Thursday, July 20, 2006

A collection of the more amusing and strange porn spams

Porn spam is once again on the rise. Here's a summary of what I'm seeing these days broken down in to neat categories.


Confusing


New start out specific nest of y0ung girls


I wasn't aware that young girls lived in nests. I wonder what they build them out of? I'm guessing discarded cloth, twigs and saliva. That web site probably isn't safe for work viewing, that idea makes Japanese porn seem boring.


Brutal d01ls worldwide


Not sure this is porn actually, I think I already own one of these brutal dolls. It's a toy (okay, it's a doll) based on a the character Grom Hellscream. A pretty brutal toy even if his rubber axe has a habit of bending a bit.


Success!

(This is a series of spam emails who's subjects always consist of "Success, ". This has led to subject likes "Success, world war" (yeah, we're all happy when another of those comes along), "Success, way freight" and so on.


Subject: Success, writing lesson

Your cre dit doesn't matter to us! If you OWN real est ate
and want IMMEDIATEK cash to spend ANY way you like, or simply wish
to LOWER your monthly paym ents by a third or more, here are the dea ls
we have TODAY (hurry, these ofers will expre TONIGHT):

$488,000.00 at a 3.67,% fixed-rateL
$372,000.00 at a 3.90,% variable-rateA
$492,000.00 at a 3.21,% interest-onlyS
$248,000.00 at a 3.36,% fixed-rate1
$198,000.00 at a 3.55,% variable-rateY

Hurry, when these deals are gone, they are gone Simply fill out this one-min ute form...

Don't worry about approval, your cre dit will not disqualify you!


I think they spoke to early. I'm happy that the spam writer considers their writing lessons to be a success but on reading their mail I doubt they were paying much attention in class. Mind you, a they aren't as stupid as the twats who'd fall for such an obvious scam.

"Wow, a bank I've never heard of before sent me an email typed by baboons and proof-read by a professional footballer which promised me a mortage without knowing where I live, who I am or what my current financial situation is. I'd better be quick and go to this web site and give them my personal financial details including my bank account number and any other information a criminal would need to rob me blind. Reminds me, I need to buy some lottery tickets later, better stop at the fortune teller to see what numbers I'll use."


Mum?

These are emails from a chap who's mother and girlfriend add up to fewer than two people. Problem still only two if you add his sister. They're particularly amusing since they seem like very poorly translated lyrics from a hentai film theme tune.



Withb my shot on inside mothers rear wide outlet I had eat seeds running falling out of her.


Okay, the idea itself is pretty unpleasant but you've got to enjoy the English. Rear wide outlet? Does anyone in the world actually refer to their arse in this way or does his mother have some kind of special arse that alone deserves this name?


Because with mome indeed allows
myself to desrtoy all enters with strongr attacks.


They're keeping it in the family still but what the fuck are they keeping in the family? I am honestly baffled by this text.

Tuesday, July 11, 2006

LETS WORK OUT THE TRANSFER OF $25MILLION TO YOUR PRIVATE ACCOUNT CONTACT ME FOR MORE DETAILS (NNPC) NIGERIA

This week's delight ... imagine, I had totally forgotten that some Nigerian banker with a UK Singaporean yahoo email address, needed my banking details to arrange the transfer of these $ 25 million ....

From: gregmute2000@yahoo.com.sg
Subject: LETS WORK OUT THE TRANSFER OF $25MILLION TO YOUR PRIVATE ACCOUNT CONTACT ME FOR MORE DETAILS (NNPC) NIGERIA
Date: July 11, 2549 BE 10:20:52 AM GMT+01:00
To: [my email]
Reply-To: greggreg58@yahoo.co.uk
Return-Path:
Received: [..[ (qmail 9951 invoked by uid 60001); Tue, 11 Jul 2006 09:20:52 +0000
Received: from [196.3.62.3] by web55805.mail.re3.yahoo.com via HTTP; Tue, 11 Jul 2006 02:20:52 -0700 (PDT)
Message-Id: <20060711092052.xxxxxx.qmail@web55805.mail.re3.yahoo.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="0-894308545-1152609652=:6560"
Content-Transfer-Encoding: 8bit
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com.sg; h=Message-ID:Received:X-RocketDSI:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=ac6arCE/au2cGiJTmWDfpK2BoaOWBMHWjxUkHvTDa+gMt/9PKCCU[...]RjxVBcGbus8EIr98Ae/YBCLlGuxfQdkrOJ41XVqo+VnXgAnE+k7obhWrT0z3WKndjEQ= ;
X-Rocketdsi: i=216.252.110.51;s=w
X-Spam-Flag: YES
X-Brightmail-Tracker: AAAADQL/OgsC/zoxAv890gL/PcsC/0OvAv87bAL/QTsC/znQAv84agL/QL4C/zh7Av84bQL/RS0=
Original-Recipient: [an email]

I have a new email address!
You can now email me at: gregmute2000@yahoo.com.sg

Dear Friend


Am contacting you for this transfer of money to your Bank Account

Greg Mute

- Greg Mute

Monday, May 22, 2006

Sensattion'alll revolution #2

Spam hunting for Sensatttional revolution in medicine # 2


X-Gmail-Received: 38f6828ae5da9d57dd80f414d77f064be6d79ed5
Delivered-To: [my email]
Received: by 10.70.69.11 with SMTP id r11cs321099wxa;
Mon, 22 May 2006 12:30:08 -0700 (PDT)
Received: by 10.78.51.16 with SMTP id y16mr1200803huy;
Mon, 22 May 2006 12:30:07 -0700 (PDT)
Return-Path:
Received: from 72.14.215.27 ([210.218.232.119])
by mx.gmail.com with SMTP id 37si1295812hub.2006.05.22.12.30.00;
Mon, 22 May 2006 12:30:07 -0700 (PDT)
Received-SPF: neutral (gmail.com: 210.218.232.119 is neither permitted nor denied by best guess record for domain of UYRDBWEFVTYN@csaw.com)
Received: from draftsmanpeternixon.net [76.112.255.149] (helo=composition.vergenet.net)
by smtp0.cistron.nl with esmtp (beach)
id 5AQ6iH-2992CR-00; Mon, 22 May 2006 15:29:59 -0500
Date: Mon, 22 May 2006 18:29:59 -0200
Message-ID: <6834B67C.3929107@larynx.peternixon.net>
From: "Anderson Lynn"
To: [another email address]
Subject: Fwd: REPLY
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031013 Thunderbird/0.3
X-Accept-Language: en-us, en


-S'ensationall revoolution in m'edicine!

-E'n'l'a'r'g'e your p''enis up to 10 cm or up to 4 inches!

-It's herbal solution what hasn't side effect, but has 100% guaranted results!

-Don't lose your chance and but know wihtout doubts, you will be impressed with results!

Clisk here: http://associationexchange.info



bitterroot thatch homology journey regretful nolo irresolution armhole dreamboat amethystine
curd scabious archetype polymorph elder postulate grater dosimeter sectarian
complexion muzak concurred crummy grizzly snuggle balzac ticklish whitetail embarrass sunbonnet
kiss raze baleful salvatore fiasco mattson speed lost
portia evaluate staid longtime textile margo duplex afresh
behind congressman incise bifurcate mosque testes disquietude pulitzer




Domain Name:ASSOCIATIONEXCHANGE.INFO
Created On:20-May-2006 21:47:12 UTC
Last Updated On:21-May-2006 08:45:34 UTC
Expiration Date:20-May-2007 21:47:12 UTC
Sponsoring Registrar:RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_3042873
Registrant Name:emmanuel muller
Registrant Organization:emmanuel
Registrant Street1:rue des colimacons 15
Registrant Street2:
Registrant Street3:
Registrant City:clermont
Registrant State/Province:NA
Registrant Postal Code:60600
Registrant Country:FR
Registrant Phone:+1.33344503520
Registrant Phone Ext.:
Registrant FAX:+1.33344503520
Registrant FAX Ext.:
Registrant Email:muller@perovo.net
Admin ID:DI_3042873
Admin Name:emmanuel muller
Admin Organization:emmanuel
Admin Street1:rue des colimacons 15
Admin Street2:
Admin Street3:
Admin City:clermont
Admin State/Province:NA
Admin Postal Code:60600
Admin Country:FR
Admin Phone:+1.33344503520
Admin Phone Ext.:
Admin FAX:+1.33344503520
Admin FAX Ext.:
Admin Email:muller@perovo.net
Billing ID:DI_3042873
Billing Name:emmanuel muller
Billing Organization:emmanuel
Billing Street1:rue des colimacons 15
Billing Street2:
Billing Street3:
Billing City:clermont
Billing State/Province:NA
Billing Postal Code:60600
Billing Country:FR
Billing Phone:+1.33344503520
Billing Phone Ext.:
Billing FAX:+1.33344503520
Billing FAX Ext.:
Billing Email:muller@perovo.net
Tech ID:DI_3042873
Tech Name:emmanuel muller
Tech Organization:emmanuel
Tech Street1:rue des colimacons 15
Tech Street2:
Tech Street3:
Tech City:clermont
Tech State/Province:NA
Tech Postal Code:60600
Tech Country:FR
Tech Phone:+1.33344503520
Tech Phone Ext.:
Tech FAX:+1.33344503520
Tech FAX Ext.:
Tech Email:muller@perovo.net
Name Server:DNS1.REGISTERFLY.COM
Name Server:DNS2.REGISTERFLY.COM
Name Server:DNS3.REGISTERFLY.COM


Which gives us back to the registerfly and the sensatttional revolution in medicine #1

- same, not valid registrar details as in the #1.

Bookmyname.com again ....

X-Gmail-Received: 57e23de077f925ef264ad7e5ad55d3547ad7c76d
Delivered-To: [my email]
Received: by 10.70.69.11 with SMTP id r11cs315277wxa;
Mon, 22 May 2006 10:16:11 -0700 (PDT)
Received: by 10.36.75.6 with SMTP id x6mr5715619nza;
Mon, 22 May 2006 10:16:10 -0700 (PDT)
Return-Path:
Received: from interbusiness.it (69-171-233-239.clspco.adelphia.net [69.171.233.239])
by mx.gmail.com with SMTP id 16si1855077nzo.2006.05.22.10.16.10;
Mon, 22 May 2006 10:16:10 -0700 (PDT)
Received-SPF: neutral (gmail.com: 69.171.233.239 is neither permitted nor denied by domain of cowlmar@interbusiness.it)
Message-ID: <000001c67dc3$657be170$5381a8c0@fht24>
Reply-To: "Marissa Cowley"
From: "Marissa Cowley"
To: [my email]
Subject: Re: test VvtAGGRA
Date: Mon, 22 May 2006 10:16:00 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C67D88.B91D0970"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C67D88.B91D0970
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,
=20
L E V / T R A
M E R / D / A
S O M ^
P R O Z ^ C
X ^ N A X
V / A G R A
V A L / U M
A M B / E N
C / A L / S
=20
http://www.bunotacke.com
=20
=20
=20
=20
=20
below because of the overhang of the cliff, nor from further off because
it was so small that it looked like a dark crack and no more. It was not
a cave and was open to the sky above; but at its inner end a flat wall=20
rose up that in the lower I part, close to the ground, was as smooth and
upright as masons work, but without a joint or crevice to be seen.=20
No sign was there of post or lintel or threshold, nor any sign of=20


------=_NextPart_000_0001_01C67D88.B91D0970
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


L E V / T R A

M E R / D / A

S O M ^

P R O Z ^ C

X ^ N A X

V / A G R A

V A L / U M

A M B / E N

C / A L / S
 

=
 

 

 

 

 

below because of the overhang of the =
cliff, nor from further off because
it was so small that it looked =
like a dark crack and no more. It was not
a cave and was open to the =
sky above; but at its inner end a flat wall
rose up that in the =
lower I part, close to the ground, was as smooth and
upright as =
masons work, but without a joint or crevice to be seen.
No sign =
was there of post or lintel or threshold, nor any sign of =


------=_NextPart_000_0001_01C67D88.B91D0970--

#########

Gives

Domain Name : bunotacke.com (BUNOTA2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Billing Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Technical Contact :
PERSON
David FORMAN (FORMAN6-BMN-PE)

73-15 196th St

11366 Fresh Meadows
UNITED STATES NY
phone : 7182175470
fax :
e-mail : lameisat@yahoo.com


Domain servers :
ns0.anothegisa.com (NAC230-BMN-HST)

ns0.sigumebersi.com (NSC202-BMN-HST)

Created on 05/20/2006 17:00:03
Updated on 05/21/2006 10:19:21
Expires on 05/20/2007 13:00:03

Our friend bookmyname gets some mail again ...

Sensatttttionnnaaalll revolution in medicine with typos, #1

Of the kind that I was annoyed by earlier.
Of the billion different ways to typo sensational revolution in medicine.

Here we go, let's hunt them back one by one.

X-Apparently-To: [my email address] via 206.190.48.153; Mon, 22 May 2006 12:05:13 -0700
X-YahooFilteredBulk: 70.127.155.110
X-Originating-IP: [70.127.155.110]
Return-Path:
Authentication-Results: mta306.mail.scd.yahoo.com from=messe-duesseldorf.de; domainkeys=neutral (no sig)
Received: from 70.127.155.110 (HELO 110-155.127-70.tampabay.res.rr.com) (70.127.155.110) by mta306.mail.scd.yahoo.com with SMTP; Mon, 22 May 2006 12:05:11 -0700
Received: from micro.webhost8.alterusa.com id CFB67284DE; Mon, 22 May 2006 18:00:16 -0200
Received: by desultory.webhost1.starnetusa.net (Postfix, from userid 308) id CFB63724DE; Mon, 22 May 2006 21:03:16 +0100
Date: Tue, 23 May 2006 02:03:16 +0600
Message-Id: <21041130090241.CFB3859DE@age.starnetusa.net>
From: "Brady Carr" Add to Address Book Add Mobile Alert
To: [another email address showing here]
Subject: Order Delivery
Content-Length: 749
-S'ensationall revoolution in m'edicine!

-E'n'l'a'r'g'e your p''enis up to 10 cm or up to 4 inches!

-It's herbal solution what hasn't side effect, but has 100% guaranted
results!

-Don't lose your chance and but know wihtout doubts, you will be
impressed with results!

Clisk here: http://yaoph.info


chariot convair pitchfork bullock taos sake rectify nine chou christy
propylene scapegoat brindisi deplore emit franchise bluebird silty tic
spin mathews field energy pottery chemisorption transverse freetown
anhydrite apparent census
cagey knickerbocker vita somers supply postpone aspire chosen
gretchen centerpiece coercion dragnet rebuke interception thiocyanate
bombard
caveman fin rotc ink sculptor staircase switchboard sextuple




Of which we can find out the following :

Domain ID:D13489530-LRMS
Domain Name:YAOPH.INFO
Created On:20-May-2006 22:14:42 UTC
Last Updated On:21-May-2006 07:52:05 UTC
Expiration Date:20-May-2007 22:14:42 UTC
Sponsoring Registrar:RegisterFly.com, Inc. (R318-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_3042873
Registrant Name:emmanuel muller
Registrant Organization:emmanuel
Registrant Street1:rue des colimacons 15
Registrant Street2:
Registrant Street3:
Registrant City:clermont
Registrant State/Province:NA
Registrant Postal Code:60600
Registrant Country:FR
Registrant Phone:+1.33344503520
Registrant Phone Ext.:
Registrant FAX:+1.33344503520
Registrant FAX Ext.:
Registrant Email: muller@perovo.net
Admin ID:DI_3042873
Admin Name:emmanuel muller
Admin Organization:emmanuel
Admin Street1:rue des colimacons 15
Admin Street2:
Admin Street3:
Admin City:clermont
Admin State/Province:NA
Admin Postal Code:60600
Admin Country:FR
Admin Phone:+1.33344503520
Admin Phone Ext.:
Admin FAX:+1.33344503520
Admin FAX Ext.:
Admin Email: muller@perovo.net
Billing ID:DI_3042873
Billing Name:emmanuel muller
Billing Organization:emmanuel
Billing Street1:rue des colimacons 15
Billing Street2:
Billing Street3:
Billing City:clermont
Billing State/Province:NA
Billing Postal Code:60600
Billing Country:FR
Billing Phone:+1.33344503520
Billing Phone Ext.:
Billing FAX:+1.33344503520
Billing FAX Ext.:
Billing Email: muller@perovo.net
Tech ID:DI_3042873
Tech Name:emmanuel muller
Tech Organization:emmanuel
Tech Street1:rue des colimacons 15
Tech Street2:
Tech Street3:
Tech City:clermont
Tech State/Province:NA
Tech Postal Code:60600
Tech Country:FR
Tech Phone:+1.33344503520
Tech Phone Ext.:
Tech FAX:+1.33344503520
Tech FAX Ext.:
Tech Email: muller@perovo.net
Name Server:DNS1.REGISTERFLY.COM
Name Server:DNS2.REGISTERFLY.COM
Name Server:DNS3.REGISTERFLY.COM


Of which ...

http://registerfly.com/ shows the following ... bulk registrations - "Bulk registrations. Search and register up to 300 names at once
Bulk Transfers - Transfer up to 100 names at once
Bulk renewals - Renew a single, multiple or all of your names at once" - now please someone come up with ONE legitimate reason for bulk registrations? Apart of spam, I can't find any, not a single reasson.


Well, as they promise the following
"We provide you your own unique spam-filtered email address. We scrub and spam/virus filter all emails sent to your Spam Filtered email address" the least we could expect from them is to not host sites that send me spam.

The minimum we can come up with the domain registration details is the following:

- the phone number is not valid. It is not a valid phone number for nor USA neither France.
- the address is not valid. Again a confusion by registrant about the country they were residing in.
- email address MAY be valid but it's on a Russian site, which makes both the phone and physical address details even less affidable.


part #2

How to chase spam

A great simple how to chase spam instructions.

Unfortunately I haven't found any good spam recently, it's all this sensattionnal revoluttttion in medicine with more typoes than I have ever seen. Maybe 120 different versions of that viagra and related spam in the past 2 weeks - who knows, maybe I get bored enough to actually start to hunt these rrrr'e"vvvolutTTiiioonal pe0pl3. Stay tuned.

Friday, May 12, 2006

All these software spam sites seem to be registered as bulk sites via bookmyname.com

So, a typical software spammer and scammer ... that keeps going on and on and on and on and on. I wonder how long it will be before http://www.bookmyname.com would have to care? According ot the website, they don't. No anti-spamming policies on the domains registered via them. Too bad.
But what could you expect from a domain that allows bulk domain registrations? Would desk@BookMyName.com really care?

So would a compilation of the previous spam spam spammety spam by the people registered their bulk of spam and scam domains using bookmyname.com as registrar service, with regular enough updates do? Let's see - at least as long as gmail doesn't completely block these e@##@%$^ spams even out of my spam folders.

Thus updating ...

Mail, today:

X-Gmail-Received: eb71238aebe7e1fdf0bf5427c28ef3fb5b4e419d
Delivered-To: [my email]
Received: by 10.70.71.13 with SMTP id t13cs97601wxa;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Received: by 10.36.108.5 with SMTP id g5mr88809nzc;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Return-Path:
Received: from -1212939104 (vsg94-1-82-234-116-246.fbx.proxad.net [82.234.116.246])
by mx.gmail.com with SMTP id c12si11401602nzc.2006.05.12.01.29.13;
Fri, 12 May 2006 01:29:14 -0700 (PDT)
Received-SPF: neutral (gmail.com: 82.234.116.246 is neither permitted nor denied by best guess record for domain of settle@globalmedtech.com)
Received: from globalmedtech.com (-1210574040 [-1211124016])
by vsg94-1-82-234-116-246.fbx.proxad.net (Qmailv1) with ESMTP id FAB147FAE7
for ; Fri, 12 May 2006 17:30:33 -0400
Date: Fri, 12 May 2006 17:30:33 -0400
From: "Mastodon O. Masqueraders"
X-Mailer: The Bat! (v2.00.3) Personal
X-Priority: 3
Message-ID:
To: [my name and email]
Subject: Software
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-AntiVirus: Checked by Dr.Web (http://www.drweb.net)

some software u need!
75% Off for All New Software. microsoft, adobe, macromedia!

New software on our site:

Creative Suite Premium (5 CD) - $149.95
Office XP Professional - $79.95
Encarta Encyclopedia Delux 2004 (3CD) - $89.95
Office 2003 Professional (1 CD Edition) - $89.95
Flash MX 2004 - $69.95
InDesign CS - $69.95
Photo Painter 8 - $59.95
Acrobat 6 Professional - $79.95
Photoshop 7 - $69.95
Quark Xpress 6 Passport Multilanguage - $69.95
Windows 98 Second Edition - $49.95
Premiere 7 - $69.95
InDesign CS - $69.95
Premiere 7 - $69.95

Our site:
http://6duvb0u7udcj7oo1b66jbooo.unstaidda.com/


Of which whois run:

Domain Name: UNSTAIDDA.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: FF.GENOSMG.COM
Name Server: DD.GENOSMG.COM
Status: ACTIVE
Updated Date: 10-may-2006
Creation Date: 10-may-2006
Expiration Date: 10-may-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

DOMAIN
Domain Name : unstaidda.com (UNSTAI2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)
417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Billing Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)
417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Technical Contact :
PERSON
Slumminas SLUMMINAS (SLUMMI2-BMN-PE)

417 Schepps Blvd
88101-8381 Clovis
UNITED STATES
phone : (505) 769-2811
fax :
e-mail : slumminas@yahoo.com

Domain servers :
ff.genosmg.com (FGC2-BMN-HST)
dd.genosmg.com (DGC14-BMN-HST)

Created on 05/10/2006 11:11:28
Updated on 05/10/2006 12:15:01
Expires on 05/10/2007 07:11:28


Of which you know what? I don't believe Slumminas SLUMMINAS or Tram TELPIL are real names.
I don't think phone numbers with inexistent region codes, and with registrar mailing addresses being in USA while their phone numbers are in Poland and other countries, are anywhere near valid argument for registrant details.
Well, time to like Rick's spam digest for best howto.

As a minimum, still totally ignoring the no-spam and no scam-sites hosting policies mentioned, at least I can say the whois data for the domains registered via bookmyname, is suspect.

And this based only on a sample of spams that I have received, and whois run on the domains the spams were for.

Thursday, May 11, 2006

A typical software scammer

X-Gmail-Received: 9f2a37f63e8ea5e9c7b9d541d3c5812c8d5e5556
Delivered-To: [my email]
Received: by 10.70.71.13 with SMTP id t13cs286502wxa;
Wed, 3 May 2006 21:42:31 -0700 (PDT)
Received: by 10.49.36.20 with SMTP id o20mr346861nfj;
Wed, 03 May 2006 21:42:30 -0700 (PDT)
Return-Path:
Received: from -1212146352 ([220.74.2.100])
by mx.gmail.com with SMTP id d2si2212133nfe.2006.05.03.21.42.28;
Wed, 03 May 2006 21:42:30 -0700 (PDT)
Received-SPF: neutral (gmail.com: 220.74.2.100 is neither permitted nor denied by best guess record for domain of heksterb@gijonmotorclub.com)
Received: from gijonmotorclub.com (-1208692080 [-1208674456])
by greenleafforestry.com (Qmailv1) with ESMTP id A281C243B7
for ; Thu, 04 May 2006 00:53:41 -0400
Date: Thu, 04 May 2006 00:53:41 -0400
From: "Stereotypes V. Loudmouths"
X-Mailer: The Bat! (v2.00.4) Personal
X-Priority: 3
Message-ID:
To: [my name and email]
Subject: Software
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by Ameriserv.net Anti-Virus E-Gateway

All best software!
some software u need!

New software on our site:

Creative Suite Standard (3 CD) - $129.95
Windows NT 4.0 Server - $49.95
FileMaker 7.0 Professional - $69.95
Photoshop CS with ImageReady CS - $99.95
InDesign CS PageMaker Edition (2CD) - $69.95
Flash MX 2004 - $69.95
Windows 98 Second Edition - $49.95
Studio MX 2004 with Director MX 2004 - $139.95
Photoshop CS with ImageReady CS - $99.95
Acrobat 6 Professional - $79.95
SQL Server 2000 Enterprise Edition - $69.95
Money 2004 - $69.95
Fireworks MX 2004 - $69.95
Windows 98 - $49.95

Our site:
http://im6b6vncoqnd10id5iiv50ii.energydd.com/

####

Great. What is it with these software sites that they NEVER ever publish the address of where they themselves are located? Maybe because what they claim to be doing, would not be legal in USA, or in any western world country.

Know what? You can't buy this OEM software legally, no matter if it was claimed to be sold and manufactured to you by Adobe, Dell, Apple, HP, Sony, or Macromedia. It's not legal.

So, if these sites never want to announce who they really are, whois your friend...

####

Domain Name: ENERGYDD.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: WE.REDAMAGEDG.COM
Name Server: ST.REDAMAGEDG.COM
Status: ACTIVE
Updated Date: 02-may-2006
Creation Date: 02-may-2006
Expiration Date: 02-may-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

DOMAIN
Domain Name : energydd.com (ENERGY4-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Billing Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Technical Contact :
PERSON
Joan-Ploem MILLER (MILLER14-BMN-PE)

527 SE BASELINE SUITE B

97123 HILLSBORO
UNITED STATES OR
phone : +48 22 3895469
fax :
e-mail : MILLERPLOEM@yahoo.com


Domain servers :
we.redamagedg.com (WRC5-BMN-HST)

st.redamagedg.com (SRC6-BMN-HST)


Created on 05/02/2006 14:48:38
Updated on 05/02/2006 17:41:27
Expires on 05/02/2007 10:48:38

Interesting. USA and Oregon as a state, so why do these "Americans" have a phone number listed and located in Poland?

If you buy pirated software from an "American" company located in Poland or whoever knows where, why would that be less illegal than buying just "regular" illegal software?

At leaast get some more sympathy points from me, and list the location (mailing address) in the next software scamming site.

... and guess what? Checking some other recent spams, I found this

Domain Name: PALAITECE.COM
Registrar: ONLINE SAS
Whois Server: whois.bookmyname.com
Referral URL: http://www.bookmyname.com
Name Server: QO.NEEDINGEI.COM
Name Server: MO.NEEDINGEI.COM
Status: ACTIVE
Updated Date: 27-apr-2006
Creation Date: 27-apr-2006
Expiration Date: 27-apr-2007
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

Domain Name : palaitece.com (PALAIT2-BMN-DOM)
Registrar : BookMyName
Whois Server : whois.bookmyname.com
Referral URL : https://www.bookmyname.com

Registrant / Admin Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Billing Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Technical Contact :
PERSON
Tram TELPIL (TELPIL2-BMN-PE)

795 Farmers Lane, Suite 23

95405 Santa Rosa
UNITED STATES
phone : (707) 575 1468
fax :
e-mail : tramtelpil@yahoo.com

Domain servers :
qo.needingei.com (QNC2-BMN-HST)

mo.needingei.com (MNC5-BMN-HST)

Created on 04/27/2006 16:39:24
Updated on 04/27/2006 18:00:39
Expires on 04/27/2007 12:39:24

Tram Telpil? What the heck of name is that? That sounds like a name for a tram driver in a Polish c-category movie from the 1930s. At least the billing address and phone number of this guy this time aren't in Poland.


####

Hmm... so all this data such as

ENERGY4-BMN-DOM
MILLER14-BMN-PE
PALAIT2-BMN-DOM
TELPIL2-BMN-PE
QNC2-BMN-HST
MNC5-BMN-HST
PTISAN2-BMN-DOM
BENZLE2-BMN-PE
QNC2-BMN-HST

Comes to interesting stuff. Indeed.
And wide spamming by can be googled easy by the same person or society already last year. The same people here, here, here, here... so I would be too late to suggest this spammer to try something new such as trying to sell other than software. He's been already a Nigerian, "paying" via private persons bank accounts, and sending normal cialis and viagra spam.

Really, I should bother to hunt down this guy, and sue him for $ 1,000 for each spam I have ever received from him.

It would be easier if http://www.bookmyname.com would have an antispam policy - according ot the website, they don't. Too bad. But what could you expect from a domain that allows bulk domain registrations? Would desk@BookMyName.com really care?

Saturday, May 06, 2006

Ebay-authorize.net

X-Message-Status: n:0
X-SID-PRA: support@email[randomnumber].ebay.com
X-SID-Result: TempError
X-Message-Info: [random numbers and letters]
Received: from osiedle.net-conekt.pl ([80.55.154.146]) by bay0-mc11-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830);
Fri, 5 May 2006 08:15:55 -0700
Received: from osiedle.net-conekt.pl (80.55.154.146)
by osiedle.net-conekt.pl with SMTP;
Received: (qmail 3328 by uid 184); Fri, 5 May 2006 05:12:46 +0100
Message-Id: <20060505061246.xxxx.qmail@osiedle.net-conekt.pl>
To:
Subject: RE: Alert Message [a number]
From:
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Return-Path: frontsys@hotmail.com
X-OriginalArrivalTime: 05 May 2006 15:15:55.0745 (UTC) FILETIME=[CE4F7510:01C67056]
Date: 5 May 2006 08:15:55 -0700

Dear Member eBaY,

This is your official notification from company that the service(s) listed below will be deactivated and deleted if not renewed immediately.
Previous notifications have been sent to the Billing Contact assigned to this account. As the Primary Contact, you must renew the service(s) listed below or it will be deactivated and deleted.

EXPIRATION: May 8

https://signin.ebay.com/ws/eBayISAPI.dll?SignIn?DisplayLoginPage
Sincerely,

This Alert was sent according to your settings ([my email address]).
================================================================
Need help? Use "Site Helper" or call customer service at 1.800.576.7645. Please do not "Reply" to this Alert.

©2006 Financial Group. All rights reserved

#######

Now this is funny. Since when is eBay a POLISH organization??? Since the link where these scammers link to, http://ebay-authorize.net, also redirects to http://signin.ebay.com.ebay-authorize.net/eBayISAPI.dll?SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=http%3A%2F%2Fwww.ebay.com&pp=&pa2=&errmsg=&runame=&ruparams=&ruproduct=&sid=&favoritenav=&confirm=&ebxPageType=&existingEmail=&isCheckout=&migrateVisitor=, I think some fool people may even fall to that.

And now to the fun part.

WHOIS information for ebay-authorize.net:

Domain Name: EBAY-AUTHORIZE.NET
Domain Status: ACTIVE
Registrar: Wooho T&C Co., Ltd. d/b/a RGNames.com
Referral URL: http://www.RGNames.com

Domain Registration Date....: 2006-05-05 GMT.
Domain Expiration Date......: 2007-05-05 GMT.
Domain Last Updated Date....: 2006-05-05 14:06:14 GMT.

Registrant:
Philip J Roller
10101 West Parmer Lane #711,
, 78717
US


Administrative, Technical, Billing Contact:
Philip J Roller whitbit@hotmail.com
10101 West Parmer Lane #711,
, 78717
US
(PHONE) +800-530-32-12 (FAX) +--


Domain Name Servers in listed order:
NS1.NARROWTOK.NET 67.167.254.42
NS2.NARROWTOK.NET 72.240.109.122

Thursday, May 04, 2006

My PayPal info needs to be confirmed - I don't even use PayPal

From: Billing@PayPal.com
Subject: Credit/Debit card update
Date: May 4, 2006 3:51:07 PM GMT+01:00
To: [my email address]
Reply-To: Billing@PayPal.com
Return-Path:
Delivered-To: [my email address]
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on u15175516.onlinehome-server.com
X-Spam-Level: *
X-Spam-Status: No, score=1.9 required=7.0 tests=HTML_MESSAGE, HTTPS_IP_MISMATCH,MIME_HTML_ONLY autolearn=no version=3.1.0
Received: (qmail 19012 invoked by uid 2020); 4 May 2006 09:51:09 -0500
Received: from unknown (HELO dok.kifee.com) (72.9.246.226) by [my mail service]
Received: from nobody by dok.kifee.com with local (Exim 4.52) id 1FbfAZ-0003ST-KE for [my email]; Thu, 04 May 2006 10:51:07 -0400
Received-Spf: none ([my email service]: domain at dok.kifee.com does not designate permitted sender hosts)
Mime-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <....@dok.kifee.com>
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - dok.kifee.com
X-Antiabuse: Original Domain - [my email service]
X-Antiabuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-Antiabuse: Sender Address Domain - dok.kifee.com
X-Source:
X-Source-Args:
X-Source-Dir:

Dear Paypal valued member,

Due to concerns, for the safety and integrity of the paypal
account we have issued this warning message.

It has come to our attention that your account information needs
to be updated due to inactive members, frauds and spoof reports.
If you could please take 5-10 minutes out of your online experience and renew
your records you will not run into any future problems with the online service.
However, failure to update your records will result in account suspension
This notification expires on 48.

Once you have updated your account records your paypal account
service will not be interrupted and will continue as normal.

Please follow the link below and login to your account
and renew your account information
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

Sincerely,
Paypal customer department!

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.

To receive email notifications in plain text instead of HTML, update your preferences here.



Very entertaining that that link https://www.paypal.com/cgi-bin/webscr?cmd=_login-run links to http://66.160.154.156/catalog/paypal/ - instead http://66.160.154.156/ has a redirect to http://66.160.154.156/catalog/ or as its name, http://www.peek-a-book-store.com/.

That gives

Domain Name: PEEK-A-BOOK-STORE.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.HE.NET
Name Server: NS2.HE.NET
Status: REGISTRAR-LOCK
Updated Date: 22-aug-2005
Creation Date: 20-aug-2005
Expiration Date: 20-aug-2008


IP address 66.160.154.156 -
OrgName: Hurricane Electric
OrgID: HURC
Address: 760 Mission Court
City: Fremont
StateProv: CA
PostalCode: 94539
Country: US

NetRange: 66.160.128.0 - 66.160.207.255
CIDR: 66.160.128.0/18, 66.160.192.0/20
NetName: HURRICANE-7
NetHandle: NET-66-160-128-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.HE.NET
NameServer: NS2.HE.NET
NameServer: NS3.HE.NET
Comment:
RegDate: 2003-10-09
Updated: 2005-09-27

RTechHandle: ZH17-ARIN
RTechName: Hurricane Electric
RTechPhone: +1-510-580-4100
RTechEmail: hostmaster@he.net

OrgAbuseHandle: ABUSE1036-ARIN
OrgAbuseName: Abuse Department
OrgAbusePhone: +1-510-580-4100
OrgAbuseEmail: abuse@he.net

OrgTechHandle: ZH17-ARIN
OrgTechName: Hurricane Electric
OrgTechPhone: +1-510-580-4100
OrgTechEmail: hostmaster@he.net

And, of course I am going to update my PayPal info to this obnoxious website. After all, I don't even have a PayPal account.

Uk Business proposal, "EDGAR SMITHS VENTURES LTD UK" - nothing original

From: contractaffairs@yahoo.com
Subject: Job Offer
Date: May 4, 2006 6:57:xx PM GMT+01:00
To: [my email]
Reply-To: contractaffairs@yahoo.com
Return-Path:
Received: [...] Received: from nt5.nshosts.com (nt5.nshosts.com [206.169.164.205] (may be forged)) by [isp] (Xserve/smtpin15/MantshX 4.0) with ESMTP id k44Gwpq9017825for [my email]; Thu, 04 May 2006 09:58:56 -0700 (PDT)
Received: from NT5 ([127.0.0.1]) by nt5.nshosts.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 04 May 2006 10:57:56 -0600
Message-Id: < [...] @nt5.nshosts.com>
Content-Type: text/plain; charset=iso-8859-1
Original-Recipient: [my email]
X-Originalarrivaltime: 04 May 2006 16:57:56.0250 (UTC) FILETIME=[E400A7A0:01C66F9B]


Hello,

My name is James Coker,I work for EDGAR SMITHS VENTURES LTD UK as a consultant, I also majored in business management.

The company produces various clothing materials,batiks,assorted fabrics and traditional costume which we have clients we supply weekly in the states.I am at our company in UK,though we have just completed a base in Africa and i might be visiting and we have made such a large client base in the US but I am always facing serious difficulties when it comes to transacting with Americans,they are always offering to pay with a US MONEY ORDERS OR CASHIERS CHECKS, which is difficult for me to cash here in United Kingdom.

We need a representative in the states who will be working for us as a part-time worker and who will be paid 5% for every transaction carried out,which wouldnt affect your present state of work,someone who would help me recieve payments from my customers in the states and get them processed at US banks.

I mean someone that is responsible,trust worthy,honest and reliable,cause the cost of coming to the state and getting payments is very expensive,i am working on extending a branch in the states,so for now we need a representative in the united states who will be handling the payment aspect.

These payments are usually in money orders and they would come to you in your name, so all you need do is cash the money order deduct your percentage and wire the rest back. It wouldnt cost you any amount,you are to receive payments which will be sent to you by Courier from my business patners.

Kindly get back to us as soon as possible if you are interested in this job offer at the email address below;

contractaffairs@gmail.com and i will brief you further with what this job will entail.

WARM REGARDS

James Coker

contractaffairs@gmail.com (alternate email)

www.edgarsmithvents.biz


#######

Well, the URL of this spammer does not exist.

The main point is unoriginal, it so reminds of STRYKER GINA RAYE of GINA FABRICS AND TEXTILES INDUSTRIAL LTD - except the previous one was to scam the UK residents, the latter to scam the Americans. Well - maybe this Gina person didn't get anyone from UK scammed, and had to try to fish on the other side of the pond?

Nevertheless, if there WAS any company trying to get work, I don't think the British officials, money laundering officials, tax officials etc would really like it. Also, British banks are relatively cheap. Would it REALLY make ANY SENSE for a business to find these 'honourable businessmen' in US that they would find only in the spambots of the internet, to contact them for this offer? I honestly think a British bank is a far better alternative with the less than 2 pounds a cheque they would charge for a SAFE transaction.

Originality: * of *****
Content repeated of all similar kind of business 'proposals'. Nothing new.

Wednesday, May 03, 2006

Stupid scams: The fraud girl from Russia

Spam seems to follow a 'flavour of the month' pattern. Certain types of spam become popular for a period of time.

Nigerian scams had theirs. Recently 'cheap meds' had their moment. Now it seems it's time for the dating scams. Here's a recent example.


Dear friend,
I found youbr pictaureb on one of the websites, acan we talk to
each otaher? I might be coming to your place in few aweeks.
This would be a grbeat opportunity to meet each other.
Btw, I am a woman. I am 25. Drop me a line at [email removed]



I love the "Btw, I am a woman" line near the end. As if to say "If you speak to me, there's a good chance you'll get laid".

Typically here's what this scam is intended to do.

1) Lonely and gullible man receives email and wonders "Wow, who is this chick"?
2) Man responds to email.
3) 'Woman' responds to man. Probably sends pictures to show how hot she is.
4) Man thinks he's on to something and invites her to visit.
5) She needs help with her ticket. For some reason she can't buy the ticket herself but promises that if you send her the money for the ticket, she'll return the money when she arrives.
6) Man sends money and never hears from them again.

This site has a nice write-up of this type of scam.

Fraud girl from Russia

Thursday, April 27, 2006

Scam self checks

Brilliant links for the day.
Scam self check
Scam reply generator

You are Susan Gezi.Your father was killed by a planned motor accident. He was the former Zimbabwean Minister for Youth & Gender Equality. You have $22,000,000 to share.  You want to assure me this transaction is 100% risk free.
Which Nigerian spammer are You?

And statistics rule

Interesting ....
a site of mine gets an interesting amount of visitor from Nigeria (pbr.linkserve.net (195.166.237.40)) . Among the last one someone got from here. Deficient. At least get a bit more creative, you lazy Nigerian scammers. Emails of engineers @hotmail.com, @yahoo.com, @zwallet.com etc? Dream on. How about searching this or this search instead?

As I need a break today at least I found something interesting in Scamorama.
And some other people get as many propositions to become rich as I do #2 #3, and more on Useni brothers.
And more cool stuff.
This is a brilliant article, with a bunch of the emails of the scammers visible too.

And, I will entertain myself at Scamorama.

Tuesday, April 25, 2006

Is this a scam or the deal of a lifetime?

No matter how stupid (or clever) you may be, here's a pretty much fool-proof test you can can do next time an African president offers to share 33 million Dollars with you.

With most scams, the person writing the mail pretends that you have been chosen for some special reason. They claim to have received your contact details via a chamber of commerce (see the previous blog entry), a trusted business associate or some other reputable source. Obviously these are big deals. President Ungaka Mbotu Taylor doesn't trust just anyone with this kind of transaction. With this in mind, he is fairly likely to have chosen you because of your trustworthy reputation.

After reading the crudely written email you should be fairly certain that it's a scam. If not, then here's the best test.

Ask the president if he know's your name?

Remember that in most cases, the spammers just capture the email address and not the name that had been associated with it. A genuine person would likely know your name and a bit more about you. A scammer is not likely to know your name at all.

A great way to waste a scammer's time is to dwell on the question of how they found you? Ask them in great detail who it was who passed on your email address. Play along, tell them how excited you are and that you are proud that your reputation has spread as far as the Sudannese refugee camps (that also happen to have fax services and a T1 line).

Friday, April 21, 2006

American Chamber of Commerce?

Hah.

The hilarious spam of the day ....

A Texan lady telling she has work for you? Despite the fact her SPELLING LOOKS VERY NIGERIAN TO ME.
I thought the US companies would simply do the routine typing tasks in cheap places like Jamaica, India, China .. And if they would want to employ you, you would need a work authorization?

And the pearl parts of the spam: I am willing
to pay you 10% for every money received by you from every of our client who
makes payment through you.
I am doing this based on trust. Just incase you are concerned about how i got
to contact you, it was through the American Chamber of Commerce for trust
worthiness.

Oh I did not know I am listed in the Americn Chamber of Commerce? If s/he thinks I am based in UK, wouldn't it have to be some London Chamber of Commerce?

Anyway here it comes (again a href for your spambot reerence):


From: gina_fabric01@ny.com
Subject: URGENT PART TIME JOB OPPORTUNITY
Date: April 21, 2549 BE 11:01:41 AM GMT+01:00
To: undisclosed-recipients: ;
Reply-To: interlinks6@yahoo.co.uk
Return-Path: < gina_fabric01@ny.com>
Received: [..] Received: from unix-14.vhostnix12.com ([64.128.189.42]) by[..]Received: from localhost (127.0.0.1) by localhost with SMTP; Fri, 21 Apr 2006 06:01:49 -0400
Received: from 213.185.106.3 ([213.185.106.3]) by webmail.netchemist.org (Horde MIME library) with HTTP; Fri, 21 Apr 2006 06:01:41 -0400
Message-Id: <.....@webmail.netchemist.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
User-Agent: Internet Messaging Program (IMP) H3 (4.0.3)
Original-Recipient: [removed]


GINA FABRICS AND TEXTILES INDUSTRIAL LTD.
10 Newport ave, Scoff ford Area,
Oxford, L349HA, 44(0)151 549 2700
Private email - (gina_fabric01@ny.com)
Hi ,
My name is STRYKER GINA RAYE a Texan working in Uk, I manage a fast growing
company here in the United Kingdom. We supply raw materials for clothing
companies. I want to know if YOU will like to work online from home and
getting paid weekly without leaving or affecting your present job?
Actually i need a representative in the states who can be working for our
company as a book-keeper . We make a lots of supplies to some of our clients in
the states which i do come to the states to receive payment and have it
cashed, after i supply them our raw materials. so i realized that its quite too
expensive and stressful for me to be coming to the states to receive such
payment twice in a month so i therefore decided to contact you. I am willing
to pay you 10% for every money received by you from every of our client who
makes payment through you.
I am doing this based on trust. Just incase you are concerned about how i got
to contact you, it was through the American Chamber of Commerce for trust
worthiness.
SO ALL I NEED IS TO FOWARD YOUR INFORMATION TO OUR CLIENTS IN THE STATES
AND ,THEY ISSUE PAYMENTS IN FORM OF CHECK THEN SEND
IT TO YOU VIA MAIL OR COURIER
I will need is your full name, address and phone number
so we can forward it to our clients and they will start making payments to
you as the company? representative in the states
I WILL EMAIL YOU A LETTER OF EMPLOYMENT FROM OUR
COMPANY WHICH YOU HAVE TO REPLY WITH AN ACCEPTANCE LETTER AND A SCANNED COPY OF
YOUR INDETIFICATION ATTACHED TO IT WHILE I SEND YOU MY OWN
IDENTIFCATION.
I AWAIT YOUR URGENT RESPONSE.
Warmest Regards,
STRYKER GINA RAYE.
PRIVATE EMAIL- gina_fabric01@ny.com
Pls contact me via direct email address for more information?s
(gina_fabric01@ny.com)

Wednesday, April 19, 2006

My service status?

Another "great" email.
Why is it that they keep telling me about the service status? My service status of what? Of the pills that I ordered? Oh man ... even though I am a female, I can still get more than 4 inches of penis even without ordering any spam.
Oh, and the a href mailto code added for your convenience, and for the spambot convenience.

From Katrina Bright Wed Apr 19 11:48:46 2006
X-Apparently-To: [my email address] via 206.190.48.144; Wed, 19 Apr 2006 10:52:21 -0700
X-YahooFilteredBulk: 203.156.1.91
X-Originating-IP: [203.156.1.91]
Return-Path: < odgmwrw@mail-good.pasteur-lille.fr>
Authentication-Results: mta224.mail.mud.yahoo.com from=mail-good.pasteur-lille.fr; domainkeys=neutral (no sig)
Received: from 203.156.1.91 (HELO 4.79.181.14) (203.156.1.91) by mta224.mail.mud.yahoo.com with SMTP; Wed, 19 Apr 2006 10:52:20 -0700
Received: from copywriter.striker.ottawa.on.ca ([79.154.204.32] helo=mail.nitros6.org) by maple.striker.ottawa.on.ca with esmtp (objectivity 3.35 #1 (mellon)) id 873nlc-0057MM-00 for < odgmwrw@mail-good.pasteur-lille.fr>; Wed, 19 Apr 2006 20:42:46 +0200
Message-Id: <[removed]@mail.nitros7.org>
X-Sender: odgmwrw@mail-good.pasteur-lille.fr
Date: Thu, 20 Apr 2006 00:48:46 +0600
From: "Katrina Bright" < odgmwrw@mail-good.pasteur-lille.fr>
To: [some other email address]
Subject: Service Status:
Content-Length: 735

-Sensattional revolution in medicine!

-Enlarge your penis up to 10 cm or up to 4 inches!

-It's herbal solution what hasn't side effect, but has 100% guaranted
results!

-Don't lose your chance and but know wihtout doubts, you will be
i`mpressed with results!

Clisk here: [someurl, removed]


impressible compound dido lorinda certify out effeminate gorgon convene
casbah
velocity baseband galley edinburgh peg columbus lookup brice taurus
fancy cleric eliot glomerular collegian furthermost antagonist nominee
swizzle glean peculiar
gauguin flexural guarantee confabulate breton ltv vital spruce
pursuer keyes coworker breakup cape analogous frambesia smithy
shrill grateful dyad dependent dear grip strait michaelangelo


Or maybe that Katrina tested that penis enlargement on herself, and the stupidity and pointlessness of the message could be explained simply by the fact that she used MicroSoft Office with the automatic spellcheck, and she typed all the text with her 4 inch penis.

Monday, April 17, 2006

Damn this is straight to the point.

Just received this spam.

subject: want to make a baby? lizexeda

dapam wepovaki pobaqo

blast 5x your load and have powerful most satisfying orgasms. Superb results totally guarnateed. It is time to get some serious firepower! [URL REMOVED]

deromucufuxedixuke


Five times your load? Blimey, how can you fail to make someone pregnant. Besides, the results are guarnateed.

Wednesday, April 12, 2006

Fresh ideas for scam business - make money out of newborns

This looks like a fresh enough idea to succeed among scams - even if tried by the Nigerians.

So, the news story was published by Yahoo:

GRAIN VALLEY, Mo. - The library books on multiple births crowded the couple's coffee table. The bedroom-turned-nursery awaited the arrival of six newborns.

But in the end, authorities say Sarah and Kris Everson never had the sextuplets as claimed. All they had was what appears to be a big lie.

The couple's dramatic story had holes in it from the start — from their mysterious withholding of information for more than a month to the unanimous response of area hospitals that they hadn't helped deliver the newborns.

On Tuesday, authorities said the mystery had been solved — the entire tale was deemed a hoax aimed at tapping the generosity of others to pay the couple's mounting bills.

"I have never dealt with anything like this," Police Chief Aaron Ambrose said. "The level of fraud like this involving people, I have not."

Gary Bradley, the city administrator, said charges against the Eversons were forthcoming. Prosecutors had not yet determined how much the couple profited from the scam or whether they would qualify for charges beyond the municipal level.

The Eversons — Sarah, 45, and Kris, 33 — claimed to have given birth to four boys and two girls on March 8. The babies were apparently in intensive care.

The tale exploded in the local spotlight Monday when The Examiner in Independence ran on its front page a photograph of the couple holding six one-piece baby outfits and announcing the births.

Those who heard the Eversons' sad story of tight finances set up a Web site to solicit contributions — including a van, washer and dryer, cash and gift certificates. A real estate agent was even working to find the family new housing.

Hours before admitting it was a scam, Sarah Everson showed an Associated Press reporter pictures of her in maternity clothes, her baring a huge pregnant-looking midsection, even sonogram images she claimed were of her infants. She showed off a tiny nursery, a closet full of baby clothes and the tiny diapers premature newborns must wear.

She said the entire story of her children's births was being kept secret by a court order enacted because a member of her husband's family was trying to kill the Eversons and their new sextuplets.

"I'm so afraid they're not going to make it," she sobbed. "Nobody understands how hard this is. I know that they're here. I know what I had to go through to get them here."

Sarah Everson said a detective begin questioning her Tuesday evening; Bradley and Ambrose said the Eversons were interviewed at the police station for about an hour, during which they revealed the story was a scam. They were released pending charges.

After the Examiner's initial story, the AP did not publish a story or transmit photos about the sextuplets over concerns of accuracy.

Reached by phone late Tuesday, Sarah Everson offered no explanation. "I'm not talking to anybody right now," she said, "because nobody gets it."

The Web site soliciting gifts was taken down Tuesday night.

Examiner Editor Dale Brendel said he was considering a front-page column to readers addressing the issue. He said the incident would force a review of his reporters' verification practices.

"I think that we fell victim to the hoax. There were people out in the community who were doing fund-raisers already, and we feel bad for them and for us that we were the victims of that," Brendel said. "In retrospect, there were things we could have done better from a newspaper standpoint, in terms of our investigations and trying to flesh out some of the red flags there were about the story."


So this would possibly be a new way for the Nigerian businessmen. Claim that you have had sextuplets, and that you need the money, so you can sell the sextuplets to whoever respectable businessman gives them $ 50,000. Oh, a White Nigerian business man who has had White babies of course. $ 50,000 for 6 White babies would be cheap enough to see how many people would get to that scam.

Monday, April 10, 2006

Proposed punishment for spammers

Prison. Solitary confinement. A very limited computer, able to
receive Email but nothing else. An Email address widely and
frequently exposed on newsgroups, web pages, and other venues
liable to harvesting.

Three times a day—at unpredictable times—an Email with a
random subject line would contain a password needed to get the
next meal served. This might be at the end of the (otherwise
typical SPAM) message, in the middle, near the beginning, but
the prisoner would need to read each and every EMail to find the
password for his next meal.

[Found in a newsgroup]