undisclosed-recipients

Hi,

Pardon me for not having the pleasure of knowing your mindset before making you this offer and it is utterly confidential and genuine by virtue of its nature.I write to solicit your assistance in a funds transfer deal involving US$3.5M.

This fund has been stashed out of the excess profit made last year by my branch office the International Commercial Bank which I am the manager.

I have already submitted an approved end of the year report for the year 2005 to my head office here in Accra-Ghana and they will never know of this excess. I have since then, placed this amount on a Non-Investment Account without a
beneficiary.

Upon your response, I will configure your name on our database as holder of the Non-Investment Account. I will then guide you on how to apply to my head office for the Account Closure/ bank-to-bank remittance of the funds to your designated bank account.

If you concur with this proposal, I intend for you to retain 30% of the funds while 70% shall be for me.

Kindly forward your response to: tonicb12@aim.com

Mobile: +233-24-468-5072

With Regards,

Anthony Aka

A bank scam that goes to ponyfarm...

2009-02-01T02:40:00.000-08:00

If my bank has a problem with my account, they call me. They even call me when they want to offer a bad deal of a visa for the 11th time a year, just to check if I'd be interested in it now. But no real bank would ever email me (and never to undisclosed recipients for sure) - and I've never even been in a Alliance & Leicester bank - so good, they can glady keep the acount I don't have, blocked.

Internet Banking Access Blocked
From: "Alliance & Leicester Internet Banking Service"
To: undisclosed-recipients

Dear Valued Customer,
We use the very latest industry-standard technology, plus multiple levels of security to safeguard your personal and transaction details, so that you can bank online with confidence.
We are committed to continually developing our security systems to ensure that Internet Banking remains safe and secure. We hope that you will also take the necessary precautions to protect your computer and your personal security details.
Internet Banking access blocked. For your protection Internet Banking access to your accounts has been blocked. Your security details have been incorrectly entered 3 times. Please follow the reference below and you will be guided to where you can instantly To re-establish access.
Log in to Internet Banking
it will only take about five minutes.

Thank you.
Online Banking Security Team

"Service" means the Alliance & Leicester Internet Banking Service We provide which enables You to give Instructions to Us relating to Your Account by logging on at www.alliance-leicester.co.uk or alternatively https://www.mybank.alliance-leicester.co.uk
"We" / "Our" / "Us" means Alliance & Leicester plc

The domain they direct you, www.cv-ponyfarm.de, for sure isn't owned by a UK bank, but the German whois queries returned only MS server errors.

Computer jobs...

2009-02-01T02:30:00.000-08:00

The global economy sucks so they must have a lot of jobless, brainless and greedy people working and interested in working with software right? Now if you would get a job offer from a computer company, wouldn't you think that they possibly might have a domain and not have to go as low as free email services and milking you out of money to "work" for them? And wouldn't you possibly do some google fu before you even think of applying?

EMPLOYMENT REQUEST
From: "Xenex Navigation Inc"
To: undisclosed-recipients

Hello Sir/Madam

My name is Tom Gabriel, I represent Xenex Navigation Inc, We are one of the fastest growing software company based in Florida (UNITED STATE). We design computer components and other related software products.

At Xenex we specialize in exporting quality products at relatively low prices. But due to our ever-increasing customer base in Scotland and United Kingdom, we at Xenex are searching for representatives to assist us in establishing a medium to connect to our costumers more efficiently in Scotland and United Kingdom Region.

JOB TASKS
If you choose to join Xenex as a representative, your basic task will consist of checking emails, processing orders and receiving payments from our customers on behalf of Xenex though basically payments are often made out on Money Orders, Certified Cashiers Check or a Personal Check.

MAIN REQUIREMENT
*18 years or older,
*legally capable,
*Responsible,
*Ready to work 3-4 hours per week.,
*With computer knowledge,
*E-mail and internet experience (minimal),
*We are not requesting for your Bank information's, SSN or any other personal information from you, as what we need is a proof of seriousness.

WHAT YOU EARN
Note that for every transaction processed, you will receive 10% of the total amount. Xenex product price range starts at 4,000pounds. At 10% you are guaranteed a minimum of 500 pounds per order. We guarantee that you can start making money as early as in 2 weeks once your job has been approved, and you don't need to invest your money, just your spare time to process orders via email

Please fill or email the following information inside the employment application form in order for us to facilitate the conclusion of this proposal if accepted.

EMPLOYMENT APPLICATION FORM
First Name ________Middle Name___________Last
Residential________________________
City _______State ______ ________Zip ______
Home /Work Telephone Number________
Personal cell phone Number__________
Gender _____Marital Status_______
Age ____ Nationality_________
Present Work_______

Please note: Only interested applicants should respond to this offer. We understand that this job position is very challenging and you should understand it. We are looking only for persons who satisfy our requirements and will be an honest assistant.

If you feel that you are a serious, trust-worthy and honest person and you want to work for XENEX NAVIGATION INC., Please respond immediately with the requested information above.
Send Replies to: tomgabriell11@gmail.com

Yours Truly.
Mr.Tom Gabriel
Marketing Executive
tomgabriell11@gmail.com

Another not too personalized Nigerian scam

2009-02-01T02:19:00.000-08:00

Isn't it a bit odd that a Ms Marina with such an odd sounding first name that if I didn't see her use it as her first name, would have guessed that the lvovska part of her email address would only refer to some L Vovska but even that way it sounds too Polish, Russian or East European to be a kosher thing from Africa. And why the marshall.edu address? It maybe helps it pass your spamfilters better but why a lovely lady with such a first name as Lvovska who is studying at Marshall University, Huntington, WV would be involved with such amounts of money?

Isn't it a bit odd that this Lvovska is also sending this to undisclosed recipients? That never means only you.
Isn't it a bit odd that the people you should be contacting in Nigeria have a free email service in UK and ... well, at least that phone number is for a Nigerian number.

Anyone up to calling this Fedex courier with a free UK email address (but not a fedex one) and give them what this Ms Maryna asks for?

ACT FEDEX COURIER SERVICE (NIGERIA) FOR DELIVERY
From: "Lvovska, Maryna"
To: undisclosed-recipients

Greetings.

I am Lvovska Maryna. I have been waiting for you since to contact me for your
Confirmable Bank Draft of $950.000.00 United States Dollars, but I did not hear from you since that time.
Then I went and deposited the Draft with FEDEX COURIER SERVICE, West Africa, I traveled out of the
country for an asignment and I will not come back till end of Febuary 2009.
What you have to do now is to contact the FEDEX COURIER SERVICE as soon
as possible to know when they will deliver your package to you because of the expiring
date.

For your information, I have paid for the delivering Charge, Insurance
premium and Clearance Certificate Fee of the cheque showing that it is
not a Drug Money or meant to sponsor Terrorist attack in your Country.
The only money you will send to the FEDEX COURIER SERVICE to deliver
your Draft direct to your postal Address in your country is ($390.00 USD) Dollars only
being Security Keeping Fee of the Courier Company so far. Again, don't be
deceived by anybody to pay any other money except $390.00 US Dollars. I would have
paid that but they said no because they don't know when you will contact them and
in case of Demurrage.

You have to contact the FEDEX COURIER SERVICE now for the delivery of
your Draft with this information below;

Contact Person: Mr.Gary Albert
FedEx West Africa.
E-mail: fedexdelivery1975@live.co.uk
Telephone: +234-702-518-8585

Finally, make sure that you reconfirm the following:
(1) Full names
(2) Your Postal address
(3) and Direct telephone number
To avoid any mistake on the Delivery and ask them to give you the tracking number immediately you make the payment to them
to enable you track your package over there and know when it will get to your address.

Let me repeat again, try to contact them as soon as you receive this
mail to avoid any further delay and remember to pay them their Security
Keeping fee of $390 US Dollars for their immediate action.

You should not bother to contact me as I will not be around to check my emails since I am on an asignment till the
end of Febuary 2009.

Yours Faithfully,
Lvovska Maryna.

European lotteries... never anything new

2009-02-01T02:08:00.000-08:00

When did we ever see anything interesting with the lottery scams?
Not even once even the email coming from the domain they claim to represent. Why would a Mrs Gloriakok from an Italian free email address (and with its free default ads for alice messenger) contact you to tell you that you wont and should contact a Dr. Krugar which also isn't using his correct email address?
+31 countrycode resolves to Netherlands, and if anyone WAS contacting you from the Netherlands lottery office, their email address would end @lotto.nl. (Never mind that they wouldn't know you bought a ticket... or did you?)

From: mrs_gloriakok@alice.it
Subject: REF
Date: January 29, 2009 8:45:32 PM GMT

REF

To claim your email prize of 1,000,000 Euros.
Contact Dr.Hans J. Krugar
TEL:+31-647269378 FAX:+31-847598766.
Reply To: claimfiles@i12.com
======================================

Copyright 1994-2009 The Netherlands National Lottery Inc.

Alice Messenger ;-) chatti anche con gli amici di Windows Live Messenger e tutti i telefonini TIM!

Spam FAIL

2009-02-01T02:04:00.000-08:00

A spam that can't even contain itself from the headers or doctype info = FAIL

From: shidan569thu_ji@punkass.com, shidan569thu_ji@punkass.com

Untitled Document

email =F0=E5=EA=EB=E0=EC=E0 =20

(495)6603522=20

------=_NextPart_000_0023_4A_977768B6.E952EEEDContent-Type: text/html; charset="windows-1251"Content-Transfer-Encoding: quoted-printable
w3.org/TR/html4/loose.dtd">

251">
Untitled Document

email =F0=E5=EA=EB=E0=EC=E0

(495)6603522

------=_NextPart_000_0023_4A_977768B6.E952EEED--

Mensaje de Animo

2009-02-01T02:02:00.000-08:00

Ah, sure - of course I will install all sorts of software on my 'puter just because some company I've never heard of tells me they have a message for me...

From: ventas@microalambre.com
Subject: Mensaje de Animo
Date: August 30, 2008 8:48:46 PM IST
To: [my address]
Reply-To: ventas@microalambre.com

Tenemos un mensaje de animo para ti en

http://www.microalambre.com/comunicacion.html

VICTIM COMPENSATION OF $1,500,000.00

2009-02-01T01:57:00.000-08:00

Oh, this is a new one for me. And as always, all these bank and UN representatives use only free email addresses such as yahoo, for conducting their business. Even if Sarah Palin repeatedly does it, the emails coming from a non-corporate address shouldn't be dealt for business.

I have a new email address!
You can now email me at: alfred.watson93@yahoo.in

- ATTN: Beneficiary ,SCAMMED VICTIM COMPENSATION OF $1,500,000.00 USD ,This is to bring to your notice that I the representative of Nigeria to the United Nations has been appointed by United Nation/International Financial & Economic Crime Unit to Nigeria in association with ECOBANK NIGERIA PLC to pay 150 scammed victims the sum of $1,500,000.00 USD each. You have been listed and approved for this payment as one of the scammed victims to be paid this amount in the second phase of the Economy Reform Project; I would like you to Provide/confirm your detail, so that your compensation would be paid out to you. On this faithful recommendations, I want you to know that during the last U.N./Economic Reform meetings held at Abuja, Nigeria, it was alarmed so much by the rest of the world in the meeting on the lose of funds by various foreigners to the scam artists operating in syndicates all over the world today. In other to retain the good image of the country, the President of the country is now paying 150 victims of this operators $1,500,000.00 USD each in accordance with the U.N. recommendations. Due to the corrupt and inefficient Banking Systems in Nigeria, the payment are to be paid by ECOBANK NIGERIA PLC.According to the number of applicants at hand, 114 Beneficiaries has been paid, Most of the victims are from the United States while the rest are Europeans, Asians and Australians. We still have more 36 left to be paid the compensations of $1,500,000.00 USD each. Your particulars was mentioned by one of the Syndicates who was arrested in Lagos, Nigeria as one of their victims of the operations, you are hereby warned not to communicate or duplicate this message to him/anyone for any reason what so ever as the Interpol is already on trace of the criminals. So keep it secret till they are all apprehended. Other victims who have not been contacted can submit their applications as well for scrutiny and possible consideration. You are advised to contact Mr. Jim Lott OF ECOBANK NIGERIA PLC, E-mail: contact.jimlott@gmail.com as he is our representative in Nigeria, contact him immediately for your International wire transfer of $1,500,000.00 USD. Therefore, you should send him your full Name,telephone number, fax number,mailing address,your complete banking details and a copy of your identification , I shall feed you with further modalities as soon as I hear from you. Yours faithfully, Sir. Alfred Watson U.N REPRESNTATIVE( WEST AFRICA). United Nations (UN).

Aids spam

2008-07-20T01:22:00.000-07:00

This is a new category of spam to me.

From: ndxk9@hotmail.com
Subject: Please help ! -[some random letters and numbers here]
Date: July 20, 2008 7:55:40 AM IST
To: [some email alias of mine]
Return-Path: 3embb@hotmail.com

Honoured ladies and gentlemen,

it is not to be turned my kind me on this way to you however the circumstances leave me no other possibility.
I want to tell no long stories however I search people to me perhaps help and something support.
My name is Jim Knopf are 45 years and are for 23 years of HIV Positive (Aids)!

Now my problem!
I need approx. 2500.-Euros of every month for drugs.
I have lost my health insurance and is not to be raised in the position this sum every month.
I can allow to prescribe drugs of the doctor however I must pay this itself.
At the moment I live on 210.- Euros in the month this is only for food and for the everyday need.
I do not need ointments - oil baths with the low amount are payable
My savings are used up I can raise the money no more.
This is why I search people to me, perhaps with small sums can support.
Every amount is a welcome.
I would like to thank for her support!

Here the Online payment systems !!
Paypal : https://www.paypal.com
Acc : one-euro@Safe-mail.net
Reference : Thank You !

---------------------------------------------------------------

Alertpay: https://www.alertpay.com
Acc : one-euro@Safe-mail.net
Reference: Thank You !

------------------------------------------------------------

Paypay: https://www.paypay.com
Acc : 8100588105
Reference : Thank You !
_____________________________________________

Bank :
Bankname : Raiffeisenkasse Guntramsdorf
Bankaccount : Frank Laugwitz
IBAN Nummer : AT163225000005000641
BIC/SWIFT : RLNWATWWGTD
Reference : Thank You !!

_______________________________________________

Greeting Jim Knopf

Well well. Dear Jim Knopf, why does your bank account say Frank Laugwitz?

Since the bank account you are trying to scam money to is in an Austrian bank, I guess we can assume that you are trying to tell people that you are based in Austria. How about having a look how their healthcare works?

"Top spot in Europe for Austria's health care system: nowhere else in Europe are patients treated more quickly and their medical needs better attended to. This has been revealed by a current study in the EU.

According to this expert study, Austria not only has the most consumer-friendly health care system in Europe, but also performs better than countries like Switzerland or Luxembourg which spend considerably more money on medical care. Austria spends 2,186 euros per head per year, Luxembourg spends 3,526 euros, Switzerland and Norway roughly 2,820 euros."

Even if all health care would not be free in Austria, spamming unknown people for scamming money out of them is never ok.
Oh, and if you are Austrian as you claim, why doesn't your bank account name match your name?
Why are you using an Israelian email?
And why do you spam unknown people with this fake story, Frank (which I don't believe is your name either)? Shame on you.

Tourismania.info, flooding the inboxes

2008-07-16T16:18:00.000-07:00

Tourismania is the only spam of a new type I've received recently. New, as in sense that after lastminutetours.com I have not been spammed by travel sites. Now tourismania.info is flooding my inbox daily, and the fact there is no blacklist on my server side deeply annoys me. I have also never been on their website, which makes this even more annoying.

Typical spam of them:

From: fasbadoo@hotmail.fr
Subject: GRECE IDYLLIQUES
Date: July 16, 2008 11:54:10 PM IST

GRECE IDYLLIQUES
TRADITION TOURISMANIA
8 JOURS / 7 NUITS Vols + Hotel 3 * + 2 Excursions
10.990,00 DHS
Dйpart tous les jours de la semaine
Murs blanc, ciel bleu azur, vestiges antiques, champs d'oliviers, et partout, la mer: la Grиce est un hymne aux vacances.
En Crиte, plages idylliques et villages pittoresques composent le tableau enchanteur des vacances.
Tourismania vous invite а dйcouvrir cette destination et rend la Grиce plus accessible que jamais.
Chaque semaine, au dйpart de Casablanca, nous vous donnons rendez-vous pour une dйcouverte de ce merveilleux pays
grвce а un programme complet de circuits et de sйjours , minutieusement sйlectionnйs.
N’hйsitez pas а contacter notre йquipe pour plus d’informations.

GRECE IDYLLIQUES [link to tourismania.info]

Of which we can get

Domain ID:D10838720-LRMS
Domain Name:TOURISMANIA.INFO

Registrant Name:Cemil Fidanligul
Registrant Organization:Performans Iletisim ve Teknoloji Hizmetleri Ltd. St

Registrant Email:noc@performans.com
Admin ID:BB15D8B8008DE68E
Admin Name:Cemil Fidanligul
Admin Organization:Performans Iletisim ve Teknoloji Hizmetleri Ltd. Sti
Admin Street1:Halaskargazi Cad. No:48 Daire
Admin Street2:6 Kat:3
Admin Street3:
Admin City:Istanbul
Admin State/Province:-
Admin Postal Code:34373
Admin Country:TR
Admin Phone:+90.2122919816

Whatever excuse they use for spamming daily without any "opt-in" even, this fasbadoo@hotmail.fr deserves to get his/her/its mailbox flooded with proper porn spam.

Spock.com - another creepy social network

2007-12-17T11:51:00.000-08:00

From: donotreply@spock.com
Subject: [a friend's name] has requested your trust on Spock
Date: December 17, 2007 4:18:21 AM GMT+00:00
To: [my email]

Hi Future Spocker,

[a friend's name] has added you as a trusted contact on Spock. By accepting trust, you will be able to search each others’ network, share contact information, and get news.

Click here to get started. [had some URL incorporated to that]

-
Unsubscribe: http://www.spock.com/do/public/request_unsubscribe

Another of the series of failures of the social networking attempts, just like Pulse Plaxo. Is it so hard, really?

1. Do not send me spam. One is enough.

2. Do not spam the internet and digg about how you will become the google of the people searches. Know what? I'm happy to be found using google when I want to. I sign up for my profiles. There is a huge difference in spock or any other creepy failure social network creating automatically a profile for you or me, or we creating them ourselves. I have no control over who they claim I am. And I have zero desire to join spock, or any other spooky network. No, seriously, no, no, no. LinkedIn, and limited Facebook, that's it. No spock, pulse plaxo, hi5, tweety, orkut, schoolfriends, or anything else. No.

3. What is it with the unsubscribe? Anything that I never subscribed to that is offering me the option to unsubscribe is nothing but spam, irregardless of who sends or appears to have sent it. The spock invites are from people I know, but these basic not understanding how the invites or social networking sites work really creep me out. Don't create a profile by any spambot for me, thank you very much. And don't send me any unsubscribe option either.

Surpise, I am not the only one out there annoyed by spock.com invites.
People are considering action against spock.com through CAN-SPAM act

How to survive Facebook, Beacon, and avoid Facebook spam

2007-12-10T12:22:00.000-08:00

In a blog specialized in nothing but spam, how come there was no entry for Facebook yet?
Well... it was a nice and tolerable website first, allowing one to keep in contact with the friends that are not in Linkedin or anywhere else that you'd actually care to join.

But it keeps getting worse and worse, so it's time for a cumulative How to survive Facebook-post.

I have over 100 hundred invitations to add applications in my profile. Each one is generating an email, and they are by friends, not by random spammers out there. Everyone finds something fun and wants their friends to add it, but ... well, friends don't always find it fun when you have hundreds of applications in there sending you uninvited spams.
If you want to offer me a beer, please do it in a bar in real life, not in Facebook.
And please keep superwall, sith and jedi, vampires, compare people, x-me and make a baby out of my email inbox, thank you...

First, let's jump to a solution. Block Facebook Spam is a group that helps with links to how to block the most offending applications.

After the solution, a quick 3 step how to survive Facebook:

1. Add only people you consider to be your friends.
2. When you don't like to receive a notification from an application, block it, or block them all (or remove them, from the same link).
3. Disable Beacon (below).

That's it - 3 steps. I could make it proper Web 2.0 style and lengthen it to 10 points but why bother? Here below rather how to block individual applications.

Facebook itself does not send spam, but with one of the relatively recent changes in the platform it allowed all sorts of little applications that you can add to your profile to spam everyone in your contacts list. How nice... that added to the fact that 90 % of these applications in Facebook are pointless (want to add vampires? Want to add vampires? How about pirates, yarr? Join quizes and spam everyone on your friendslist now? Join superwall? Someone sent you a gift or a message, click here and thisandthat to see it).

Facebook also added Beacon a month ago. A neutral name for an application that tracks what you do on external websites, and that you are supposed to opt out and not in, in case you would not like your friends to see what you purchased in Amazon etc.

To disable Beacon in Facebook: Set your privacy settings to remove Beacon -
1. go to privacy
2. go to external sites (bottom of list)
3. check - "Don't allow any websites to send stories to my profile."

To disable individual offending applications from sending you spam from your friends - more e.g. here.

* My personality:
http://www.facebook.com/apps/block.php?id=2490151219&action=block
* Hatching eggs:
http://www.facebook.com/apps/block.php?id=6702295930&action=block
* Friend wheel:
http://www.facebook.com/apps/block.php?id=2415325843&action=block
*Polls:
http://www.facebook.com/apps/block.php?id=2334088888&action=block
* Instant messaging:
http://www.facebook.com/apps/block.php?id=2603081069&action=block
* Boozemail:
http://www.facebook.com/apps/block.php?id=2360569570&action=block
* My questions:
http://www.facebook.com/apps/block.php?id=2363570816&action=block
* How Sexy Is Your Name Calculator:
http://www.facebook.com/apps/block.php?id=4673474311&action=block
* Name Analyzer:
http://www.facebook.com/apps/block.php?id=10939930426&action=block
* My Heritage:
http://www.facebook.com/apps/block.php?id=2528261089&action=block
* Jedi vs. Sith:
http://www.facebook.com/apps/block.php?id=2403689652&action=block
* Sticky Notes
http://www.facebook.com/apps/block.php?id=2384089789&action=block
* Naughty Gifts
http://www.facebook.com/apps/block.php?id=2412269324&action=block
* Free Condoms
http://www.facebook.com/apps/block.php?id=2410978396&action=block
* Are YOU Interested? (Yes in News Feeds):
http://www.facebook.com/apps/block.php?id=17091798008&action=block
* Entourage:
http://www.facebook.com/apps/block.php?id=4706620662&action=block
* Compare People:
http://www.facebook.com/apps/block.php?id=2433486906&action=block
* Superlatives:
http://www.facebook.com/apps/block.php?id=2372128250&action=block
* X-Me:
http://www.facebook.com/apps/block.php?id=2345673396&action=block
* Super Wall:
http://www.facebook.com/apps/block.php?id=2601240224&action=block
* Hot or Not:
http://www.facebook.com/apps/block.php?id=2252801962&action=block
* Likeness:
http://www.facebook.com/apps/block.php?id=4188419540&action=block
* Top Friends:
http://www.facebook.com/apps/block.php?id=2425101550&action=block
* Pirates:
http://www.facebook.com/apps/block.php?id=2342084241&action=block
* Vampires:
http://www.facebook.com/apps/block.php?id=2458301688&action=block
* Zombies:
http://www.facebook.com/apps/block.php?id=2341504841&action=block
* Werewolves:
http://www.facebook.com/apps/block.php?id=2721700161&action=block
* Slayers:
http://www.facebook.com/apps/block.php?id=17801732384&action=block
* Flixter/Movies:
http://www.facebook.com/apps/block.php?id=2558160538&action=block
* Funwall:
http://www.facebook.com/apps/block.php?id=2378983609&action=block

More:
Stop sending me invitations to add shit applications - Another interesting Facebook group with a lot of links.
Facebook: Do not sell my private pictures! Change your terms of use, NOW!
Facebook Is Always Watching You
How to sniff out private information on Facebook
Facebook CEO Apologizes, Lets Users Turn Off Beacon
15 reasons Facebook may be worth $15bn
Facebook opens profiles to public
Your boss could own your Facebook profile

From Terms of Use - regarding user data, incl. e.g who owns the photos or any materials users have posted.

When you post User Content to the Site, you authorize and direct us to make such copies thereof as we deem necessary in order to facilitate the posting and storage of the User Content on the Site. By posting User Content to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to the Company an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute such User Content for any purpose on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing. You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.
{http://www.facebook.com/terms.php}

From a Facebook group:

1. It's not your friends fault (except a few) - the application are constructed in a way that rewards invites etc.
2. It's facebooks fault - what was a really nice contact management/news system - is becoming spambook.
3. Where is the "ignore ALL invites" button? - shame on facebook.
4. Everyone using facebook has put effort and time into creating and maintaining a profile - in good faith that facebook wouldn't screw up the basic premise of the system - that is being ignored by facebook. Saying "if you don't like it leave it" - is stupid - if you don't like - tell them info@facebook.com - if they ignore it... you won't be the only one leaving.

5. http://news.bbc.co.uk/1/hi/technology/7120916.stm - 50,000 users get facebook to change Beacon.

Block the worst applications:
http://www.facebook.com/group.php?gid=7230287089 - Block Facebook Spam

Subject: What does the Bible say about homosexuality?

2007-12-10T11:42:00.000-08:00

From: Jan Grimm [akstcadamsmotorcompanymnsdgs@adamsmotorcompany.com]
Subject: What does the Bible say about homosexuality?
Date: November 5, 2007 6:02:13 PM GMT+00:00
To: [someone else's email]

Save money and buy your prescription*s online

press right here

them to work immediately.
learned by those

Oh, what a disappointment. For once at least an interesting title. This is really such a disappointment (even if I would not care about religion). With this headline it's such a loser solution to have 2 lines of meaningless text and a link to a geocities homepage.

At least you could have been selling discounted and counterfeit Bibles or something.

Well well. For a miracle a forward of that link was still valid.
Canadian pharmacy, eh?

Domain Name: IMYLATEYNO.COM
Registrar: SCHLUND+PARTNER AG
Whois Server: whois.schlund.info
Referral URL: http://REGISTRAR.SCHLUND.INFO
Name Server: NS2.POLACREPOX.COM

registrant-firstname: Mark
registrant-lastname: Kinevan
registrant-street1: 7844 Troy Hills Ln
registrant-pcode: 32256
registrant-state: FL
registrant-city: Jacksonville
registrant-ccode: US
registrant-phone: +1.9045380494
registrant-email: motorbus@tokyo.com

tech-c-firstname: Hostmaster
tech-c-lastname: ONEANDONE
tech-c-organization: 1&1 Internet Inc.
tech-c-street1: 701 Lee Rd.
tech-c-street2: Suite 300
tech-c-pcode: 19087
tech-c-state: PA
tech-c-city: Chesterbrook
tech-c-ccode: US
tech-c-phone: +1.8774612631
tech-c-fax: +1.6105601501
tech-c-email: hostmaster@1and1.com

Schlund.info gets a few hits on google. The registrant itself is based in Germany, despite a few fishy details (Registrant ID:C5261-LRMS, schlund.de, but referral etc details missing) schlund itself won't get a tag of its own until I get a few new and annoying spams from them again. Which I hope won' happen anytime soon.

Liu hui or cncliup@21cn.com, again and again

2007-12-10T11:25:00.000-08:00

From: Betty Longoria [flatatom@yahoo.com]
Subject: Weapon
Date: November 6, 2007 5:37:56 PM GMT+00:00
To: [someone else's email]

buy all kind of med on a very cheap price.

pharmstopmachine.com.

Remove the dot from the end of the link to use it, thanks.

This is only entry #2 for Ivy, or Liu Hui or whatever he wants to be called, so he's still far behind Leo Kuvayev aka Alex Rodrigez. At least Liu Hui does not seem to have his own biography information on rokso.

But I have had dozens of these spams on my private and very private email address, several of them daily, and that has the tendency to piss me off very much. The style is always the same, much more repetitive than Kuvayev's.

Received: from [88.231.255.223] by e.mx.mail.yahoo.com

Domain Name: PHARMSTOPMACHINE.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Name: liu hui
Organization: liu hui
Address: nan chang
City: NanChang
Country: CN
Postal Code: 321000
Phone: +86.7913219002
Fax: +86.7913219002
Email: cncliup@21cn.com

The next big Chinese version of Alex Rodrigez?

2007-12-10T11:17:00.000-08:00

From: Toni Bernal [flames102587@yahoo.com]
Subject: Window
Date: November 8, 2007 7:42:37 AM GMT+00:00
To: [some other person's email address]

purchase all kind of pharmacy on a very less price.

onlinemedicalkey.com. Remove the dot from the end of the link to use it, thanks.

At least the flames part of the email address looks appropriate.

Domain Name: ONLINEMEDICALKEY.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Registrant:
Name: liu hui
Address: nan chang
City: NanChang
Country: CN
Postal Code: 321000

Administrative Contact/Technical Contact:
Name: liu hui
Organization: liu hui
Address: nan chang
City: NanChang
Country: CN
Postal Code: 321000
Phone: +86.7913219002
Fax: +86.7913219002
Email: cncliup@21cn.com

Create: 2007-10-31 00:40:34
Update: 2007-11-06
Expired: 2008-10-31
QueryTimes: 63

The mathematician Liu Hui must hate you for poisoning his name.

Not new to abusebutler, or news.admin.net-abuse.email, or Sirt.

Pulse Plaxo - spams you from random people and offers opt-out (don't you expect something more from a "social networking site"?)

2007-12-10T10:42:00.000-08:00

Alright, oh please not again one more social networking site?
Justonemoredamnsocialnetworkingweb2.0website.com?

Let's have a look.

From: pulse@mx.plaxo.com
Subject: Dipl. Detlef Käding added you as a connection on Pulse
Date: December 10, 2007 2:51:11 PM GMT+00:00
To: [my email]
Reply-To: pulse@plaxo.com

Dipl. Detlef Käding wants to add you as a connection on Plaxo Pulse.

To accept this connection request, go to:
http://pulse.plaxo.com/pulse/invite/?i=somerandomnumber

Thanks!
The Plaxo team

---
What's Pulse?

It's the first networking tool to span business and personal life.

Your family, friends, and business connections are using lots of different sites to find and share content. Some are writing blogs. Others write restaurant and product reviews. And many are uploading photos and videos. Until now, finding that stuff has been really hard - and staying on top of it, even harder. Let Pulse bring it to you - automatically - in your own personal stream of news.

Don't want to receive emails from Plaxo any more? Opt out:
http://www.plaxo.com/opt_out

1. I don't know anyone called Detlef Käding.

2. I have never subscribed or even been to pulse.com.

3. I absolutely don't want to join one damn more failure of social networking site that someone that I have never heard of in my life invites me to.

4. The biggest failure of them all: considering the above, you are offering me an opt-out for your spam site? I never opted in, so I should not have to opt out. Quit flooding my inbox.

Let's have a look.

Plaxo Pulse Random Connections - I'm not the only one ...
Does Plaxo flood your inbox with connection requests? - definitely not the only one... and there are a huge number of others out there. I think I'm happy enough to forward every single pulse or plaxo (by the way, does plaxo come from the word plague?) to my isp spamfilter. And possibly remove the people that I would know sending me that spam from my professional networks in the other services that I already use.

A comment from Tom's blog (above) probably sums it better than a good googling around:

In a previous iteration, Plaxo was notorious for spamming the contacts you had listed on it to get them to sign up for Plaxo service - after many complaints the publicly renounced this policy and promised to be on their best behaviour.

Dear Real Life friends and business contacts, in case you want to ever add me, let's make a deal? Keep it in linkedin. That said, if I don't know who you are and you make no effort in introducing yourself to me, I will click the "I have no clue who this person is" button.

FROM CENTRAL BANK OF NIGERIA -style score: -227 points

2007-12-10T10:41:00.000-08:00

Subject: FROM CENTRAL BANK OF NIGERIA

X-Apparently-To: [my email] via 206.190.48.155; Mon, 10 Dec 2007 03:47:36 -0800
X-Originating-IP: [64.71.41.45]
Return-Path: tunde@sunlight-company.biz
Authentication-Results: mta164.mail.re3.yahoo.com from=; domainkeys=neutral (no sig)
Received: from 64.71.41.45 (EHLO lvs01-n06.chi.affinity.com) (64.71.41.45) by mta164.mail.re3.yahoo.com with SMTP; Mon, 10 Dec 2007 03:47:35 -0800
Received: ("??"@ams06.chi.affinity.com) by ams06.chi.affinity.com id S374514AbXLJLrU for [my email]; Mon, 10 Dec 2007 05:47:20 -0600
From: "Dr Tunde Lemo" tunde@sunlight-company.biz Add to Address Book Add Mobile Alert
Reply-to: tlemo101_0000@yahoo.com.hk
Message-Id: S374514AbXLJLrU/20071210114720Z+21059@ams06.chi.affinity.com

Yea, right, not again. Central Bank of Nigeria? The start of this scam should receive negative 50 points for the total lack of originality.

Dear Nigerian scammers, make your kids enjoy the XO laptop at school to learn everything about The Internet....
Based on your content, may I just assume you are using the 1 per child laptop and you are way underaged? Otherwise, you might want to consider to learn e.g. about the grammatics...

Oh, and would any "manager" from the Central Bank of Nigeria for once bother to explain me a few things?
1. Why you are not using your official email address? Do you really think that a yahoo Hong Kong address with some other repty-to email address (that again isn't your cenbank address) will do it?
2. You are telling me that you are sending a box worh $ 75 million and I need to send you a deposit? I'm sorry, you have probably never even been in a bank, let alone any central bank, unless central village bank of Dogbutt, Suburbia of Lagos counts. First, for money transfers you don't send a box. Wired transfer, hello? Second, remove the damn deposits from that. Third, you send this email to a list of people without bothering to specify who you are faking to send all this cash to?

You fail as a scammer, Tunde. And really big time.

No love,

me.

FROM CENTRAL BANK OF NIGERIA
HEAD OF BANKING OPERATIONS
Tinubu square - Lagos

Attention

CONTRACT PAYMENT BY CASH CALL SYSTEM

Sequel to the secret arrangement in regards to the Shipment of your
totalcontract sum(US$55.5m), I wish to inform you that all necessary
modalities have been automatically concluded and the fund has left
C.B.N
office through the Diplomatic Courier Services today by Express Cargo
Flight to your home country.

Note carefully that the content of the box are your total contract
value
but the CBN did not disclose the content to the Courier Services,
rather it
was registered as Vital "DIPLOMATIC DOCUMENTS" belonging to the CBN
client
(That’s you).

Furthermore, the box is (1) in number and about 75kg. However, you are
advised not to disclose the content of the box to the Courier Services
to
avoid Betrayal in any circumstances In the mean time, you are kindly
advised to furnish us with your direct
telephone/mobile number, your valid I.D/Drivers License and your
office/house address or where ever you wish to receive the diplomat to
enable him identify you when he arrives to your address with the box
For
more information, we advise you to contact this office as soon as you
receive this mail to enable us fax you the necessary documents which
you
will
need to deposit your funds into your bank account.

Congratulations and remain blessed.
Sincerely,

Dr Tunde Lemo
C. B .N HEAD BANKING OPERATIONS

Blessing Goodluck - so poor Central Bank of Nigeria fake that no one would have falled to taht even in 1990

2007-09-13T23:14:00.001-07:00

From: blessing2007@web2mail.com
Subject: Notification Message
Date: September 14, 2007 4:30:12 AM GMT+01:00
To: [me]
Reply-To: goodluck2007@web2mail.com
Return-Path: [..]
Received: from topaze.jouy.inra.fr (topaze [138.102.22.1]) by adm3.jouy.inra.fr (Postfix) with ESMTP id C02A36F8ACfor [email]; Fri, 14 Sep 2007 05:30:12 +0200 (CEST)
Received: by topaze.jouy.inra.fr (Postfix, from userid 48)id B7EAF104DD9; Fri, 14 Sep 2007 05:30:12 +0200 (CEST)
Message-Id: <20070914033012.B7EAF104DD9@topaze.jouy.inra.fr>
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.6 (diorite.jouy.inra.fr [138.102.119.178]); Fri, 14 Sep 2007 05:30:12 +0200 (CEST)

FEDERAL REPUBLIC OF NIGERIA
CENTRAL BANK OF NIGERIA
CORPORATE HEAD QUARTERS TINUBU SQUARE,
MARINA LAGOS NIGERIA.
Our Ref: CBN/IRD/CGX/NNPC/021/05
ATTN: contractors,

During the Third Quarter Payment Shedule of the financial records of the Central Bank of Nigeria (CBN) it was discovered from the records of outstanding Foreign contractors due for payment with the Federal Government of Nigeria on 14th Sept. 2007 that your name is next on the
list of Those who will receive their fund. I wish to officially notify you that your payment is being processed and will be released to you as soon as you respond to this letter.

Also once we receive the information's from you for the President of Federal Government of Nigeria will Approve it to enable us release the fund to your account. Note that from the record in our file, your outstanding contract payment is US D$9.000,000.00(Nine Million United States Dollars). Kindly re-confirm to me if this is inline with what you have in your Record and also re-confirm the information below to enable this office Proceed and finalize your fund remittance without further delays.

1) Your full name.
2) Phone, fax and mobile #.
3) Company name, position and address.
4) Profession, age and marital status.

As soon as the above information are received, your payment will be Made available to you via an international certified bank draft, which will be delivered to your doorstep for your confirmation or through Bank ransfer.

You should Email: blessinggoodluck1@yahoo.com as soon as you receive his letter for your payment approval and also for further Discussion and ore clarification.

YOURS SINCERELY,
Ms. Blessing Goodluck
Dep. Governor CBN

Uh oh. Dear Ms Blessing Goodluck, you have a very fake name.

If you are faking to be communicating to anyone from Central Bank of Nigeria, quit using these shady emails.

In fact, if you were working for Central Bank of Nigeria, I am pretty sure their webmail access policies would be at least as anal as I've heard they have at Morgan Stanley. No webmail for you, if you need that spelled out.

If I was supposed to be paid $9 million USD by CBN, I think you would have honestly called me.

Dear Blessing Goodluck, you have just managed to provide me the least original Central Bank of Nigeria scam that I have read in years. Even in 1990 no one would have fell for it.

IP 138.102.119.178 is located in Paris, IL, FR
netname: FR-INRA-ILE-DE-FRANCE
descr: Institut National de Recherches Agronomiques
descr: 147 rue de l'Universite

Another dying African with millions to give you for some charity

2007-09-09T03:19:00.000-07:00

From: florence.henshaw@orangemail.es
Subject: MAY GOD BE WITH YOU.
Date: September 9, 2007 5:01:25 AM GMT+01:00
To: florence@shuf.com
Return-Path:
Received: [...] by smtp.latinmail.com (Postfix, from userid 65534) id C073AD650D5; Sun, 09 Sep 2007 06:01:25 +0200 (CEST)
Received: from unknown (unknown [172.17.224.57]) by smtp.latinmail.com (Postfix) with SMTPid A5650D5E666; Sun, 09 Sep 2007 06:01:25 +0200 (CEST)
Message-Id: <20070909040125.A5650D5E666@smtp.latinmail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary=orangemail.es_dam08.wnet_9bcf6f59d8ea449d982b4b854f5e0319
Importance: normal
X-Bogosity: No, tests=bogofilter, spamicity=0.539907, version=0.15.13
Original-Recipient:

My Dear Friend
May Almighty God be with you, and how are you doing?. My intention of contacting you is to solicit your assistance for a project, which will be mutually beneficial. Though I know my decision to contact you is to a large extent unconventional, the prevailing circumstances necessitated my action. I am Mrs. Florence Henshaw from Seychelles. I am married to late Johnson Clarke Henshaw of blessed memory who was an oil explorer in Libya and Kuwait for twelve years before he died in the year 2000. We were married for twelve years without a child. He died after a brief illness that lasted for only four days before his death we were both devoted Christians. Since his death I too have been battling with both Cancer and fibroid problems. When my late Husband was alive he made a huge deposit in millions of US dollars with a Deposit Company in overseas. (I will tell you the amount as we proceed).
Recently, my doctor told me that I have only six months to live due to blood cancer problem. Though what disturbs me mostly is my stroke sickness. Having known my condition I decided to donate this fund to either a Christian's organization or devoted individual that will utilize this money the way I am going to instruct herein. I want this Christian organization or individual to use this money in all sincerity to fund churches, orphanages, widows, and also propagating the word of God and to ensure that the society upholds the views and belief of the Holy Bible.
The Holy Bible emphasizes so much on GOD benevolence and this has encouraged me to take the bold step. I took this decision because I don't have any child that will inherit this money and my husband relatives are into some radical Organizations and I don't want a situation where this money will be used in an unholy manner. Hence the reasons for this bold decision. I know that after death I will be with Bosom of our Lord the most beneficent and the most merciful I don't need any telephone communication in this regard because of my health, because of the presence of my husband's relatives around me always. I don't want them to know about this development. With God all things are possible. As soon as I receive your reply on Email: (florence.henshaw1@ozu.es) I shall give you the contact information of the Deposit Company in oversea where the money was deposited. I will also issue a letter of authority to the Deposit Company authorizing them that the said fund have being willed to you and a copy of such authorization will be forwarded to you. I want you and the Christian community where you reside to always pray for me. My happiness is that I lived a true devoted Christian worthy of emulation. Whoever that wants to serve God must serve him in truth and in fairness. I will not stipulate any precise amount to reward you, as it will have to be on pre-negotiated terms, based on your level of involvement.
Please always be prayerful all through your life. Any delay in your reply will give room in sourcing for a Christian organization or a devoted Christian for this same purpose. Until I hear from you by email, my drea,s will rest squarely on your Shoulders.
May the Almighty God continue to guide and protect you.
God Bless,

Mrs. Florence Henshaw

And that repeated 5 times in the same email.

If anyone had these millions of dollars, they would hopefully be smart enough to first, cure themselves in hospitals that can help them, and secondly, use a lawyer or someone to take care of their finances while they are alive and when they will not be any more. Seriously. What kind of millionaire, even if they had a famine starved brain, would go to internet to spam unknown people to give them millions of dollars?

Dear Mrs Henshaw or whatever you want to be called, if you indeed have millions of dollars that you don't want and need, I don't think you would be very smart spamming random people in the internet to help you. How do you know if random recipient of your emails care about your christian values? If you however exist and have these millions, how about drop a half a or a million of dollars for Joshua as he will need it when he grows up.

Pfizer zombies send Viagra spam, Wired reports

2007-09-06T10:06:00.000-07:00

Zombie Pfizer Computers Spew Viagra Spam

By Ryan Singel 09.06.07 | 2:00 AM

Computers inside pharmaceutical giant Pfizer's network are spamming the internet with e-mails touting the company's flagship erectile-enhancement drug Viagra, along with ads for knockoff Rolexes and shady junk stocks.

But the e-mails are not part of Pfizer's official marketing efforts.

Pfizer's computers appear to have been infected with malware that has transformed them into zombie computers sending spam at the behest of a hacker. Oddly enough, they are spamming the public's inboxes with ads for the company's own product.

"There is a disaster inside this company, and they don't know it," says Rick Wesson, CEO of Support Intelligence -- a small San Francisco-based security company that alerted Wired News to the problem.

The flood of spam adds to Pfizer's recent computer security woes. This summer, the company revealed that it had suffered three breaches of sensitive data, cumulatively affecting more than 50,000 individuals.

In one breach, a Pfizer employee exposed personal information on 17,000 employees after installing peer-to-peer software on a laptop. In another breach, confirmed Tuesday, a former employee downloaded sensitive data, including social security numbers and credit-card information for about 34,000 Pfizer employees.

Full story at Wired.

True or false : Joshua needs your help

2007-09-05T11:55:00.000-07:00

Update : the information I had found in the Internet regarding this illness was not even nearly complete to estimate the whole story, so I have updated the bits and pieces provided in the comments section, striking over pieces here, and have to update the category. Not scams.

This is a real child, and with a real disease, of which the costs to cure him or to help him get as normal as possible life are not cheap, so the gala evenings are a way to help them be able to afford the treatment. Which they cannot have done closer to where they live due to the rarity of disease, as the Irish hospitals are not prepared for treating it.

Here a link for ways for helping his family.

This as a piece of email may be ~~scam and spam~~ questionable regarding companies email acceptable use policies. ~~Not the blog post itself - but the points Rahina makes in it.~~ This is how I run to it.

Come join us on Sat September 29th for a Drinks Reception, 4 Course Banquet, Goodies Bag for everyone worth €150!! Live music and dancing and an auction!!
Every single penny goes to Josh Huffy Duff from Castletownroche, who is 20 months old and has a rare medical condition which necessitated both his legs being amputated. This money will fund his medical treatment in Shriner Hospital, Chicago as well as prosthetic limbs.
For more details on the night planned and Josh & family see the offical email below from my friend Gerry, formerly of RTÉ Radio 1.
Tickets are €100 per person - so when you think of it, you actually *make* €50 by going and getting the goodie bag alone
I know we’re all short of cash these days, but I think something like this really puts things in perspective - please pass this on to as many people as you know, we really need a big turn out for this event to help Josh and his family.
If you can go, we require a minimum of 50% deposit (or if possible the total amount) — Cheques made payable to “For Josh.” — Their second son has autism but is responding very well on the one to one teaching method. However, the costs involved with Josh are horrendous.

1. It was sent out to him in company email (not where I work for, nevertheless)
2. It underlines, not only in this email but also in the whole country wide media coverage how this is a sick child and how they want to raise money for it.
I'm not saying this child would be fake - the newspapers on national level probably would have noticed by now if it was. I'm not saying the kid would not be sick either, or that getting new prosthetics etc would be cheap either. It for sure isn't. BUT a few things .. The story seemed odd as the medical details provided did not seem to match. The things that seemed particularly odd :

~~They live in Ireland, in a country where their some sort of national health insurance should cover the costs of it. The system should be closer to the UK NHS style than the wild range US market.~~
Where the hospitals are not prepared to deal with this disease. Where they should cover it.

Why does a under 2 years old need 2 prosthetic legs? He will grow so fast out of them - good point (in Rahina's post)

From comments:

2. Children are given prosthetic lower limbs at the same age they would be starting to learn to stand and walk. They get adjustments made as they grow, and get new ones as they outgrow them. The earlier they start, the better they learn to use them. Weight bearing and walking helps shape the hip sockets in the toddler years, so if they don't walk early enough, they may end up with deformed hips that will make it more difficult to wear prostheses as an adult.

The exact disease of this child is not really mentioned in the articles in the national newspaper. The event mentioned is not organized by RTE but by a private person. Or they do mention arthrogryposis as the disease, but that can't be it.

Arthrogryposis, also known as Arthrogryposis Multiplex Congenita, is a rare congenital disorder that causes multiple joint contractures and is characterized by muscle weakness and fibrosis. It is a non-progressive disease.

~~Since when is amputation a cure for congenital, non-progressive muscle and joint wasting disease?~~

1. Children with severe arthrogryposis sometimes have legs amputated, when the severity of the contractures are such that they cannot be corrected to any kind of functionality. Severe contractures can be painful as a child grows. It is not common, but it happens. There can also be complications from previous surgeries that make it the best option.

Brave Joshua Duffy-Huff was born with a rare condition which meant he had to have emergency surgery when he was just one month old.

~~That is over 1,5 years ago?~~ This is unfortunately one of the serious cases about AMC. And far from fun for a small child, or a person of any age.

Due to complications and limited medical resources in Ireland, doctors have amputated his legs and now there is discussion of his hands or arms.

This ~~looks identical to the scam email Rahina received. Same $ 100 food deal.~~
It is better in this case if they actually DO manage to organize more people for the dinners and other help, so that the child will be able to have as normal and happy life as possible.

Shriners Hospitals for Children is a network of 22 pediatric hospitals in the U.S., Canada and Mexico providing specialized care for orthopaedic conditions, burns, spinal cord injuries and cleft lip and palate. All services are provided at no charge.

Is on big bold letters on Shriners hospital webpage.

Again, from comments clarified :

3. Shriners hospitals do provide treatment free of charge. And parents are offered places in Ronald McDonald houses if they need them. However, they do not pay for airfare, for incidentals, or for loss of wages and babysitters for the other children while a parent is at the hospital with the child. The RM houses are sometimes full, and the hotels that you are bumped to can be more expensive. You can usually only get a visa to come to the US for treatment if you can get everything done in one shot, meaning some serious time away from home. I researched this on behalf of a parent from Pakistan who was hoping to bring his child to Shriners.

Living months there to be with the child to get him back to health will be far from cheap.

I hope this will help to convince anyone else running to the story of Joshua and wondering if it is a real story or a made up one. Now that it is debusted as a made up story, consider helping him.

Thank you for the information priovided additionally in the comments. My apologies.

I would like to see this kid grow up keeping the happy smile he has in the only picture that I've seen of him in the internet.

University degrees spam - they can't even spell other than their phone number, (206) 350-2402

2007-09-04T13:15:00.000-07:00

From: stheis@blizzop.com
Subject: RE: Your-Degree is pending.
Date: September 4, 2007 5:20:47 PM GMT+01:00
To: [someone else's email]

Received: from [59.23.249.177] ([59.23.249.177]) by mac.com (Xserve/smtpin073/MantshX 4.0) with ESMTP id l84GK2LQ001140; Tue, 04 Sep 2007 09:20:42 -0700 (PDT)
Received: from [59.23.249.177] by redir-mailav-telehouse2.gandi.net; Tue, 35 Aug 2007 25:20:46 +0900
Date-Warning: Invalid date header replaced by ms121.mac.com; original content: Tue, 35 Aug 2007 25:20:46 +0900
Message-Id: <0107ffa4$0107fe78$b1f9173b@stheis>
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106

F A S T T R A C K D E G R E E P R O G R A M

Obtain the degree you deserve, based on your present knowledge and life experience.

A prosperous future, money earning power, and the Admiration of all.

Degrees from an Established, Prestigious, Leading Institution.

Your Degree will show exactly what you really can do.

Get the Job, Promotion, Business Opportunity

and Social Advancement you Desire!

Eliminates classrooms and traveling.

Achieve your Bachelors, Masters, MBA, or PhD
in the field of your expertise

Professional and affordable

Call now - your Graduation is a phone call away.

Please call:
1-206-350-2402

Interesting. No website, just phone number. Maybe a few other people have got this same spam it seems...

Would you consider getting a degree from something that spams you, and does not even know how to capitalize words? You could even think that these are German Spammers as All Conceptual Words are Capitalized.

(206) 350-2402

Type: Land LineProvider: International Telcom, Ltd Location: Seattle, WA

The landline registrant details look shady too.

Registrant:
International Telcom
Attn: chip phillips
417 Second ave West
Seattle, WA 98119
US

Registrar: DOTSTER
Domain Name: ITLTD.NET
Created on: 24-FEB-96
Expires on: 25-FEB-08
Last Updated on: 03-FEB-06

Administrative, Technical Contact:
Telcom, International admin@itltd.net
Attn: chip phillips
417 Second ave West
Seattle, WA 98119
US
(206) 666-4991

Domain servers in listed order:
GATE.KALLBACK.COM
BART.KALLBACK.COM

Paypal scammers, srdev.fr

2007-09-02T15:45:00.001-07:00

From : service@paypal.com
Sent : Sunday, August 26, 2007 9:37 PM
Subject : Notification of Limited Account Access

X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator33.hostgator.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

Information Regarding Your account:
Dear PayPal Member:

Attention! Your PayPal account has been limited!

As part of our security measures, we regularly screen activity in the PayPal system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the Last reminder to log in to PayPal as soon as possible. Once you log in, you will be provided with steps to restore your account access.

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

Click here to activate your account

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience..

Sincerely,
PayPal Account Review Department
Copyright © 1999-2007 PayPal. All rights reserved. PayPal Ltd. PayPal FSA Register Number: 226056.

PayPal Email ID PP059

Protect Your Account Info
Make sure you never provide your password to fraudulent websites.

To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal login page (http://paypal.com/) to be sure you are on the real PayPal site.

For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips
Protect Your Password
You should never give your PayPal password to anyone.

Sure, the images linked from paypal's server and the warnings to not give out passwords for fraudulent sites give some authentic look, but why would paypal want you to authenticate to a completely non-paypal website? http://srdev.fr/images/paypal.co.uk/paypal/cgi-bin/webscrcmd=_login-run/webscrcmd=_account-run/updates-paypal/confirm-paypal/index.htm - srdev.fr shows a few other google results for fraud attempts.

UK FORTUNATE DRAWS RESULT - Sure, UK national lottery giving out money for email addresses harvested with a spambot

2007-09-02T15:35:00.000-07:00

From : UK FORTUNATE DRAWS RESULT < fortunate_draws0012@hotmail.com >
Reply-To : < barrister_frank_davies@yahoo.co.uk >
Sent : Friday, August 24, 2007 5:08 PM
Subject : UK FORTUNATE DRAWS

MIME-Version: 1.0
X-Originating-IP: [64.214.231.141]
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: 9P4r4dq6Pdvh5oKuxbNsBa2zvH2Q9ir2TxJbseS7RDpsNCRTK3LhyPfGDKOAuM14VqTDtl4l20iIC3uTglQ+xA==
Return-Path: fortunate_draws0012@hotmail.com
X-OriginalArrivalTime: 24 Aug 2007 17:08:13.0786 (UTC) FILETIME=[5B1FEBA0:01C7E671]

UNITED KINGDOM NATIONAL LOTTERY
292, Upper Richmond Rd West,
East Sheen, London,
SW14 7JG United Kingdom

TRACK Nº: 51024060210 OFFICIAL PRIZE NOTIFICATION

This is to inform you that have been selected for a cash prize of £500,000.00 (
FIVE HUNDRED THOUSAND GREAT BRITAIN POUNDS) programs held on the 23th OF August
, 2007 in the London U.K. The selection process was carried out through random
selection in our computerized email selection system(ess) from a database of
over 250,000 email addresses drawn from all the continents of the world. The UK
National Lottery is approved by the British Gaming Board and also Licensed by
the The International Association of Gaming Regulators (IAGR). This lottery is
the 3rd of its kind and we intend to sensitize the public.

To begin the processing of your prize you are to contact your claims officer
through our accredited Prize Transfer agents as stated below:
================================================================
Mr.Frank Davies
292, Upper Richmond Rd West,
East Sheen, London,
SW14 7JG United Kingdom

Email:(barrister_frank_davies@yahoo.co.uk)
Phone/ Fax: +44 709 288 0349
Phone Number: +44-70457-15368
For further enquiries Please call us (10.00am to 5.30 pm london Standard Time)
====== ==========================================================
contact him, please provide him with your secret pin code x7pwyz2006 and your
reference number BCLY:12052006/21.You are also advised to provide him with the
under listed information as soon as possible:
========================== ========================================
If you do not claim your WINNINGS on or before 30TH of SEPTEMBER,your winnings
would be revoked. Winners are advised to keep their winning details/information
from the public to avoid fraudulent claim (IMPORTANT)pending the transfer/claim
by Winner.

*Winner under the age of 18 are automatically disqualified.
*Staff of all Companies in the UK are not to partake in this Email Promotional
Lottery.

Accept my hearty congratulations once again!

Regards
Mr ANTHONY CAMPBELL
(Lottery Manager)

_________________________________________________________________
Discover the new Windows Vista
http://search.msn.com/results.aspx?q=windows+vista&mkt=en-US&form=QBRE

Text pieces in bold and italics added to highlight the best pieces.

So they have selected YOU based on a spambot finding 250,000 email addresses from the web, for he sole purpose of donating BIG AMOUNT OF MONEY (why does it always have to be spelled in capitals?)

Also the contact person you should contact is always with a free email provider, not once from anything like lottery.gov.uk ..

So you would need to be over 18, in UK, and yet "Staff of all Companies in the UK are not to partake in this Email Promotional Lottery"..

Sydney Car Center job offers again...

2007-09-01T05:52:00.000-07:00

From: jsmzyexyzeud@atlanta.com
Subject: vacant position in the Sydney Car Centre
Date: July 25, 2007 7:31:15 PM GMT+01:00
To: [someone's email]

While we may have high expectations of our associates, we also give them high rewards. Imagine being part of a stable organization with a sterling reputation - a place where the Sydney Car Centre is an integral part of all that we do. With our car centre personality, you'll not just succeed - you'll thrive. And, with our strong commitment to promoting from within, you'll definitely enjoy your rise to the top.

Today the Sydney Car Centre is looking for an industrious regional assistant to fasten the process of the delivery of customer payments to the suppliers. The position offered is a part-time job, and will only require from you to be available for 1-2 hours a day.

As a regional assistant, you will be supposed to operate with the payments from those customers, based in your country. You will be expected to accept 2-3 transactions to your bank account every week, make certain calculations about every transaction (you will be precisely instructed about it), & transfer the funds to the suppliers by means of western Union/Money Gram less your fee & the charges of the Western Union/Money Gram. You will be continuously communicating with the manager from the head office, who will instruct you & give advice regarding every new payment.

The ideal candidate will be industrious, goal-oriented person, with the availability of a personal/business bank account suitable to be used for the company needs. Knowledge of English, computer literacy and sociability are appreciated.

The company guarantees to pay NET 10% fee out of the amount of every payment you dealt with and to provide you with the regular income & flexible schedule. All the related expenses you might have (like the Western Union/Money Gram chargers, related expenses on traveling) are covered by the company.

The more detailed information is available on our web-site http://vacancy-2427298.sydncar.kg/vacancies.php, where you can fill in the on-line application form for this position.

We would be glad to welcome you in our team!

We are looking forward to hearing from you as soon as possible!

Yours sincerely, Polly Lyles

common: 0x4, 0x3, 0x4300, 0x32818886, 0x5, 0x85379018, 0x071, 0x022, [etc, white on white background]

Sydney car centre, eh?
Again.

Earlier, same story and more about them

A car sales job in Sydney, Australia, when the domain is registered in Kyrgystan or however it's spelled?

The email is sent from walla.com - a big no. I have never received a legitimate email from anyone using walla.com.

Sender and return path are different, both free email services. And the mail is signed by another name than is on the sender field.

Their jobs list 401K as a benefit, even though they claim to be in Australia.

And so on. All these details don't match.

+ Google (4,860,000 hits)
+ Sydney Car Centre Fraud (a lot about these Sydney Car Center jobs history and background).

Sydney Car Centre is the replacement money laundering/transfer fraud site for the Lux Capital money laundering fraud - exactly the same Serenitynet / Infinitie.net / Eonix Corporation hosted nameserver/botnet controller, exactly the same modus operandi, i.e. a stolen website offering an illegal 'Regional Assistant' so-called 'job' as a money laundering mule/transfer fraud victim and generally hosting the stolen site using a zombie botnet, (some domains use the Yahoo/Geocities 'small business' network as seen before), often with a host that apparently has no scruples about hosting thieves and fraudsters, the latest being Convergent Network Services of Hicksville NY, aka Ironcolo.com who do not respond to abuse reports concerning this criminal botnet on their network.

HOTXTINA again, this time searching for her fuckbuddies at pinpointthecoordinates.com

2007-09-01T05:41:00.001-07:00

From : Increadible Dating
Reply-To : Doddering@84Ew095La.com
Sent : Thursday, August 2, 2007 3:18 PM
To : essiers@hotmail.com
Subject : Free Online Search

Received: from aN6zkES.com ([89.181.47.236]) by bay0-mc2-f8.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 2 Aug 2007 10:10:43 -0700
Received: from 84Ew095La.com ([89.181.47.236]) by bay0-mc2-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 2 Aug 2007 08:18:08 -0700
Received: by 84Ew095La.com id hm7qqk0afgkl for ; Thu, 2 Aug 2007 08:18:01 -0700 (envelope-from )
Received: by srv-000-95-000-95.84Ew095La.com (Postfix, from userid 0) id 269B17D7A73; Thu, 2 Aug 2007 08:18:01 -0700 (ART)
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: g+YnDTwJTP4ObfgplAbNAybZSuhtVRrwl0n7RO1Zcvl3ODcrovgVXCiAm/ZwDjWNppd0o1mmeSk=
Errors-To: noreply@84Ew095La.com
Precedence: list
Return-Path: noreply@84Ew095La.com
X-Spam-Check: igzdqos.egd$kgfixfztk04=
X-OriginalArrivalTime: 02 Aug 2007 17:10:43.0819 (UTC) FILETIME=[0F76A3B0:01C7D528]

The same hotxtina that was in the other emails too..

whois for pinpointthecoordinates.com

Referral URL: http://www.dns.com.cn
Domain Name.......... pinpointthecoordinates.com
Creation Date........ 2007-07-12 23:13:51
Registration Date.... 2007-07-12 23:13:51
Expiry Date.......... 2008-07-12 23:13:51
Organisation Name.... wang jing
Organisation Address. NO.75 PINGTAN XIAN PU DONG ZHUANG
Organisation Address.
Organisation Address. Fuzhou
Organisation Address. 210222
Organisation Address. FJ
Organisation Address. CN

De lotto online - one more lottery scam, as original as all these yahoo microsoft msn aol lottery notifications out there

2007-09-01T05:35:00.000-07:00

From : Info Desk < infodesk@lotto.nl >
Reply-To : claimsdepartmentstaatbv@yahoo.co.uk
Sent : Monday, August 20, 2007 11:35 PM
Subject : PP 3502 /8707-01.

MIME-Version: 1.0
Received: from swip.net ([212.247.154.108]) by bay0-mc5-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Mon, 20 Aug 2007 16:35:05 -0700
Received: from [64.70.24.209] (account eu1371123@tele2.fr) by mailbe02.swip.net (CommuniGate Pro WEBUSER 5.1.10) with HTTP id 72853902; Tue, 21 Aug 2007 01:35:01 +0200
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: N4u0pqWW+O2oFq5Mbu0IBjQaTW9L0ZrHRvLwX/O+wN8ZykD9/Fsx2lo6Y1tpc/6adDPdRJX7PTS83yuxE2yIDA==
X-Cloudmark-Score: 0.000000 []
X-Mailer: CommuniGate Pro WebUser v5.1.10
Organization: Info Desk
Return-Path: eu1371123@tele2.fr
X-OriginalArrivalTime: 20 Aug 2007 23:35:05.0855 (UTC) FILETIME=[BCF190F0:01C7E382]

De Lotto Nl Email Result;
INTERNATIONAL PROGRAM

Dear Email User,

We are pleased to inform you of the result of the last final annual
draw of our LOTTERY INTERNATIONAL Programs. De Lotto online
cyber lotto draws was conducted from an exclusive list of 25,000,000 e-
mail addresses of individuals and corporate institutions,picked by an
advanced automated random computer search from the internet. No
tickets were sold.After this automated computer ballot, your e-mail
address emerged as a winner in the category "A" with the following
numbers Email Informations below.

Your prize award has been insured with your e-mail address and will be
transferred to you upon meeting our requirements,statutory
obligations,verifications, validations and satisfactory report.

It is important to note that your award information was released today
the 20th of August 2007 with the following particulars attached to it.

(I) Award numbers: TL 22/15409
(ii) Email ticket number: PP 3502 /8707-01.
(iii) Lotto code number: TL09622NL
(iv) The file Ref number: TL/0534/30/07

To file in for the processing of your prize winnings, you are advised
to contact our Certified and Accredited claims agent for category "A" winners with the information below To file for your claim, please contact our /your processing
agent.
**********************************************
Mr.Steve Litzin
DIRECTLINE: 0031-616-725-622
EMAIL:delottonl001@yahoo.co.uk
**********************************************

Sincerely,
SUSAN LU
Promotions Manager
Netherlands the Letter company
European promotions.

Dear Email User? Wow, is that me?

This is as bad and without imagination as these yahoo microsoft msn lotteries out there.

Yahoo.co.uk email address used for some big lottery in Netherlands? As likely as any bank manager anywhere on this planet sending you any email from yahoo or hotmail.

My favorite part in this one is though "De Lotto online
cyber lotto draws was conducted from an exclusive list of 25,000,000 e-
mail addresses of individuals and corporate institutions,picked by an
advanced automated random computer search from the internet.". So what they are effectively saying is that this big lottery used an email harvesting bot to get the addresses ...
I think what they should have said is that they sent this same email to these 25,000,000 email addresses.

Stock spam, cytv.ob

2007-09-01T05:27:00.001-07:00

From : admin@stockcross.com < fake email>
Sent : Monday, August 6, 2007 8:06 AM
To : < same fake email>
Subject : RE: Weekly News
MIME-Version: 1.0
X-Originating-IP: [82.48.4.430]

Cytv.ob would resolve to China YouTV Corp. [snippet]

Never trust stock advice that you didn't ask for, that arrives in your inbox, and that appears that you have even sent yourself from your email address (the fake email part).

Joey Jones, an American soldier in Iraq, fluent in Chinese, with millions of dollars to offer to Hello Pal...

2007-09-01T05:20:00.000-07:00

From : Sgt.Joey Jones. < thepreacherman@yahoo.com >
Reply-To : sgtjoeyjones_usarmy@yahoo.com.cn
Sent : Monday, August 6, 2007 12:27 AM
To : [my email]
Subject : CAN I TRUST YOU?(Assistance Needed From Iraq)

MIME-Version: 1.0
Received: from quox.net ([85.214.52.163]) by bay0-mc2-f16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sun, 5 Aug 2007 17:32:01 -0700
Received: (qmail 21834 invoked by uid 30); 6 Aug 2007 02:27:06 +0200
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Info: JGTYoYF78jGrtPiMsbkWHeFOfu0UTMWNk75KwY6EJLv0RgxjUL0NeZS8MVeTDBweM+6V/OPh1CZh4GCH5tQi1Q==
Return-Path: root@quox.net
X-OriginalArrivalTime: 06 Aug 2007 00:32:01.0953 (UTC) FILETIME=[34E68110:01C7D7C1]

Content-Type: text/plain
Content-Transfer-Encoding: 8bit

Hello Pal,

I hope my email meets you well. I am in need of your assistance. My name is
Sgt. Joey Jones. I am an American soldier serving in the military of the 1st
Armored Division in Iraq, we have just been posted out of Iraq and to return in
a short while. My colleague and I need your help to transfer out the sum of
Twnety Five Mllion U.S Dollars (US25.0M).

The money which is now in the custody of a Security Company is part of the
money we seized from late Saddam Hussein but was not declared. Right now I am
in the Bagdad trying to sort out things with the Security Company to ensure a
smooth and unhindered transfer of the money to you,Therefore be assured that the
transfer is safe and risk free.

My colleague and I need a good partner someone we can trust to actualize this
venture.But we are moving it through diplomatic means to your house directly or
a safe and secured location of your choice using a shipping company.But can we
trust you? Once the funds get to you, you take your 40% out and keep our own
60%. Your own part of this deal is to find a safe place where the funds can be
sent to. Our own part is sending it to you.

If you are interested I will furnish you with more details,
Awaiting your urgent response.

Your Buddy.
Sgt. Joey Jones.

God Bless America!!!!

Maybe these scammers have realized that while the general public gets more xenophobic and does not trust that much all these Abdul Al Abdullah who have the Hundreds of Millions of Euro Dollars to offer you (whom they found in the internet and trust you with their millions ..), so all these American soldiers in Iraq are now hten norm then?

At least the spelling isn't as retarded as the majority of the Nigerian scammers have.

I just find it very very odd that an American soldier named Joey Jones would have enough Chinese skills to use Yahoo chinese email... also if he did know enough Chinese to actually use it, what would he be doing in Iraq? And with all these millions, "Hello Pal"? Odd choice of words there...

CEPU spam, from mailing-list.it

2007-09-01T05:11:00.000-07:00

From : Cepu
Reply-To : mailing@mailing-list.it
Sent : Tuesday, August 21, 2007 7:14 AM
To : [my email]
Subject : Cepu c'è! Nello studio è con te!

Quando ...

non riesci a superare un esame, Cepu c'è.
vuoi sentirti più sicuro, Cepu c'è.
vuoi acquisire un metodo di studio, Cepu c'è.
desideri un bel voto all'esame, Cepu c'è.
vuoi finire prima l'università, Cepu c'è.
sogni la laurea, Cepu c'è.
arrivi alla laurea, Cepu c'è.

... e gioisce con te.

Inoltre nelle sedi cepu trovi Campus Privati Universitari per le facoltà di Giurisprudenza, Psicologia, Ingegneria e Economia,
con stage, inglese, e pratica per la tua futura professione.

Messaggio inviato in ottemperanza al Decreto legislativo 196/03.
Clicca qui per cancellare la registrazione e non ricevere piu' messaggi.

With some link for the cancel. Sure.
You can say you are using whatever points behind Italian spam legislation. Nevertheless, I have never agreed to get a single CEPU spam from you. I have used mailing-list.it a few times while it didn't suck, that was over 5 years ago. Now the email is doomed in receiving still all these CEPU and other @#%%. I for sure have NEVER agreed to received even a single CEPU related notification. Oh did I mention the frequency I get the CEPU spam? It makes it qualify for hte annoying, repetitive category

Hotmail joys - "Meet a new fuck buddy", criostasiswithequipment.com

2007-09-01T05:05:00.000-07:00

X-Message-Status: n:0
X-SID-PRA: cool@yuiopplkjh.com
X-Message-Info: LsUYwwHHNt2679teDQ0I1ujVGG18SjEEV61J4QCsJCDe8Q49HfWXczIrUawpA+FR
Received: from yuiopplkjh.com ([58.237.41.137]) by bay0-mc9-f22.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Thu, 12 Jul 2007 13:15:07 -0700
Date: Thu, 12 Jul 2007 18:35:40 -0400
Message-ID:
From:Meet A New FuckBuddy
To: essiers@hotmail.com
Subject: Search Your Area
Mime-Version: 1.0
Content-Type: text/html;
Sender: cool@yuiopplkjh.com
Return-Path:
X-OriginalArrivalTime: 12 Jul 2007 20:15:07.0833 (UTC) FILETIME=[57747290:01C7C4C1]

[snip] accomplished.margin.kids.clear
personal-compose

fame.victims.appointed.commands
personal-compose

smoothly.hands.king-craft.options--becoming
personal-compose

little.traumatic.solemnity.because
personal-compose

one-third.cocktail.examined.Their
personal-compose

solid.resembles.mentally.Cro-Magnon
personal-compose [snip]

And more of that that mindless junk.

Whois for http://www.criostasiswithequipment.com

Referral URL: http://www.dns.com.cn
Domain Name.......... criostasiswithequipment.com
Creation Date........ 2007-07-12 23:14:46
Registration Date.... 2007-07-12 23:14:46
Expiry Date.......... 2008-07-12 23:14:46
Organisation Name.... wang jing
Organisation Address. NO.75 PINGTAN XIAN PU DONG ZHUANG
Organisation Address.
Organisation Address. Fuzhou
Organisation Address. 210222
Organisation Address. FJ
Organisation Address. CN
Admin Name........... wang jing
Admin Address........ NO.75 PINGTAN XIAN PU DONG ZHUANG
Admin Address........
Admin Address........ Fuzhou
Admin Address........ 210222
Admin Address........ FJ
Admin Address........ CN
Admin Email.......... admin@32c.com
Admin Phone.......... +86.5913210023
Admin Fax............ +86.5913210023

This is just one of the reasons why I would not suggest anyone to let hotmail be their children's email choice. This kind of junk goes always to my inbox, no matter how many times it is indicated to be spam.

More graphic spam containing male organs and Russian women measuring them

2007-09-01T04:46:00.000-07:00

From: xversal.com@usedcompanycars.com
Subject: She will love you more than any other guy
Date: August 1, 2007 11:40:26 PM GMT+01:00
To: [my email

Contained a very gross graphic picture of a male organ, and a Russian looking black haired lady measuring said white male organ with a tape measure on it's right side. I don't feel like uploading that graphic to the web as it is just gross. Maybe some desperate males who want to attract money leeching Russian ladies who want to have a huge while male organ in addition to your wallet might like it, I'm obviously not in the target group.

The picture was linked to http://www.vetrib.com/.

Whois gives

Domain Name: VETRIB.COM
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com

Registrant Contact:
liu dong
dong liu liug@greatchinausa.com
0891-32563256 fax: 0891-32563256
NO.23 xin road qiche xin road
haikou hainan 891000
cn

Well, at least it's Liu Dong and not a Dick Wang.

I have got several graphic spams about the same subject, always the same ugly male organ and that same Russian looking lady. Being exposed more to this graphic might make an average lady to turn lesbian rather than to order these male enhancement pills to their man. Since I'm not average and just not into ladies at all, this turns me off and very badly.

Voce recebeu um Tim VideoMensagem ! from phone number 99854211

2007-09-01T04:45:00.000-07:00

From: supervisao_se@uol.com.br
Subject: Voce recebeu um Tim VideoMensagem !
Date: August 11, 2007 4:50:15 PM GMT+01:00
To: supervisao_se@uol.com.br
Reply-To: supervisao_se@uol.com.br

Você recebeu um TIM VideoMensagem!
VideoMensagem foi enviado de um celular para seu e-mail, do número
99854211.

visualizar

TIM agora do seu celular para seu e-mail.
Importante: VideoMensagem ficará disponível na Web durante 7 dias.
TIM - Viver sem fronteiras.

Brazilians seem to go crazy for these free video messages. I have been getting these at least one a day for the past month. Sure, to view your free video message all you need is to download and execute some shady http://www.c2ctrees.com/VideoMensagem.exe on your computer. Excellent idea.

Never mind even the fact that I have not subscribed ever to any service that would allow any video messages.

From: torpedos@tim.com.br
Subject: Voce recebeu um Tim VideoMensagem !
Date: August 9, 2007 7:38:51 AM GMT+01:00
To: torpedos@tim.com.br
Reply-To: torpedos@tim.com.br

Você recebeu um TIM VideoMensagem!
VideoMensagem foi enviado de um celular para seu e-mail, do número
99854211.

visualizar

TIM agora do seu celular para seu e-mail.
Importante: VideoMensagem ficará disponível na Web durante 7 dias.

All these free TIM video messages some Brazilian has left to my service that I have never even subscribed to allways appear coming from number 99854211.
How about for authenticity add some region code in the number? Just as good as getting a phone call from US from 123-4567. There are a few prefix options there you know.
Well, this number hasn't left messages only for me...
Oh, it has some graphics too, so it looks like the TIM messages, however I'm just too lazy to load any graphics on my emails unless they are from my manager.

Banca di Roma scam

2007-09-01T04:31:00.000-07:00

From: servizi.clienti@bancadiroma.it
Subject: Oggetto: Comunicazione nr. 53841 del 13 08 2007 - Leggere con attenzione
Date: August 13, 2007 7:24:38 AM GMT+01:00
To: 5@lora.pns.networktel.net
Return-Path:
Received: [...] from lora.pns.networktel.net (jor-l.pns.networktel.net [216.83.236.236]) by isp (Xserve/smtpin026/MantshX 4.0) with ESMTP id l7D6LjD2006504for [email]; Sun, 12 Aug 2007 23:21:45 -0700 (PDT)
Received: from server2k.corp.landcrafters.com (72-12-63-158.wan.networktel.net [72.12.63.158])by lora.pns.networktel.net (8.13.6/8.12.11) with ESMTP id l7D6IShr008859; Mon, 13 Aug 2007 06:18:34 +0000 (GMT)
Received: from User ([71.251.120.98]) by server2k.corp.landcrafters.com with Microsoft SMTPSVC(5.0.2195.6713); Mon, 13 Aug 2007 01:19:34 -0500
Message-Id:
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [my email]
X-Originalarrivaltime: 13 Aug 2007 06:19:34.0234 (UTC) FILETIME=[EAB853A0:01C7DD71]

Gentile Cliente,

Il codice segreto del suo conto on-line e stato inserito incorretto piu di tre volte.
Per proteggere suo conto abbiamo sospeso il acceso.
Per recuperare il acceso prego di entrare e completare la pagina di attivazione.

Se scegliete di ignorare la nostra richiesta, purtroppo non avremo altra scelta che bloccare temporaneamente il suo account.

Grazie ancora per aver scelto i servizi on-line di Banca di Roma.

Banca di Roma garantisce il corretto trattamento dei dati personali degli utenti ai sensi dell'art. 13 del D. Lgs 30 giugno 2003 n. 196 'Codice in materia di protezione dei dati personali'.

Considerazioni migliori.

With a few images added for the authentic look.

Sure, Banca di Roma obviously uses some shady cox.net scriptkiddy address for authentication...

OEM scammer - asnolyke.com aka Jacqueling Tomaszewski

2007-09-01T04:25:00.000-07:00

From: irkjdot@blotteracid.com
Subject: User favorites software
Date: August 31, 2007 2:45:03 PM GMT+01:00
To: [someone else's email address]
Reply-To: irkjdot@blotteracid.com
[Received: from [201.244.215.181] by mx1.balanced.spunky.mail.dreamhost.com; Fri, 31 Aug 2007 08:45:03 -0500
Message-Id: <036876691.82044173926622@blotteracid.com>
Mime-Version: 1.0
X-Mailer: The Bat! (v3.71.14) Professional]

User favorites software
Adobe Photoshop CS3 Extended $89.95
Microsoft Windows XP Professional with SP2 $49.95
Microsoft Office 2003 Professional with Business Contact Manager for Outlook $69.95
Microsoft Windows Vista Business $79.95
Microsoft Office 2007 Enterprise $79.95
Adobe Acrobat 8.0 Professional $79.95
Macromedia Studio 8 $99.95
Microsoft Office XP Professional $49.95
and other
http://asnolyke.com

Whois gives

[whois.myorderbox.com]
Registration Service Provided By: CRISP NAMES, INC.
Contact: +1.3104837168

Domain Name: ASNOLYKE.COM

Registrant, technical, admin etc:
N/A
JACQUELING TOMASZEWSKI (repository@munich.com)
140 S HOBBS HWY
TRAVERSE CITY
Michigan,49686
US
Tel. +6.2319292893

Creation Date: 18-Jul-2007
Expiration Date: 18-Jul-2008

Michigan phone number starting with +6? Sure. This "Jacqueling" gives already some google hits.

500,000 Euros with LSLUK/4034/8161/04 winning code from Holland

2007-09-01T04:24:00.000-07:00

And back after some downtime - been too absorbed in the real life work.

From: farmacia.barnaba@virgilio.it
Subject: CONTACT CLAIM OFFICE
Date: August 30, 2007 6:20:09 PM GMT+01:00
Reply-To: farmacia.barnaba@virgilio.it
[Received: from pswm19.cp.tin.it (192.168.70.69) by vsmtp3.tin.it (7.3.122) id 46B6E4A8002DC49F; Thu, 30 Aug 2007 19:20:09 +0200
X-Originating-Ip: 86.87.7.252]

CONTACT CLAIM OFFICE
REFERENCE NUMBER: LSLUK/4034/8161/04
BATCH NUMBER:
15/011/IPD

Dear sir/madam,

We are happy to inform you that you have
emerged a winner under the First Category of our promotion,Winners were
picked by computerized system, drawn from company and individual e-mail
addresses worldwide.The draws is officially announced today 29th of
August, 2007.You have therefore been awarded alump sum pay out of
500,000(Five hundred thousand Euros), which is the winning payout for
Category A winners.

NOTE: For easy reference and identification,find
below your Reference and Batch numbers. Remember to quote these numbers
in your correspondence to our claim Department.

REFERENCE NUMBER:
LSLUK/4034/8161/04
BATCH NUMBER: 15/011/IPD
Please contact Staatsclaim
department immediately for due processing and remittance of your prize
money to a designated account of your choice:

Dr. Peter Hans
Tel.:
0031- 626381909
Fax: 0031- 847103194
Email:claimfile@sfax.ws

Sincerely Yours,
Mrs Betty Rice
PROMOTION CORDINATOR
*************************************************************************************************************
N.B: Disclaimer - This email is confidential and contain privileged or
copyright information. You must not present this message to another
party.If you are not the intended recipient you must not copy,
distribute or use this email or the information contained in it for any
purpose other than to notify us.
If you have received this message in
error, please delete this email from your system.

Sure, a Five Hundred Thousand Euros is alumpofmoney.
How about they even once would forge their email addresses to be something that actually has even remotely something to do with any lottery?
Why is this particular scammer using virgilio.it if he is still physically located in Netherlands?

'Sydney Car Centre' - sydncar.kg

2007-07-27T16:44:00.000-07:00

X-Originating-IP: [84.110.180.64]
Return-Path: < nguyen.kelli@walla.com >
Subject: new vacancies in our company – please, find out about them
Sender: "Sydney Car Centre" < Webb005@free.fr >
User-Agent: Mutt/1.5.1i

While we may have high expectations of our associates, we also give them high rewards. Imagine being part of a stable organization with a sterling reputation - a place where the Sydney Car Centre is an integral part of all that we do. With our car centre personality, you'll not just succeed - you'll thrive. And, with our strong commitment to promoting from within, you'll definitely enjoy your rise to the top.

Today the Sydney Car Centre is looking for an industrious regional assistant to fasten the process of the delivery of customer payments to the suppliers. The position offered is a part-time job, and will only require from you to be available for 1-2 hours a day.

As a regional assistant, you will be supposed to operate with the payments from those customers, based in your country. You will be expected to accept 2-3 transactions to your bank account every week, make certain calculations about every transaction (you will be precisely instructed about it), & transfer the funds to the suppliers by means of western Union/Money Gram less your fee & the charges of the Western Union/Money Gram. You will be continuously communicating with the manager from the head office, who will instruct you & give advice regarding every new payment.

The ideal candidate will be industrious, goal-oriented person, with the availability of a personal/business bank account suitable to be used for the company needs. Knowledge of English, computer literacy and sociability are appreciated.

The company guarantees to pay NET 10% fee out of the amount of every payment you dealt with and to provide you with the regular income & flexible schedule. All the related expenses you might have (like the Western Union/Money Gram chargers, related expenses on traveling) are covered by the company.

The more detailed information is available on our web-site http://vacancy-888257429.sydncar.kg/vacancies.php, where you can fill in the on-line application form for this position.

We would be glad to welcome you in our team!

We are looking forward to hearing from you as soon as possible!

Yours sincerely, Gale Zapata

0x36756210, 0x2000, 0x56, 0x4 4RTT 0x81, 0x085, 0x275 [and so on a long list of letters, white on white]

I have received several of these, to different email addresses.
And fair enough, it looks a bit like a marketing email for jobs.
But look at the details.

A car sales job in Sydney, Australia, when the domain is registered in Kyrgystan or however it's spelled?

The email is sent from walla.com - a big no. I have never received a legitimate email from anyone using walla.com.

Sender and return path are different, both free email services. And the mail is signed by another name than is on the sender field.

Their jobs list 401K as a benefit, even though they claim to be in Australia.

And so on. All these details don't match.

The jobs look very good though. I just hope no one volunteers their personal info to these people

Whois on the domain

Domain SYDNCAR.KG

Administrative Contact:
Garcar (11619-KG), botlbonds@hotmail.com
8557 Forestview Avenue
phone: 4402555718

Technical Contact:
Garcar (11619-KG), botlbonds@hotmail.com
8557 Forestview Avenue
phone: 4402555718

Billing Contact:
Garcar (11619-KG), botlbonds@hotmail.com
8557 Forestview Avenue
phone: 4402555718

Domain support: AsiaInfo

Record created: Mon Jul 16 22:56:43 2007
Record last updated on Wed Jul 25 02:41:56 2007
Record expires on Wed Jul 16 23:59:00 2008

No name of person is provided, also no city or country. Just hotmail address and a street name and number, and a phone number without telling in which country it is. Would you trust your personal information to them?

Rodrigez aka Kuvayev again

2007-07-23T15:13:00.000-07:00

From: timbergrovefarm.com@crossroadsmusicfestival.com
Subject: Corel Draw
Date: July 23, 2007 10:58:18 PM GMT+01:00
To: [my email]

OEM software means no CD/DVD, no packing case, no booklets and no overhead cost!
So OEM software is synonym for lowest price.

Buy directly from the manufacturer, pay for software ONLY and save 75-90%!

See discounts and special offers! Find software for home and office!
TOP POSITIONS

Windows XP Pro w/SP2 $49
MS Office Enterprise 2007 $79
Adobe Acrobat 8 Pro $79
Microsoft Windows Vista Ult $79
Macromedia Studio 8 $99
Adobe Premiere 2.0 $59
Corel Grafix Suite X3 $59
Adobe Illustrator CS2 $59
Macromedia Flash Prof 8 $49
Adobe Photoshop CS2 V9.0 $69
Macromedia Studio 8 $99
Autodesk Autocad 2007 $129
Adobe Creative Suite 2 $149
http://pnt.lalasoftb.com/?[random letters]
----
Top items for Mac:
Adobe Acrobat PR0 7 $69
Adobe After Effects $49
Macromedia Flash Pro 8 $49
Adobe Creative Suite 2 Prem $149
Ableton Live 5.0.1 $49
Adobe Photoshop CS $49
http://pnt.lalasoftb.com/[random letters]
----
Popular eBooks:
Home Networking For Dummies 3rd Edition $10
Windows XP Gigabook For Dummies $10
Adobe CS2 All in One Desk Reference For Dummies $10
Adobe Photoshop CS2 Classroom in a Book(Adobe Press) $10
----
Find more by these manufacturers:
Microsoft...Mac...Adobe...Borland...Macromedia...IBM
http://pnt.lalasoftb.com/?[random letters]
----

Brodick led the procession up
The Maitland home was at the t
Brodick dismounted with Alec i
The crowd silently pressed for
Alecs homecoming should be pri

OEM is illegal BS.

The companies listed in scams like these do NOT sell their software online by some shady resellers.

The OEM software spams are REALLY annoying, but they are way too numerous out there making that Adobe, Apple, IBM, Microsoft etc etc can't keep up to the speed of scamming.

Of the scammer URL we can get the following info

Domain Name: LALASOFTB.COM
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com

Creation Date: 04-jul-2007
Expiration Date: 04-jul-2008 -- these dates are one more indication of not being proper kosher. Recent registration, minimum registration validity time.

Domain name: lalasoftb.com

Registrant Contact:
-
Alex Rodrigez domains@surink1.com
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi

Thus our friend Alex Rodrigez aka Leo Kuvayev again.
Again with an invalid Finnish address and invalid phone number.
What is his passion with Finland?

And surink1.com email?

Domain Name: SURINK1.COM
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Whois Server: whois.dns.com.cn
Referral URL: http://www.dns.com.cn
Name Server: NS1.GORLOK.NET

Creation Date: 21-jun-2007
Expiration Date: 21-jun-2008

Domain Name.......... surink1.com
Creation Date........ 2007-06-22 10:40:26
Registration Date.... 2007-06-22 10:40:26
Expiry Date.......... 2008-06-22 10:40:26
Organisation Name.... cheng mingfei
Organisation Address. NO.599 east road nanjing
Organisation Address.
Organisation Address. Nanchang
Organisation Address. 321100
Organisation Address. JX
Organisation Address. CN

Admin Name........... cheng mingjun
Admin Address........ NO.599 east road nanjing
Admin Address........
Admin Address........ Nanchang
Admin Address........ 321100
Admin Address........ JX
Admin Address........ CN
Admin Email.......... liuggg@surink1.com
Admin Phone.......... +86.7916316556
Admin Fax............ +86.7916316556

http://www.dns.com.cn gets listed on bad registrars list.
And Mr Kuvayev seems to do a lot of traffic with the Chinese lately.

The reason why all these lottery notifications always come from Holland

2007-07-21T16:32:00.000-07:00

iDeceive has a link that explains why so many of the lottery winning noifications you get in your email are coming from Netherland.

Dutch police arrest 111 West Africans in 419 clampdown

Dutch police have arrested 111 suspected 419 scammers. The arrests on Saturday follow the end of a seven-month investigation - dubbed Operation Apollo, AFP reports.

Eight of those detained were carrying false papers. Many others among the group of West African (mainly Nigerian) suspects are reckoned to have entered the Netherlands illegally or to have overstayed their permitted stay.

The alleged scammers are suspected of running a series of lottery-based (AKA 419-lite) scams. Prospective victims of these frauds are first informed by email that they have won fictitious lottery prizes. Victims are then tricked into handing over money-up front to cover processing fees or other fictitious expenses. The promised windfalls never materialise and dupes are left nursing their losses.
Investigators in the Netherlands estimate that 2,000 internet con-men are active in the country.

Unrelated but interesting : Harvard prof scams $600,000, then hands it to 419ers

Wonder Crew Unsubscribe, enom.com, and whoisprivacyprotect.com

2007-07-21T15:49:00.000-07:00

X-SID-PRA: Confirmation Department
X-Message-Info: LsUYwwHHNt060LY3N4Ugg6uoo6pi8yZesED9xjzqM1hRzBmxnAy+5SipqnHykXRO
Received: from gardeninsectguide.com ([64.21.182.39]) by bay0-mc5-f23.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Mon, 16 Jul 2007 09:32:48 -0700
Received: by gardeninsectguide.com id hjfb5i0cvqg8; Mon, 16 Jul 2007 16:31:33 -0400 (envelope-from )
Date: Mon, 16 Jul 2007 16:31:33 -0400
MIME-Version: 1.0
From: Confirmation Department
Subject: JCPenney Participation Confirmation
Message-ID:
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-Path:
X-OriginalArrivalTime: 16 Jul 2007 16:32:48.0853 (UTC) FILETIME=[F274A050:01C7C7C6]

[3 graphics that link to http://www.itsyourdisco.com]

\majorities \

\Essences \volunteering \Antal \directly \antiguo \bought \relevant \Cordova \cheesy.porkium \..Survey \calibration \RCP \chosen \forested \peripherals \lifespan \adoring \ticketed \facilitate \laying \GMAT \cataract \despondent \KEEPSAKES \

\products.even \forbids \ina \cover. \ÃƒÂ‚Ã‚Âhalf \raspy \Grumman \investigational \designing \Saint \vegetables.not \Gandhi \economists \noticia \92.95 \drinks \Californians \SNA \courrier_des_lecteur \Bathtub \desiring \Jobs \tribal \for. \sues \
\Pars \1602 \Stryker \religion \Habib \Halles \Mauna \dietitians \Saturday \00.1 \reinforces \Cassano \anxieties \Ketchikan \composting \improvised \D6751.02a \Stripper \megabit \Citys \1834 \Acciona \discontent \comfortable \debacle \
\grievances \Incarnation \Lonesome \inevitability \1116 \1.1 \demonised \teddy \contact \appointment \Fmt \Queda \imitating \outwardly \consultancy \webcast_ \outcry \Emeryville \flares \succession \withdrawn \59 \chiefs \PQ \couch \

\kind \problems \ljus \Etheridge \..Results \sz \particuliÃƒÂƒÃ‚Â¨ \carrot \Yates \4225 \en \outcomes \rant \Simone \affections [nonsense continues]

Again, the http://www.itsyourdisco.com page goes to "Wonder Crew" which only has unsubscribe button in it. See why unsubscribing is a very bad idea.

Whois gives

Domain Name: ITSYOURDISCO.COM
Registrar: ENOM, INC.
Domain name: itsyourdisco.com

Registrant Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (pndwrgkpn@whoisprivacyprotect.com) *
+1.4252740657
Fax: +1.4256960234
PMB 368, 14150 NE 20th St - F1
C/O itsyourdisco.com
Bellevue, WA 98007
US

I have been getting these JC Penney Confirmations, Order Confimations, Thisandthat Confirmations, Anything confirmations several of them a day for the past at least 3 years. Know what? I am sick of it.

I am disgusted by the fact that enom.com claims how they have such great zero spam policy, yet they allow bulk registrations, and the registrant details for enom.com are suspiciously too close to the geographical area of this other Nameless Person or is it Company with an Original Name.

Registration Service Provided By: eNom, Inc.
Contact: paul.stahura@enom.com

Domain name: enom.com

Registrant Contact:
eNom, Inc.
DNS Manager (info2@enom.com)
+1.4258838860
Fax: +1.4258833553
PO Box 7449
Bellevue, WA 98008
US

Enom About US site provides a lot of info regarding him.

Please note: this person can not be contacted ( the phone voice mail is always full or will cut you off),he is a spamer and uses bots and fake info to collect names and email addresses. He uses these to send people to one or more of his many duplicated sites pretending to loan or offer to loan you money. if you fill in the form you will get even more spam email ( No one will lend you money) I do not even own property and I was getting 10 to 20 of these a day with fake names attached. offering to get me a $365,000 loan for a property which I don't own. Obviously they do not research, they just send out bulk emails. All the domains registered recently have been new as of Dec 2006. Be advised , It is very easy to buy up Domain names and start a web site, many re3gistrars offer cheaper prices in bulk. If you get email from this person do a who is search, if my info is correct you will see the exact same person attached to them. report them at the bottom of the Who is page. it is the only way to end it.

I've found eNom to be the worse company I've dealt with in my life. Arrogant, stuck up and downright thieves. eNom could give DELL's customer support line a run for it's money, at least at DELL they reply. This company is still trying to charge me $200 for my own domain, they even renewed it a further year so I couldn't have it for even longer.
DO NOT DEAL WITH ENOM!
Dan

Enom report abuse page
+ Google reveals 48,600 hits for query 'enom.com spam'
Enom.com review
Enom review 2
Reporting spam & Where to send your complaints (suggests legal@enom.com)

ENOM.COM.RESPECTED.BY.WWW.DNDIALOG.COM

DNDIALOG.COM

Registrant [680427]:
XSS, Ltd.
Sokolnicheskaya pl. 4A
Moscow
RU
107113
RU

Administrative Contact [680427]:
Ilya Poyarkov xss@xss.ru
XSS, Ltd.
Sokolnicheskaya pl. 4A
Moscow
RU
107113
RU
Phone: +7.4957488116

Dndialog.com was the service used to register enom.com?
That website has now only a forum, but it has interesting topics. Such as this. Based on what I can guess of the words in Russian, the whole domain seems to be a playground for Russian bulk domain registrants and spammers.

* And whoisprivacyprotect.com (used in domain registration email address above for this Wonder Crew)

whoisprivacyprotect.com:
[whois.enom.com]
Whois Privacy Protection Services, Inc.
Whois Agent (idprotect@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4254842044
PMB 368, 14150 NE 20th St - F1
Bellevue, WA 98007
US

Again registered by enom.com!

Whosiprivacyprotect.com gets a few hits in Google, and they are all indicating spam.

Hm. Let me think.

Enom.com makes a big fuzz how they have strong antispam policies and zero spam tollerance.
Yet enom.com gets nearly 50,000 hits only in google for a very simple search for their name and the word spam.

All of the spams that I have received from companies (or the same spam group) that uses enam.com for the past over three years, have always had this Whois Privacy Protection Services, Inc, without a real email address, or a name, as the registrant. In the years, this means I have got thousands if not tens of thousands of spam by them. Too bad one of the email addresses suffering for this I need to keep for other purposes, and the anti-spam tools seem too dumb to just ignore all of them.

If enom.com really had this anti-spam attitude, and zero spam tollerance, I believe they would not allow companies to register without a name for registrant, and a real address and contact details.

If they had truely this zero spam tolerancy, they would not allow this Wonder Spam company to be hosting on their services fof bulk domains for over 2 years, with their main page just harvesting for email addreses.

Enom.com just got their own name tag.

Incorporatecrew.com, just to catch your email addresses and sell them

2007-07-21T15:25:00.000-07:00

X-SID-PRA: Window Replacement Specialists...
X-Message-Info: LsUYwwHHNt0yvR6EbKRcxAnZyp3EuoPtlPsoz+wtuw9vd2NoxZ7CV7e+wA7FJnYu
Received: from authorityanswers.com ([66.29.58.127]) by bay0-mc2-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Fri, 20 Jul 2007 12:48:05 -0700
Received: by authorityanswers.com id hk553i0cvqgd; Fri, 20 Jul 2007 19:49:17 -0400 (envelope-from )
Date: Fri, 20 Jul 2007 19:49:17 -0400
MIME-Version: 1.0
From: Window Replacement Specialists...
Subject: The windows you want at the right price
Message-ID:
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-Path:
X-OriginalArrivalTime: 20 Jul 2007 19:48:05.0567 (UTC) FILETIME=[E3D04CF0:01C7CB06]

http://www.incorporatecrew.com/14176/17739846

conscience.Too.emerge.footnote.delivered

English.guilty.something.elder.29

plans.landscape.Environmental.predicts.item

wrath.Come.boom.ten-year-old.Naval

Open.contacts.fellow.Way.savages--could

Jersey.asked.deus.planned.supports

scoop.criteria.pretenders--they.Collins.gut

And so on a long page of nonsense text in addition to incorporatecrew webpage.
There were a few pictures that I did not have a look at.

The main page that was linked to thse spams, http://www.incorporatecrew.com/ is "Wonder Crew" that offers to remove your email address in case they have got it by mistake. *

That site owner and registrant info :

Domain Name: INCORPORATECREW.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Registration Service Provided By: Enom, Inc
Contact: CustomerSupport@enom.com
Visit: www.enom.com

Domain name: incorporatecrew.com

Administrative, Technical, Registrant Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (pryfgrywhk@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4256960234
PMB 368, 14150 NE 20th St - F1
C/O incorporatecrew.com
Bellevue, WA 98007
US
Creation date: 11 Jul 2007 03:06:36

Shady registrant details if you ask me.
At least enom.com has a zero spam policy. Too bad the spam itself was over 8000 characters so can't use their spam reporting website.

* Why using the unsubscribe from spam is always a bad idea
Spamhelp.co.uk
One more reason not to "unsubscribe" from spam [Cnet]
APCSNH
Don't view HTML by default [Spamhelp.co.uk]

A Ghanan faker trying to get your money

2007-07-21T15:01:00.000-07:00

From : chr kanu
Reply-To :
Sent : Monday, July 9, 2007 1:00 PM
Subject : Dear Sir/Madam,URGENT BUSINESS
MIME-Version: 1.0
X-Originating-IP: [216.250.221.5]
Received: from bay0-omc3-s18.bay0.hotmail.com ([65.54.246.218]) by bay0-imc3-s35.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Mon, 9 Jul 2007 06:00:25 -0700
Received: from BLU111-W33 ([10.6.62.68]) by bay0-omc3-s18.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Mon, 9 Jul 2007 06:00:21 -0700
X-Message-Info: LsUYwwHHNt0W9hfqf5comrBG9CjO88k1HgNbqQuqqkBX6PvKJvTHSP8ggOXNRRAV
Return-Path: kanuchr19@hotmail.com
X-OriginalArrivalTime: 09 Jul 2007 13:00:21.0498 (UTC) FILETIME=[1B8C5DA0:01C7C229]

Content-Type: multipart/alternative; boundary="_238cafa8-45bf-4c1e-b376-47611aab70d2_"
Content-Type: text/html; charset=Windows-1252
Content-Transfer-Encoding: quoted-printable

Dear Sir/Madam,URGENT BUSINESS
I am a staff of one of the leading banks in Ghana. I
will give you the name of my bank and other important information if
I
receive a positive reply from you. For security reasons I cannot
disclose my full identity to you now until I am sure of your
cooperation. I work in the operations dept where I serve as account
officer to numerous customers. One of the customers whom I worked as
his account officer was a wealthy diamond merchant from America.
Because this man was good to me when he was alive, I took it upon
myself to travel to his country last month, to see if I could locate
any of his close relations.

On reaching there I discovered that his only surviving uncle died a few
months back. I sponsored this trip on my own and nobody in the bank
knew I was undertaking the journey so I did not present any official
report of my findings in the bank. Now there are two things I could do
with regards to the money. First, as his accounts officer, I could
formally notify the bank authorities that the man is dead and has no
next of kin. In this case the money would be forfeited to the
government
after some time. As a matter of fact this is the proper thing I am
supposed to do.

Another thing I can do is to arrange for someone else, a foreigner, to
act as the next of kin of the late man so that he will claim the
money. This is the option that I can do to help anybody and myself
since the money actually is public fund due to the fact that my friend
was a close ally to the late brutal military president that looted
government treasury. And that is why I have chosen to do it.
I want you to be my partner. All you would have to do is act as the
next of kin of the dead man and the whole money in the account will be
transferred to your account. As the accounts officer to the late man, I
have all the necessary documents that will require claiming the money
in the account. The total money in the account is USD17 million. Your
share will be 30%, which is USD5, 100,000. My colleague and i will
share70%. Reach me immediately by mail so that I can give you further
details.Also provide me you with direct telephone to reach you.
PLS SEND REPLY TO MY PRIVATE BOX chr_kanu_207@yahoo.de
kanu christopher

Play free games, earn tickets, get cool prizes! Join Live Search Club. Join Live Search Club!

This one particularly makes no sense at all.
So you work in a bank, have a foreign rich customer who dies, you go search his relatives, find none, and now you are telling that the government in Ghana gets the money of an American who died there? Unless anyone with a hopefully American passport can fake to be their relative and they will get 30 % for faking it.

Uh oh. The 'dear sir/madam' part is always a brilliant start...

Dear Mr Scam Kanu, how did you find me? What race was this dead man of? Do you personally think that your story makes any sense?

Kvenoir.net - the first penis enlargement spam I have ever received that had a picture of the male body part in it

2007-07-18T14:29:00.000-07:00

From: celticwrestling.com@velloxcoatings.com
Subject: Don't be left out, join millions of men in the revolution
Date: July 18, 2007 11:29:26 AM GMT+01:00
To: [email]
Return-Path:
Received: ... : from ixirnx (dsl-sp-81-140-10-51.in-addr.broadbandscope.com [81.140.10.51]) by isp (Xserve/smtpin007/MantshX 4.0) with SMTP id l6IATZUY008642for [email]; Wed, 18 Jul 2007 03:29:36 -0700 (PDT)
Message-Id: <000401c7c926$321c3c80$0100007f@pwbdawq>
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-Type: multipart/related; boundary="----=_NextPart_000_0027_01C7C926.321C3C80"
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [email]

Content of spam a huge picture of a male body part with penis enlarge patch rx mentioned, the image linking to kvenoirt.net.

I usually find the penis enlargement ads kind of amusing, but this is the first time in 15 years that I get a penis enlargement spam that actually has a picture of the thing in it.
And that grossed me out.

Of the domain that this spam is advertising we get
(Oh, isn't the use of polandmail so .. American??)

Domain: kvenoirt.net
Registrar: CATALOG.COM, INC.
Status:ACTIVE
Registrant :
Jason Litalien (CTLGDN-490412)
11615 Dundalk
San Antonio, TX 78251
US
Admin Contact:
Jason Litalien (490414)
11615 Dundalk
San Antonio,TX,US 78251
email:repository@polandmail.com
ph:2107570284
Tech Contact:
Jason Litalien (490413)
11615 Dundalk
San Antonio,TX,US 78251
email:repository@polandmail.com
ph:2107570284
Created on 17-jul-2007

'Standard Bank' in 'Southafrica' with someone trying to offer you $ 52m...

2007-07-16T22:53:00.000-07:00

From: frank.mark1@zipmail.com.br
Subject: Good day,
Date: July 17, 2007 2:20:01 AM GMT+01:00
To: frank.mark1@zipmail.com.br

Good day,

Thanks for finding time to read this proposal. After thinking about this
transaction and the need to make contact with someone to assist me do it,
I found it interesting and decided to contact you for this business transaction.
Be so kind to contact me at your earliest convenience for a possible business
deal involving money transfer of about $52,000,000.00.

I am presently in Southafrica working as an Auditor General with the below
bank at their offshore department. With your sincere assistant and co-operation,
I am determined to work this deal out if we can do business. As at this
moment, I am constrained to issue more details about this business until
your response is received.

If you are not familiar with the above information which I believe is scanty
for security purposes, please contact me for further details.

This deal is worth taking and highly profitable. Thank you for your time
and attention.

Do redirect you positive response to my private email: frankmark_private@yahoo.com

Warmest regards,
Frank Mark
........................

..........................................
Auditor General,
Dept.of Offshore Mortgage Services,
Standard Bank,
Southafrica

Uh, sure. Talking so openly about scamming the bank he works for $ 52 million, and can't even spell South Africa crrectly. And 'Standard Bank'? That has got to be the worst name for a bank ever, you'd think that even an advance fee scammer would be able to be a bit more creative...

Tryfase.com / Liquid Ventures

2007-07-16T10:16:00.000-07:00

From: jacanale@realazestate.com
Subject: Albizzia lebbeck 50 mg
Date: July 16, 2007 3:47:52 PM GMT+01:00
To: [another user's email]
Return-Path:
Received: from [..] HSI-KBW-082-212-044-090.hsi.kabelbw.de (hsi-kbw-082-212-044-090.hsi.kabelbw.de [82.212.44.90]) by mac.com (Xserve/smtpin013/MantshX 4.0) with ESMTP id l6GDlcrC013566; Mon, 16 Jul 2007 06:47:39 -0700 (PDT)
Received: from [82.212.44.90] by iris1.directnic.com; Mon, 16 Jul 2007 13:47:52 -0100
Message-Id: <01c7c7af$e7bd8530$5a2cd452@jacanale>
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1506
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C7C7C0.AB489F20"
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [email]

Second month you will notice an increase in penis size of up to 1 inches, plus an increase in Girth (Width) of 5%, plus all the benefits of the first month. When you are sexually aroused, your brain releases a hormone causing blood to enter the penis and fill your erectile tissue (Corpora Cavernosa). The cells in the Corpora Cavernosa are filled with blood until an erection is achieved. You can have a BIGGER PENIS!
http://tryfase.com
There are stories and myths of penis size from around the world. One of the common stories is that men from different cultures or races have penis length differences. This is entirely inaccurate. The most common differences are in length and girth but remember, there are differences in all people in regards to height, weight and appearance.

Of which the spammer's (or the one's who gets the profit for anyone buying that cr.p) whois info gives

Domain Name: TRYFASE.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM

domain: tryfase.com
owner: Sammy Lee
organization: Liquid Ventures Inc
email: admin@liquidventuresinc.com
address: 44/E ENTERPRISE SQUARE
city: KOWLOON
state: --
postal-code: 0000
country: HK
phone: +852.94528422
admin-c: CCOM-1028986 admin@liquidventuresinc.com
tech-c: CCOM-1028986 admin@liquidventuresinc.com
billing-c: CCOM-1028986 admin@liquidventuresinc.com
created: 2007-07-12 20:39:46 UTC
contact-hdl: CCOM-1028986
person: Sammy Lee
organization: Liquid Ventures Inc

SunTrust Bank phishing attempt

2007-07-14T13:14:00.000-07:00

From: businessservice.ref73250944520406.nf@suntrust.com
Subject: SunTrust Bank: please confirm your online banking records! (message id: 83603923766)
Date: July 14, 2007 8:55:46 PM GMT+01:00
To: [someone else's email]
Return-Path:
Received: ... from 23.pool85-59-64.dynamic.orange.es (23.pool85-59-64.dynamic.orange.es [85.59.64.23]) by [isp] (Xserve/smtpin49/MantshX 4.0) with SMTP id l6EJtk2u014914; Sat, 14 Jul 2007 12:55:48 -0700 (PDT)
Received: from never.kellychen.com (manley.kellychen.com [14.88.204.68]) by kerio.com with SMTP id 2HVQ0190FT for [that other user's email]; Sat, 14 Jul 2007 12:55:43 -0800
Message-Id: <200707141955.l6EJtk2u014914@mac.com>
Mime-Version: 1.0
X-Mailer: Microsoft Internet Mail 4.70.1155
Content-Type: multipart/alternative; boundary=--1UZQ6E4EO_WCCZXUU2IVA361
X-Priority: 3 (Normal)
X-User_Ip: 24.114.1.202
User-Agent: Microsoft Internet Mail 4.70.1155
Original-Recipient: [my email]

Dear SunTrust Bank customer,

SunTrust Client Service Team requests you to complete Online Treasury Customer Form.

This procedure is obligatory for all business and corporate clients of SunTrust Bank.

Please click hyperlink below to access Online Treasury Customer Form.

http://onlinetreasurymanager-id7365548.suntrust.com/ibswebsuntrust/cmserver/customer.cfm

Thank you for choosing SunTrust Bank for your business needs.

Please do not respond to this email.

This mail generated by an automated service.

__________________________________________________________________________

0x99, 0x3, 0x3796, 0x1, 0x3 media hex U1L S5Z rev 8PG RAR 9UD U3Y 0x23, 0x596 tmp: 0x874, 0x54937793, 0x9, 0x09224268, 0x0008, 0x3, 0x14, 0x64292480, 0x9571, 0x94, 0x07166475, 0x37, 0x607, 0x3, 0x852 0x4, 0x9011 0x20, 0x00634897, 0x601, 0x9038, 0x015, 0x70250798, 0x25986704, 0x27075584, 0x547, 0x07, 0x6 rev: 0x5384, 0x29, 0x35, 0x74, 0x57, 0x3, 0x378, 0x69679773 07FX: 0x515 64J1: 0x6417, 0x31, 0x92, 0x1702, 0x04186070

exe: 0x3638, 0x0280, 0x679, 0x2, 0x66, 0x845, 0x95393472, 0x74, 0x59, 0x4 interface: 0x13 HIR: 0x296, 0x561, 0x7138 common ZLB S48I 65F JGTP. U3MK: 0x6292, 0x998, 0x6 0x10491729, 0x0, 0x055, 0x12164091, 0x6 rcs HVYR 3M9 WW1 define 0JA QZ2: 0x063, 0x692, 0x484, 0x59 start: 0x1, 0x4156, 0x44, 0x8562, 0x3912, 0x78828520, 0x267, 0x38, 0x616, 0x31, 0x510, 0x58918884 0x2591, 0x9, 0x82503509

120: 0x06, 0x425, 0x2186, 0x5782, 0x5467, 0x1014, 0x7, 0x3, 0x3221, 0x295, 0x79464507, 0x091, 0x25949962, 0x2953, 0x84039376 0x6947, 0x8, 0x205, 0x60003283, 0x39960848 R5Q: 0x6541, 0x71549568, 0x41812577, 0x2721, 0x45349447, 0x507, 0x96555838, 0x224, 0x7483, 0x2, 0x7, 0x715, 0x65, 0x69218234 0x6, 0x15770665, 0x84, 0x30, 0x82403901, 0x287, 0x3606, 0x32, 0x93 0NJ 62R0 XFEP TED function SVH IYKW EE38 root0x5442, 0x6 0x1, 0x019, 0x9, 0x6450, 0x9, 0x154, 0x723, 0x142 KR1: 0x52, 0x13, 0x8, 0x83, 0x65 H7JL, NGR. ACZ9: 0x22, 0x682, 0x4

All random numbers on small white character to not make it visible.
The link where this "SunTrust Bank" points to gives the following registrant info :

Domain Name: GOLCOWD.BIZ
Domain ID: D19103697-BIZ
Sponsoring Registrar: REGISTER.COM
Registrant ID: 3343322C9CF42696
Registrant Name: Jeff Mills
Registrant Address1: 1255 Marlborough st. Apt. A
Registrant City: Philadelphia
Registrant State/Province: PA
Registrant Postal Code: 19125
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.2679976940
Registrant Email: jeffmills@whoever.com
Same contact info for Administrative and Technical contacts.
Domain Registration Date: Fri Jul 13 18:14:18 GMT 2007
Domain Expiration Date: Sat Jul 12 23:59:59 GMT 2008

Nnoemd.com - Kuvayev strikes again

2007-07-08T13:26:00.000-07:00

And Alex Rodrigez aka Leo Kuvayev strikes again.

From: oldbluemoses.com@gregsart.com
Subject: Need S0ftware?
Date: June 24, 2007 6:09:56 PM GMT+01:00
To: [my email]

OEM software means: no DVD/CD, no packing case, no booklets and no overhead cost!
So OEM software is synonym for lowest price.

Buy directly from the manufacturer, pay for software ONLY and save 75-90%!

Check our discounts and special offers! Find software for home and office!
Different platforms. World leading manufacturers. Instant download.
----
HOT ITEMS

Windows XP Pro + SP2 $49
MS Office Enterprise 2OO7 $79
Adobe Acrobat 8 Pro $79
Microsoft Windows Vista Ult $79
Macromedia Studio 8 $99
Adobe Premiere 2.O $59
Corel Grafix Suite X3 $59
Adobe Illustrator CS2 $59
Macromedia Flash Prof 8 $49
Adobe Photoshop CS2 V9.0 $69
Macromedia Studio 8 $99
Autodesk Autocad 2007 $129
Adobe Creative Suite 2 $149
http://dst.nnoemd.com/? [someletters]
----
Top items for Mac:
Adobe Acrobat Pro 7 $69
Adobe After Effects $49
Macromedia Flash Pro 8 $49
Adobe Creative Suite 2 Prem $149
Ableton Live 5.0.1 $49
Adobe Photoshop CS $49
http://dst.nnoemd.com/-software-for-mac-.php? [someletters]
----
Popular eBooks:
Home Networking For Dummies 3rd Edition $10
Windows XP Gigabook For Dummies $10
Adobe CS2 All in One Desk Reference For Dummies $10
Adobe Photoshop CS2 Classroom in a Book(Adobe Press) $10
----
Find more by these manufacturers:
Microsoft...Mac...Adobe...Borland...Macromedia...IBM
http://dst.nnoemd.com/? [someletters]
----

None of us feel tricking Lady
No, but I assure you, that wil
Is there something else bother
Brenna wasnt about to tell her
I wasnt very hungry tonight, s

nnoemd.com resolves to

Registrar: BIZCN.COM, INC.
Registrant Contact:
-
Alex Rodrigez domains@preved.cd
+358-30-5563 fax:
po box 445
Laapentranta Laapentranta 12700
fi

Of which the address is invalid, the phone / fax number is more than just invalid...

The registrant register details :

BIZCN.COM resolves to

Domain name: bizcn.com

Registrant Contact:
XiaMen BizCn Computer & Network CO.,LTD
Bizcn Bizcn postmaster@bizcn.com
+86.5922577888 fax: +86.5922577111
1F - 4F, Software Technology Service Builing, Xiamen Software Park
Xiamen Fujian 361000
cn

Selling OEM software is, needless to remind I hope, illegal. I hope they finally catch this spammer. Here more about this spammer, mr Kuvayev. ICQ = 101859176

katizhalthh - loan spammers

2007-07-08T13:16:00.000-07:00

From: MAILER-DAEMON@[my isp]
Subject: Returned mail: see transcript for details
Date: July 3, 2007 7:35:53 AM GMT+01:00
To: [my email]

The original message was received at Mon, 2 Jul 2007 23:35:46 -0700 (PDT)
from ppp-124.120.199.216.revip2.asianet.co.th [124.120.199.216]

----- The following addresses had permanent fatal errors -----
< some user >
(reason: 550 5.1.1 unknown or illegal alias: some user )
(expanded from: < some user >)

----- Transcript of session follows -----
... while talking to smtp-bounce.isp.com.:
DATA
<<< 550 5.1.1 unknown or illegal alias: some user
550 5.1.1 < some user >... User unknown
<<< 554 5.5.0 No recipients have been specified.
Reporting-MTA: dns; isp
Received-From-MTA: DNS; ppp-124.120.199.216.revip2.asianet.co.th
Arrival-Date: Mon, 2 Jul 2007 23:35:46 -0700 (PDT)

Final-Recipient: RFC822; some user
Action: failed
Status: 5.1.1
Remote-MTA: DNS; smtp-bounce.isp.com
Diagnostic-Code: SMTP; 550 5.1.1 unknown or illegal alias: [ some user ]
Last-Attempt-Date: Mon, 2 Jul 2007 23:35:53 -0700 (PDT)

From: "Wilda" < my email >
Date: July 3, 2007 7:38:53 AM GMT+01:00
To: "Concetta" < some user >
Subject: astounding loans for the usa!

Hello, Your refinance application has been accepted.
We are ready to give you a loan.
There is no obligation and this is a FREE quote
(o)Debt Consolidation.
(o)Refinancing.
(o)Second Mortgage.
(o)Equity Line of Credit.
(o)First Purchase.
Visit here for more information Expect to be contacted within 24 Hours.
http://katizhalthh.com

So the spammer has forged MY email address for at least some outgoing emails again.

Of the site that is being advertised, we can get the following :

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Domain name: katizhalthh.com

Registrant Contact:
PrivateDomainRegistrations
Gary Reed (garyreed07@fastmail.net)
+1.6047678695
Fax: +1.5555555555
150-3495 Cambie Street
Vancouver, BC V5Z 4R3
CA

Illegal phone numbers. And namecheap.com isn't the first time on the list ..

Anatrim spam - rlcco.com

2007-07-08T03:27:00.000-07:00

From: cvelasqu@hopecollective.com
Subject: Thanks for the awesome product and the great service. Anatrim.
Date: July 8, 2007 12:54:44 PM GMT+01:00
To: [my email]
Return-Path:
Received: .. [122.128.152.59] by smtp.secureserver.net; Sun, 08 Jul 2007 02:54:44 -0900
Message-Id: <01c7c10b$56b9d9d0$3b98807a@cvelasqu>
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.1830
X-Mailer: Microsoft Outlook Express 6.00.3790.1830
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C7C156.C6A181D0"
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [my email]

I was originally amazed that the first two pills I took of Anatrim, almost immediately took my cravings away. Now 4 weeks later, 3 belt holes later, I have become an advocate for this awesomely powerful, natural supplement! Due to the incredible surge in popularity of Anatrim, many new products are flooding the market claiming to be of top quality.
http://holenem.net
Anatrim contains the absolute highest quality ingredients available- you simply won’t find a more complete product of this kind, anywhere.

Of which

Domain Name: HOLENEM.NET
Registrar: 1-877NAMEBID.COM LLC DBA "1-877NAMEBID.COM"
Whois Server: whois.1-877namebid.com
Referral URL: http://www.1-877namebid.com

Registration Service Provided By: 1-877NAMEBID.COM LLC
Contact: +1.8776263243
Website: http://1-877NameBid.com

Registrant:
N/A
eugene lopez (penmanshif@mad.scientist.com)
3210 killarney
el paso
Texas,79925
US
Tel. +7.9155920373

Creation Date: 05-Jul-2007
Expiration Date: 05-Jul-2008

Of which at least phone number is invalid. If the person is in Texas, his phone number should not be a Russian one. Or is this just a new try for Alex Kuvayev aka Alex Rodrigez?
And on the site that this spam was linked to, typically no phone number and no address for contacting them, other than the website. And sure, buying it from Texas .. with a Russian phone number...

http://1-877namebid.com offers bulk registration and bulk domain transfers so for that domain

[whois.myorderbox.COM]
Registration Service Provided By: DOMAINSTOBESEEN.COM
Contact: +1.4235100030

Domain Name: 1-877NAMEBID.COM

Registrant:
R. Lee Chambers Company LLC
Richard (chambers@rlcco.com)
Post Office Box Ten
Ooltewah
TN,37363-0010
US
Tel. +000.0000000

Creation Date: 19-Mar-2004
Expiration Date: 19-Mar-2009

Domain servers in listed order:
ns1.1-877namebid.com
ns2.1-877namebid.com

And of domaintobeseen.com

[whois.myorderbox.com]
Registration Service Provided By: 1-877NAMEBID.COM LLC
Contact: +1.8776263243
Website: http://1-877NameBid.com

Domain Name: DOMAINSTOBESEEN.COM

Registrant:
1-877NameBid.com LLC
Richard L. Chambers (chambers@rlcco.com)
6441 Bonny Oaks Drive
Suite C
chattanooga
TN,37416-3537
US
Tel. +1.4235100030

Looking at the email address of the registrant, maybe we find some more - at least http://www.rlcco.com seems to be a historic website of this R Lee Chambers. Rlcco.com gives also the same exact registrant details - R Lee Chambers, with phone number of 00000 ....

At least rlcco.com has something entertaining .. the source.

< meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
< title>RLCCO.COM - Global Reach...Web Savvy

< meta name="GENERATOR" content="Microsoft FrontPage 4.0">
< meta name="ProgId" content="FrontPage.Editor.Document">

We have the winner.

One more Spanish lottery ...

2007-07-07T10:15:00.001-07:00

From: lpwes59@hotmail.com
Subject: PRIMITIVA FREE PROMOTION
Date: July 7, 2007 11:50:23 AM GMT+01:00
Reply-To: vca1002@aim.com
Return-Path:
X-Originating-Ip: [62.37.212.10]
Message-Id:

PRIMITIVA FREE PROMOTION
Promotion SL,
28044, Madrid
Spain.

Dear Winner,

Congratulations to you as we bring to your notice the
result of Loteria Primitiva Free promotion. We are happy to
inform you that your email address have emerged a
winner of Five Hundred and Fifty Thousand Euros
(550,000.00) Euros.
NOTE: to file for your claim, please contact the claim agency
below on email.

***********************************************
Office: Vart Claim Agency
Mr. Alex Dimas,
Address: P.O. Box 3051 3500GA Bailen 31 28005 Madrid Spain.
Tel.: +34-643 016 780
Email : vca1002@aim.com
**********************************************

Find below your promotion date, Ticket and Prize Winning
numbers. Remember to quote these numbers in your
correspondence with your claims agent Mr. Alex Dimas

PROMOTION DATE: 3rd of July
PRIZE WINNING NUMBER: SLEU/62331/83426/07
EMAIL TICKET NUMBER: 197/00543/IPF

Kindly send the following information:
(i) Your full names,
(ii) Contact telephone and fax numbers
(iii) Contact Address
(iv) Your winning numbers
(v) Quote amount won.

Congratulations once again from all our staff and
thank you for being part of our promotions program.

Warm Regards,
Dr. Clarion Fabian.
Director, Award Distribution Center.

Make every IM count. Download Windows Live Messenger and join the i'm Initiative now. It's free. Make it count!

Uk lottery scam, again

2007-07-06T15:22:00.000-07:00

From : UK National Online Lottery
Reply-To : uknl.williammcgils@hotmail.com
Sent : Friday, July 6, 2007 2:25 PM
Subject : Claims Notification For Category "A" Winner / (Batch No.: 2005MJL-01)
MIME-Version: 1.0
Received: from smtp3.fuse.net ([216.68.8.177]) by bay0-mc1-f5.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Fri, 6 Jul 2007 07:00:10 -0700
Received: from gx4.fuse.net ([216.68.8.199]) by smtp3.fuse.net (InterMail vM.6.01.04.04 201-2131-118-104-20050224) with ESMTP id <20070706135958.KDHY6940.smtp3.fuse.net@gx4.fuse.net>; Fri, 6 Jul 2007 09:59:58 -0400
Received: from wmvirt1 ([216.68.8.199]) by gx4.fuse.net with ESMTP id <20070706135958.FHXP7351.gx4.fuse.net@wmvirt1>; Fri, 6 Jul 2007 09:59:58 -0400
X-Message-Info: txF49lGdW434iGG8CYTl9Z/6Snw5M8RDr7i8jykvKYZtZeq51iG1WYRjkZSuwzsU
Sensitivity: Normal
Return-Path: ukn_online.lottery@fuse.net
X-OriginalArrivalTime: 06 Jul 2007 14:00:10.0796 (UTC) FILETIME=[F7B286C0:01C7BFD5]

Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

FROM: UNITED KINGDOM NATIONAL LOTTERY.
3B OLYMPIC WAY, SEXTONS BUSINESS PARK,
AINTREE, LIVERPOOL, L30 1RD.
BONUS LOTTERY PROMOTION PRIZE AWARDS WINNING NOTIFICATION

Dear: Lucky Winner,
We are pleased to inform you of the result that just concluded lottery
draws of THE UK NATIONAL LOTTERY BORAD Programs. The online cyber lotto draws
was conducted from an exclusive list of 21,000 e-mail addresses of individual
and corporate bodies picked by an advanced automated random computer search from
the internet, No tickets were sold. After this automated computer ballot, your
E-mail address was emerged as one of two winners in the s Category "A" Winner.
with the following winning information:
* REF No: UKNL-L/200-26937
* BATCH No: 2005MJL-01
* TICKET No: 20511465463-7644
* SERIAL No: S/N-00168
* LUCKY No: 887-13-865-37-10-83

You as well as the other winner are therefore to receive a cash prize of Â£
250.000 (Two Hundred And Fifty Thousand Pounds only) each from the total payout.
Your prize award has been insured with your email and will be transferred to you
upon meeting our requirements, verifications and satisfactory report. To begin
the claims processing of your winnings prize, you are advice to contact the
fiduciary agent at Claims Verification Department Via E-mail:
uknl.williammcgils@hotmail.com . To file your winning prize to our licensed and
accredited claims agent for category "A" winners with the information below:

To file your claim, please contact the processing agent;
Agent Name: Mr. William A. McGill.
Telephone Number: +44 70457 22177
Email: uknl.williammcgils@hotmail.com

NOTE: All winnings must be claimed not later than 20 days. After this date all
unclaimed funds would be included in the next stake. Remember to quote your
reference information in all correspondence. You are to keep all lotto
information away from the general public especially your reference and ticket
numbers. (This is important as a case of double claims will not be entertained).
Anybody under the age of 16 and members of the affiliate agencies are
automatically not allowed to participate in this program.

Please note; You are hereby advice to send the claims officer the following:
1. Your full name and address
2. Your age, sex and occupation
3. Your personal phone and fax number
4. Your winning numbers (Ref No. Batch No. Ticket No. Serial No. & Lucky
No.).
All reply should be sent to his confidential E_mail account:
uknl.williammcgils@hotmail.com . Congratulations once more from our members of
staff and we are glad you took part in our promotional program.

Sincerely,
Mrs. Monica Lopez
For: United Kingdom National Lottery Borad.

This is the least original lottery scam that I have seen in a long time.
UK lottery, with hotmail multiple addresses, where the phone number is to a UK mobile phone and not any landline, the email address that has nothing to do with the name of the person that 'sent' this email, ...
and why is it that they have your email address magically but they just don't bother to magically have also your phone number?

If it was from UNITED KINGDOM NATIONAL LOTTERY, don't you think that it would be YOUR responsibility to find out you have won something, secondly that they would use the official email address and not their hotmail .. and that they might know your name? These are getting kind of repetitive...

Msn spam # 1

2007-07-06T15:15:00.001-07:00

From : Microsoft Customer Support
Reply-To : "Microsoft Customer Support"
Sent : Wednesday, July 4, 2007 10:16 AM
To : < my email@hotmail.com>, < some other email@hotmail.com>, < someotheremailemail@hotmail.com>, < smeother@hotmail.com>, < someotheragain@hotmail.com>
MIME-Version: 1.0
Received: from live.com ([220.79.115.72]) by bay0-mc1-f19.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Wed, 4 Jul 2007 02:58:16 -0700
Received: from unknown (HELO mx03.listsystemsf.net) (Wed, 04 Jul 2007 22:47:46 +1200)by mail.naihautsui.co.kr with QMQP; Wed, 04 Jul 2007 22:47:46 +1200
Received: from mx.reskind.net ([44.107.80.227]) by m1.gns.snv.thisdomainl.com with NNFMP; Wed, 04 Jul 2007 22:27:58 +1200
Received: from snmp.otwaloow.com ([5.164.107.215]) by external.newsubdomain.com with SMTP; Wed, 04 Jul 2007 22:18:06 +1200
X-Message-Info: txF49lGdW4071A5lTQZ0DNyptoGZUP8ibgsYx5joEcoMuXYaGAW+hxTSizSQAMht
Return-Path: postmaster@live.com
X-OriginalArrivalTime: 04 Jul 2007 09:58:17.0183 (UTC) FILETIME=[D8156EF0:01C7BE21]

Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

i saw your picture online and found you attractive can we meet on Windows
Live Messenger my name there is emily1985local@hotmail.com feel free to add
me. thanks
Emily

Hello, [myemail]:

We received your request to reset your Windows Live password. To confirm
your request and reset your password, follow the instructions below.
Confirming your request helps prevent unauthorized access to your account.

If you didn't request that your password be reset, please follow the
instructions below to cancel your request.

CONFIRM REQUEST AND RESET PASSWORD

1. Copy the following web address:

https://accountservices.msn.com/EmailPage.srf?emailid=oursga&ed=[string of random letters here]

IMPORTANT: Because fraudulent ("phishing") e-mail often uses misleading
links, Microsoft recommends that you do not click links in e-mail, but
instead copy and paste them into your browsers, as described above.

2. Open your web browser, paste the link in the address bar, and then press
ENTER.

3. Follow the instructions on the web page that opens.

CANCEL PASSWORD RESET

1. Copy the following web address.

https://accountservices.msn.com/EmailPage.srf?emailid=[string of random letters here]

IMPORTANT: Because fraudulent ("phishing") e-mail often uses misleading
links, Microsoft recommends that you do not click links in e-mail, but
instead copy and paste them into your browsers, as described above.

2. Open your web browser, paste the link in the address bar, and then press
ENTER.

3. Follow the instructions on the web page that opens.

OTHER INFORMATION

Windows Live is committed to protecting your privacy. We encourage you to
review our privacy statement Privacy Statement at
http://g.msn.com/0PR_/enus.

For more information, go to the Windows Live Account site at
https://account.live.com.

Thank you,

Microsoft Customer Support

NOTE: Please do not reply to this message, which was sent from an
unmonitored e-mail address. Mail sent to this address cannot be answered.

Uh right. Something forged to be coming from live.com that has exactly what to do with microsoft? \
Nevertheless, I guess feel free to add this emily1985local@hotmail.com to your live messenger as she must have seen you or someone else in the internet.
"Oh hi emily, I'm from the internet!"

One million euros from a handbag lottery ...

2007-07-06T15:05:00.001-07:00

From :
Sent : Sunday, July 1, 2007 1:06 PM
Subject : You are a winner. Ref Number: 4226119.
MIME-Version: 1.0
Received: from mk-outboundfilter-4.mail.uk.tiscali.com ([212.74.114.8]) by bay0-mc8-f3.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sun, 1 Jul 2007 06:07:06 -0700
Received: from [88.16.201.165] by mail-2.uk.tiscali.com with HTTP; Sun, 1 Jul 2007 15:06:55 +0200
X-Message-Info: txF49lGdW41vBGZUwOuegtGQUCQ1iybV2b0lNdlzTqy3dVBPDmv2xEOF/twKofHp
X-SBRS: None
X-RemoteIP: 212.74.100.142
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmYmAA5Eh0bUSmSO/2dsb2JhbACGH4gR
Return-Path: susanha01@handbag.com
X-OriginalArrivalTime: 01 Jul 2007 13:07:06.0907 (UTC) FILETIME=[B9E2DEB0:01C7BBE0]

Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

You are a winner. Ref Number: 4226119.

This is to inform you that your Email Address attached to a
Ticket Number: 1O6012 has won the prize Sum of ?1 ,000,000.00 (One
Million Euro), in an Email Sweepstakes program held on the 28th of June
2007.

Do contact the Details below for the Claim

Contact Person: Mr. Jon Bosch
TEL: +31-630-010-727
E-mail: jonsponsorlot@yahoo.de
WINNING INFORMATIONS
Reference Number: 4226119, Serial Number: 176087, Lucky Number:12426765,
Batch Number: EU75011

Congratulations!

SINCERLY YOURS,
MRS.SUSAN HANSEN
PROMOTION CO-ORDINATOR.
Contact Email: jonsponsorlot@yahoo.de

___________________________________________________________

Tiscali Broadband from 14.99 with free setup!
http://www.tiscali.co.uk/products/broadband/

Aren't these lottery winning notifications so great when they don't even TRY to tell you how this would be the Yahoo & Hotmail & AOL & Microsoft & Everything Else Lottery? Just *a* lottery where they had your email address. But not your name or address or anything else ...

DeVry University and University of Phoenix

2007-07-06T01:43:00.000-07:00

From : DeVry.University
Sent : Tuesday, July 3, 2007 1:38 PM
To : [my email]
Subject : Succeed faster...
MIME-Version: 1.0
Received: from KarmaDogOnline.com ([66.29.53.53]) by bay0-mc9-f18.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Tue, 3 Jul 2007 10:42:10 -0700
Received: by KarmaDogOnline.com id hh98r60cvqg5; Tue, 3 Jul 2007 09:38:28 -0400 (envelope-from )
X-Message-Info: LsUYwwHHNt1LK/nREKLBsanyDZxzDd7nXyQi1nswZ+09XS+ln+gJY3jbM/zhsRDL
Return-Path:
X-OriginalArrivalTime: 03 Jul 2007 17:42:10.0203 (UTC) FILETIME=[7B717EB0:01C7BD99]

Message contents : gif

Gif links to yourdirectline.com for "cancelling".

From : University of Phoenix - Online
Sent : Friday, June 29, 2007 2:34 PM
To : [my email]
Subject : The leading choice...
Received: from KarmaDogOnline.com ([66.29.74.1]) by bay0-mc2-f16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Fri, 29 Jun 2007 11:36:57 -0700
Received: by KarmaDogOnline.com id hgkca20cvqg8; Fri, 29 Jun 2007 10:34:20 -0400 (envelope-from )
X-Message-Info: LsUYwwHHNt0hnHTZ2pc/8nz5x3nDjSFiRyV0Vz3CYnL1M5nIwb1+AOqNHRPzVSWb
Return-Path:
X-OriginalArrivalTime: 29 Jun 2007 18:36:57.0015 (UTC) FILETIME=[78E23470:01C7BA7C]

Gif with link to www.originativebusiness.com to "cancel".

DeVry University and University of Pheonix are something that have been annoying me for a long time.

I never signed to receive any of their spams, yet I get at least one spam per day, and this has been going on for at least the past 4 years.
These along with the [something] confirmation department are something that are so constant that it's not probably even annoying...

Mysweetmeds.com

2007-07-06T01:16:00.000-07:00

From : Alba@viagrapharmacy.com
Sent : Thursday, July 5, 2007 8:35 PM
To :
Subject : RE: Pharmacy Email.
MIME-Version: 1.0
X-Originating-IP: [79.941.263.406]
X-Originating-Email: [email]
X-Sender: [forged email]
Received: from cpe-76-184-6-97.tx.res.rr.com ([76.184.6.97]) by bay0-mc4-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 5 Jul 2007 13:35:13 -0700
Received: (qmail 12215 by uid 296); Thu, 5 Jul 2007 03:36:10 -0600
X-Message-Info: txF49lGdW43Ql6ck42gxPXo/M+QN6b53EWOKl4GhFqyQJvyMz+ejm8GdA/GS+HeI
Return-Path: [forged email]
X-OriginalArrivalTime: 05 Jul 2007 20:35:13.0625 (UTC) FILETIME=[FD457490:01C7BF43]

Contents of email were only a gif with a lot of viagra, cialis etc images linking to http://pn.mysweetmeds.com

Of which we get

Registrant Contact:
medstore
David Snyder devid@lovelymeds.com
6516866867 fax:
3350 Heritage Ln.
Eagan MN 55121
us

Jain Hagis - Sep 11 scammer who can't spell

2007-07-06T01:06:00.000-07:00

Maybe the scamers figured out that people would trust more American business men in these money advance scams?
This one is entertaining - even enough that I bothered to open the message at all in hotmail. Bold and italic additions are mine for comic or other value...

So, an American that types his name in CAPSLOCK like a NIGERIAN. Who used to work for a SECURITY/FINANCE COMPANY. Who lost his voice so that if people would actually call him they didn't figure out how exactly American he was... who misspells words like "organisation", "september", "EUROPE", and who also tries to milk from the September 11 thing ..

Never trust an American who misspells simple words like "organisation".

From : jain hagis <jain-h23178@hotmail.com>
Reply-To :
Sent : Thursday, June 28, 2007 12:53 PM
Subject : My Dear in Christ
X-Originating-IP: [216.226.70.22] [...]
X-Message-Info: LsUYwwHHNt14Z7jiFj59bCOsXpwBDfMCY+cVAcljtvRVBwCMW0F255vJHI/N4USs
Return-Path: jain-h23178@hotmail.com

X-OriginalArrivalTime: 28 Jun 2007 12:53:28.0336 (UTC) FILETIME=[52BD9900:01C7B983]
Content-Type: multipart/alternative; boundary="_4183b661-2641-46c9-831c-2fb6c538bad6_"
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

My Dear in Christ

Greetings to you in the name of our heavenly God. This mail might come to you as a surprise and the temptation to ignore it as unserious could come into your mind,but please, consider it as a divine wish and accept it with a deep sense of humility. My name is MR JAIN HAGIS I'm a 49 years old man,living in EUROPE,Though an American.

I was a merchant and i owned two businesses in Dubai. I was also married,with two children. My wife and my two children died in a september 11,plane bomb blast that happen in USA 6years ago. Before this happened my business and my concern for making money was all my interest as A living man. I never really cared about other values in life. But since i lost of my family, I have found a new desire to assist helpless families. I have been helpingorphans in orphanage/ motherless homes. I have donated some money to orphans in Sudan, South Africa, Cameroon, Brazil,Spain, Austria,Japan ,Germany and some Asian countries. Before I became ill, I kept $8 Millionin a long-term deposit account in a SECURITY/FINANCE COMPANY.

Presently, I'm in a hospital where I have been undergoing treatment for oesophageal cancer. I have since lost my ability to talk and my Doctors have told me that I have only a few months to live.It is my last wish to see this money distributed to charity organizations. Because relatives and friends have plundered so much of my wealth since my illness, I cannot live with the agony of entrusting this huge responsibility to any of them.

Please, I beg you in the name of God to help me collect the deposit and the interest accrued from the company and distribute it amongst charity homes and poor & needy in your country. Use your judgement to distribute the money and feel free to reimburse yourself when you have the money for any cost you incure during the process of collecting and distributing the money to Hurricane Katrina victims in USA ,Charity organisations,and motherless babies homes.

I'm willing to offer you a reward If you are willing to help, please reply as soon as you can to my email:

May the good Lord bless you and your family.

Regards,
MR JAIN HAGIS
Change is good. See what's different about Windows Live Hotmail. Check it out!

"Spainsh" lottery winning notification "E-mail"

2007-06-16T02:51:00.000-07:00

From: DR LUIZ FERNANDEZ euspainlotterys@aim.com
Subject: CONGRATULATION!!! WINNING NOTIFICATION.
Date: June 16, 2007 10:35:30 AM GMT+01:00
Reply-To: infofernandezsec@aim.com
Return-Path:
Received: ... from aim1088.com ([84.76.178.9]) by isp (Xserve/smtpin32/MantshX 4.0) with SMTP id l5G9Zskm009479; Sat, 16 Jun 2007 02:35:56 -0700 (PDT)
Message-Id: <200706160935.l5G9Zskm009479@isp>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary=a4ad678d-d1bb-4568-ab24-88912ff8c6d9
Original-Recipient: [email]

EURO MILLION SPAINSH LOTTERY INTERNATIONAL.
FROM:VICE PRESIDENT
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REFERENCE:67/80/ESP
BATCH:ESP-541-623-782
DATE:12TH OF JUNE 2007
RE: WINNING NOTIFICATION / FINAL NOTICE
Sir/Madam
We are pleased to inform you of the result of the Euro Million Spainsh Lottery Winners International E-mail programs held on the 8th of JUNE 2007. Your E-mail address attached to ticket number 653-908-321-675 with serial main number 345-790-241-671 drew lucky star numbers 34-32-90-43-32 which consequently won in the 2nd category, you have therefore been approved for a lump sum pay out of 1.000.000.00 Euro.(One Million Euro)
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 100,000 company and 50,000,000 individual email addresses and names from all over the world.
This lottery was promoted and sponsored by his royal highness King Rey Juan Carlos ,This promotional program takes place every three year. We hope with part of your winning you will take part in our end of year 50 million Euro International lottery.
To file for your claim,please contact our fiducial agent:DR.LUIS FERNANDEZ
(FERNANDEZ SECURITY COMPANY SPAIN)
TEL:+34-648-823-675
Email: infofernandezsec@aim.com
Remember all winning must be claimed not later than two weeks,After this date all unclaimed funds will be included in the next stake.
Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible.
Congratulations once more from our members of staff and thank you for being part of our promotional program.
Note:Anybody under the age of 18 is automatically disqualified.
Sincerely yours,
MRS,COMFORT JOSE
Lottery Coordinator

Great spelling on this one.
Ad if I would end up winning one million, wouldn't it be MY responsibility to find it out?
Do people really believe in that they have been added by someone to some random lottery where they won million(s)?
And why would any such instance rely on "E-mail" to inform the winners, giving even the winning notification that way? Sure they must have also address and phone details in record then.
Plus I have not seen even one where the URL or the email sending domain would have anything to do with anything else but hotmail, yahoo, lycos, walla, or any other free email provider.
This "Spainsh" winning notification is no different.

I guess I should write a book about how to write GOOD scams that anyone would actually even remotely believe, get that on Amazon, and then send a reply to these unoriginal ones telling how much they could learn and how they could tenfold their income with some training in how to feed people bs ...

Aisha Qadir - millionaire laundering money to charity

2007-06-14T13:25:00.000-07:00

From: mrsaishaqadir@aim.com
Subject: Please reply if you are interested
Date: June 14, 2007 1:44:13 PM GMT+01:00
To: [email]
Return-Path:
Received: .. from pc-a66cdb5b8f57 (hst-144-21.orlandonet.net [83.143.144.21]) by isp (Xserve/smtpin26/MantshX 4.0) with SMTP id l5ECU0vg021047for ; Thu, 14 Jun 2007 05:30:02 -0700 (PDT)
Received: from [83.143.144.21] by web335.mail.aim.com via HTTP; Thu, 14 Jun 2007 12:44:13 +0000 (GMT)
Message-Id: <0KAVSR0K.LO6MY9L@aim.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
X-Priority: 3
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
User-Agent: Mozilla 2.0 (Macintosh; I; 68K)
Original-Recipient: [my email]

Greetings,

My name is Mrs. Aisha Qadir, widow to late Mr. Ahmed Qadir, former owner of
Petroleum and Gas Company, here in Kuwait, I am 68years old, Suffering from
long time cancer of the breast, From all indications my condition is really Deteriorating, and it's
quite obvious that I won't live more than 3 months according to my doctors, this is because the cancer stage has
gotten to a very bad stage, I don't want your pity, but i need your trust.

My late husband died early last year from heart attack, and during theperiod of
our marriage we Couldn't produce any child, my late husband was very wealthy, and after his death, I
inherited all his business and wealth, The doctor has advised me that I will not live for more than 3
months, so I have now decided to spread all my wealth, to contribute mainly to the development of charity in
Africa, America, Asia and Europe, am sorry if you are embarrassed by my mail, i found your e-mail
address in the web directory, and i have decided to contact you, but if for any reason you find this mail
offensive, you can ignore it and please accept my apology.

Before my late husband died he was a major oil tycoon, in Kuwait anddeposited
the sum of 25million dollars (Twenty Five million dollars) in a company in Europe some years ago,
thats all i have left now, I need you to collect this funds and distribute it yourself to charity,
so that when i die my soul can rest in peace, the funds will be entirely in hands and management, i hope
God gives you the wisdom to touch very many lives, that is my main concern.
20% of this money will be for your time and effort, while 80% goes to charity.

God bless you.

Mrs. Aisha Qadir.

A millionaire in a poor country, with millions of dollars of illegal money ... the spouse is dead for a while now, and this dying millionaire found your contact details in a web directory and now wants your help to launder this money to charity and will pay you so much in return ...
How many times have I heard this story? Maybe 3 variations a day for the past 3 years ...

Even all these rich dying millionaires that are located in Muslim countries are always using God bless somewhere in the email. How about Allah bless, for once?

IP address is located in Sofia, Bulgaria.

Geneyratevideo.com - loam spam

2007-06-14T13:12:00.000-07:00

From: conformal@bkkmail.com
Subject: Your refinan/ce application
Date: July 14, 2007 5:01:07 PM GMT+01:00
To: [another user's email]
Return-Path:
Received: ... 62.42.101.235.dyn.user.ono.com (62.42.101.235.dyn.user.ono.com [62.42.101.235]) by isp (Xserve/smtpin37/MantshX 4.0) with SMTP id l5DG0w9Q027096; Wed, 13 Jun 2007 09:01:20 -0700 (PDT)
Message-Id: <70355383.20280090@cherokee.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Original-Recipient: [my email]

Hello.
Important information regarding your l()an: ID MLDU2376
Your refinan/ce application has been accepted. We are ready to you a l()an.
Please finalize everything by visitig our Secure Web-form.
http://geneyratevideo.com

Of which

Domain Name: GENEYRATEVIDEO.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Visit AboutUs.org for more information about geneyratevideo.com
a href="http://www.aboutus.org/geneyratevideo.com"AboutUs: geneyratevideo.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Domain name: geneyratevideo.com

Registrant/Administrative/Technical Contact:

metsales inc.
gordon metcalfe (gordomet@coldmail.ca)
+1.4033979426
Fax: +1.5555555555
7622 Elbow drive
calgary, AB T2V 1K2
CA

More Karin Patterson originated Viagra spam

2007-06-12T13:31:00.000-07:00

From: busy4miles@urscorp.com
Subject: You pay We ship, NoPrescription, CialisPhentemineXanaViagra\/aliun from $2/pill MeridiaCelebrex RivotrilLevitrPropecia favour
Date: June 12, 2007 2:39:05 PM GMT+01:00
To: [someotheremail]

Certified OnlinePharmacy
Genuine Quality Ingredient & All Countries Shipping
ViagraAs 10pills $57
CialisAs 20pills $1xx
PhentermineAs 30pills $1xx
ValiumAs 30pills $95
XanaxAs 30pills $99
LevitraAs 10pills $73
plus 30 meds more RivotrilAs 30pills $70
AtivanAs 30pills $90
AmbienAs 30pills $1xx
MeridiaAs 30pills $1xx
SomaAs 30pills $1xx
CelebrexAs 30pills $1xx
plus 30 meds more
Best Price - Click Here To View More [link to http://kehuxw.alsoathankyou.com]

Of which we can get

Domain Name: ALSOATHANKYOU.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Registrant:
Name: Karin Patterson
Organization: Karin Patterson
Address: 408 McLaughlin Dr.
City: Santa Cruz
Country: US
Postal Code: 95064-1017
Email: karinpattersonmint@yahoo.com

Which makes it that she/he/them have been spamming habitually my inbox, and it annoys me enough to get an own label for this Karin Patterson.

Schoolisalways.com - viagra spams

2007-06-10T22:58:00.000-07:00

From: am9discuss@cnh.com
Subject: 1 Million Satisfied Customers Worldwide, 100% Safe & Effective PenisEnlargement Pill raised
Date: June 11, 2007 6:10:25 AM GMT+01:00
To: [some other email]
Return-Path:
[..] Received: from 78.237.237.221.broad.ga.sc.dynamic.163data.com.cn (78.237.237.221.broad.ga.sc.dynamic.163data.com.cn [221.237.237.78] (may be forged))by isp (Xserve/smtpin50/MantshX 4.0) with SMTP id l5B4Achg028878; Sun, 10 Jun 2007 21:10:41 -0700 (PDT)
Message-Id: <76901.26134.30544@cnh.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [my email]

idea address tomorrow.
Safe & Effective PenisEnlargement
Over 1,500,000 bottles sold worldwide
WeOffer a FULL MONEY BACK GUARANTEE if you are not completely satisfied with the results of Man-XL, you have nothing to lose, just a lot to gain
A breakthrough in herbal Science has created a pill that has been designed specifically for PenisEnlargement. The tests that took place over a 6 month period showed that out of the 5,000 Males from around the world who participated, the average gain after 5 months of taking Man-XL pills was 3.02 Inches! Amazing, PERMANENT RESULTS that will last.
Did you know... Man-XL was featured in leading mens magazines such as FHM, MAXIM, plus many others, and rated No.1 choice forPenisEnlargement Also seen on TV
-:- Gain Up to 3+ Inches In Length
-:- Increase YourPenis Width (Girth) By upto 20%
-:- Help Stop PrematureEjaculation!
-:- Produce Stronger, Rock HardErections
-:- 100% Safe To Take, With NO Side Effects
-:- Fast Shipping WorldWide
-:- Doctor Approved And Recommended
-:- No Pumps, No Surgery, No Exercises
-:- Very discrete shipping and billing
-:- 100% Money Back Guarantee
-:- Up to 3 FREE Bottles Of Man-XL
-:- Highly secure 128bit order processing
See by yourself BEFORE & AFTER result by a customer
Buy This herbal EnlargementPills here [link to schoolisalways.com]

progress goes satisfaction,

Of which whois

Domain Name: SCHOOLISALWAYS.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Registrant/Administrative Contact/Technical Contact:
Name: Karin Patterson
Organization: Karin Patterson
Address: 408 McLaughlin Dr.
City: Santa Cruz
Country: US
Postal Code: 95064-1017
Email: karinpattersonmint@yahoo.com

Edward Moore, $ 35 million ...

2007-06-10T22:51:00.000-07:00

And today's ~~winner~~ loser is "Edward Moore".
He forgot to write on the spam that he is a banker from Some Fancy Bank in UK.
And how about for once, one of these banker scams could even fake to be coming from a bank's email address ad ISP? I have not yet seen a single one.

Absolut pearl part of it

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you

Don't you find it odd how he send the offer to transfer $ 35 million to undisclosed recipients?

Dear mr, since you claim that you know me and these $ 35 million are legal, please call me on the phone. I would not trust internet for such delicate matters. Since you say that you know me, you surely must have my phone number in your address book.

From: edwardmoore141@aol.co.uk
Subject: Permission To Transfer $35 Million USD
Date: June 11, 2007 2:39:42 AM GMT+01:00
To: undisclosed-recipients: ;
Return-Path:
[..] Received: from imo-m19.mx.aol.com (imo-m19.mail.aol.com [172.20.107.65]) by imr-d01.mx.aol.com (v107.10) with ESMTP id RELAYIN3-4466cb2104c; Sun, 10 Jun 2007 22:23:12 -0400
Received: from edwardmoore141@aol.co.ukby imo-m19.mx.aol.com (mail_out_v38_r9.2.) id j.d1a.c063172 (57881); Sun, 10 Jun 2007 21:39:47 -0400 (EDT)
Received: from mblk-d45 (mblk-d45.mblk.aol.com [205.188.212.229]) by air-ia04.mail.aol.com (v115.17) with ESMTP id MAILINIA43-e219466ca7df187; Sun, 10 Jun 2007 21:39:45 -0400
Received: from 41.205.166.74 by mblk-d45.sysops.aol.com (205.188.212.229) with HTTP (WebMailUI); Sun, 10 Jun 2007 21:39:42 -0400
Message-Id: <8C979E084BFC6CC-9AC-14E1E@mblk-d45.sysops.aol.com>
Mime-Version: 1.0
X-Mailer: AOL Email 27618
Content-Type: multipart/alternative; boundary=--------MB_8C979E084BFC6CC_9AC_27703_mblk-d45.sysops.aol.com
X-Mb-Message-Source: WebUI
X-Mb-Message-Type: User
X-Aol-Ip: 172.20.107.65
X-Spam-Flag: YES
Original-Recipient: [my email]

Permission To Transfer $35 Million USD

If with your permission, I can arrange for the transfer of $35 Million Usd into your personal account or company account. This transaction is legitimate and legal and hence you have no need to worry.

On acceptance of this offer please let me know so that i can furnish you with more details on this issue. An early response to my mail will be appreciated to enable us open up commuinication towards the realization of this goal.

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you.

God bless you and your family.

Regards
Edward Moore
edwardmoore911@yahoo.co.uk
Get a FREE AOL Email account with 2GB of storage. Plus, share and store photos and experience exclusively recorded live music Sessions from your favourite artists. Click Here for more information.

More digging on Leo Kuvayev aka Alex Rodrigez

2007-06-10T08:31:00.000-07:00

And more digging on Leo Kuvayev aka Alex Rodrigez:

BBC : Massachusetts tackles spam gang - May 12, 2005
Not unknown in the wild wild web.
Leo Kuvayev @ Rokso
Kuvayev/Rodrigez at Spamtrackers.eu
Leo Kuvayev / Alex Rodrigez aka Badcow at Spamhaus.org
Spamhaus Statistics : The Top 10 of the whole planet
Lawsuit against Russian Spam Gang @ Spam Kings, O'Reilly (Spam Kings is a brilliant book by the way!)
Attorney General Tom Reilly Shuts down Spam King Leo Kuvayev @ Lindqvist.com
MA Atterney General on Leo Kuvayev (excl. Microsoft server errors)
Mr Kuvayev's home page in Web Archive, leonik.com
Kuvayev @ Information Week
Wed, 28 Feb 2007 Sick of spam? Get mad and get even
Leo Kuvayev is listed on the top 10 of the internet influent people

In the '90s Leo was a promising computer science grad student at the University of Massachusetts, where his focus was on artificial intelligence and machine learning. (His articles include "Intelligent Methods for File System Optimization" and "Learning to Play Hearts.") [articles]

Leo apparently became a US citizen in 2000 and was running some kind of online casino and Internet payment business out of Montreal. Last year, he launched a spam affiliate network called BadCow with a partner, Vladislav Khokholkov, who is also named in the lawsuit along with a handful of other people. The AP apparently reached Vlad by phone in Russia today, and he coyly said "I don't send e-mails."

(Spam Kings article above)

Bits and pieces
Mr Kuvayev / Rodrigez' ICQ = 101859176 (from his site, via internet archive, also listed on icq.com)
Mr Kuvayev's provided info (again all from his expired home page) about his 3 sisters :

Nadira's brief info:
Born in November, 1980 in Moscow, Russia
Height: 5'6''
Weight: on a slim side
Location: Moscow, Russia
Phone: +7 095 423-6337

Lana's brief info:
Born in November, 1980 in Moscow, Russia
Height: 5'6''
Weight: just right
Location: Boston, MA
Email: laname@hotmail.com

Regina's brief info:
Email: regi428@ilovechocolate.com

This guy is sued only in MA for close to $ 40 million. He seems to log in to his ICQ account regularly.
Why is it so hard to catch him?
ICQ logs for sure every time each user logs in from which IP address. I can only guess that ICQ respects the privacy of every user it has then. So it ICQ where all the Isreali. Palestinians and Al Quaida communicate as well as it gives them privacy?

Another paypal scam - billingline.com

2007-06-10T07:33:00.000-07:00

From: do-not-reply@paypalsecurity.com
Subject: Please Restore Your Account Access
Date: June 9, 2007 1:07:33 PM GMT+01:00
Reply-To: do-not-reply@paypalsecurity.com
Return-Path:
[...] Received: from User ([38.114.33.242]) by smtpgw.armorholdings.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 09 Jun 2007 08:03:18 -0400
Message-Id:
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.3959
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-Priority: 1
X-Msmail-Priority: High
Thread-Index: AceqjirC+y1pkfyfQIaztd797ObJDg==
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]
X-Originalarrivaltime: 09 Jun 2007 12:03:18.0157 (UTC) FILETIME=[2AAF7BD0:01C7AA8E]

PayPal is constantly working to ensure security by regularly screening the accounts in our system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and we apologize for the inconvenience.
Why is my account access limited?

Your account access has been limited for the following reason(s):

June 09, 2007: We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is PP-xxx-xxx-xxx )

How can I restore my account access?

Please visit the Resolution Center and complete the steps to remove limitations.

To complete the verification process you must log in and go to resolution center and unlimit your account.

Of the link (www.domainline.com) we get

Domain Name: BILLINGLINE.COM
Registrar: DSTR ACQUISITION VII, LLC
Whois Server: whois.dotregistrar.com
Referral URL: http://www.dotregistrar.com
Name Server: NS1.EXTRAHOST.ES
Name Server: NS2.EXTRAHOST.ES
Status: clientTransferProhibited
Updated Date: 14-dec-2006
Creation Date: 20-jan-2005
Expiration Date: 20-jan-2008

Registrant, Administrative Contact, Technical Contact, Zone Contact:
Chazelle Christophe (BILLINGLINE-COM-DOM)
ExtraNext On Line consulting S.L.
Paseo Joan de Borbo, 16
Entresuelo, 2a
Barcelona, ES 08003
ES
+34 902955627
+34 935504050
whois@extranext.es

2007-06-08T17:51:00.000-07:00

The spam selection of the past few days has been more interesting than for a while ...

From: ms_sarah_boko1@hotmail.com
Subject: Hi Dearest,
Date: June 8, 2007 10:28:15 AM GMT+01:00
Reply-To: ms_hopedaniel@yahoo.co.uk
Return-Path:
Received: from mrson2148.com ([196.207.219.199]) by ...com (Xserve/smtpin14/MantshX 4.0) with SMTP id l58BRFcl019517; Fri, 08 Jun 2007 04:27:16 -0700 (PDT)
Message-Id: <200706081127.l58BRFcl019517@...com>
Mime-Version: 1.0
X-Mailer: Microsoft Outlook Express 5.00.2919.6900 DM
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Original-Recipient: [my email]

Hi Dearest,
I'm Miss Hope Williams Daniel, i slim in staure above all i like being honesty,trusted, sincere. I have gonne through
your porfiles, it interest me to know you more, and I hope to use this opportunity to explain myself a little about me,
i am fair in complexsion,5.9fit tall, 44kg. I wish you to write me through id (ms_hopedaniel@yahoo.co.uk). also i
will send you my picture after hearing from you. Somethings I like to do in my spare time are gardening, home
improvement projects, camping, bicycling in the park, backyard bar-b-ques, moon-lite walks on the beach, preparing
candle-lite dinners for someone special, sending flowers to someone special for some reasons, sitting and watching
the sun set with someone special, and cuddling in front of a fire with someone special. I enjoy cooking, gardening,
playing billards, darts, dinning out, going to the cinama, traveling and site-seeing, museums, and concerts. I like
almost any kind of music, but I think my favourite is instrumental jazz. i will tell you more about myself again in my
next mail dear and hope to hear from you soon.
Love From,
Miss Hope Williams Daniel

Interesting, a fair complexed 'woman' in Britain that spells worse than a Nigerian banker, and who has her weight and height in metric.
Oh dear Hope, I'm into women with creative spelling and such original hobbies... tell me what kind of women turn you on and you are looking for?
Oh and dear "Miss Hope William Daniel" .. why do you make some Sarah Boko read your email replies?

What kind of spam would you like to see here?

2007-06-07T14:12:00.000-07:00

And some interesting statistics for once again.. keywords from logs how this site has been found (mostly google).

lochers paris
africans hotmail
nomarriage.com
cmpgnr.com
angelstar pornstar
you have won the yahoo/msn inc and the microsoft windows lottery
pacnames
yahoo/msn lottery incoperation
scam exquisite replicas
bookmyname.com
felicia samson
yahoo/msn lottery inc & windows live
yahoomsn lottery
alex rodrigez
yahoo and microsoft window inc lottery

So it looks like that I am not the only one getting these scam attempts and my mailboxes loaded with these spams ....
If you found yourself here searching for something special - what is it that you would like to see in an antispam site? Do you have any good spams and scams that you got recently? Please post as comments, we are open to collaborators ...

THREE soldiers from Ameria whose style is the same of the Nigerians

2007-06-07T12:58:00.001-07:00

From: dayansalim31@hotmail.fr
Subject: Please Comfirm Reciept
Date: June 7, 2007 8:30:16 PM GMT+01:00
Reply-To: wilkinsdenis@myway.com
Return-Path:
Received: [...] from hotmail.com ([65.54.174.41]) by bay0-omc1-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 07 Jun 2007 12:30:18 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 07 Jun 2007 12:30:17 -0700
Received: from 65.54.174.200 by by103fd.bay103.hotmail.msn.com with HTTP; Thu, 07 Jun 2007 19:30:16 +0000 (GMT)
X-Originating-Ip: [41.223.251.78]
X-Sender: dayansalim31@hotmail.fr
Message-Id:
Mime-Version: 1.0
Content-Type: text/html; format=flowed
X-Originating-Email: [dayansalim31@hotmail.fr]
Original-Recipient: [email]
X-Originalarrivaltime: 07 Jun 2007 19:30:17.0909 (UTC) FILETIME=[47AD5E50:01C7A93A]

Dear friend,

We are team(THREE IN NUMBER) of American soldiers writing from Baghdad in Iraq.We are urgently seeking your assistance to secure the below consignments with attached photos.Please see photo below.

The goods were captured here in Baghdad 2 weeks ago abandoned in one of the underground treasure house.The goods consist of GOLD BARS, GOLD COINS and HUGE AMOUNT OF CASH in the sealed boxes.

To make my message short I will go straight to the point.At this moment we have succeeded shiping the goods outside Iraq to another country and have placed it in the custody of a treasury company.We will want you help us receive and secure the boxes.Once you receive it open the boxes and re-transfer the money to bank a account which we will give you latter.Due to law and restriction order we are unable to transport and secure the good in Ameria ourselves that is the reason we are seeking your help in receiving the goods on our behalf.You will be entitled to 20 bars of gold and raw cash;amount we will tell you once you reply.We will appreciate you reply us quickly indicating your readiness to help us.As soon as we receive your positive reply we shall furnish you with further details;the amount you will be entitled to and the current location of the boxes containing the goods. Perfect arrangement have been made to make sure the boxes arrive you safely.

Please note that this information must be handled with utmost confidentiality so as to avoid publicity which may risk our job, as you may know we are at war and still in active service.You may call me on phone +964 7032700320,ask of Sergent.Ray,for security reasons call me only between 19 hours-21 hours GMT.

Yours truly.

SGT.Wilkins Ray
Team Leader

Dear team of THREE soldiers from Ameria, would you mind to explain me why your style of writing looks identical to all these Nigerian scams?

Rolex spammers - intheworldseries.com

2007-06-07T12:54:00.000-07:00

From: pokk8hmcy@starstream.net
Subject: Swiss Rolex, Patek Philippe, Panerai, Omega, Breitling, IWC, Tag Heuer From $199, Limited Stock! srbb
Date: June 6, 2007 8:07:03 PM GMT+01:00
To: [some email]
Return-Path:
Received: ...
from ioxemua (adsl-dyn12.91-127-77.t-com.sk [91.127.77.12]) by [isp] (Xserve/smtpin60/MantshX 4.0) with SMTP id l56I71Xh018208; Wed, 06 Jun 2007 11:07:26 -0700 (PDT)
Message-Id: <564r564p.6650732@starstream.net>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=surely.changed; d=starstream.net; b=QjJVeUfegyYhvqkLmVHoLomQcOrCDMssOAHyXiVaPuAoJWtvJfSoOBwehpNRjZvfMWYXVJxozeJWNeUT;
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [email]

garden within know? using dark sudden bought,Swiss Watch Retailer
Special From $ 199
Bestseller Watches
A.Lange & Sohne
Audemars Piguet
Breitling
Bvlgari
Cartier
Chanel
Chopard
Franck Muller
IWC
Jaeger-Lecoultre
Omega
Panerai
Patek Philippe
Rolex Ladies
Rolex Mens
SWISS Rolex
Tag Heuer

Checkout the hottest watches now
circumstances know and mistress bad? favour your appearance blue?

had link to http://rymibryk.intheworldseries.com/

Of which we get very similar results than for the previous entry. Again real registrant hidden, but internet.bs is the domain used by the spammers. Once I find a third spammer using that domain, or a spam of a third different product and domain registered by that domain, I'll count that domain registry service as spammer operated as well.

Domain Name: INTHEWORLDSERIES.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.ROCKETSKYROCK.COM
Name Server: NS2.ROCKETSKYROCK.COM
Name Server: NS3.ROCKETSKYROCK.COM
Name Server: NS4.ROCKETSKYROCK.COM
Name Server: NS5.ROCKETSKYROCK.COM
Status: clientTransferProhibited
Updated Date: 05-jun-2007
Creation Date: 05-jun-2007
Expiration Date: 05-jun-2008

Theyankeesbeat viagra spam

2007-06-07T12:47:00.000-07:00

From: kvobm0bzg@ups-scs.com
Subject: Ciali Valiun Viagre Xanas At Super Low Price, Express Ship To All Countries lm
Date: June 6, 2007 8:07:51 AM GMT+01:00
To: [my email]
Return-Path:
Received:[....]
from wxiww ([84.36.22.143])by [isp] (Xserve/smtpin70/MantshX 4.0) with SMTP id l5667pG7023666for ; Tue, 05 Jun 2007 23:07:52 -0700 (PDT)
Message-Id: <830l240s.7096704@ups-scs.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=miserable.food; d=ups-scs.com; b=lLKFpjXnVVPKMaCbkqvNRbIHtbWVBUWnoRhnzItZNSkUYnEsIrQxyAWJkddyfytzcwBZDLIoJrcCdofO;
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [my email]

Express Drug Mart
We are the best price on all high quality meds. Established by a reputable Canadian Doctor and Scientist, Express Drugmart's mission is to provide you with a secure online environment to purchase the safest, quality medication

Viagraa (Brand & Generic available) - as LOW as $ 2.25 per D0SE
Cialiss (Brand & Generic available) - as LOW as $ 2.25 per D0SE
Valiumm - as LOW as $ 1.50 per D0SE
Xanaxxxxx - only $ 1.50 per D0SE
Ambienn - only $ 1.65 per D0SE
Ativann - only $ 1.50 per D0SE
Somaa - only $ 1.50 per D0SE
Clenbuterol - only $ 2.50 per D0SE
Meridiaa (brand name) - only $ 3.99 per D0SE

See What Meds Has Special Discount
Click On This Link [had a link to http://btsckz.theyankeesbeat.com/]

Of which we get

Domain Name: THEYANKEESBEAT.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.ROCKETSKYROCK.COM
Name Server: NS2.ROCKETSKYROCK.COM
Name Server: NS3.ROCKETSKYROCK.COM
Name Server: NS4.ROCKETSKYROCK.COM
Name Server: NS5.ROCKETSKYROCK.COM
Status: clientTransferProhibited
Updated Date: 05-jun-2007
Creation Date: 05-jun-2007
Expiration Date: 05-jun-2008

Unfortunately can't dig the details of the registrant person or gang yet.

And Alex Rodrigez aka Leo Kuvayev has his wikipedia entry

2007-06-07T12:34:00.000-07:00

I wondered how long it would take before Alex Rodrigez would get his own wikipedia entry. It didn't take that long, since he already has one. Under his real name it appears.
From that wikipedia entry:

The last known email address for Kuvayev, under his alias, was domains@locu.st.

If that brings any joy for your revenge.
More on Leo Kuvayev / BadCow owned domains.
European spam wiki puts

Russian/American spammer, a spin-off or occasional partner with Alan Ralsky, Igabromiv, Lindsay and also the P/A/Y gang.
Does "OEM CD" pirated software spam, child and animal porn spam, porn payment collection, pharma/pills, phishing, and others. Does his own DNS, possibly does DNS for other spammers. Buys bulletproof hosting wherever he can get it. Noted for enormous numbers of domains (bogus registration info, of course), often rotating every three hours in the spam to avoid URIBL filters. Mails via proxies using the usual spamwares, probably off his own (leased) servers. Noted for having "fresh" peas, meaning he is very close to the botnet masters collecting new, unlisted, zombie IPs. Was part of Sun Network spamhaus on MCI, gets BP hosting in Brazil, China, Russia, etc.

Loan spammers - onlycghjguff.com

2007-03-14T14:44:00.000-07:00

From: preemption@guadalupano.com
Subject: Reduce your current loan rate!
Date: April 14, 2007 3:11:19 PM GMT+01:00
To: [some other email]
Return-Path:
Received: [..] from AAnnecy-157-1-132-158.w90-14.abo.wanadoo.fr (aannecy-157-1-132-158.w90-14.abo.wanadoo.fr [90.14.51.158]) by mac.com (Xserve/smtpin27/MantshX 4.0) with SMTP id l2EED2ci006049; Wed, 14 Mar 2007 07:13:03 -0700 (PDT)
Message-Id: <28384979.44116607@debut.com>

Hello!
We are glad to inform you about the way to save your money!
This way is so simple that you will be surprised! What is it, you wonder?
Stop overpaying mortgage rates!
You will save over 250 dollars a month by reducing your current loan.
You are only to fill the form which will take you 30 second.
It is a winning game!
http://onlycghjguff.com/
With deepest respect and best wishes,

Of which whois :

Domain Name: onlycghjguff.com
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET

Registrant Contact
Name: Gary Reed
Address: 3495 Cambie street
150
Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695
Administrative Contact
Name: Gary Reed
Address: 3495 Cambie street
150 Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695
Technical Contact
Name: Gary Reed
Address: 3495 Cambie street
150 Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695

Cinemium.com - TCF bank scammers

2007-03-14T14:37:00.000-07:00

From: onlinebanking.alert@tcfbank.com
Subject: Online Banking Security Notification
Date: March 12, 2007 3:01:58 PM GMT+00:00
To: [my email]
Return-Path:
Received: [..] (from leppink@localhost)by lsh101.ams.nl.siteprotect.com (8.11.6/8.11.6) id l2CF1wE25257; Mon, 12 Mar 2007 16:01:58 +0100
Message-Id: <200703121501.l2CF1wE25257@lsh101.ams.nl.siteprotect.com>

Dear TCF Express Bank Customer,

Security Precaution For optimal viewing of the TCF Express Bank Web site, we recommend that you enable CSS. For your security, we have temporarily prevented access to your account. TCF Express Bank safeguards your account when there is a possibility that someone other than you is signing on. You may be getting this message because someone is signing on from a different location or device. In this case, your access may be restored when you return to your normal sign on method. You are required to log on your account information via the link below to secure your account details. Thank you for helping us protect your account..

http://www.tcfbank.com/secure/view/online/statement/ssl.cfm

Regards,
TCF Express Bank Online Service.

Of which whois :

http://www.cinemenium.com/news/userr/tcf/index.htm/
Domain Name: CINEMENIUM.COM
Registrar: NETWORK SOLUTIONS, LLC.

Registrant:
gottoseeit.com
14404 N. 15th Pl.
Phoenix, AZ 85022
US
Domain Name: CINEMENIUM.COM
Administrative Contact, Technical Contact:
Demetrian, Ovi ovi@HOME.COM
aBSOLUTE sOUND SySTEMs
6819 N. 12th st. #15
Phoenix, AZ 85014
US
(602) 230-7122

Another lottery scam - 500,000 US $ Euros

2007-03-12T01:13:00.000-07:00

My favorite part of this scam :
Prize Amount: US $500,000 Five Hundred Thousand Euros Only - I have never seen US $ Euros in my life so far ....

From: worldsoftware23@aim.com
Subject: CONGRATULATIONS!!! YOU HAVE WON
Date: March 12, 2007 5:18:25 AM GMT+00:00
To: My email address
Reply-To: worldsoftware23@aim.com

Lottery Group: Consolation Prize Group
Prize Amount: US $500,000 Five Hundred Thousand Euros Only
You are required to file claims for your lottery prize winning by contacting the Lottery
Claims Processing Officer with your winning information provided above.
Lottery Claims Officer:
Name: Mr. KENNETH HOORT
Email: worldsoftware23@aim.com
Tel: +31-616248143
Fax: +31847520588
Congratulations once again from all our staffs on your consolation prize winning, we hope you will partake in our forth coming world software Lotto-Wheel
Email-games.
Provided in attachment is a Non resident claims form you are required to completely fill the claims form with your correct information and submit same.
We look forward to receive receipt of your information.
===============================================================================
NON-RESIDENT AWARD CLAIM FORM GG
==============================================================================
FULLNAME:....................................................................
FORWARDING ADDRESSE:.........................................................
CITY/STATE:.......................
COUNTRY OF ORIGIN:.......................
MARITAL STATUS:.....................
NATIONALITY..............
SEX...........
PASSPORT NR:..................
DATE OF BIRTH:.................
TEL/FAX NR: .........................
OCCUPATION:..........................
CURRENT EMAIL:............................
================================================================================================
WINNING INFORMATION
================================================================================================
COUPON NR:..................................
LOTTERY REF NR:..................
LOTTERY DATE:..................
CLAIMANT
SIGNATURE:...........................
================================================================================
Yours truly,
Mr. Mirrel Smith,
(Lottery Coordinator)

American Axle & Manufacturing, aam.com

2007-03-07T13:43:00.000-08:00

From: american_axlemanufacturing6@yahoo.com
Subject: From American Axle & Manufacturing
Date: March 7, 2007 10:10:35 AM GMT+00:00
To: american_axlemanufacturing@yahoo.com
Reply-To: american_axlemanufacturing@yahoo.com
Return-Path:
Received: [..] Message-Id: <20070307101035.19798.qmail@web63008.mail.re1.yahoo.com>
X-Brightmail-Tracker: AAAAAQAAA+k=
X-Language-Identified: TRUE
Original-Recipient: [my email]

American Axle & Manufacturing,Company
One Dauch Drive
Detroit, MI 48211-1198
www.aam.com

ATTN;Sir,
I know that this E-mail will be a surprise to you, but I got your mail through Internet. I am Richard Jefferson the secretary to the chairman of American Axle & Manufacturing Company; we deal on, engineering, validation and manufacture of driveline systems, chassis systems, and forged products for trucks, buses, sport utility vehicles, and passenger cars.

We are interested in opening a branch in your country and I want to confirm from you if we can get 58 (Fifty Eight Acre’s) of land for our new site.We need three good warehouses where we can store our machines and two complete building duplex, at least for temporary office until we finish our main site.

However, the company will like to make you the African representative. You can send your contact number. Please if you can do that, contact me immediately through my mail address.
Thanks And Kind Regards

Richard Jefferson Secretary
To Richard E. Dauch .
Co-Founder, Chairman & CEO
American Axle & Manufacturing

Of which : aam.com ->

Referral URL: http://www.ebrandsecure.com
AAM.COM
Language:
Created: 4/10/2006 10:04:00 AM
Updated: 4/10/2006 10:04:00 AM
Expires: 9/10/2007 12:00:00 AM

American Axle & Manufacturing (JHSG2G4L7)
Administrative Contact:
American Axle & Manufacturing (JHSG2G4L7)
1840 Holbrook Ave.
Detroit, MI 48212
United States
Phone: +1.3139742399 Fax: +1.3139742848
E-Mail: friedmg@AAM.COM
Updated: 4/10/2006 10:04:00 AM
Created: 3/28/2006 7:20:00 AM

Billing Contact:
ccTLD @ Billing (AY6B2QT4V)
CSC Corporate Domains Inc
PO Box 597
Yarmouth, Nova Scotia B5A 4B4
Canada
Phone: +1.9027465201 Fax: +1.4137238334
E-Mail: cctld-billing@cscinfo.com
Updated: 1/11/2007 12:20:00 PM
Created: 8/12/2004 11:13:00 AM

Technical Contact:
EDS @ NNAM (0DL6KK1HM)
5400 Legacy Drive
Plano, TX 75024
United States
Phone: +1.2482655000 Fax: +1.1231231234
E-Mail: dnsmaster@eds.com
Updated: 4/10/2006 10:04:00 AM
Created: 3/28/2006 7:21:00 AM

Medicine spam - ceasarrare.com

2007-03-02T17:03:00.000-08:00

From: reemphasizesblanching@protectfrogs.com
Subject: Don't know where to buy medications?
Date: March 2, 2007 8:52:51 PM GMT+00:00
To: [someone else's email]
Return-Path:
Received: [..] 66.249.83.27 (HELO ASPMX5.GOOGLEMAIL.com) by ispwith esmtp (1?IL-J<00>K1 +X3JT) id *2@0D*-R@@(LB-V= for [email]; Sat, 03 Mar 2007 00:52:51 +0400
Message-Id: <01c75d2e$451dd410$6c822ecf@reemphasizesblanching>
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.2663
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01C75CFB.FA836410"
Thread-Index: Aca6Q6+47R*F,05L4+X7-N*2X*96)U==

Dear valued member!

We are writing to inform you about the result of the recent research concerning the quality of the drugs sold on the Internet.

Not all the meds offered in numerous Web pharmacies are as qualitative as you might wish them to be. According to the results of the official research made by our Association only one (USDrugs) out of 46 online drugstores analyzed offers drugs of true generic quality.

Remember! Taking generic drugs you will secure yourself against poisoning!

Click here to learn more.

With Best Regards, Pierre Clarke
USDrugs B.V.
http://www.ceasarrare.com/

Of which whois :

Referral URL: http://www.dotregistrar.com
Registrant, administrative, technical contact :
Icek Pankovich (CEASARRARE-COM-DOM)
Sos. Mihai Bravu,No. 5
Bl. 4, Entr. 4, Apt. 9
Bucuresti, Sector 2 76101
Romania
+040.0212516407
+040.0212516407
icek_pankovich@yahoo.com

Domain servers in listed order:
Name Server: ns1.tonsilsbot.com
Name Server: ns2.groupron.com
Name Server: ns1.belikeyous.com

And a second "auditor" of Bank of Scotland in one day

2007-03-02T05:08:00.000-08:00

X-Apparently-To: [my email]
X-Originating-IP: [212.216.176.109]
Return-Path:
Authentication-Results: mta246.mail.mud.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: ... from pswm13.cp.tin.it (192.168.70.37) by vsmtp21.tin.it (7.2.072.1) id 45D4389D0024FD02; Fri, 2 Mar 2007 04:30:34 +0100
Message-ID: <11110b2ef9d.wills008@virgilio.it>
Date: Fri, 2 Mar 2007 04:30:34 +0100 (GMT+01:00)
From: "Mr.Larry Bodricks" Add to Address Book Add Mobile Alert
Reply-to: mrlarry_bodricks2@yahoo.co.uk
Subject: From Mr.Larry Bodricks/Business Relationship
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 195.175.37.71

From Mr.Larry Bodricks/Business Relationship

I am contacting you
individually for a business transaction involving GBP £30 Million and I
hope that you will contact me at your earliest convenient for this
possible business transaction.

I am the Auditor General, and Chairman,
Audit Committee of Bank of Scotland, with your sincere assistant and
co-
operation,I have determined to work this deal with you if you can do
the business.

At the moment,I am constrained to issue more details
about this business until your positive response is received.

Please
take a moment of your time schedules to read this and send your
response or better call me with this mobile number : +44 704 57 06187
for further information concerning this transaction.

I assure you that
this deal is worth taking and highly profitable.

Thank you for your
time and attention.
Yours truly,
........................
Mr. Larry
Bodricks,
Auditor General,
Bank Of Scotland Plc.
Tel: +44 704 57 06187
Email: mrlarry_bodricks3@yahoo.co.uk

Wow. Another Bank of Scotland auditor general and chairman who is offering me to transfer 30 million UK pounds to my account within one day.
Neither of these guys is using their bankofscotland.co.uk email address. Both use a mobile phone number, not even a landline. Same mobile phone number even.
I think the Bank of Scotland might be interested in these scam attempts .. if I get a third one today, I will do something about it.

Mr Hobson - Bank of Scotland scam try

2007-03-02T04:51:00.000-08:00

X-Apparently-To: [my email] via 206.190.48.154; Thu, 01 Mar 2007 22:18:41 -0800
X-Originating-IP: [212.216.176.109]
Return-Path:
Authentication-Results: mta240.mail.re3.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: [..[ from pswm13.cp.tin.it (192.168.70.37) by vsmtp21.tin.it (7.2.072.1) id 45D4389D00253205; Fri, 2 Mar 2007 07:13:02 +0100
Message-ID: <1111147afca.johnsonsaka@virgilio.it>
Date: Fri, 2 Mar 2007 07:13:02 +0100 (GMT+01:00)
From: "Mr. Anthony Hobson"
Reply-to: mrhobson1111@yahoo.co.uk
Subject: Goodday/Call me
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 195.175.37.71

Goodday/Call me

I am contacting you individually for a business
transaction involving transfer of GBP £30 Million and hope that you
will reply back at your convenient time for this possible business
transaction.

I am the Auditor General, and Chairman, Audit Committee
of Bank of Scotland, with your sincere assistant and co-operation,I
have determined to work this deal with you if you can do the business.

At the moment,I am constrained to issue more details about this
business until your positive response is received.

Please take a
moment of your time schedules to read this and send your response via
mrhobson2222@yahoo.co.uk or call me with this mobile number : +44 704
570 6187 for further information concerning this transaction.

I assure
you that this deal is worth taking and highly profitable.

Thank you
for your time and attention.

Yours truly,
........................
Mr. Anthony Hobson,
Auditor General,
Bank Of Scotland Plc.
Tel: +44 704
570 6187
Email: mrhobson2222@yahoo.co.uk

The originating IP address is in Washington, USA.
The email address used indicates faking to be in Italy.
If you actually were from Bank of Scotland, why would you use an Italian / yahoo UK address and not your bankofscotland.co.uk email address? And why on earth would you have a mobile phone number only, Mf Hobson?

InstantQuotes aka Jalbabyfood.com - loan spams

2007-03-02T04:17:00.000-08:00

From: esprit@access-one.com
Subject: Re: loan request
Date: March 1, 2007 5:55:35 PM GMT+00:00
To: [somebody else's email than mine address listed]

Shop hundreds of lenders...
..with just ONE click!
Step 1... Answer a few questions
Step 2... Lenders compete for your business
Step 3... See how much YOU can save!

Refinance NOW while rates are still low. You could save Hundreds per month!

There is no obligation and this is a FREE quote!
• Debt Consolidation
• Home Improvement
• Refinancing
• Second Mortgage
• Equity Line of Credit

Please visit http://jalbabyfood.com/ for short application

Of which

Domain Name: jalbabyfood.com
Registrar: THE NAME IT CORPORATION DBA
NAMESERVICES.NET

Registrant, Administrative, Technical Contact:
Name: Gary Reed
Address: 3495 Cambie street
150 Vancouver, BC V5Z 4R3, CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695

Once visited that website, it shows some fancy text and graphics for being spam-can compliant .. well - I have never in my life asked to get ANY loan quotes. That means I don't care for "remove me" when I don't want to get them in the first place.
This "Jalbabyfoods.com" aka "InstantQuotes" does also not have any kind of about them. Very reassuring.

Felicia Samson - UK millionaire scamming from CHARITIES

2007-03-02T04:15:00.000-08:00

Another less than credible one ...
A female millionaire in London who is offering 20 $ of her millions of dollars that she does not want to give to CHARITIES because she has a cancer. If she had millions of pounds, she'd be dumb to waste away spamming unknown people when she could just cure herself.

From: fciasaonm@rediffmail.com
Subject: can i trust you ?
Date: February 21, 2007 7:39:08 PM GMT+00:00
To: fciasaonm@rediffmail.com
Return-Path:
Received: [...] (qmail 10952 invoked by uid 510); Wed, 21 Feb 2007 19:39:08 +0000 [..]
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=redf; d=rediffmail.com; b=d+HtN1XoiglkoGgr/3LWWpCdJj4H/ZLZDFu8S+1ju7rmx9NMeAO3NgIsuoPkseddxd/A3qdgoc9yVHtUbT9k7fp04qFtpNM06FPIvXMha3AQSLjx2I494IctU9kAK4iaFOXjxKOa8HzNsCqHQPu8TLp4wEAX5uk7SUBGJfjig1s= ;
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]

Hello,

You may be surprised to receive this mail, as you read this, don't feel so sorry for me because I know everyone will die someday.

My name is Mrs. Felicia Samson, a business woman in London. I have been diagnosed with esophageal cancer which was discovered very late due to my laxity in caring for my health. It has defiled all forms of medication right now and I have only few hours left to live, according to medical experts. I have never particularly lived my life so well as I never really cared for anyone not even me but my business. Though I am very rich, but I was never generous, I was always hostile to people and I only focus on my business as that was the only thing I cared for in my life. But now I regret all this as I now know that there is more to life than just wanting to have or make all the money in the world. I believed when God gives me a second chance to come to this world I would live my life in a different way from how I have lived now, but now tha God has called me through this way I willed most of my properties and access to my immediate and extended family and as well as few close friends.

I want God to be merciful to me and accept my soul and so with that reason I decided to give alms to CHARITY ORGANISATIONS, as I want this to be one of the last good deed I did on earth, so far I have distributed money to some Charity Organization in countries like India and Africa. Now that my health has deteriorated so badly, I cannot do this myself anymore.

I once asked my family members to close one of my accounts and distribute the funds which I have there to CHARITY ORGANSATION in Rwanda and Pakistan; they refused and kept the money to themselves. Hence, I do not trust them anymore, as they seem not to be contended with what I have left for them. The last of the funds which no one knows of, is the cash deposit in one of the banks here. I want to know if you can be of good help to dispatch these funds to CHARITY organizati ns. I have set aside 20% of the total amount $1,500,000.00 One million five hundred thousand dollars) for you and your time and patience for carrying out this duties. This means you will keep $300,000 (three hundred thousand dollars) for yourself and donate the rest to any charity organisation. May God be with you as you have decided to take a bold step to heal the world with me or even in my demise. I am going in for an operation now, and I don’t think I will make it. And this hurts.

If you can give me this assistance, you can then contact my lawyer who will assist you in getting the funds to you in my absence if i die or not. He would give you more details. His name is Barr. Harry Wesley and his email address is: ( barrhwesleyy@aim.com ) He would guide you through receiving the funds.

Best Regards,
Felicia Samson

Greatfred.info - medicine spam

2007-02-08T11:51:00.000-08:00

From: plpzg@bluegoldusa.every1.net, plpzg@bluegoldusa.every1.net
Subject: Your doc thinks you`re millionaire? Natalia
Date: February 8, 2007 7:43:58 PM GMT+00:00
To: [a list of email addresses]
Return-Path:
Received: [..] from cpe-76-80-71-122.socal.res.rr.com (cpe-76-80-71-122.socal.res.rr.com [76.80.71.122]) by is[ (Xserve/smtpin70/MantshX 4.0) with SMTP id l18Ji0iO005072; Thu, 08 Feb 2007 11:44:18 -0800 (PST)
Received: from 67.72.99.371 (mta013.discoweasel.com) (67.72.99.371) by rly89.mail.buildtraffic.com with ESMTP; Thu, 08 Feb 2007 19:43:58 +0000
Received: (qmail 3124 invoked by alias); Thu, 08 Feb 2007 19:43:58 +0000
Message-Id: <889371059702869qoc0lqu5jj4.4484544454494.Mail.news@comparison.obtrusive.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Domainkey-Signature: a=wcv-oxt1; q=dns; c=ousnt; s=s6904; d=z2c.net; b=in7PlxTzxLq8PAXRKgcfIZ4yCdBPKok8MxUhzWl31RWXsdKChh/Sgl7j0a5yRcIHdflS7r23nrJxXytDkoebxG2lDLcS5blEN8bIgwC1isnleaauzJZh2byLK+yzGTDdA7SKDa0VrivTMKtfiNypatSX=
X-Mpm: 889371059702869qoc0lqu5jj4
Original-Recipient: [my email]

Xanax and other drugs with wholesale prices.

You wont find better prices anywhere!

Cialis
Viagra - 150 Pills - 269$
Valium - 180 Pills - 370$

Xanax - 60 Pills - 199$
Ambien - 60 Pills - 190$
Ultram - 60 PilIs - 85$
Soma - 80 Pills - 79$

Please click below and check out our offer.

http://greatfred.info

Of which whois :

Domain Name:GREATFRED.INFO
Created On:15-Jan-2007 14:03:48 UTC
Last Updated On:06-Feb-2007 07:09:50 UTC
Expiration Date:15-Jan-2008 14:03:48 UTC
Sponsoring Registrar:eNom, Inc. (R126-LRMS)
Status:TRANSFER PROHIBITED
Registrant ID:ADC74A16CB8F5749
Registrant Name:Lew Knox
Registrant Organization:
Registrant Street1:23482 Peralta Suite # E
Registrant Street2:
Registrant Street3:
Registrant City:Laguna Hills
Registrant State/Province:CA
Registrant Postal Code:92653
Registrant Country:US
Registrant Phone:+1.9498595924
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:fredgarz@yahoo.com
Admin ID:ADC74A16CB8F5749
Admin Name:Lew Knox
Admin, Billing, and Tech information the exact same. fredgarz@yahoo.com

Lochers.com - underwear spammers with cmpgnr.com

2007-02-08T11:29:00.000-08:00

From: info@lochers.com
Subject: Locher's New Darling Collection
Date: February 8, 2007 6:49:07 PM GMT+00:00
To: [my email]
Reply-To: Lochers_yyyvwv@cmpgnr.com
Return-Path:
Received: [...] from mta16br.cmpgnr.com (mta16br.cmpgnr.com [216.24.227.16]) by [isp] (Xserve/smtpin60/MantshX 4.0) with SMTP id l18Im31u005587for ; Thu, 08 Feb 2007 10:48:03 -0800 (PST)
Errors-To: gotb889308_888565_702191_931354833@cmpgnr.com
Message-Id: <1700222.1170960547062.KadaSegment.156.1@mta16br.cmpgnr.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_429433_18707296.1170960547062"
Bounces-To: somrandomnumbers@cmpgnr.com
X-Campaign: 889308.888565.702191.931354833
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]

Just in time for Fashion Week in Paris, Locher's launches their new darling embroidery collection featuring tops embroidered with delicate flowers and "nasty sayings", (perfect for Valentine's Day, gift certificates also available).

The entire collection of 16 tops plus accessories is available online at http://www.lochers.com The photo shoot for this collection was shot by frequent Italian Vogue photographer Amedeo Volpe.
It would be surely nice to have you visit.
Bisous from Nicole

You are subscribed as [my email]. To unsubscribe please click here. (had a link to www.cmpgnr.com/ something)

Umh, what?
No, I have not subscribed to lochers.com. I'm not interested in women's underwear spamlist subscriptions. So let's see a bit further.

Domain Name.......... lochers.com
Creation Date........ 2004-06-10
Registration Date.... 2004-06-10
Expiry Date.......... 2007-06-10
Organisation Name.... Nicole Locher
Organisation Address. 188 rue championnet #122
Organisation Address.
Organisation Address. paris
Organisation Address. 75018
Organisation Address. TX
Organisation Address. FRANCE
Admin Name........... Nicole Locher
Admin Address........ 188 rue championnet #122
Admin Address........
Admin Address........ paris
Admin Address........ 75018
Admin Address........ TX
Admin Address........ FRANCE
Admin Email.......... unagidesign@yahoo.com
Admin Phone.......... +1.0698779484
Admin Fax............
Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax.............
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com

So wait ... Paris, TX, or Paris, France?
The address is invalid.
The phone number is invalid for at least being in France.

Second part, whois for this remove me-something part :

Registrant:
Got Corporation Inc.
685 Cathcart Street
Suite 300
Montreal, Quebec H3B 1M7
Canada
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: CMPGNR.COM
Created on: 04-Oct-06
Expires on: 04-Oct-08
Last Updated on:

Administrative Contact:
Saibil, Jeremy it@gotcorp.com
Got Corporation Inc.
685 Cathcart Street
Suite 300
Montreal, Quebec H3B 1M7
Canada
5142820595 Fax -- 5142821908
Technical Contact:
Saibil, Jeremy it@gotcorp.com
Got Corporation Inc.
685 Cathcart Street
Suite 300
Montreal, Quebec H3B 1M7
Canada
5142820595 Fax -- 5142821908
Domain servers in listed order:
NS1.FST-DNS.ORG
NS2.FST-DNS.ORG
NS1.CAMPAIGNER.COM

Some companies don't just seem to get that faking that people would have subscribed to their spamlists is rude. Whatever rude would be in French.

French bank scam

2007-02-07T08:55:00.001-08:00

Ah ah.
One more bank scam.
This time ah so European version.
Oh I'm a French bank this and that and I want to offer you 15 million UK pounds, just nevermind that my IP is Italy, and you want me to anser to a Polish email addy, not your work email address.
So we just found this random Gerard Stone that is a relative of yours so do you want to get all this free money?
Free money, sounds all good doesn't it?

X-Apparently-To: [my email] via 206.190.48.158; Wed, 07 Feb 2007 01:11:27 -0800
X-Originating-IP: [212.216.176.223] [that IP resides in Arese, Lombardia, Italy]
Return-Path:
Authentication-Results: mta332.mail.re4.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: from 212.216.176.223 (EHLO vsmtp3.tin.it) (212.216.176.223) by mta332.mail.re4.yahoo.com with SMTP; Wed, 07 Feb 2007 01:11:22 -0800
Received: from pswm3.cp.tin.it (192.168.70.17) by vsmtp3.tin.it (7.2.072.1) id 45ACADE60045A30C; Wed, 7 Feb 2007 10:11:12 +0100
Message-ID: <1109b788a4a.b13_richard@virgilio.it>
Date: Wed, 7 Feb 2007 10:11:12 +0100 (GMT+01:00)
From: "Mr Richard"
Reply-to: bob_richard@o2.pl
Subject: From Richard
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 86.62.6.162
Content-Length: 790

Dear,
Do accept my sincere apologies if my mail does not meet your
personal ethics.I introduce myself as Richard a staff in the accounts
management Section of a well-known bank here in France.One of our
foreign accounts with holding balance of £15,000,000(Fifteen Million
British Pounds) has been dormant and last operated in the past 5 years.
From my investigations and confirmations, the owner of this account is
a Foreigner by name Gerald Stone died on the 4th of January 2002 on a
planecrash in Birmingham faraway United Kingdom.Since then nobody has
done anything as regards the claiming of this moneyas he has no family
Member who is aware of the existence of either the account nor the
Funds.Information from the National Immigration also states that he was
single on entry into France.I have confidentially discussed this issue
with some of the bank officials and we have agreed to find a reliable
foreign partner to deal with. We thus propose to do business with you,
standing in as the next of kin of the deceased and have the funds
released to you after due processes have been followed.This transaction
is totally free of risk and troubles as the fund is Legitimate and does
not originate from drug, money laundry, terrorism or any othe rIllegal
act.On your interest, let me hear from you.
Regards,
Mr Richard

Private Urgent Message from Citibank

2007-02-05T09:26:00.000-08:00

How urgent can it be? I don't even have an account at them.

The link went to http://www.citi.com.globalportal.id2508058396.cpurn.biz/app instead.

Of which whois :

Domain Name: CPURN.BIZ
Domain ID: D16251490-BIZ
Sponsoring Registrar: MONIKER ONLINE SERVICES, LLC
Sponsoring Registrar IANA ID: 228
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant ID: MONIKER344946
Registrant Name: hostmaster
Registrant Organization: Domain Park Limited
Registrant Address1: Vaea Street
Registrant Address2: Level 2, Lotemau Centre
Registrant City: Apia
Registrant State/Province: Samoa
Registrant Postal Code: 0815
Registrant Country: Samoa
Registrant Country Code: WS
Registrant Phone Number: +42.0603822657
Registrant Email: hostmaster@domainparkltd.com
Administrative Contact ID: MONIKER344946

Citibank's report fraudulent and suspicious emails instructions. Needless to say, they got some email ...

Mr John Michael - 419 once in a while

2007-02-05T04:38:00.000-08:00

How weird. Mr Businessman who is now emailing me that he has stored my $ 750,000 that are ready for me .. is 1) using a hotmail address, not his work address, 2) my name is not in the To : field .. last time I checked my name wasn't "undisclosed-recipients", and 3) for some reason, the work email's spam filters didn't catch this. Oh, and his secretary has a walla.com email address instead of a professional one. Or is it maybe that the only time I have ever seen anyone use any walla.com email address is for professional African scammers?

From: jmmichael19@hotmail.com
Subject: COMPENSATION
Date: February 3, 2007 11:31:08 AM GMT+00:00
To: undisclosed-recipients: ;
Reply-To: jnmichael007@yahoo.com
Return-Path:
Received: [...]
Received: from hotmail.com ([65.54.162.47]) by bay0-omc3-s20.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sat, 03 Feb 2007 03:31:12 -0800
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Sat, 03 Feb 2007 03:31:12 -0800
Received: from 65.54.162.200 by by108fd.bay108.hotmail.msn.com with HTTP; Sat, 03 Feb 2007 11:31:08 +0000 (GMT)
X-Originating-Ip: [196.29.120.70]
X-Sender: jmmichael19@hotmail.com
Message-Id:
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-Auditid: 1148853b-acc1abb00000638b-2b-45c47281fc09
X-Originating-Email: [jmmichael19@hotmail.com]
X-Brightmail-Tracker: AAAAAA==
Original-Recipient: [my email]
X-Originalarrivaltime: 03 Feb 2007 11:31:12.0417 (UTC) FILETIME=[CECE6110:01C74786]

Dear Friend,

I'm happy to inform you about my success in getting those Funds transferred under the cooperation of a new partner from Trinidad and Tobago. Presently I'm in Switzerland for investment Projects with my own share of the total sum. Meanwhile, I didn't forget your past efforts and attempts to assist me in transferring those funds despite that it failed us some how.

Now contact my confidential secretary, his name is Mr. George Okoye on this e-mail address:- secretary_sgeorge@walla.com ask him to send you the total of USD$750,000.00 which I kept for your compensation for all the past efforts and attempts to assist me in this matter in the past. I appreciated your efforts at that time very much. So feel free and get in touch with my secretary Mr. George Okoye and instruct him where to send the amount to you.

Please do let me know immediately you receive it so that we can share the joy after all the sufferness at that time. In the moment, I am very busy here because of the Investment projects which me and the new partner are having at hand. Finally, Remember that I had forwarded instruction to the secretary on your behalf to receive that money, so feel free to get in touch with Mr. George Okoye, he will send the amount to you without any delay.

Regards,
Mr. John Michael.

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

Alex Rodrigez - how long until he gets a Wikipedia entry?

2007-02-04T13:00:00.000-08:00

Someone found be searching for Alex Rodrigez some time ago.
Interesting.
Also interesting to find a blog with the same interests than mine, where of course I found some sites of this Alex Rodrigez again. (Except what I have noticed Mr Rodrigez more for is Mac software .. not just Office).
Since he seems to be quite famous .. I wonder how long before someone bothers to make a wikipedia entry for him?

Russian "Euro" casino, Eucas.org ..

2007-02-04T12:41:00.000-08:00

Now I must admit I'm not used to casino ads. I've been getting them slowly every now and then .. and I kind of feel I shouldn't bother to give these ones a label - that would prove they are worth something. Maybe the casino owners weren't or aren't that bad themselves? But they send spam. Or pay someone else to send spam. And that is enough to really annoy me.

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs114525qbf;
Fri, 2 Feb 2007 23:07:39 -0800 (PST)
Received: by 10.35.84.16 with SMTP id m16mr8501297pyl.1170486459919;
Fri, 02 Feb 2007 23:07:39 -0800 (PST)
Return-Path:
Received: from c-24-125-1-11.hsd1.va.comcast.net (c-24-125-1-11.hsd1.va.comcast.net [24.125.1.11])
by isp with ESMTP id 6si20143323nzn.2007.02.02.23.07.39;
Fri, 02 Feb 2007 23:07:39 -0800 (PST)
Received-SPF: pass (isp: domain of hslohnu@comcast.net designates 24.125.1.11 as permitted sender)
From: "Kasparov Chessmate"
To: [my email]
Subject: Fun and make money.
Date: Sat, 3 Feb 2007 02:07:38 +0500
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0000_01C74738.14045F40"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: AcdHOBQEyuj3lA1ISnOABPe4yNeWTA==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
Message-Id:

Only from the most noble of all
casinos you could except such a Regal gift:

300% Bonus on your First Deposit!!!

Deposit 100 €/$ and Play with 400 €/$!!!
And on top of that, a service at such a
level you would not find in the best
Royal Families of Europe.

<<<<< Come and play at Royal VIP Casino!!! >>>>> then link

Of where the link goes to we get with whois :

Domain ID:D138238728-LROR
Domain Name:EUCAS.ORG
Created On:26-Jan-2007 12:46:22 UTC
Last Updated On:02-Feb-2007 19:15:56 UTC
Expiration Date:26-Jan-2008 12:46:22 UTC
Sponsoring Registrar:OnlineNIC Inc. (R64-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:ONLC-2572694-4
Registrant Name:Sergey Ivanov
Registrant Organization:Personal Domens
Registrant Street1:Russia, Mikhailova st, 22-22
Registrant Street2:
Registrant Street3:
Registrant City:Moscow
Registrant State/Province:MO
Registrant Postal Code:109456
Registrant Country:RU
Registrant Phone:+7.4955184040
Registrant Phone Ext.:
Registrant FAX:+7.4955184040
Registrant FAX Ext.:
Registrant Email:maddreams2005@yandex.ru
Admin ID:ONLC-2572694-1
Admin Name:Sergey Ivanov
Admin Organization:Personal Domens
Admin Street1:Russia, Mikhailova st, 22-22
Admin Street2:
Admin Street3:
Admin City:Moscow
Admin State/Province:MO
Admin Postal Code:109456
Admin Country:RU
Admin Phone:+7.4955184040
Admin Phone Ext.:
Admin FAX:+7.4955184040
Admin FAX Ext.:
Admin Email:maddreams2005@yandex.ru
Tech ID:ONLC-2572694-2
Tech Name:Sergey Ivanov
Tech Organization:Personal Domens
Tech Street1:Russia, Mikhailova st, 22-22
Tech Street2:
Tech Street3:
Tech City:Moscow
Tech State/Province:MO
Tech Postal Code:109456
Tech Country:RU
Tech Phone:+7.4955184040
Tech Phone Ext.:
Tech FAX:+7.4955184040
Tech FAX Ext.:
Tech Email:maddreams2005@yandex.ru
Name Server:NS2.NSSERVISRU.RU
Name Server:NS3.NSSERVISRU.RU

Eucas? The last time I checked, Russia wasn't part of EU ...
And the name Sergey Ivanov is a bit boring but at least we get a few other spam related stuff with google for it.

Another retro sex spam - herbal-kings.com

2007-02-04T12:27:00.000-08:00

Another retro sexual enhancement spam ...
The text is so bad .. really, do any guys believe claims like that??
(For once without full headers since for once I am entertained just by the stupidity of the texts)

From: Haydon
To: [my email]
Date: Jan 6, 2007 8:22 PM
Subject: FWD[82]:

Our Penis Enlargement Pills Will Expand, Lengthen And Enlarge Your Penis Up to 3+ Inches. 100% Satisfaction Guaranteed! Or Your Money Back!

Our team of expert Doctors have spent years developing a product that will safely and effectively add length, width, and strength to any man's penis. The work has created a product that has been shown to significantly increase penis length, provide stronger erections, improve sexual endurance, and increase ejaculation volume. ManXL has been labeled a "Medical Breakthrough" with over 1,500,000 bottles sold worldwide. ManXL is the only penis enlargement pill that has been manufactured in a FDA Approved laboratory.

click here >>>>> (with link)

Ha. Now if this ManXL was a medical breakthrough, you'd think it would have become as famous as all these viagras and cialis. And it probably would have been sold and produced by a pharmaceutical company, not by some herbal-kings.com ...
Hm.. also, if it was approved by FDA, why would the registrants be located in Mexico?

Whois :

Referral URL: http://www.joker.com
domain: herbal-kings.com
owner: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: admin@querendamx.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187
fax: +52.443655187
admin-c: CCOM-477954 admin@querendamx.com
tech-c: CCOM-477954 admin@querendamx.com
billing-c: CCOM-477954 admin@querendamx.com
nserver: ns1.main-dns3.com 59.188.23.77
nserver: ns2.main-dns3.com 218.188.64.134
nserver: ns3.main-dns3.com 210.245.160.139
status: lock
created: 2007-01-06 05:20:40 UTC
modified: 2007-01-23 07:23:16 UTC
expires: 2008-01-06 05:20:40 UTC

contact-hdl: CCOM-477954
person: Eduardo Macias
organization: TOLMEN STAR ENTERPRISES LTD
email: admin@querendamx.com
address: Querenda No. 353, Fracc. Bosque Camelinas
city: Michoacan
postal-code: 58290
country: MX
phone: +52.443655187

Oh wait - the best part - their testimonials :

I've played on and off with pumps, weights, and exercises for the last few years and have never gained one centimeter. I recently began ManXL and was pleasantly surprised to see that this product actually works. I have been on the product 2 months now and I have already gained 1 inch. Its fantastic! My new girlfriend is really impressed with my size and stamina.
J.C. Raleigh, NC

This is going to sound weird but I was never really embarrassed of my penis size in front of my wife. However, I always wished that I was bigger and I was embarrassed of my size when I was in the locker room. I felt that guys would look at me and secretly make fun of me. With ManXL I have gained 1.5 inches and appear quite thick when flaccid. I am no longer embarrassed in the locker room and I feel that I am a solid size now. My wife also loves my new size.
P.J. Holly, MI

Men are going to stand up and clap their hands at these penis enlargement capsules. It has produced remarkable results that have never been seen before with NO negative side effects. These penis enlargement capsules offer women what they really want, more to play with! Those extra inches really do make the difference!
AngelStar - PornStar

Retro viagra and cialis spam - Progenyid.com

2007-02-04T12:12:00.000-08:00

They still spam for viagra?
Amazing but they do.
Getting some of these creative spelling viagra-cialis-spams makes me feel retro fuzzy, just as if I was using hotmail 12 years ago.
Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs22459qbf;
Wed, 31 Jan 2007 09:38:25 -0800 (PST)
Received: by 10.49.20.5 with SMTP id x5mr2879040nfi.1170265105219;
Wed, 31 Jan 2007 09:38:25 -0800 (PST)
Return-Path:
Received: from landheim-schondorf.de (p54AAEBB6.dip.t-dialin.net [84.170.235.182])
by isp with SMTP id y23si6893734nfb.2007.01.31.09.38.24;
Wed, 31 Jan 2007 09:38:25 -0800 (PST)
Received-SPF: neutral (isp: 84.170.235.182 is neither permitted nor denied by best guess record for domain of manyasum@iapdatacom.net)
Message-ID: <01c7455e$9934b880$6401a8c0@pentium4>
Reply-To: "Eutimio Pritt"
From: "Eutimio Pritt"
To: "Katsuro Morello" [my email]
Subject: Re: VIAcihGRA
Date: Wed, 31 Jan 2007 18:38:20 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Good day,

Viav_gra $1, 80
Ciav_lis $3, 00
Leviv_tra $3, 35

http://www.progenyid!.com ( Important Remove "!" )

--
You believe I didnt do it, then? said Harry, concealing with
difficulty the rush of gratitude he felt at Hagrids words.
Course I do, Hagrid grunted. Yeh say it wasn you, an I believe

So what do we get with good whois? At least the registrants phone number is invalid .. which probably should matter to dotregistrar.com if they weren't bulk domin registrants.

Referral URL: http://www.dotregistrar.com
Registrant:
arnette (PROGENYID-COM-DOM)
gibson
4271 Nw 5th
Plantation, FL 33317
USA
+332.7188767449
arnettegibson@yahoo.com
Domain Name: PROGENYID.COM
Administrative Contact:
arnette arnettegibson@yahoo.com
4271 Nw 5th
Plantation, FL 33317
USA
+332.7188767449
Technical Contact, Zone Contact:
arnette arnettegibson@yahoo.com
4271 Nw 5th
Plantation, FL 33317
USA
+332.7188767449
Record last updated on 19-Jan-2007.
Record expires on 10-Jan-2008.
Record created on 10-Jan-2007.
Domain servers in listed order:
Name Server: in.indusfk.com
Name Server: fk.indusfk.com

Exquisitereplicas

2007-02-04T12:02:00.000-08:00

I never realized the fake watches was such a big business. I considered it to be a thing of the past, a thing of the wannabe beach lions beach rolexes from the 1980s .. but they still seem to exist, and they seem to be getting more numerous. First the beautifulswiss thing, now this.
This is getting a bit boring...

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs129766qbf;
Sat, 3 Feb 2007 13:26:23 -0800 (PST)
Received: by 10.49.42.5 with SMTP id u5mr182529nfj.1170537983204;
Sat, 03 Feb 2007 13:26:23 -0800 (PST)
Return-Path:
Received: from localhost.localdomain (cpe-66-68-88-166.austin.res.rr.com [66.68.88.166])
by isp with SMTP id o45si20601923nfa.2007.02.03.13.26.18;
Sat, 03 Feb 2007 13:26:23 -0800 (PST)
Received-SPF: neutral (isp: 66.68.88.166 is neither permitted nor denied by best guess record for domain of iramey@mailbox.sk)
Message-ID: <5ba501c747d9$b6afc8b7$2621bc89@mailbox.sk>
From: Bvlgari Watches
To: [my email]
Subject: Exquisite Replica
Date: Sun, 04 Feb 2007 00:20:33 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_3D3E90D7.57FB7D65"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

QUALITY REPLICAS!

Rolex Watches
Cartier Watches
Breitling Watches
Bvlgari Watches
Omega Watches
Tag Heuer Watches
Officine Panerai Watches
A.Lange & Sohne Watches
Franck Muller Watches
Chopard watches
Hermes watches
Jacob & Co. watches

Get 25% off when buying 2 watches!

VISIT OUR ONLINE SHOP! with the link ...

Of which some whois and we have the registrant :

Domain Name: newdsannysongg.com
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET
Registrant Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Administrative Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Technical Contact
Name: paul gregoire
Address: 175 Montreal Road
304
vanier, on K1L 6E4
CA
Email Address: paulgregoire@coldmail.ca
Phone Number: (613)255-2162
Record Created on........ 2007-02-01 17:15:16.057
Expire on................ 2008-02-01 17:25:04.000
Domain servers in listed order:
ns1.hairyolddns.com
ns2.hairyolddns.com

Needless to say .. I wouldn't buy from these if I was in the market for a watch.
First - the domain exists for the past 3 days.
Second - and biggest : these people could get sued by the copyright country of any civilized and semicivilized country, probably including even Romania.
Third - wtf is it with the routings of this email? Austin, TX, or Slovakia .. for a Canadian registered site? sure. Now if only I would bother to forward the details to Bvlgari and all these other companies that would be really interested in infringing their name ...

And the first Microsoft Vista Scammers are here ..

2007-02-04T11:45:00.000-08:00

Microsoft Vista pirate scammers ... now that didn't take that long that these would start to appear, did it?

Delivered-To: [my email]
Received: by 10.64.185.8 with SMTP id i8cs140932qbf;
Sun, 4 Feb 2007 06:48:42 -0800 (PST)
Received: by 10.90.34.3 with SMTP id h3mr7634002agh.1170600522592;
Sun, 04 Feb 2007 06:48:42 -0800 (PST)
Return-Path:
Received: from 200.209.221.130 ([200.209.221.130])
by [isp] with SMTP id 8si7572771agd.2007.02.04.06.48.36;
Sun, 04 Feb 2007 06:48:42 -0800 (PST)
Received-SPF: neutral (isp: 200.209.221.130 is neither permitted nor denied by best guess record for domain of matkueuo@vinorumcodex.com)
From: "Jackie Mueller"
Reply-To: "Jackie Mueller"
Message-ID: <9700665285.3600826893@vinorumcodex.com>
Date: Sun, 4 Feb 2007 08:51:01 -0600
To: [my email]
Subject: Windows Vista Business ready to download
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

The most comprehensive edition of Windows Vista, Vista Business Upgrade (DVD-ROM) is the first operating system that combines all of the advanced infrastructure features of a business-focused operating system, all of the management and efficiency features of a mobility-focused operating system, and all of the digital entertainment features of a consumer-focused operating system. For the person who wants one operating system that is great for working from home, working on the road, and for entertainment, Vista Business is a no-compromise operating system that lets you have it all. Windows Vista Business contains a number of new features, the most notable of which are: Windows Vista Business combines all the features of a business-focused operating system, all the efficiency features of a mobility-focused operating system, and all of the digital entertainment features of a consumer-focused operating system; Remotely connect to business networks; Windows BitLocker Drive Encryptiption provides improve levels of protection against theft for your important business data whether you are at home, on the road, or in the office; Delivers all of the entertainment features available in Vista Home Premium; includes everything you need to enjoy the latest in digital photography, music, movies, analog TV, or even HDTV; Upgrade from your current edition of Microsoft Windows XP or Windows 2000 (including Windows XP Professional, Windows XP Home, Windows XP Media Center, Windows XP Tablet PC, Windows XP Professional x64, Windows 2000)
Windows Vista Business Upgrade (DVD-ROM)
Retail Price $299.00
Our Price $79.95
You save $219.05
http://juvenileoccupeble.org
Please note, that there will be more special offers available for our constant customers. Every effort has been made to ensure the accuracy of all information contained herein. DS Team makes no warranty expressed or implied with respect to accuracy of the information, including price, product editorials or product specifications. Product and manufacturer names are used only for the purpose of identification. We appreciate your cooperation with us and we'll be glad to see you as our clients in the future.

Microsoft for surely will like this. So I forwarded their piracy department the whole shabang, and meanwhile made some tracing ... So if the registrant details would be correct, these scammers would be in Bulgaria.

Domain ID:D138853446-LROR
Domain Name:JUVENILEOCCUPEBLE.ORG
Created On:03-Feb-2007 21:36:39 UTC
Last Updated On:03-Feb-2007 21:36:42 UTC
Expiration Date:03-Feb-2008 21:36:39 UTC
Sponsoring Registrar:Direct Information PVT Ltd dba PublicDomainRegistry.com (R27-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_5117152
Registrant Name:Manny Pull
Registrant Organization:Manny Pull
Registrant Street1:1u second st
Registrant Street2:
Registrant Street3:
Registrant City:Sophia
Registrant State/Province:
Registrant Postal Code:B-1050
Registrant Country:BG
Registrant Phone:+032.32653777
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:geraworkman@inbox.com
Admin ID:DI_5117152
Admin Name:Manny Pull
Admin Organization:Manny Pull
Admin Street1:1u second st
Admin Street2:
Admin Street3:
Admin City:Sophia
Admin State/Province:
Admin Postal Code:B-1050
Admin Country:BG
Admin Phone:+032.32653777
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:geraworkman@inbox.com
Tech ID:DI_5117152
Tech Name:Manny Pull
Tech Organization:Manny Pull
Tech Street1:1u second st
Tech Street2:
Tech Street3:
Tech City:Sophia
Tech State/Province:
Tech Postal Code:B-1050
Tech Country:BG
Tech Phone:+032.32653777
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:geraworkman@inbox.com
Name Server:NS1.KROLOBUL.COM
Name Server:NS2.KROLOBUL.COM
Name Server:NS3.KROLOBUL.COM
Name Server:NS4.KROLOBUL.COM
Name Server:NS5.KROLOBUL.COM

Another peculiarity that probably should be taken into account .. the URL redirects after clicking on it to http://www.pozdravloem.com/. Of which we get one of our favorite spammer and scammer bulk domain registration services, pacnames.org, and some scammer who cares for his privacy (as you see the fancy email).
Needless to say ... Microsoft Windows is not legally sold in downloadable format anywhere on this planet.

Domain name: POZDRAVLOEM.COM
Registrar: PacNames
Referral URL: http://www.pacnames.com/
Domain Registrant: (Private Contact) (pws.ad952b82efb7219@shieldedwhois.com)
Shielded Whois
Shielded WHOIS
PO Box 2076
Arvada CO 80001
US
Telephone: +1.5016348793
Fax:
Administrative, Technical Contact: (Private Contact) (pws.ad952b82efb7219@shieldedwhois.com)
Shielded Whois
Shielded WHOIS
PO Box 2076
Arvada CO 80001
US
Telephone: +1.5016348793
Fax:
Name Server: NS1.SRUL5.COM
Name Server: NS2.SRUL5.COM
Domain creation date: 2007-01-19 21:44:58.0
Domain expiration date: 2008-01-20 02:58:07.0

Amina Togar .. another African millionaire?

2007-02-04T11:05:00.000-08:00

Let me guess...
Another poor millionaire at a concentration camp with fast speed internet access, offering me millions since I am such a reliable and honest person, whom they found in the internet and trust me more than they would trust their mother...

Oh, and wait - this Liberian guy/gal who is in Senegal has for some reason an Italian IP address, close to Bergamo in the far Northern Italy, and a bit too good English.

From: amina4togar@yahoo.com
Subject: Greetings From Africa [random letters]
Date: February 4, 2007 [some time]
To: [my email]
Return-Path:
Received: [..]
Received: from mx4.hotmail.com ([196.207.197.65]) by [isp] (Xserve/smtpin18/MantshX 4.0) with ESMTP id l14FRx9S022174for ; Sun, 04 Feb 2007 10:06:40 -0800 (PST)
Message-Id: <200702041806.l14FRx9S022174@isp>
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
Content-Type: text/plain
X-Msmail-Priority: Normal
X-Spam-Flag: Suspected Spam
Original-Recipient: [email]

Hello,

I am writing you from Africa and I know you will be surprised to receieve a mail from a stranger....Please, don't be surprised...I got your contact from peoples search and decided to share an important issue with you...My name is Amina Togar and I am originally from Liberia, but do reside in Senegal...I am single, 26 years old and I would like you to spare me your time to know and discuss an important issue with you , which in my opinion will be of interest to you and hopefully, we would get to know from there....

Please confirm the receipt of this short mail and I will get back to you with a more detailed mail about myself and what I actually want to share with you....

You may reach me on yahoo messenger with the following id; amina4togar@yahoo.com or you can reply to the email above...

Thanks for your time and hope to hear from you soon...

Amina...

Great responses aol, bol and namecheap.com .. nada

2007-01-08T13:01:00.000-08:00

It has been two weeks since I first got my inboxes of email killed by the bounces of the emails sent by the spammers marketing for Beautifulswiss.net or .com.
It has been two weeks since I contacted TOSREPORTS@aol.com, abuse@bol.com.br, and support@namecheap.com. No answers, from any of them.

These beautifulswiss, fineswiss and so on people or someone they pay to do the dirty job, send these spams. My email address is still occasionally showing as the reply-to field, so the undelivered spam bounces to me. Great.

AOL have clear TOS about not using its sites for marketing illegal stuff. Even if AOL would shut down these sites that host the redirects to this site (or its clones), it's still killing them slowly, one by one ... AOL hasn't answered to any TOS report. Fantastic customer service.

Namecheap.com is the domain registrant that has something fancy in their TOS agreement ... But as if they would give a shiitake... allow bulk site registrations, and suddenly any bulk registration site doesn't really care. Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). " Or show me one bulk registration site that cares.

There we go. No answer from any of the TOS breaking and abuse complaints, and the mailboxes still get more bounced shiitake by these same people.
This gives a great image of AOL TOS reports handling people, BOL abuse, and of this bulk spam domain registrant namecheap.com.
Maybe time to write an angry letter to that Mr Maduro if the email address he used in these domain bulk registrations is even valid.
Or one day, time to just get a new email address... it is very frustrating when the address they kill by this shiitake are not the free email addresses but something you actually pay to use. The email provider, as usual, hasn't done anything more than AOL TOS reports on this ...

Beautifulswiss.com War - Part II

2006-12-26T14:09:00.001-08:00

Beautifulswiss.com War - Part I

Today 8 AM : discovery that this spammer has invaded my inbox, using my email address as his reply-to.
First spam reports and TOS violations were reported hours ago; no reply yet.

Today 9 PM :
Second round of war.
More spam on my inbox.
Again I am used as reply-to fields. F-ers.

Again as in the previous spam post, again the beautifulswiss.com domain.
This time the only difference : the spammer has used a new aol account to spam :

Message-ID: <0AB1981F.70D59CEA@mac.com>
Date: Wed, 27 Dec 2006 02:53:26 +0600
From: "King, Catherine"
User-Agent: eGroups Message Poster
MIME-Version: 1.0
To: "Daniel"
Subject: ROLEX at unbelievable prices cu
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

High Quality Rrol,x Re*lica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more re.lica watches.

http://members.aol.com/amandagld/

Their stone, nursing a baby in the paradise, wasn't tearfully wax.
Her devil, crying in the toolbox, is silently piggy.

Today around 10 PM,
my response to this last spam attack :

From: me
Subject: Fwd: Undeliverable Mail
Date: December 26, 2006 9:56:17 PM GMT+00:00
To: spam@my email provider, TOSReports@aol.com, support@namecheap.com

This spammer (http://members.aol.com/amandagld/ ) continues to abuse my email address.
My email address in the reply-to field, making me angry...

This aol account forwards to http://beautifulswiss.com/

of which whois:

Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=

Domain registrant,
TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Cheapnames.com, please deactivate.

Mac.com, please do something to help deactivate these irrelevant spam forwards.

Angrily,

ME

[with full spam and its headers followed]

Beautifulswiss.com - invading my emails means WAR

2006-12-26T14:09:00.000-08:00

Dear spammers, the fact that you use MY email address in your spams reply-to field means war.

War, 8 AM on 26 December 2006.
My inbox :

From: Postmaster@post4.tele.dk
Subject: Mail System Error - Returned Mail
Date: December 26, 2006 8:50:43 AM GMT+00:00
To: [my email]
Reply-To: Postmaster@post4.tele.dk
Return-Path: <>
Received: from mac.com (smtpin11-en2 [10.13.10.81]) by ms121.mac.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005)) with ESMTP id <0JAV005BHHXQ11@ms121.mac.com> for [my email]; Tue, 26 Dec 2006 00:51:26 -0800 (PST)
Received: from fep34.mail.dk (fep34.mail.dk [80.160.76.198]) by mac.com (Xserve/smtpin11/MantshX 4.0) with ESMTP id kBQ8oj0D023645for ; Tue, 26 Dec 2006 00:50:46 -0800 (PST)
Message-Id:
Mime-Version: 1.0
Content-Type: multipart/report; Boundary="===========================_ _= 6371765(15235)1167123043"; report-type=delivery-status
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]

This Message was undeliverable due to the following reason:

Dansk forklaring, klik her:
http://tdc.mail.dk/cgi-bin/redirect.pl?MsLimitNumMsgs

The user(s) account is temporarily over quota.

Please reply to
if you feel this message to be in error.
Reporting-MTA: dns; fep34.mail.dk
Arrival-Date: Tue, 26 Dec 2006 09:50:42 +0100
Received-From-MTA: dns; fep24.mail.dk (211.59.78.182)

Final-Recipient: RFC822;
Action: failed
Status: 4.2.2

From: "Williams, Joyce"
Date: December 27, 2006 1:56:02 AM GMT+00:00
To: "Brown, Julie" , "Karen" < some user @post4.tele.dk>, "Lisa Davis" , "Smith, Margaret" , "Andrew" , "Anthony Brown" , "White, Brenda"
Subject: An Affordable Rolex [random letters]
Reply-To: "Johnson, Joseph"

High Quality Rro*ex Rep*ica

Worldwide Fast Shipping -- Meticulous Design -- Inexpensive

An additonal 15% off when you purchase two or more repl,ca watches.

http://hometown.aol.com/steed249/

Her vampire, ruling the world in the Shire, nicely nasty.
Her devil, crying in the toolbox, is silently piggy.

The paper, sitting under the roof, was briefly hellish.
His programmer, standing in your house, is quietly slim.
Her ancestor, stealing money in the shadows, isn't perseveringly yellow.

Your dancer, talking crap behind the window, wasn't generously barren.

War, 11 AM
My response :

From: [my email]
Subject: SPAM Fwd: Mail System Error - Returned Mail
Date: December 26, 2006 5:42:26 PM GMT+00:00
To: TOSREPORTS@aol.com, abuse@bol.com.br, support@namecheap.com
Mime-Version: 1.0 (Apple Message framework v752.2)
Message-Id:
Content-Type: multipart/alternative; boundary=Apple-Mail-1--130814484
References: <20061226085043.somenumbers.fep34.mail.dk@fep34>

I forward this spam report to you AOL Tosreports since it IS relevant.

Someone - user steed249 - is forging my email to be used for sending out these emails. the emails with forget details are in the bottom of this email.
I have received several of these emails today.

The URL http://hometown.aol.com/steed249/ is in this spam advertising.
User steed249 is breaking his TOS.
The site is forwarding to replicas of brand products and that is a violation of your TOS, http://help.aol.com/aimhelp/search.do?cmd=displayKC&docType=kc&externalId=http--helpchannelsaolcom-kjumpadparticleId219305&sliceId=&dialogID=63390544&stateId=1%200%2063416598

Needless to say, I am angry that my email is used in these spams as reply-to.

And bol.com.br and the bulk domain support used for registering these domain are in to field too.
I would think that the TOS of cheapnames.com would also prohibit this spamming activity; http://www.namecheap.com/legal/reg-agreement.asp has : "Your WG Domain or the content found at any associated IP address infringes upon or conflicts with the legal rights of any third party or any third party's trademark or trade name. You also warrant that neither the WG Services nor WG Domain(s) will not be used in connection with any illegal or morally objectionable activity (as defined below in section 5), or, in connection with the transmission of unsolicited commercial email ("Spam"). "
Cheapnames.com, please consider canceling the account of this user. The domain is selling illegal products, and clearly violates your TOS by sending SPAM.

Here are the registrant details I have found out using whois searches for who registered the domains that website redirects to :

Domain Name: FINESWISS.NET
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: fineswiss.net

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.mygoodswiss.net
ns2.mygoodswiss.net

Creation date: 30 Oct 2006 12:12:26
Expiration date: 30 Oct 2007 12:12:26

It also redirects to :
Domain Name: BEAUTIFULSWISS.COM
[whois.enom.com]
=-=-=-=
Visit AboutUs.org for more information about beautifulswiss.com
a href="http://www.aboutus.org/beautifulswiss.com"AboutUs: beautifulswiss.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/

Domain name: beautifulswiss.com

Registrant Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Administrative Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Technical Contact:
Merengue do Brasil Ltda
Marco Maduro (mmaduro2007@bol.com.br)
+55.4330267732
Fax: +1.
R Marcel Proust, 54
Apucarana, ST 86010
BR

Status: Locked

Name Servers:
ns1.beautifulswiss.com
ns2.beautifulswiss.com

Creation date: 25 Dec 2006 14:49:57
Expiration date: 25 Dec 2007 14:49:57
=-=-=-=
The data in this whois database is provided to you for information
purposes only, that is, to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is," and do not guarantee its accuracy. By submitting a
whois query, you agree that you will use this data only for lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume, automated, electronic processes that stress or load
this whois database system providing you this information; or (2) allow,
enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by telephone. The compilation, repackaging, dissemination or
other use of this data is expressly prohibited without prior written
consent from us.

[and in the bottom the full full headers and full text of the spam I had bounced in my email inbox]

Regards,

ME

----- to be continued as soon as I get answers for this spam.