Mysweetmeds.com

From : Alba@viagrapharmacy.com
Sent : Thursday, July 5, 2007 8:35 PM
To :
Subject : RE: Pharmacy Email.
MIME-Version: 1.0
X-Originating-IP: [79.941.263.406]
X-Originating-Email: [email]
X-Sender: [forged email]
Received: from cpe-76-184-6-97.tx.res.rr.com ([76.184.6.97]) by bay0-mc4-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 5 Jul 2007 13:35:13 -0700
Received: (qmail 12215 by uid 296); Thu, 5 Jul 2007 03:36:10 -0600
X-Message-Info: txF49lGdW43Ql6ck42gxPXo/M+QN6b53EWOKl4GhFqyQJvyMz+ejm8GdA/GS+HeI
Return-Path: [forged email]
X-OriginalArrivalTime: 05 Jul 2007 20:35:13.0625 (UTC) FILETIME=[FD457490:01C7BF43]

Contents of email were only a gif with a lot of viagra, cialis etc images linking to http://pn.mysweetmeds.com

Of which we get

Registrant Contact:
medstore
David Snyder devid@lovelymeds.com
6516866867 fax:
3350 Heritage Ln.
Eagan MN 55121
us

Jain Hagis - Sep 11 scammer who can't spell

Maybe the scamers figured out that people would trust more American business men in these money advance scams?
This one is entertaining - even enough that I bothered to open the message at all in hotmail. Bold and italic additions are mine for comic or other value...

So, an American that types his name in CAPSLOCK like a NIGERIAN. Who used to work for a SECURITY/FINANCE COMPANY. Who lost his voice so that if people would actually call him they didn't figure out how exactly American he was... who misspells words like "organisation", "september", "EUROPE", and who also tries to milk from the September 11 thing ..

Never trust an American who misspells simple words like "organisation".

From : jain hagis <jain-h23178@hotmail.com>
Reply-To :
Sent : Thursday, June 28, 2007 12:53 PM
Subject : My Dear in Christ
X-Originating-IP: [216.226.70.22] [...]
X-Message-Info: LsUYwwHHNt14Z7jiFj59bCOsXpwBDfMCY+cVAcljtvRVBwCMW0F255vJHI/N4USs
Return-Path: jain-h23178@hotmail.com

X-OriginalArrivalTime: 28 Jun 2007 12:53:28.0336 (UTC) FILETIME=[52BD9900:01C7B983]
Content-Type: multipart/alternative; boundary="_4183b661-2641-46c9-831c-2fb6c538bad6_"
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

My Dear in Christ

Greetings to you in the name of our heavenly God. This mail might come to you as a surprise and the temptation to ignore it as unserious could come into your mind,but please, consider it as a divine wish and accept it with a deep sense of humility. My name is MR JAIN HAGIS I'm a 49 years old man,living in EUROPE,Though an American.

I was a merchant and i owned two businesses in Dubai. I was also married,with two children. My wife and my two children died in a september 11,plane bomb blast that happen in USA 6years ago. Before this happened my business and my concern for making money was all my interest as A living man. I never really cared about other values in life. But since i lost of my family, I have found a new desire to assist helpless families. I have been helpingorphans in orphanage/ motherless homes. I have donated some money to orphans in Sudan, South Africa, Cameroon, Brazil,Spain, Austria,Japan ,Germany and some Asian countries. Before I became ill, I kept $8 Millionin a long-term deposit account in a SECURITY/FINANCE COMPANY.

Presently, I'm in a hospital where I have been undergoing treatment for oesophageal cancer. I have since lost my ability to talk and my Doctors have told me that I have only a few months to live.It is my last wish to see this money distributed to charity organizations. Because relatives and friends have plundered so much of my wealth since my illness, I cannot live with the agony of entrusting this huge responsibility to any of them.

Please, I beg you in the name of God to help me collect the deposit and the interest accrued from the company and distribute it amongst charity homes and poor & needy in your country. Use your judgement to distribute the money and feel free to reimburse yourself when you have the money for any cost you incure during the process of collecting and distributing the money to Hurricane Katrina victims in USA ,Charity organisations,and motherless babies homes.

I'm willing to offer you a reward If you are willing to help, please reply as soon as you can to my email:

May the good Lord bless you and your family.

Regards,
MR JAIN HAGIS
Change is good. See what's different about Windows Live Hotmail. Check it out!

"Spainsh" lottery winning notification "E-mail"

From: DR LUIZ FERNANDEZ euspainlotterys@aim.com
Subject: CONGRATULATION!!! WINNING NOTIFICATION.
Date: June 16, 2007 10:35:30 AM GMT+01:00
Reply-To: infofernandezsec@aim.com
Return-Path:
Received: ... from aim1088.com ([84.76.178.9]) by isp (Xserve/smtpin32/MantshX 4.0) with SMTP id l5G9Zskm009479; Sat, 16 Jun 2007 02:35:56 -0700 (PDT)
Message-Id: <200706160935.l5G9Zskm009479@isp>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary=a4ad678d-d1bb-4568-ab24-88912ff8c6d9
Original-Recipient: [email]

EURO MILLION SPAINSH LOTTERY INTERNATIONAL.
FROM:VICE PRESIDENT
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REFERENCE:67/80/ESP
BATCH:ESP-541-623-782
DATE:12TH OF JUNE 2007
RE: WINNING NOTIFICATION / FINAL NOTICE
Sir/Madam
We are pleased to inform you of the result of the Euro Million Spainsh Lottery Winners International E-mail programs held on the 8th of JUNE 2007. Your E-mail address attached to ticket number 653-908-321-675 with serial main number 345-790-241-671 drew lucky star numbers 34-32-90-43-32 which consequently won in the 2nd category, you have therefore been approved for a lump sum pay out of 1.000.000.00 Euro.(One Million Euro)
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 100,000 company and 50,000,000 individual email addresses and names from all over the world.
This lottery was promoted and sponsored by his royal highness King Rey Juan Carlos ,This promotional program takes place every three year. We hope with part of your winning you will take part in our end of year 50 million Euro International lottery.
To file for your claim,please contact our fiducial agent:DR.LUIS FERNANDEZ
(FERNANDEZ SECURITY COMPANY SPAIN)
TEL:+34-648-823-675
Email: infofernandezsec@aim.com
Remember all winning must be claimed not later than two weeks,After this date all unclaimed funds will be included in the next stake.
Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible.
Congratulations once more from our members of staff and thank you for being part of our promotional program.
Note:Anybody under the age of 18 is automatically disqualified.
Sincerely yours,
MRS,COMFORT JOSE
Lottery Coordinator

Great spelling on this one.
Ad if I would end up winning one million, wouldn't it be MY responsibility to find it out?
Do people really believe in that they have been added by someone to some random lottery where they won million(s)?
And why would any such instance rely on "E-mail" to inform the winners, giving even the winning notification that way? Sure they must have also address and phone details in record then.
Plus I have not seen even one where the URL or the email sending domain would have anything to do with anything else but hotmail, yahoo, lycos, walla, or any other free email provider.
This "Spainsh" winning notification is no different.

I guess I should write a book about how to write GOOD scams that anyone would actually even remotely believe, get that on Amazon, and then send a reply to these unoriginal ones telling how much they could learn and how they could tenfold their income with some training in how to feed people bs ...

Aisha Qadir - millionaire laundering money to charity

From: mrsaishaqadir@aim.com
Subject: Please reply if you are interested
Date: June 14, 2007 1:44:13 PM GMT+01:00
To: [email]
Return-Path:
Received: .. from pc-a66cdb5b8f57 (hst-144-21.orlandonet.net [83.143.144.21]) by isp (Xserve/smtpin26/MantshX 4.0) with SMTP id l5ECU0vg021047for ; Thu, 14 Jun 2007 05:30:02 -0700 (PDT)
Received: from [83.143.144.21] by web335.mail.aim.com via HTTP; Thu, 14 Jun 2007 12:44:13 +0000 (GMT)
Message-Id: <0KAVSR0K.LO6MY9L@aim.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
X-Priority: 3
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
User-Agent: Mozilla 2.0 (Macintosh; I; 68K)
Original-Recipient: [my email]

Greetings,

My name is Mrs. Aisha Qadir, widow to late Mr. Ahmed Qadir, former owner of
Petroleum and Gas Company, here in Kuwait, I am 68years old, Suffering from
long time cancer of the breast, From all indications my condition is really Deteriorating, and it's
quite obvious that I won't live more than 3 months according to my doctors, this is because the cancer stage has
gotten to a very bad stage, I don't want your pity, but i need your trust.

My late husband died early last year from heart attack, and during theperiod of
our marriage we Couldn't produce any child, my late husband was very wealthy, and after his death, I
inherited all his business and wealth, The doctor has advised me that I will not live for more than 3
months, so I have now decided to spread all my wealth, to contribute mainly to the development of charity in
Africa, America, Asia and Europe, am sorry if you are embarrassed by my mail, i found your e-mail
address in the web directory, and i have decided to contact you, but if for any reason you find this mail
offensive, you can ignore it and please accept my apology.

Before my late husband died he was a major oil tycoon, in Kuwait anddeposited
the sum of 25million dollars (Twenty Five million dollars) in a company in Europe some years ago,
thats all i have left now, I need you to collect this funds and distribute it yourself to charity,
so that when i die my soul can rest in peace, the funds will be entirely in hands and management, i hope
God gives you the wisdom to touch very many lives, that is my main concern.
20% of this money will be for your time and effort, while 80% goes to charity.


God bless you.

Mrs. Aisha Qadir.

A millionaire in a poor country, with millions of dollars of illegal money ... the spouse is dead for a while now, and this dying millionaire found your contact details in a web directory and now wants your help to launder this money to charity and will pay you so much in return ...
How many times have I heard this story? Maybe 3 variations a day for the past 3 years ...

Even all these rich dying millionaires that are located in Muslim countries are always using God bless somewhere in the email. How about Allah bless, for once?

IP address is located in Sofia, Bulgaria.

Geneyratevideo.com - loam spam

From: conformal@bkkmail.com
Subject: Your refinan/ce application
Date: July 14, 2007 5:01:07 PM GMT+01:00
To: [another user's email]
Return-Path:
Received: ... 62.42.101.235.dyn.user.ono.com (62.42.101.235.dyn.user.ono.com [62.42.101.235]) by isp (Xserve/smtpin37/MantshX 4.0) with SMTP id l5DG0w9Q027096; Wed, 13 Jun 2007 09:01:20 -0700 (PDT)
Message-Id: <70355383.20280090@cherokee.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Original-Recipient: [my email]

Hello.
Important information regarding your l()an: ID MLDU2376
Your refinan/ce application has been accepted. We are ready to you a l()an.
Please finalize everything by visitig our Secure Web-form.
http://geneyratevideo.com

Of which

Domain Name: GENEYRATEVIDEO.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Visit AboutUs.org for more information about geneyratevideo.com
a href="http://www.aboutus.org/geneyratevideo.com"AboutUs: geneyratevideo.com/a

Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Domain name: geneyratevideo.com

Registrant/Administrative/Technical Contact:

metsales inc.
gordon metcalfe (gordomet@coldmail.ca)
+1.4033979426
Fax: +1.5555555555
7622 Elbow drive
calgary, AB T2V 1K2
CA

More Karin Patterson originated Viagra spam

From: busy4miles@urscorp.com
Subject: You pay We ship, NoPrescription, CialisPhentemineXanaViagra\/aliun from $2/pill MeridiaCelebrex RivotrilLevitrPropecia favour
Date: June 12, 2007 2:39:05 PM GMT+01:00
To: [someotheremail]

Certified OnlinePharmacy
Genuine Quality Ingredient & All Countries Shipping
ViagraAs 10pills $57
CialisAs 20pills $1xx
PhentermineAs 30pills $1xx
ValiumAs 30pills $95
XanaxAs 30pills $99
LevitraAs 10pills $73
plus 30 meds more RivotrilAs 30pills $70
AtivanAs 30pills $90
AmbienAs 30pills $1xx
MeridiaAs 30pills $1xx
SomaAs 30pills $1xx
CelebrexAs 30pills $1xx
plus 30 meds more
Best Price - Click Here To View More [link to http://kehuxw.alsoathankyou.com]

Of which we can get

Domain Name: ALSOATHANKYOU.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Registrant:
Name: Karin Patterson
Organization: Karin Patterson
Address: 408 McLaughlin Dr.
City: Santa Cruz
Country: US
Postal Code: 95064-1017
Email: karinpattersonmint@yahoo.com

Which makes it that she/he/them have been spamming habitually my inbox, and it annoys me enough to get an own label for this Karin Patterson.

Schoolisalways.com - viagra spams

From: am9discuss@cnh.com
Subject: 1 Million Satisfied Customers Worldwide, 100% Safe & Effective PenisEnlargement Pill raised
Date: June 11, 2007 6:10:25 AM GMT+01:00
To: [some other email]
Return-Path:
[..] Received: from 78.237.237.221.broad.ga.sc.dynamic.163data.com.cn (78.237.237.221.broad.ga.sc.dynamic.163data.com.cn [221.237.237.78] (may be forged))by isp (Xserve/smtpin50/MantshX 4.0) with SMTP id l5B4Achg028878; Sun, 10 Jun 2007 21:10:41 -0700 (PDT)
Message-Id: <76901.26134.30544@cnh.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [my email]

idea address tomorrow.
Safe & Effective PenisEnlargement
Over 1,500,000 bottles sold worldwide
WeOffer a FULL MONEY BACK GUARANTEE if you are not completely satisfied with the results of Man-XL, you have nothing to lose, just a lot to gain
A breakthrough in herbal Science has created a pill that has been designed specifically for PenisEnlargement. The tests that took place over a 6 month period showed that out of the 5,000 Males from around the world who participated, the average gain after 5 months of taking Man-XL pills was 3.02 Inches! Amazing, PERMANENT RESULTS that will last.
Did you know... Man-XL was featured in leading mens magazines such as FHM, MAXIM, plus many others, and rated No.1 choice forPenisEnlargement Also seen on TV
-:- Gain Up to 3+ Inches In Length
-:- Increase YourPenis Width (Girth) By upto 20%
-:- Help Stop PrematureEjaculation!
-:- Produce Stronger, Rock HardErections
-:- 100% Safe To Take, With NO Side Effects
-:- Fast Shipping WorldWide
-:- Doctor Approved And Recommended
-:- No Pumps, No Surgery, No Exercises
-:- Very discrete shipping and billing
-:- 100% Money Back Guarantee
-:- Up to 3 FREE Bottles Of Man-XL
-:- Highly secure 128bit order processing
See by yourself BEFORE & AFTER result by a customer
Buy This herbal EnlargementPills here [link to schoolisalways.com]

progress goes satisfaction,

Of which whois

Domain Name: SCHOOLISALWAYS.COM
Registrar: TODAYNIC.COM, INC.
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN

Registrant/Administrative Contact/Technical Contact:
Name: Karin Patterson
Organization: Karin Patterson
Address: 408 McLaughlin Dr.
City: Santa Cruz
Country: US
Postal Code: 95064-1017
Email: karinpattersonmint@yahoo.com

Edward Moore, $ 35 million ...

And today's winner loser is "Edward Moore".
He forgot to write on the spam that he is a banker from Some Fancy Bank in UK.
And how about for once, one of these banker scams could even fake to be coming from a bank's email address ad ISP? I have not yet seen a single one.

Absolut pearl part of it

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you

Don't you find it odd how he send the offer to transfer $ 35 million to undisclosed recipients?

Dear mr, since you claim that you know me and these $ 35 million are legal, please call me on the phone. I would not trust internet for such delicate matters. Since you say that you know me, you surely must have my phone number in your address book.

From: edwardmoore141@aol.co.uk
Subject: Permission To Transfer $35 Million USD
Date: June 11, 2007 2:39:42 AM GMT+01:00
To: undisclosed-recipients: ;
Return-Path:
[..] Received: from imo-m19.mx.aol.com (imo-m19.mail.aol.com [172.20.107.65]) by imr-d01.mx.aol.com (v107.10) with ESMTP id RELAYIN3-4466cb2104c; Sun, 10 Jun 2007 22:23:12 -0400
Received: from edwardmoore141@aol.co.ukby imo-m19.mx.aol.com (mail_out_v38_r9.2.) id j.d1a.c063172 (57881); Sun, 10 Jun 2007 21:39:47 -0400 (EDT)
Received: from mblk-d45 (mblk-d45.mblk.aol.com [205.188.212.229]) by air-ia04.mail.aol.com (v115.17) with ESMTP id MAILINIA43-e219466ca7df187; Sun, 10 Jun 2007 21:39:45 -0400
Received: from 41.205.166.74 by mblk-d45.sysops.aol.com (205.188.212.229) with HTTP (WebMailUI); Sun, 10 Jun 2007 21:39:42 -0400
Message-Id: <8C979E084BFC6CC-9AC-14E1E@mblk-d45.sysops.aol.com>
Mime-Version: 1.0
X-Mailer: AOL Email 27618
Content-Type: multipart/alternative; boundary=--------MB_8C979E084BFC6CC_9AC_27703_mblk-d45.sysops.aol.com
X-Mb-Message-Source: WebUI
X-Mb-Message-Type: User
X-Aol-Ip: 172.20.107.65
X-Spam-Flag: YES
Original-Recipient: [my email]


Permission To Transfer $35 Million USD

If with your permission, I can arrange for the transfer of $35 Million Usd into your personal account or company account. This transaction is legitimate and legal and hence you have no need to worry.

On acceptance of this offer please let me know so that i can furnish you with more details on this issue. An early response to my mail will be appreciated to enable us open up commuinication towards the realization of this goal.

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you.

God bless you and your family.

Regards
Edward Moore
edwardmoore911@yahoo.co.uk
Get a FREE AOL Email account with 2GB of storage. Plus, share and store photos and experience exclusively recorded live music Sessions from your favourite artists. Click Here for more information.

More digging on Leo Kuvayev aka Alex Rodrigez

And more digging on Leo Kuvayev aka Alex Rodrigez:

BBC : Massachusetts tackles spam gang - May 12, 2005
Not unknown in the wild wild web.
Leo Kuvayev @ Rokso
Kuvayev/Rodrigez at Spamtrackers.eu
Leo Kuvayev / Alex Rodrigez aka Badcow at Spamhaus.org
Spamhaus Statistics : The Top 10 of the whole planet
Lawsuit against Russian Spam Gang @ Spam Kings, O'Reilly (Spam Kings is a brilliant book by the way!)
Attorney General Tom Reilly Shuts down Spam King Leo Kuvayev @ Lindqvist.com
MA Atterney General on Leo Kuvayev (excl. Microsoft server errors)
Mr Kuvayev's home page in Web Archive, leonik.com
Kuvayev @ Information Week
Wed, 28 Feb 2007 Sick of spam? Get mad and get even
Leo Kuvayev is listed on the top 10 of the internet influent people

In the '90s Leo was a promising computer science grad student at the University of Massachusetts, where his focus was on artificial intelligence and machine learning. (His articles include "Intelligent Methods for File System Optimization" and "Learning to Play Hearts.") [articles]

Leo apparently became a US citizen in 2000 and was running some kind of online casino and Internet payment business out of Montreal. Last year, he launched a spam affiliate network called BadCow with a partner, Vladislav Khokholkov, who is also named in the lawsuit along with a handful of other people. The AP apparently reached Vlad by phone in Russia today, and he coyly said "I don't send e-mails."

(Spam Kings article above)



Bits and pieces
Mr Kuvayev / Rodrigez' ICQ = 101859176 (from his site, via internet archive, also listed on icq.com)
Mr Kuvayev's provided info (again all from his expired home page) about his 3 sisters :

Nadira's brief info:
Born in November, 1980 in Moscow, Russia
Height: 5'6''
Weight: on a slim side
Location: Moscow, Russia
Phone: +7 095 423-6337

Lana's brief info:
Born in November, 1980 in Moscow, Russia
Height: 5'6''
Weight: just right
Location: Boston, MA
Email: laname@hotmail.com

Regina's brief info:
Email: regi428@ilovechocolate.com

This guy is sued only in MA for close to $ 40 million. He seems to log in to his ICQ account regularly.
Why is it so hard to catch him?
ICQ logs for sure every time each user logs in from which IP address. I can only guess that ICQ respects the privacy of every user it has then. So it ICQ where all the Isreali. Palestinians and Al Quaida communicate as well as it gives them privacy?

Another paypal scam - billingline.com

From: do-not-reply@paypalsecurity.com
Subject: Please Restore Your Account Access
Date: June 9, 2007 1:07:33 PM GMT+01:00
Reply-To: do-not-reply@paypalsecurity.com
Return-Path:
[...] Received: from User ([38.114.33.242]) by smtpgw.armorholdings.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 09 Jun 2007 08:03:18 -0400
Message-Id:
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.3959
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-Priority: 1
X-Msmail-Priority: High
Thread-Index: AceqjirC+y1pkfyfQIaztd797ObJDg==
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]
X-Originalarrivaltime: 09 Jun 2007 12:03:18.0157 (UTC) FILETIME=[2AAF7BD0:01C7AA8E]

PayPal is constantly working to ensure security by regularly screening the accounts in our system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and we apologize for the inconvenience.
Why is my account access limited?

Your account access has been limited for the following reason(s):

June 09, 2007: We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is PP-xxx-xxx-xxx )

How can I restore my account access?

Please visit the Resolution Center and complete the steps to remove limitations.

To complete the verification process you must log in and go to resolution center and unlimit your account.

Of the link (www.domainline.com) we get

Domain Name: BILLINGLINE.COM
Registrar: DSTR ACQUISITION VII, LLC
Whois Server: whois.dotregistrar.com
Referral URL: http://www.dotregistrar.com
Name Server: NS1.EXTRAHOST.ES
Name Server: NS2.EXTRAHOST.ES
Status: clientTransferProhibited
Updated Date: 14-dec-2006
Creation Date: 20-jan-2005
Expiration Date: 20-jan-2008

Registrant, Administrative Contact, Technical Contact, Zone Contact:
Chazelle Christophe (BILLINGLINE-COM-DOM)
ExtraNext On Line consulting S.L.
Paseo Joan de Borbo, 16
Entresuelo, 2a
Barcelona, ES 08003
ES
+34 902955627
+34 935504050
whois@extranext.es

The spam selection of the past few days has been more interesting than for a while ...

From: ms_sarah_boko1@hotmail.com
Subject: Hi Dearest,
Date: June 8, 2007 10:28:15 AM GMT+01:00
Reply-To: ms_hopedaniel@yahoo.co.uk
Return-Path:
Received: from mrson2148.com ([196.207.219.199]) by ...com (Xserve/smtpin14/MantshX 4.0) with SMTP id l58BRFcl019517; Fri, 08 Jun 2007 04:27:16 -0700 (PDT)
Message-Id: <200706081127.l58BRFcl019517@...com>
Mime-Version: 1.0
X-Mailer: Microsoft Outlook Express 5.00.2919.6900 DM
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Original-Recipient: [my email]

Hi Dearest,
I'm Miss Hope Williams Daniel, i slim in staure above all i like being honesty,trusted, sincere. I have gonne through
your porfiles, it interest me to know you more, and I hope to use this opportunity to explain myself a little about me,
i am fair in complexsion,5.9fit tall, 44kg. I wish you to write me through id (ms_hopedaniel@yahoo.co.uk). also i
will send you my picture after hearing from you. Somethings I like to do in my spare time are gardening, home
improvement projects, camping, bicycling in the park, backyard bar-b-ques, moon-lite walks on the beach, preparing
candle-lite dinners for someone special, sending flowers to someone special for some reasons, sitting and watching
the sun set with someone special, and cuddling in front of a fire with someone special. I enjoy cooking, gardening,
playing billards, darts, dinning out, going to the cinama, traveling and site-seeing, museums, and concerts. I like
almost any kind of music, but I think my favourite is instrumental jazz. i will tell you more about myself again in my
next mail dear and hope to hear from you soon.
Love From,
Miss Hope Williams Daniel

Interesting, a fair complexed 'woman' in Britain that spells worse than a Nigerian banker, and who has her weight and height in metric.
Oh dear Hope, I'm into women with creative spelling and such original hobbies... tell me what kind of women turn you on and you are looking for?
Oh and dear "Miss Hope William Daniel" .. why do you make some Sarah Boko read your email replies?

What kind of spam would you like to see here?

And some interesting statistics for once again.. keywords from logs how this site has been found (mostly google).

lochers paris
africans hotmail
nomarriage.com
cmpgnr.com
angelstar pornstar
you have won the yahoo/msn inc and the microsoft windows lottery
pacnames
yahoo/msn lottery incoperation
scam exquisite replicas
bookmyname.com
felicia samson
yahoo/msn lottery inc & windows live
yahoomsn lottery
alex rodrigez
yahoo and microsoft window inc lottery

So it looks like that I am not the only one getting these scam attempts and my mailboxes loaded with these spams ....
If you found yourself here searching for something special - what is it that you would like to see in an antispam site? Do you have any good spams and scams that you got recently? Please post as comments, we are open to collaborators ...

THREE soldiers from Ameria whose style is the same of the Nigerians

From: dayansalim31@hotmail.fr
Subject: Please Comfirm Reciept
Date: June 7, 2007 8:30:16 PM GMT+01:00
Reply-To: wilkinsdenis@myway.com
Return-Path:
Received: [...] from hotmail.com ([65.54.174.41]) by bay0-omc1-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 07 Jun 2007 12:30:18 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 07 Jun 2007 12:30:17 -0700
Received: from 65.54.174.200 by by103fd.bay103.hotmail.msn.com with HTTP; Thu, 07 Jun 2007 19:30:16 +0000 (GMT)
X-Originating-Ip: [41.223.251.78]
X-Sender: dayansalim31@hotmail.fr
Message-Id:
Mime-Version: 1.0
Content-Type: text/html; format=flowed
X-Originating-Email: [dayansalim31@hotmail.fr]
Original-Recipient: [email]
X-Originalarrivaltime: 07 Jun 2007 19:30:17.0909 (UTC) FILETIME=[47AD5E50:01C7A93A]

Dear friend,

We are team(THREE IN NUMBER) of American soldiers writing from Baghdad in Iraq.We are urgently seeking your assistance to secure the below consignments with attached photos.Please see photo below.

The goods were captured here in Baghdad 2 weeks ago abandoned in one of the underground treasure house.The goods consist of GOLD BARS, GOLD COINS and HUGE AMOUNT OF CASH in the sealed boxes.

To make my message short I will go straight to the point.At this moment we have succeeded shiping the goods outside Iraq to another country and have placed it in the custody of a treasury company.We will want you help us receive and secure the boxes.Once you receive it open the boxes and re-transfer the money to bank a account which we will give you latter.Due to law and restriction order we are unable to transport and secure the good in Ameria ourselves that is the reason we are seeking your help in receiving the goods on our behalf.You will be entitled to 20 bars of gold and raw cash;amount we will tell you once you reply.We will appreciate you reply us quickly indicating your readiness to help us.As soon as we receive your positive reply we shall furnish you with further details;the amount you will be entitled to and the current location of the boxes containing the goods. Perfect arrangement have been made to make sure the boxes arrive you safely.

Please note that this information must be handled with utmost confidentiality so as to avoid publicity which may risk our job, as you may know we are at war and still in active service.You may call me on phone +964 7032700320,ask of Sergent.Ray,for security reasons call me only between 19 hours-21 hours GMT.

Yours truly.

SGT.Wilkins Ray
Team Leader

Dear team of THREE soldiers from Ameria, would you mind to explain me why your style of writing looks identical to all these Nigerian scams?

Rolex spammers - intheworldseries.com

From: pokk8hmcy@starstream.net
Subject: Swiss Rolex, Patek Philippe, Panerai, Omega, Breitling, IWC, Tag Heuer From $199, Limited Stock! srbb
Date: June 6, 2007 8:07:03 PM GMT+01:00
To: [some email]
Return-Path:
Received: ...
from ioxemua (adsl-dyn12.91-127-77.t-com.sk [91.127.77.12]) by [isp] (Xserve/smtpin60/MantshX 4.0) with SMTP id l56I71Xh018208; Wed, 06 Jun 2007 11:07:26 -0700 (PDT)
Message-Id: <564r564p.6650732@starstream.net>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=surely.changed; d=starstream.net; b=QjJVeUfegyYhvqkLmVHoLomQcOrCDMssOAHyXiVaPuAoJWtvJfSoOBwehpNRjZvfMWYXVJxozeJWNeUT;
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [email]

garden within know? using dark sudden bought,Swiss Watch Retailer
Special From $ 199
Bestseller Watches
A.Lange & Sohne
Audemars Piguet
Breitling
Bvlgari
Cartier
Chanel
Chopard
Franck Muller
IWC
Jaeger-Lecoultre
Omega
Panerai
Patek Philippe
Rolex Ladies
Rolex Mens
SWISS Rolex
Tag Heuer

Checkout the hottest watches now
circumstances know and mistress bad? favour your appearance blue?

had link to http://rymibryk.intheworldseries.com/

Of which we get very similar results than for the previous entry. Again real registrant hidden, but internet.bs is the domain used by the spammers. Once I find a third spammer using that domain, or a spam of a third different product and domain registered by that domain, I'll count that domain registry service as spammer operated as well.

Domain Name: INTHEWORLDSERIES.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.ROCKETSKYROCK.COM
Name Server: NS2.ROCKETSKYROCK.COM
Name Server: NS3.ROCKETSKYROCK.COM
Name Server: NS4.ROCKETSKYROCK.COM
Name Server: NS5.ROCKETSKYROCK.COM
Status: clientTransferProhibited
Updated Date: 05-jun-2007
Creation Date: 05-jun-2007
Expiration Date: 05-jun-2008

Theyankeesbeat viagra spam

From: kvobm0bzg@ups-scs.com
Subject: Ciali Valiun Viagre Xanas At Super Low Price, Express Ship To All Countries lm
Date: June 6, 2007 8:07:51 AM GMT+01:00
To: [my email]
Return-Path:
Received:[....]
from wxiww ([84.36.22.143])by [isp] (Xserve/smtpin70/MantshX 4.0) with SMTP id l5667pG7023666for ; Tue, 05 Jun 2007 23:07:52 -0700 (PDT)
Message-Id: <830l240s.7096704@ups-scs.com>
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=miserable.food; d=ups-scs.com; b=lLKFpjXnVVPKMaCbkqvNRbIHtbWVBUWnoRhnzItZNSkUYnEsIrQxyAWJkddyfytzcwBZDLIoJrcCdofO;
User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111)
Original-Recipient: [my email]

Express Drug Mart
We are the best price on all high quality meds. Established by a reputable Canadian Doctor and Scientist, Express Drugmart's mission is to provide you with a secure online environment to purchase the safest, quality medication

Viagraa (Brand & Generic available) - as LOW as $ 2.25 per D0SE
Cialiss (Brand & Generic available) - as LOW as $ 2.25 per D0SE
Valiumm - as LOW as $ 1.50 per D0SE
Xanaxxxxx - only $ 1.50 per D0SE
Ambienn - only $ 1.65 per D0SE
Ativann - only $ 1.50 per D0SE
Somaa - only $ 1.50 per D0SE
Clenbuterol - only $ 2.50 per D0SE
Meridiaa (brand name) - only $ 3.99 per D0SE

See What Meds Has Special Discount
Click On This Link [had a link to http://btsckz.theyankeesbeat.com/]

Of which we get

Domain Name: THEYANKEESBEAT.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.ROCKETSKYROCK.COM
Name Server: NS2.ROCKETSKYROCK.COM
Name Server: NS3.ROCKETSKYROCK.COM
Name Server: NS4.ROCKETSKYROCK.COM
Name Server: NS5.ROCKETSKYROCK.COM
Status: clientTransferProhibited
Updated Date: 05-jun-2007
Creation Date: 05-jun-2007
Expiration Date: 05-jun-2008

Unfortunately can't dig the details of the registrant person or gang yet.

And Alex Rodrigez aka Leo Kuvayev has his wikipedia entry

I wondered how long it would take before Alex Rodrigez would get his own wikipedia entry. It didn't take that long, since he already has one. Under his real name it appears.
From that wikipedia entry:

The last known email address for Kuvayev, under his alias, was domains@locu.st.

If that brings any joy for your revenge.
More on Leo Kuvayev / BadCow owned domains.
European spam wiki puts

Russian/American spammer, a spin-off or occasional partner with Alan Ralsky, Igabromiv, Lindsay and also the P/A/Y gang.
Does "OEM CD" pirated software spam, child and animal porn spam, porn payment collection, pharma/pills, phishing, and others. Does his own DNS, possibly does DNS for other spammers. Buys bulletproof hosting wherever he can get it. Noted for enormous numbers of domains (bogus registration info, of course), often rotating every three hours in the spam to avoid URIBL filters. Mails via proxies using the usual spamwares, probably off his own (leased) servers. Noted for having "fresh" peas, meaning he is very close to the botnet masters collecting new, unlisted, zombie IPs. Was part of Sun Network spamhaus on MCI, gets BP hosting in Brazil, China, Russia, etc.

Loan spammers - onlycghjguff.com

From: preemption@guadalupano.com
Subject: Reduce your current loan rate!
Date: April 14, 2007 3:11:19 PM GMT+01:00
To: [some other email]
Return-Path:
Received: [..] from AAnnecy-157-1-132-158.w90-14.abo.wanadoo.fr (aannecy-157-1-132-158.w90-14.abo.wanadoo.fr [90.14.51.158]) by mac.com (Xserve/smtpin27/MantshX 4.0) with SMTP id l2EED2ci006049; Wed, 14 Mar 2007 07:13:03 -0700 (PDT)
Message-Id: <28384979.44116607@debut.com>

Hello!
We are glad to inform you about the way to save your money!
This way is so simple that you will be surprised! What is it, you wonder?
Stop overpaying mortgage rates!
You will save over 250 dollars a month by reducing your current loan.
You are only to fill the form which will take you 30 second.
It is a winning game!
http://onlycghjguff.com/
With deepest respect and best wishes,

Of which whois :

Domain Name: onlycghjguff.com
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET

Registrant Contact
Name: Gary Reed
Address: 3495 Cambie street
150
Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695
Administrative Contact
Name: Gary Reed
Address: 3495 Cambie street
150 Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695
Technical Contact
Name: Gary Reed
Address: 3495 Cambie street
150 Vancouver, BC V5Z 4R3 CA
Email Address: garyr@coldmail.ca
Phone Number: (604)767-8695

Cinemium.com - TCF bank scammers

From: onlinebanking.alert@tcfbank.com
Subject: Online Banking Security Notification
Date: March 12, 2007 3:01:58 PM GMT+00:00
To: [my email]
Return-Path:
Received: [..] (from leppink@localhost)by lsh101.ams.nl.siteprotect.com (8.11.6/8.11.6) id l2CF1wE25257; Mon, 12 Mar 2007 16:01:58 +0100
Message-Id: <200703121501.l2CF1wE25257@lsh101.ams.nl.siteprotect.com>

Dear TCF Express Bank Customer,

Security Precaution For optimal viewing of the TCF Express Bank Web site, we recommend that you enable CSS. For your security, we have temporarily prevented access to your account. TCF Express Bank safeguards your account when there is a possibility that someone other than you is signing on. You may be getting this message because someone is signing on from a different location or device. In this case, your access may be restored when you return to your normal sign on method. You are required to log on your account information via the link below to secure your account details. Thank you for helping us protect your account..

http://www.tcfbank.com/secure/view/online/statement/ssl.cfm

Regards,
TCF Express Bank Online Service.

Of which whois :

http://www.cinemenium.com/news/userr/tcf/index.htm/
Domain Name: CINEMENIUM.COM
Registrar: NETWORK SOLUTIONS, LLC.

Registrant:
gottoseeit.com
14404 N. 15th Pl.
Phoenix, AZ 85022
US
Domain Name: CINEMENIUM.COM
Administrative Contact, Technical Contact:
Demetrian, Ovi ovi@HOME.COM
aBSOLUTE sOUND SySTEMs
6819 N. 12th st. #15
Phoenix, AZ 85014
US
(602) 230-7122

Another lottery scam - 500,000 US $ Euros

My favorite part of this scam :
Prize Amount: US $500,000 Five Hundred Thousand Euros Only - I have never seen US $ Euros in my life so far ....

From: worldsoftware23@aim.com
Subject: CONGRATULATIONS!!! YOU HAVE WON
Date: March 12, 2007 5:18:25 AM GMT+00:00
To: My email address
Reply-To: worldsoftware23@aim.com

Lottery Group: Consolation Prize Group
Prize Amount: US $500,000 Five Hundred Thousand Euros Only
You are required to file claims for your lottery prize winning by contacting the Lottery
Claims Processing Officer with your winning information provided above.
Lottery Claims Officer:
Name: Mr. KENNETH HOORT
Email: worldsoftware23@aim.com
Tel: +31-616248143
Fax: +31847520588
Congratulations once again from all our staffs on your consolation prize winning, we hope you will partake in our forth coming world software Lotto-Wheel
Email-games.
Provided in attachment is a Non resident claims form you are required to completely fill the claims form with your correct information and submit same.
We look forward to receive receipt of your information.
===============================================================================
NON-RESIDENT AWARD CLAIM FORM GG
==============================================================================
FULLNAME:....................................................................
FORWARDING ADDRESSE:.........................................................
CITY/STATE:.......................
COUNTRY OF ORIGIN:.......................
MARITAL STATUS:.....................
NATIONALITY..............
SEX...........
PASSPORT NR:..................
DATE OF BIRTH:.................
TEL/FAX NR: .........................
OCCUPATION:..........................
CURRENT EMAIL:............................
================================================================================================
WINNING INFORMATION
================================================================================================
COUPON NR:..................................
LOTTERY REF NR:..................
LOTTERY DATE:..................
CLAIMANT
SIGNATURE:...........................
================================================================================
Yours truly,
Mr. Mirrel Smith,
(Lottery Coordinator)

American Axle & Manufacturing, aam.com

From: american_axlemanufacturing6@yahoo.com
Subject: From American Axle & Manufacturing
Date: March 7, 2007 10:10:35 AM GMT+00:00
To: american_axlemanufacturing@yahoo.com
Reply-To: american_axlemanufacturing@yahoo.com
Return-Path:
Received: [..] Message-Id: <20070307101035.19798.qmail@web63008.mail.re1.yahoo.com>
X-Brightmail-Tracker: AAAAAQAAA+k=
X-Language-Identified: TRUE
Original-Recipient: [my email]

American Axle & Manufacturing,Company
One Dauch Drive
Detroit, MI 48211-1198
www.aam.com

ATTN;Sir,
I know that this E-mail will be a surprise to you, but I got your mail through Internet. I am Richard Jefferson the secretary to the chairman of American Axle & Manufacturing Company; we deal on, engineering, validation and manufacture of driveline systems, chassis systems, and forged products for trucks, buses, sport utility vehicles, and passenger cars.

We are interested in opening a branch in your country and I want to confirm from you if we can get 58 (Fifty Eight Acre’s) of land for our new site.We need three good warehouses where we can store our machines and two complete building duplex, at least for temporary office until we finish our main site.

However, the company will like to make you the African representative. You can send your contact number. Please if you can do that, contact me immediately through my mail address.
Thanks And Kind Regards

Richard Jefferson Secretary
To Richard E. Dauch .
Co-Founder, Chairman & CEO
American Axle & Manufacturing

Of which : aam.com ->

Referral URL: http://www.ebrandsecure.com
AAM.COM
Language:
Created: 4/10/2006 10:04:00 AM
Updated: 4/10/2006 10:04:00 AM
Expires: 9/10/2007 12:00:00 AM

American Axle & Manufacturing (JHSG2G4L7)
Administrative Contact:
American Axle & Manufacturing (JHSG2G4L7)
1840 Holbrook Ave.
Detroit, MI 48212
United States
Phone: +1.3139742399 Fax: +1.3139742848
E-Mail: friedmg@AAM.COM
Updated: 4/10/2006 10:04:00 AM
Created: 3/28/2006 7:20:00 AM

Billing Contact:
ccTLD @ Billing (AY6B2QT4V)
CSC Corporate Domains Inc
PO Box 597
Yarmouth, Nova Scotia B5A 4B4
Canada
Phone: +1.9027465201 Fax: +1.4137238334
E-Mail: cctld-billing@cscinfo.com
Updated: 1/11/2007 12:20:00 PM
Created: 8/12/2004 11:13:00 AM

Technical Contact:
EDS @ NNAM (0DL6KK1HM)
5400 Legacy Drive
Plano, TX 75024
United States
Phone: +1.2482655000 Fax: +1.1231231234
E-Mail: dnsmaster@eds.com
Updated: 4/10/2006 10:04:00 AM
Created: 3/28/2006 7:21:00 AM