BUSINESS PROPOSAL FROM THE SPAM PARK: URGENT REPLY NEEDED!

The comedy of porn spam

2006-07-20T06:47:00.000-07:00

Porn spam is once again on the rise. Here's a summary of what I'm seeing these days broken down in to neat categories.

Confusing

New start out specific nest of y0ung girls

I wasn't aware that young girls lived in nests. I wonder what they build them out of? I'm guessing discarded cloth, twigs and saliva. That web site probably isn't safe for work viewing, that idea makes Japanese porn seem boring.

Brutal d01ls worldwide

Not sure this is porn actually, I think I already own one of these brutal dolls. It's a toy (okay, it's a doll) based on a the character Grom Hellscream. A pretty brutal toy even if his rubber axe has a habit of bending a bit.

Success!

(This is a series of spam emails who's subjects always consist of "Success, ". This has led to subject likes "Success, world war" (yeah, we're all happy when another of those comes along), "Success, way freight" and so on.

Subject: Success, writing lesson

Your cre dit doesn't matter to us! If you OWN real est ate
and want IMMEDIATEK cash to spend ANY way you like, or simply wish
to LOWER your monthly paym ents by a third or more, here are the dea ls
we have TODAY (hurry, these ofers will expre TONIGHT):

$488,000.00 at a 3.67,% fixed-rateL
$372,000.00 at a 3.90,% variable-rateA
$492,000.00 at a 3.21,% interest-onlyS
$248,000.00 at a 3.36,% fixed-rate1
$198,000.00 at a 3.55,% variable-rateY

Hurry, when these deals are gone, they are gone Simply fill out this one-min ute form...

Don't worry about approval, your cre dit will not disqualify you!

I think they spoke to early. I'm happy that the spam writer considers their writing lessons to be a success but on reading their mail I doubt they were paying much attention in class. Mind you, a they aren't as stupid as the twats who'd fall for such an obvious scam.

"Wow, a bank I've never heard of before sent me an email typed by baboons and proof-read by a professional footballer which promised me a mortage without knowing where I live, who I am or what my current financial situation is. I'd better be quick and go to this web site and give them my personal financial details including my bank account number and any other information a criminal would need to rob me blind. Reminds me, I need to buy some lottery tickets later, better stop at the fortune teller to see what numbers I'll use."

Mum?

These are emails from a chap who's mother and girlfriend add up to fewer than two people. Problem still only two if you add his sister. They're particularly amusing since they seem like very poorly translated lyrics from a hentai film theme tune.

Withb my shot on inside mothers rear wide outlet I had eat seeds running falling out of her.

Okay, the idea itself is pretty unpleasant but you've got to enjoy the English. Rear wide outlet? Does anyone in the world actually refer to their arse in this way or does his mother have some kind of special arse that alone deserves this name?

Because with mome indeed allows
myself to desrtoy all enters with strongr attacks.

They're keeping it in the family still but what the fuck are they keeping in the family? I am honestly baffled by this text.

A scammer who can carve wood?

2006-04-25T04:36:00.000-07:00

This story is amazing. 419baiters managed to get a scammer to carve them some wooden models (in the hopes of obtaining a grant). I won't go in to much detail here since you really need to read this from start to finish to appreciate it.

Scammer got wood

Does your 'GF' talk about you?

2006-03-07T02:35:00.000-08:00

This email is hysterical.

From:
Subject: is ur GF happy
Date: 5 March 2006 12:26:33 GMT
To: (Removed)
Cc: (Removed a number of .mac addresses)

Good evening Thierry,

Listen to this, Vicente told me a couple days ago that ur gf been not
satified about u in the bedroom. I can assist with that. Visit here
(URL removed). I've been using them for a years now
and nothing but good things for them.

experiences can easily be related to and will forever link Holden with
every member . regretted their actions because they found themselves on the
verge of bankruptcy and it made them very vulnerable to European invasion.
The

Hope is was of some help
Sarita

So Thierry's girlfriend doesn't like his horizontal mambo, spoke to Vicentre about it (that's nice of her), Vicente then spoke to Sarita who is now advising Thierry on how can can add some thrust to his pocket-rocket. This has all the makings of a Jerry Springer show.

Thierry: Well bitch, don't you be telling mah homies 'bout mah wang, know what I'm sayin'?
Girlfriend: Well don't you be not satisfying me dog, know what I'm sayin'?
Audience: Woooooooooooo
Chair: Look, will someone just pick me up and throw me PLEASE!!!

New act of terrorism in New York

2006-03-07T02:27:00.000-08:00

This is my first trojan I think. Here's the email.

From: news@bbc.com
Subject: New act of terrorism in New York
Date: 6 March 2006 15:10:57 GMT
To:

Today the FBI has informed new act of terrorism in New York.
Look details in an applied file.

The email carried a zip file containing a mysterious executable which I assume to be a trojan. It's fairly easy to see that this email wasn't sent by the BBC since the English is so absolutely piss-poor.

What's up claude?

2006-02-19T05:38:00.000-08:00

Adverts for web sites selling counterfeit watches seem to be popular at the moment. Here's an example. The English in this mail is particularly amusing.

"What's up Claude

I just got off the phone with my boss, who says "howdy," and she wanted to
talk with us about an incredible vendor she heard about at

She disclosed to me that this website brags a great selection and good
prices that disrepute our nearby venue!

I'm excited about exalting your new job this weekend!

You guys should go on the internet and start shopping immediately and
desist this foolishness of getting ripped off at our old venue!

no worries
ebrehem"

buy cails-rtabs without embarrassment

2006-01-09T06:46:00.000-08:00

Blimey this is the most bizarre spam I've ever seen.

Seems it's a nice service that allows you to buy viagra-type medication online to avoid the embarrassment of having to go to shop and buy it from a licenced literate professional.

It's bloody embarassing opening the email though. Included in the email is a large logo with a photo of a giant erect dick in the middle of it. Opening this email at work was not much fun.

Call me old-fashioned but I'm not buying anything advertised in spam and certainly not when they include a giant dick in the email. Surely it would have been enough to simply describe the effects of the shite they're peddling.

The URL being advertised is inchoice.net. This domain is registered to an address in Bulgaria. The web site has been unreachable now for a few days yet the spam continues. This is one thing I love about spam. It's so cheap to send and so even if it's pointless, as in this case advertising a web site that doesn't work, they'll keep sending it. Thousands of people get bothered and ultimately for no reason.

Interesting new approach to spam - fake conversations

2005-12-31T11:05:00.000-08:00

I've noticed a new method being used by spammers. Take a look at this.

From:
Subject: FW: Adorn your wrist with a luxurious renowned wrist accessory.
Date: 31 December 2005 02:41:12 GMT
To:
Reply-To:

What's new,

I know you soundly enough to see that you are obsessed with moderately
priced luxuries, so come by this web page!

See you tonight,

Meira

-------Original Message-------

From: Giamo [mailto:]
Sent: Saturday, December 24, 2005 9:41 AM
To: Meira
Subject:

How is your day, Meira

You're a savvy lady and you deserve to have gorgeous items. You've been
working so hard; you actually deserve a chic looking time piece to show off
all your success.

I can just visualize the overjoyed look on your face when you receive your
order. Not only are the prices reasonable, but this web page has real time
tracking, as well.

Well, I fell upon an e store that has lots of excellent ones and I honestly
think you should stop by.

lack the moon is maintain two hostility hours in the sky. Then will I make
During thunder the duckling grotesque football dance
shadow has gone by. As for me, I scrutinized part your face once, send and
it

Giamo

Now here's what this email is about. The bit at the bottom was marked as coming from my address, therefore making it look like it was me who originally sent an advert for the web site to Meira. The top bit is the fake reply to the fake original where Meira for some curious reason to invite me to visit the web site mentioned in the original mail, which appears to have come from me.

Why do they do this? I presume it's to trick mail admins. When I report this as spam, the mail admin who looks at the mail could well thing that I initiated the contact myself. It's an interesting new approach.

I've noticed a general increase in emails where the sender pretends to be my friend. Of course the language they use is just like Meira's, bloody weird for want of a better phrase. It reads like a poorly translated statement taken from a drunk marketing executive.

The email above was advertising an online store in China that sells replica watches. The URL of the site is desiredspecalshere.com. I'd strong advise against buying anything from this site. If anyone is considering purchasing online from a web site hosted in China, you may as well just send the money to my PayPal account. You'll get nothing in return from me but at least I'm honest about it.

Can this person be any more illiterate?

2005-12-09T09:27:00.000-08:00

This spam is great, just received it earlier today. They follow the golden rule of spamvertising.

Golden rule number 1

When trying to persuade complete strangers around the world to buy a product, never use a spell-checker. Your customers will be impressed that you spend so much time finding them bargains that you simply don't have time to write like an adult.

Lime ited Time Oaffer. Go gruab it today.
Every watch we carry is of the highest equa lity ore plica grade available. We take pride in oof fering our customers quality watch es that no one will even know it is a arep lica.

Bauy 2 or more watches from ANY category or brands from our website and receive a 25% discount automatically on BOTH watches.

Find rueplicas, roeplica name brand watches, waitches for women and men. Solid gold wautches available at discount, wholesale pr! ses! Give the gift of time. Visit us today and place your 0 erder.

COiPY the Addreiss below and paste in your weib broiwser:

[URL REMOVED]

will work for 48 hrs.

Simply wonderful! Is it the web site or the watches that will work for 48 hours?

Pointless spam

2005-10-11T01:00:00.000-07:00

This is probably the most annoying spam. The type where the sender actually forgot to include the thing that they were trying to advertise.

Return-path:
Received: from mac.com (smtpin23-en2 [10.13.11.59])
by ms81.mac.com (iPlanet Messaging Server 5.2 HotFix 2.06 (built Mar 28 2005))
with ESMTP id <0IO5007A2TLPSN@ms81.mac.com> for
; Mon,
10 Oct 2005 12:46:37 -0700 (PDT)
Received: from 59-112-40-138.dynamic.hinet.net
(59-112-40-138.dynamic.hinet.net [59.112.40.138])
by mac.com (Xserve/smtpin23/MantshX 4.0) with SMTP id j9AJkZc9025065 for
; Mon, 10 Oct 2005 12:46:36 -0700 (PDT)
Received: from unknown (HELO memoir) (192.168.35.148)
by 59-112-40-138.dynamic.hinet.net with SMTP; Tue, 11 Oct 2005 03:43:43 +0800
Date: Mon, 10 Oct 2005 12:46:35 -0700 (PDT)
From: Claud Morgan
Subject: Want to learn how to build your own website?
To:

Message-id: <7538679964.2462751245@59-112-40-138.dynamic.hinet.net>
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7bit
Original-recipient: rfc822;

Take the office with you where ever you go...
You are not allowed to access this page from this IP address.

Type faces--like people's faces--have distinctive features indicating aspects of character
It's simple. It's just things with chalk on a board.

I stand by all the misstatements that I've made.
Desire creates the power.

Marriage: a long conversation chequered by disputes.
Lawer: one who protects us against robbery by taking away the temptation.

Spammers often include nonsensical text to try to trick spam filters. Looking at this email, I suspect that this retard included the text to trick the spam filter but forgot to actually include the site or service they're trying to advertise.

My first Spanish spam scam

2005-10-03T04:59:00.000-07:00

Today I received what looks like my first Spanish scam email. Although I can't read spanish, it looks like a phishing scam.

Numero del caso: BV-0932-10-7205

Querido usario BancoDeValencia confió a mantener un ambiente seguro para su comunidad de clientes. Para proteger la seguridad de su cuenta, BancoDeValencia emplea algunos de los sistemas más avanzados de la seguridad del mundo y nuestros equipos antifraude defienden regularmente el sistema de BancoDeValencia para la actividad inusual.

Recientemente, nuestro equipo de la revisión de la cuenta identificó una cierta actividad inusual en su cuenta. De acuerdo con el acuerdo del usuario de BancoDeValencia el acceso a su cuenta será limitado. Esto es una medida preventiva del fraude significada para asegurarse de que su cuenta no está comprometida. Para asegurar su cuenta podemos requerir una cierta información específica de usted.

Siga por favor el acoplamiento abajo y renueve su información de la cuenta:

https://www.bv-i.bancodevalencia.es/confirm/index.jsp

© Copyright 2005, Banco de Valencia, Inc.

Paypal.pif scam spam

2005-09-05T11:01:00.000-07:00

Here's a typical example of how computers will never be secured until we just remove the users. Someone I work with asked me how to open a paypal file they'd been sent.

I checked the email and here's what I found.

The email was from a strange address that she'd never heard of before. The email contained no text, just a file called Paypal.pif. She had been double-clicking this file to try and open it without even knowing who it was from or what it did. She assumed it was okay because she has a Paypal account. So, she received a file from a complete stranger with no explanation of what it was an just clicked.

It's like someone walking up to you in the street, handing you a bottle of liquid, telling you it's 7-Up and then asking you to drink it.

Lucky the file was rendered harmless and didn't screw her machine. Really makes you wonder though how far security will have to go before a system can be secured. I don't think it's ever going to be possible personally. Even if all executables have to be signed, you just can't protect the whole system while still maintaining the functionality that users want.

You can offer warning dialogues but users experience 'dialogue fatigue'. They see so many warnings that they just habitually click them away.

pricelifeinsurance.com being spamvertised

2005-08-30T09:18:00.000-07:00

Another blog spammer has visited. This time, they were advertising PRICELIFEINSURANCE.COM.

here's an example.

Spam example.

A blogger user called dangelo56lidia seems to be the main culprit here. When they link to the insurance company above, they user the referrer name 'bbit'. I'd report them to the insurance company but since the company itself seems to have a history of being linked to spam, this would most likely not help.

dangelo56lidia is also posting spamvertising juicyfruiter.blogspot.com. Whether they are connected to this blog is hard to say but I can't see any reason for them to link unless they are one and the same person.

If you see generic looking posts from dangelo56lidia or others, please delete them from your comments. Too often, these spammers visit blogs and post their "Great blog, really interesting!!!! visit http://pornandviagra.com" comments and the blog owner actually thanks them for visiting.

It's fortunate that Blogspot doesn't allow comments to be crawled by search engines. At least this stops these people from abusing blogs to improve their page-rank.

Strange answer-phone message

2005-08-29T01:57:00.000-07:00

It's a momentous day today! I've received my first ever answer-phone spam. It's a recorded message that unfortunately was a bit garbled so I wasn't able to hear the company name. I did note down the number though (01580445146) so I could google it but didn't find any search results.

Anyway, so what was this message about? It would seem that I have been chosen to receive a prize. Although they could not tell me what I had won (which seems slightly odd), they provided a list of what I may have won. This a plasma television, a laptop computer, 1000 euro and a weekend break. The weekend break seems to be the cheapest of all the prizes so I suspect that if I were to call, then I'd have a weekend break in some cursed post-industrial northern town.

I'll never know what prize I won since the call is charged at 2 euro per minute so I'm not really inclined to call them. I didn't hear a company name either so I can't even look for a postal address.

I've contacted regtel (The Irish regulatory body for premium rate services) since this unsolicited advert is a breach of their Code of Practice.

The Blog Spammers Commeth

2005-08-25T05:37:00.000-07:00

Seems that some blog spammers have converged on this site.

The strangest one for advertising an organisation called Credon Inc. I had a very quick look at their web site and without reading too far in to it, it seems very questionable. I'm not sure if it's a scam or not but it looks like one of those systems where you convert regular money in to virtual cash.

Some people consider regular cash to be more useful however since it does tend to be accepted in more places than Credon Galactic Units or whatever they call their currency. The fact that their site seems to have an overtly religious element (The title is 'The Interim Monetary System of Heaven on Earth') also makes me suspicious. The terribly unprofessional web site design coupled with laughable spelling and grammar does inspire confidence.

The next one was interesting. Someone has been spamming blogs far and wide and an effort to advertise http://datarecoverysystems101.blogspot.com.

Someone is visiting blogs and posting the same generic comment.

Just thought I would visit and ask that you return the visit. Thanks!

Data Recovery Systems

They of course link back to the address above.

Dark choco nipples temporizingr for somer of yourr cream!

2005-08-16T02:00:00.000-07:00

This spam is great. It's as if someone has learnt English by just reading Slashdot comments.

Subject: SEXUALLY-EXPLICIT: bring sphere obese additional worked at ripped dramatic interest

Good morning, let me introduce for you our New-fangled galleriess.

Dark choco nipples temporizingr for somer of yourr cream!

get out

How in the name of Mbuto do nipples temporize?

The get out text at the bottom was a link to another geocities site where you can apparantly unsubscribe. Of course this won't work. It only confirms that your email address is valid and so will only get more spam sent your way. If you are receiving bulk-mail from a legitimate source, for example mail from Adobe, then following the instructions to unsubscribe will work. If on the other hand, the bulk-mail you received is written in poor English and shows obvious attempts to bypass spam filters then you should never follow the unsubscribe advice - just report the spammer to their ISP via Spamcop. Spamcop provide a free service but you can pay a very small fee, something like 15 dollars for a year, to support them.

Curiously, this seems to be following a pattern. I've been getting quite a few spam emails now in this same format, nonsensical English and links to a site hosted on geocities.

Legacy of the UMAXPPC spammer

2005-07-31T09:31:00.000-07:00

Readers of my Buffoons Blog may remember a long battle with Dmitriy Soldatenko aka Sid Wongvorakul who's web sites were spamming hundreds, if not thousands of various blogs and wikis. After a lot of complaints, his sites moved to another hosting company and the spam appeared to stop.

I was just googling for buffoons.blogspot.com (the address of my blog) to see who has mentioning it and noticed that someone has spammed a lot og guestbooks and made it look like my site was linked to the spamming.

Now, Sid's web sites used to be hosted by Everyone's Internet. I'll not go in to great detail but when I was trying to get Sid shut-down, they were absolutely useless. Now, the person doing the spamming appears to be using the IP address 216.127.68.15 which is owned by Everyone's Internet.

Spam Huntress has an article about this. It appears to be the UMAX spammer taking revenge on the people who exposed him. Here's an example entry taken from ATK Engines Guestbook.

.www.google.com/search?num=100&hl=en&lr=&q=Wiki+Spammers: ...... Get the admin of this wiki to install the solution described at ... Wreck the spammers pagerank GOOGLEPRAY (the only reason why they spam) by reporting them at .. actually spamming the wiki because spammers: spammers.chongqed - buffoons.blogspot - spamhuntress - spam.gunters - seem to circulate wiki addresses, ...I Love Wiki Spammers, submit spam; prevent spam; links; impressum ...

Note the references to my site as well as some others that highlighted and reported Sid to his hosting company. Presumably, these posts are to try and make it look like the spam-fighters are actually spammers. Of course, the person doing this spamming is an utter idiot. If the owner of the guestbook or forum visits any of the sites listed, they will see very quickly that we are not spammers. Also, he's not affecting the traffic to my web site. If anything, writing about him has boosted traffic to my blogs and brought me in contact with some good people.

On a side notes, the ATK Engines site is yet another example of a pointless guestbook that has just been left unmonitored. This is how spammers make their money and I'd strongly suggest that you should only post a guestbook if you're planning on moderating it. If I was considering buying something from ATK, I would certainly not do it now since they are hosting adverts for porn on their web site.

Since I know the IP address belongs to Everyone's Internet, I'm going to send them an email but I honestly do not expect to get any kind of meaningful response.

Finally, the most amusing thing here is that this spammer is a complete retard. If he's going to take the time to frame us for spamming, he could at least have an English speaker write the message for him. His posts are complete gibberish and in many cases, badly encoded.

Lazy spam and stringing along the scammer

2005-07-29T00:15:00.000-07:00

New one this morning.

Hello
Want a Prescription Medication? Find it here!
You can track your prescritions online.
And the costs are very low!

Go here to order

_______________________
Put this domain into your webrowser
---> meand[NOSPAM]umeds.net ([NOSPAM] added by me)

Curious, it's the first time I've seen spam done in plain text and in this format where they ask you to actually copy and paste the URL. Must be to get around spam filters.

A while back, I replied to an email from Raphael Ezekiel. He's apparantly an African foot-baller looking for someone to send him money so he can become a professional. Funny thing though is that I've been stringing him along for at least 3 months now. He sends me an email, I wait a couple of weeks before I reply or just don't reply at all. He was nice enough recently to hope that I was not affected by the London bombings. Very considerate of him.

I think I'm going to end this one soon. Normally, I end these things by proposing a wife-swap or a gay love affair. I'd like to do something different here though. Any suggestions would be appreciated. No rush though, he can wait a bit longer.

== Update 30 July 2005 ==

I've replied to him deciding to string this along a bit longer since he seems so determined. Like most Nigerian scammers, he makes refences to God. Normally they turn out to be Christian references. I've sent the following reply to him to see what kind of reaction I'll get by asking him to disclose his religion. Now, I've not told him what religion Willie (my alter-ego) adheres to so when he replies, I'll most likely just chose one that opposes his and see if we can get some theological debate going. Also, since he asked for my phone number, I've had to lie and tell him that I'm away from home. If I can get his phone number, I'll pretend that I called but there was no answer.

Raphael,
I would like to thank you for your prayers but first, I hope I do not impose by asking what religion you are. During my recent sickness, I rediscovered my faith and the recent London bombing really made me sit down and think things through. I know now that there is only one true faith and so prayers from any other religions are not just words, but are a curse.

Please understand that I do not wish to pry but would like to ask what God you worship. I would not want to be involved, even indirectly with a false-religion. When you respond, please include a phone number so I can call you. I am travelling at the moment so it's difficult to tell you where I can be contacted. I can give you my business number but it's just an answering service and the messages won't be checked until I've returned in a few weeks.

I think I've gone too far but it'll be interesting to see how he responds to this. BTW, Raphael is one of the names that the scammer used. Early on in our correspondance, he forgot his own name and switched to using a different one. It was fun when he tried to explain this after I raised a concern.

Have you visited the Spam Huntress?

2005-07-19T06:17:00.000-07:00

Spam Huntress is a pretty much essential site to know about if you're researching spam. I've had some very useful conversations on this site when I needed some help trying to stop someone from spamming my guestbook. It's a very friendly place, I recommend a visit.

Random name generator?

2005-07-13T09:57:00.000-07:00

In an earlier post, I mentioned the adverts for OEM software. Something I didn't mention is the name of the sender, Hera A. Perversion. Strange name but now I've received another advert that is very similar in content, just with a different URL. This one came from Prepare I. Henchman. The format of the name is the same and I suspect that they're using some kind of random name generator, obviously with amusing results.

One last amusing thing.. The English used in the emails and on the web sites is pretty comical. There is a link at the bottom of this email that says Try to Click. When I try, is it going to jump out the way or something?

A whois of the domain listed in the email (jansenisten.info) reveals that it's owned by the same guy as the one used in the first email.

Domain ID:D10477249-LRMS
Domain Name:JANSENISTEN.INFO
Created On:27-Jun-2005 10:34:38 UTC
Last Updated On:11-Jul-2005 01:31:02 UTC
Expiration Date:27-Jun-2006 10:34:38 UTC
Sponsoring Registrar:R157-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C10421209-LRMS
Registrant Name:Jeffee Westbury
Registrant Street1:77 Beak Street, #118
Registrant City:London
Registrant State/Province:W1F 9DB
Registrant Postal Code:W1F 9DB
Registrant Country:GB
Registrant Phone:+1.3473285225
Registrant Email:jeffywestbury@yahoo.com.br

Mortgage scam?

2005-07-13T00:43:00.000-07:00

I just received this email and it looks very much like a scam.

From: Alyssa Airth
Subject: We've been trying to reach you, please respond. emf
Date: 13 July 2005 04:12:08 IST
To: contact@badtoilet.org
Reply-To: Casauszfe@yahoo.com

Dear Homeowner

You have been pre-approved for a $400,000 Home Loan at a 3.25% Fixed Rate.
This Second Mor|gage is being extended to you unconditionally and your credit is in no way a factor.

To take Advantage of this Limited Time opportunity

All we ask is that you visit our Website and complete
The 1 minute post Approval Form

[URL REMOVED]

Sincerely,

Tristan Cervenak

So what makes me think that this email is a scam or at least, the work of a child intellect?

1) The name in the headers is Alyssa Airth yet the email is signed by Tristan Cervenak. The email address being used (most likely being spoofed) is a yahoo.com address. Most reputable financial companies don't tend to use freebie email addresses.

2) The email is addressed to "Dear Homeowner". They don't even know what country I'm in let alone my name. Yet, they seem to want to give me an unconditional mortage. My house could be a balsa wood shack worth around 400 euro yet they'll still loan me hundreds of thousands of dollars.

Since they want me to go to a web site and fill out a form, it looks like a phishing scam. The site is hosted at rateslowered4u.com. I did some checking.. Here is the owner of this site.

American Financial
Ronald Hentington (americanfinancial2005@yahoo.co.uk)
+1.2063384168
Fax: +1.2063384168
759 Mount Pleasant Road
Toronto, ON M4S 2N4
CA

The domain itself was registered in July of 2005. Far from being a long established company. According to this link, Ronald has a bit of a history.

Spam

== Update 3 August 2005 ==

Interestingly, quite a few people have been coming to my site by searching for Ronald Hentington or 759 Mount Pleasant Road. I'm not sure why but the address above seems to be owned by a book shop. I'm not sure if Ronald is linked with this shop or perhaps just using their address.

== Update 24 August 2005 ==

It looks like the bookshop that seemed to share the same address as Ronald has moved according to Melissa.

== Update 29 October 2005 ==

Here's a site with more information on this spammer. According to that site, his real name is William Waggoner. I've had a look at William's site and the sites it links to and they are pretty bizarre. The site itself is patriotic with a lovely hint of right-wing lunacy. He complains about 'Internet Terrorists'. Presumably these are the people who have targetted him for his prolific spamming. This article has some interesting facts about him.

The Bible site he links to from his page is particurly odd. Either it is run by paranoid consipracy theorists or people trying to get rich by selling junk to paranoid conspiracy theorists.

Someone needs my cooperation

2005-07-11T08:53:00.000-07:00

Again, a nice stranger in Africa wants to make me rich. The email below is interesting. Note that the English is reasonably good and that this scammer has learnt how to switch off caps lock. He seems to be confused about the money he is going to offer. He says "US$12,500,000.00 (Twelve Million Five Hundred United States Dollars) ". I think I'm going to ask him to clarify this.

From: ahmadbello@hotmail.com
Subject: I need your co-operation
Date: 10 July 2005 23:16:08 IST

Ahmad Bello
12 Avenue Centenatre
Dakar Senegal
E-mail:ahmadbello@myway.com

Attention: The President/CEO.

I am Alhaji Ahmad Bello, the Director of Bill and Exchange, Foreign Remittance Department of one of the leading banks here in Dakar Senegal. I have an urgent and very confidential business proposition for you. A contract employers- Teaser Petroleum Corporation made a numbered time Deposit for twelve calendar months, valued at US$12,500,000.00 (Twelve Million Five Hundred United States Dollars) in my bank. Upon maturity, I sent a routine notification to his forwarding address but got no reply. After a month, we sent a reminder and finally discovered from his contract employers, Teaser Petroleum Corporation that MR. ANDREAS SCHRANNER from Munich Germany died in a plane crash along with his entire family in July 2000.PLEASE TAKE A CAREFULL LOOK AT THE BBC PUBLISHED Monday, 31 July, 2000, 13:22 GMT 14:22
UK:http://news.bbc.co.uk/1/hi/world/europe/859479.stm

Since we got this information about his death and on further investigation, I found out that he died without making a WILL, and all attempts to trace his next of kin was fruitless. I therefore made further investigated and discovered that Mr. Andreas Schranner did not declare any kin or relations in all his official documents, including his Bank Deposit paperwork in my Bank. This sum of US$12,500,000.00 is still sitting in my Bank and the interest is being rolled over with the principal sum at the end of each year. No one will ever come forward to claim it. According to Laws of Senegal, at the expiration of 5
(five) years, the money will revert to the ownership of the Senegalese Government if nobody applies to claim the fund. Consequently, my proposal is that I will like you as a foreigner to stand in as the next of kin to Mr. Andreas Schranner so that the fruits of this old man's labour will not get into the hands of some corrupt government officials.

A bank account in any part of the world that you will provide will then facilitate the transfer of this money to you as the beneficiary/next of kin. The money will be paid into your account for us to share in the ratio of 50% for me and 30% for you. The remaining 20% will be for any expenses we might incurred during the course of the transaction. There is no risk at all as it will be handled in such a way that no law of any country will be violated and my position in the bank,the successful execution of this transaction is guaranteed. If you are interested, please reply immediately via the private email address above. Upon your response, I shall then provide you with more details on how we should proceed. Please send me your confidential telephone and fax numbers for easy communication.

Please observe utmost confidentiality, and be rest assured that this transaction will be most profitable for both of us because I shall require your assistance to invest my share in your country.

Awaiting your urgent reply.

Regards,

Ahmad Bello.
002215230013

OEM software for crazy low prices.

2005-07-09T10:47:00.000-07:00

I've had a few of these emails before. They promise OEM (Original Equipment Manufacturer) software at prices that are ludicrously lower than the regular retail price. An OEM software title is one that has been licenced to be bundled with a computer or sometimes, another software product. Strictly speaking, the licence will generally forbid you from selling the OEM software or using it on equipment other than the product that it came with. Here's the email itself.

[LINK TO WEBSITE REMOVED]

Corel Software and more. The best price.

Check out our prices.

Windows XP Pro - $69.95
MS Office 2000 PE (2 CD) - $59.95
MS SQL Server 2000 Enterprise Edition - $60
MS Office 2k Premium Edition (2 CD Edition) - $59.95
Director MX 2004 - $60
Win NT 4.0 Server - $49.95
MS Plus! XP - $50
Flash MX 2004 - $60
Microsoft Office 2003 Pro (1 CD) - $89.95
Office XP Professional - $70
MS FileMaker 7.0 Professional - $69.95
Corel Draw Graphics Suite 11 - $50
Microsoft Office 2003 Professional (1 CD Edition) - $89.95
Corel Word Perfect Office 2002 - $60
Microsoft Office 2k Premium Edition (2 CD) - $59.95

Go to site
[LINK TO WEBSITE REMOVED]

Here are some reasons why you probably should think carefully before avail of these amazing prices.

1 - OEM software may not be legal

OEM software sold in this manner is often in breach of contract and completely unsupported by the developers. Just try getting an update or phoning Adobe for support for the copy of Photoshop you bought for $69.95. I've worked for software companies in the past and I can tell you that you will not find them to be very understanding. Here's what Adobe have to say. Expect most other companies to tell you the same thing.

2 - Who the hell is this person?

Good question. Normally, these offers come from sites that you've never seen before and from email address that are completely unfamiliar, it's spam. Now, as a rule smart people are careful when they provide their credit card details on the Internet. Personally, I know Amazon to be safe. I know that indiepool.com are safe. I know that iTunes music store is safe. This is all because these are established businesses with business addresses and a trail of satisfied customers behind them.

In this particular case, the link in the email was bringing me to fzlcri.NOSPAMnightcapif.info (I'ved added the word NOSPAM so that I don't help this person get a better google ranking). This is an odd URL, doesn't look very professional. A quick whois search shows that this particular URL hasn't exactly a long history. It was registerered only last month. Here's a section of the whois record.

Domain ID:D10477243-LRMS
Domain Name:NIGHTCAPIF.INFO
Created On:27-Jun-2005 10:32:07 UTC
Expiration Date:27-Jun-2006 10:32:07 UTC
Sponsoring Registrar:R157-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C10421195-LRMS
Registrant Name:Jeffee Westbury
Registrant Street1:77 Beak Street, #118
Registrant City:London
Registrant State/Province:W1F 9DB
Registrant Postal Code:W1F 9DB
Registrant Country:GB
Registrant Phone:+1.3473285225
Registrant Email:jeffywestbury@yahoo.com.br
Admin ID:C10421196-LRMS
Admin Name:Jeffee Westbury
Admin Street1:77 Beak Street, #118
Admin City:London
Admin State/Province:W1F 9DB
Admin Postal Code:W1F 9DB
Admin Country:GB
Admin Phone:+1.3473285225
Admin Email:jeffywestbury@yahoo.com.br

Funny this. The owner of the URL has a London address, an American phone number and a Brazillian email address. Also, a quick google search of his email address shows that some people are linking him to more spamming. His sites are hosted in Asia and Russia (not known to be bastions of law and order). So let's summarise. The owner of the domain being advertised appears to be spread across at least 4 countries, has been in business for a matter of weeks, offers no corporate contact info in the spam email and has a history of being linked to spam. Does it seem like a good idea to try them. If you are this free and easy with your credit card, can you post it in the comments on my blog so I can check to make sure that your card is okay?

I visited the web site to see what they had to say. Amusingly enough, when the site loads, you get a pop-up advert for immitation watches. Rolex, Cartier, Gucci, they have the lot. Sounds like a reputable business. They also have the cheek in their FAQ to post this entry.

Can I get a discount? Can I resell your software?
There are no discounts for our prices nor can you resell our software. The software we offer cannot be resold.

So.... They appear to be selling legally dubious OEM software that you are not allowed to re-sell.. Mmmmmm, makes sense.

Also, they tell you that you won't be able to register the software but will be able to obtain updates. Good luck with that. Adobe in particular are quite strict about this.

Stock spam.

2005-06-29T01:21:00.000-07:00

This is an odd one. I received two emails that seemed to be providing free stock buying advice. Both of the mails are clearly spam since they contain the usual barrage of nonsensical words at the end to trick the spam filter. Both are also sent as gifs, not free text.

I did some digging and found this useful web site.

Stock Spam FAQ

Seems that this spam tends to be sent for the following reasons.

1) A misguided attempt by a company to promote itself.

2) A PR company promoting it's client through spam without their consent.

3) Individuals attempting to manipulate stock prices

You'd think common sense would make this clear but it does seem that it's not a good idea to act on free stock advice being sent to you at random by a complete stranger.

With love from Nigeria

2005-06-25T09:34:00.000-07:00

Ah, once again there is someone in Nigeria who wants to offer me the deal of the century. George Akinyele has tracked me down as a relative of someone who died a in a plane crash in 2000.

Here's his letter.

From: georgeakinyele002@zipmail.com.br
Subject: Next of Kin
Date: 25 June 2005 15:40:37 IST
To: georgeakinyele002@zipmail.com.br

Standard Trust Bank Plc

Lagos Nigeria.

Good Day Next of Kin

I am Mr. George Akinyele a Banker with Standard Trust Bank Plc, here in
Nigeria.I am an account Officer to Eng Andrew ,from your country, who used
to work with Shell Oil Development Company in Nigeria.On the 30 Jan 2000,
my client, his wife and their two children were involved in the kenya airways
flight with registration number 5Y-BEN which departed from Nairobi to Lagos.Since
then I have made several enquiries to your embassy to locate any of my clients
extended relatives, this has also proved unsuccessful.

After these several unsuccessful attempts, I decided to track his last name
over the Internet, to locate any member of his family hence I contacted
you. I have contacted you to assist in repatriating the money before they
get confiscated or declared unserviceable by Standard Trust Bank Plc where
this huge deposit were lodged.Particularly, Standard Trust Bank Plc where
the deceased had an account valued at about US$15 Million has issued me
a notice to provide the next of kin or have the account confiscated within
the 6 weeks.

Since I have been unsuccessful in locating the relatives for over 2 years
now, I seek your consent to present you as the next of kin of the deceased
to have the same last name so that the proceeds of this account valued at
US$15 Million can be paid to you and then you and I can share the money.
70% to me, 25% to you and 5% for any expenses we might run into during this
transaction.

All I require is your honest cooperation to enable us see this deal through.I
guarantee that this will be executed under a legitimate arrangement that
will protect you from any breach of the law. Please get in touch with me
immediately as I do not have much time in my disposal.
copy your reply to georgeakinyele21@katamail.com

Best Regards

George Akinyele

Note the wonderful personalised greeting "Good Day Next of Kin". This email is just comical. Funny thing is though some people must be falling for scams of this low-calibre. Otherwise my African friend wouldn't be sending this email.

Welcome

2005-06-25T03:12:00.000-07:00

My regular blog was turning in to a bit of a free-for-all really so I decided to create this blog. Recently I've been getting some pretty amusing spam and also had a bit of a battle to stop someone spamming the guestbook on a web site I maintain.