Gmail Frauds - Who's to Blame?

Who's to blame in regards to the following email spam that was sent by a gmail user:

The email spam message says:

Dear Fellow Investor,

American Stock Trader Press Daily is bringing you yet another Stellar Stock pick to add to your portfolio of winners. We are issuing an immediate alert for Chanaral Resources, Inc. (OTC PINK: CRLR). We are noticing trends that would say this stock could make a big run in the next day or so.

Based on our opinion CRLR is grossly undervalued. With a current market of only 132
Million dollars, CRLR is a steal of a deal. At present we are issuing a heavy buy and hold to 2.25.

As we said, we believe that CRLR could see a huge upside in the very short term (5 trading sessions). But on a buy and hold the numbers could be staggering. As Chanaral strives to be a leader in the iron mining and production sector, emerging markets like China and India have an insatiable hunger for steel, solidifying your investment in CRLR.

Call your stock broker today and ask them about Chanaral Resources, Inc.

Best of luck in the markets today!

Regards,

Staff
American Stock Trader Press Daily
Empowering Investors Worldwide!

More email spam information:

Return-Path: aida1886 @ gmail.com
Received: (qmail 7725 invoked from network); 23 Oct 2007 20:34:09 -0000
Received: from ro-out-1112.google.com ([72.14.202.177])
Received: by ro-out-1112.google.com with SMTP id k4so345540rog

... and then there came lot of characters, just about this type of: type:content-transfer-encoding.

Received: from gmail.com ( [59.187.105.200]) by mx.google.com with ESMTPS
id g39sm14741637rvb.2007.10.23.13.33.57
Message-ID: 770801c8155f$ced410e0$e61e77b6 @ Aida1886
Reply-To: "Alan" Aida1886 @ gmail.com
To: "Newsletter Member" my email address that I have never used to subscribe to such newsletter.
Subject: Daily Update
Date: Tue, 23 Oct 2007 10:31:01 -1100
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V10.0.2627
From: Alan aida1886 @ gmail.com
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit

Russian and Ukrainian Women

The Subject line of this email spam says: Hello, Beautiful Russian women waiting to meet YOU! alarm!

... and the body of the message says:

Hello!

Spring has finally come! Romance is in the air!

Beautiful and still single (!!!) Russian and Ukrainian women are eager to meet you! They have placed their profiles at SingleRussianGirls dating site and waiting for your emails.

Don't loose time and come get registered FREE at: online russian brides bla bla... say about this all your friends. hosting is bad, if site too slow, then refresh. if this link does not exist then please wait new link 1-7 days.

ne sternal orchis...

It is just like that, and the spammer thinks all his contact will run to the site he has mentioned. He or she absolutely will need to know that no one cares. He should build good contact first and to do this he or she needs to know his contact before sending them spam.

It seems that some spammers will not understand this fundamental process to acquire contacts and build good relations with them before sending any message out.

What he or she did is actually the last step to failure.

The email spam came in through the following pathes:

Return-Path: info @ football.co.uk
(transitioning SPF record at football.co.uk does not designate 80.160.76.198 as permitted sender)
Received: from p2081-ipbf3509marunouchi. tokyo. ocn. ne.jp ([123.224.95.81])
Message-ID: 003e01c806a8$01c6d760$55c29b0a@gubernatorial
From: "Administrator" info @ football.co.uk
To: my e-mail
Subject: Hello, Beautiful Russian women waiting to meet YOU! alarm
Date: Sun, 21 Oct 2007 23:04:25 +0500
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset=koi8-r; reply-type=original
Content-Transfer-Encoding: 7bit

Who is this spammer?

I absolutely like to receive mails from people I know and from some services I am using. I hate unsolicited emails and frauds. No one likes that of course. It is important for some services if they have third parties email lists to define themselves when they send some offers like the following:

Have you searched the internet countless times looking for a way to “hack?” Maybe you have searched for a way to download programs, games, or movies for free? Or maybe you have searched for a friendly, helpful, community that offers all that plus more? Well search no more, you have struck gold. Well not quite gold, better… Kwickfix.org!

Here at Kwickfix.org we have forums for countless discussions to be held daily. We have a ‘warez’ section with endless amounts of safe secure downloads for your favorite TV shows, Movies, Games, Programs, and more.

But what we really are known for is not our download section, but our notorious underground hacking section. Hack online games, your friends, and get passwords to any site! We offer numerous easy to follow tutorials and programs for you to become a ‘hacker’ in no time. Don’t believe us? Why not come to Kwickfix.org and see for yourself.

Stuck on a problem? Ask any of our staff members or a tech genius member. Thanks, The Kwickfix Management

I consider the message above email spam. The script of this email spam as it appears from those lines above, confirms that it is not professional. It is also not addressed to any one. Most importantly, that email spam came through gmail to a gmail address. The question is how did this person know my gmail address to send me such spam?

More Information:

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - merlin.tb-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - merlin.tb-hosting.com
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1

To: my gmail.com
Subject: Madness? This is KWICKFIX!!!!!!
From: admin @ kwickfix.org.
Message-Id: E1IjKA7-0002xc-Oc @ merlin.tb-hosting.com
Sender: Nobody nobody @ merlin.tb-hosting.com
Date: Sat, 20 Oct 2007 20:39:07 +0100

Important Note: When some people send such emails, it is very important to define who they are, because of the fact that no one will open an email from stranger. So, sending anonymous messages kills their offers. How could they be professional if they are doing this?

Spamming AdSensonia Group

The following spammer has spammed AdSensonia Group using a gmail account to send Lottery Notification scams.

The email fraud says:

ASEAN LOTTERY INTERNATIONAL
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: MLI/231-ILGI0431/04
BATCH: IPD/17/096/PTNL
RE: WINNING FINAL NOTIFICATION

Sir/Madam,

We are pleased to inform you of the result of the Lottery Winners International programs held on the 17th of September 2007. Your e-mail address attached to ticket number xxxxxxxxxxx-xxxx with serial number xxx-xxxxxx drew lucky numbers x-xx-xx-xx-xx-xx which consequently won in the 3rd category, you have therefore been approved for a sum pay out of USD $ 500,000 000. (Five hundred Thousand United States Dollars). CONGRATULATIONS!

Due to mix up of some numbers and names, we ask that you keep your winning information very confidential until your claim has been processed and your prize/money Remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants.

All participants were selected through a computer ballot system drawn from over 200,000,000 company and 300,000,000 individual email addresses and names from all over the world. This promotional program takes place annually.

We hope with part of your winning you will take part in our next year USD10 million international lottery. To file for your claim, please contact our/your fiducial agent Dr. William Stone of the, Lottery Coordinator Agent: +668--494-31313.
Email: aseanlotto at gmail.com;

Note: all winning must be claimed not later than 30th of October 2007. After this date all unclaimed, funds will be included in the next stake.

Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible.

Congratulations once more from our members of staff and thank you for being part of our promotional program.

Note: Anybody under the age of 18 is automatically disqualified.

Sincerely yours,
Mrs. Nariporn Suchada,
Lottery President

REPLY EMAIL TO aseanlotto at gmail.com

Using PayPals brands to Spam

How many spammers are there using PayPal's brands to send email frauds?

The email spam with the same message below came in from different spammers with the following information:

IP: 69.94.112.129 UNITED STATES/ CONNECTICUT/ TRUMBULL/ ISP: OLM LLC
IP: 69.159.192.117 CANADA/ ONTARIO T/ ORONTO/ ISP: SYMPATICO HSE
IP: 80.160.76.196 DENMARK/ - / - / ISP: TDC-SOLUTIONS-HOSTING-OPA
IP: 216.207.233.105 USA/ OHIO /CLEVELAND/ ISP: BREEZEWAVE BROADBAND
IP: 63.205.94.82 USA/ CALIFORNIA/ SAN RAMON/ ISP: KAPUR & ASSOCIATES INC
IP: 216.201.240.138 USA/ TEXAS/ DALLAS/ ISP: LOGIX COMMUNICATIONS INC


Some email spammers and scammers do not know their frauds will not reach its target. Those of them, who are using PayPal to send warning notifications to people, do not know that is not a Pay Pal’s way of notifying customers and clients. They do not know even, since those spammers are different, their frauds may come in through different IP addresses and different ISPs.

West African scam

Well, I'll start it with the email spam backlinks, IPs and other details and then follow to the body of the message:

West African scam details:

To: my email address
Subject: Dear Sir/Madam.
From: Miss. Anita Mohammed anita_moham99 at myway. com
Reply-To: anita_moham99 at myway. com

Important part of the tracking abuse:

Message-Id: E1IcyDV-0002FT-BA at server02. clanspyhosting. net
Date: Wed, 03 Oct 2007 00:00:21 -0700

This header was added to track abuse, please include it with any abuse report

Primary Hostname - server02. clanspyhosting. net
Originator/Caller UID/GID - [99 99] / [47 12]
Sender Address Domain - server02. clanspyhosting. net

IP adresses:

([74.86.23.218]) Country: USA - ISP: Softlayer Technologies Inc.
(domain at server02. clanspyhosting. net does not designate permitted sender hosts)

The Message:

From Miss. Anita Mohammed
Rue 114 Ave.13 Marcory
Abidjan Ivory Coast
West Africa,
Email: anita_moham99 at blablabla

Hello Dear,

How are you and your activities hoped all is fine.

I am Miss Anita by name, but even if we never knew each other before, I believe firmly that bases on the right of humanitarian assistance that a real confidence can be built from our communication and equally a good partnership between us.

I wish to request for your assistance in a financial transaction. I wish to invest in any lucrative Business, such as real estate management in your country.

I have Four Million Eight Hundred Thousand United State Dollars ($4.800.000.00) to invest in the establishments and I will require your assistance in receiving this fund in your account and establishing in your country. This fund was lodged and save-guarded in one of the leading Holding Security Firm here by my late father before his sudden death.

Your percentage in assisting me is negotiable as we proceed. I would like to count on your human, virtuous and professional qualities.

Please reply as soon as possible so that I furnish you with more details before we proceed.

NOTE: Please let me hear from you immediately only in my private email anita_moham99 at blablabla

Thanks in advance,

Yours Truly,
Miss. Anita Mohammed
_________________

You should never get yourself trapped in such scam. Take care.

Sincerely yours @
www.child-book-publishing-ezine.com