Email Spam from Sao Tome

The following email spam on this post came from two different email addresses and two different spammers and dropped together with worms attached.

Let us take the destination and sources of those email spam first:

The first email spam:

Return-Path: mellymckenzie@hotmail.com
Delivered-To: My email address
Received: (qmail 25165 invoked from network); 2 Oct 2008 01:05:43 -0000
Received: from my ISP (80.160.76.196) by webmail ..... with SMTP; 2 Oct 2008 01:05:43 -0000
Received-SPF: softfail (webmail here: transitioning SPF record at spf-d.hotmail.com does not designate 80.160.76.196 as permitted sender)
Received: from bay0-omc3-s28.bay0.hotmail.com ([65.54.246.228]) by my ISP (InterMail vG.3.00.03.01 201-2196-126-102-20080315) with ESMTP id 20081002010539.CUWH29008.my ISP @ bay0-omc3-s28.bay0.hotmail.com
for my email address; Thu, 2 Oct 2008 03:05:39 +0200
Received: from BAY116-W9 ([64.4.38.109]) by bay0-omc3-s28.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959), Wed, 1 Oct 2008 18:05:37 -0700
Message-ID: BAY116-W9E9CC31995C53367BCEABA63D0@phx.gbl
Return-Path: mellymckenzie@hotmail.com
X-Originating-IP: [125.40.48.12]
From: melly mckenzie mellymckenzie@hotmail.com
To: polipino96@hotmail.com This is not my email address
Subject: Wholesale price for every Customers
Date: Thu, 2 Oct 2008 11:05:37 +1000
Importance: Normal
X-OriginalArrivalTime: 02 Oct 2008 01:05:37.0277 (UTC) FILETIME=[FADCCAD0:01C9242A]
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=_78ec60d3-2266-468b-af2b-d079c3d7116f_

The second email spam:

Return-Path: papajoeza12@yahoo.com
Delivered-To: my email address
Received: (qmail 5110 invoked from network); 30 Sep 2008 18:43:16 -0000
Received-SPF: none (domain at yahoo.com does not designate permitted sender hosts)
Received: from my ISP (InterMail vM.7.09.01.00 201-2219-108-20080618) with ESMTP id 20080930184314.UIDW25070.MY ISP
Received: from nc6-rba-vif0-1.cache.isnet.net ([196.213.33.52]) by MY ISP (InterMail vG.3.00.03.01 201-2196-126-102-20080315) with SMTP
From: "Joe Pears" papajoeza12@yahoo.com
To: my email address
Subject: SALES VENTURE
Date: Tue, 30 Sep 2008 20:43:13 +0000
Organization: ANP-STP
Message-Id: 20080930184312.ZFSG29008.my isp@nc6-rba-vif0-1.cache.isnet.net>
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"
This is a multi-part message in MIME format.

The message in the email spam:

Sir,

I wish to introduce you to this highly prospective crude oil sale venture. What do I mean? I propose that we become partners in a crude oil sales project under the umbrella of the National Petroleum Agency of Sao Tome and Principe. I am presently in Sao Tome and Principe Liaison In South Africa.

In this project, we will register either your company or a joint company with the local Corporate Affairs Commission of Sao Tome and Principe ; re-assign an already allocated crude oil sale license to the company and act as representative of the Petroleum Agency in selling of crude oil to the end buyers.

I have assisted a company based in Oman, Middle East to secure a crude oil sale license allocation in 2005. The director of this company, Mr. Ahmed Syed could not actualize his dream in this project as he; the sole owner of the company was unfortunately struck by stroke therefore incapable of involving in active business.

I will package you as the crude oil sale license beneficiary. We would re-assign the sale license earlier given to Mr. Ahmed to your/our company. This will give your company/our joint company the legal authority to act as crude oil sales agent/representative for the petroleum agency.

The assignment of the crude oil sale license allocation to our company gives us the privilege to operate as first lifters of crude oil from the block. This attracts US$2.00 discount per barrel to the lifter. The US$2.00 is our (lifter) entitlement from the local petroleum agency (national petroleum agency), also been able to get final buyers entitles us also to a US$1.00 discount from the discount given to the end buyer as "mandates". As we are going to be lifting 2 million barrels per month from the block, US$2.00 discount from local petroleum agency sums up to US$4 million per month. And US$1.00 discount from the end buyer comes to US$2 million per month.

This totals to US$6 million gross coming to our group per transaction/per month. On equity sharing ration, both of us will be netting in a cool US$6 Million as profits monthly. This proceeds known as commissions will be shared equally on equity between the both of us at the end of every sales operation month. This implies that shall both go home with US$3 Million each.

This project is highly prospective and presently the most legitimate money making machinery someone can set up. What is so interesting about the project is that our both presence is not much needed, rather after the registration of your/our company and obtaining the crude oil sales license, we would connect buyers to the Petroleum Agency by any means we choose and our commissions will be directed instantly to our nominated company bank co-ordinates.

I will gladly appreciate your understanding and keen interest to be part of this moving train called CRUDE OIL SALES VENTURE.

Get back urgently.
Jonathan Pears. (NPA
Fax:+27115075668

Spam From Mike Bama (banker)

Good Day,

I am MIKE BAMA, Accounts staff at the BANK OF AFRICA (BOA) Ouagadougou Branch Burkina Faso.This is to inquire of you to handle this transaction for mutual benefits and opportunity for both of us.

The transaction is to present you as the next of kin/ beneficiary of US$25 000 000(Twenty Five Million Dollars) belonging to a deceased who was a customer to this bank. He died along with his family during their vacation journey.The Fund is currently in his dormant account awaiting claim.

The bank will release the fund to anybody who applies as his relatives or next of kin. In that regard.Note that this transaction does not involve any risks.Necessary modalities will be worked out to enable us carry out the fund claim under legitimate arrangements.

I have resolved to offer you 35% of the fund, 5% for sundry expenses that maybe incurred during the transfer and 60% for me.

I will give you more details when I receive your affirmative response.

Thanks and God bless.
MIKE BAMA.

More Details about this Email Spam

Return-Path: maikebama@gmail.com
Delivered-To: my email address
Received: (qmail 19903 invoked from network); 1 Oct 2008 13:34:55 -0000
Received: from My ISP by my webmail client with SMTP; 1 Oct 2008 13:34:55 -0000
Received-SPF: neutral (my webmail client: 80.160.76.199 is neither permitted nor denied by SPF record at _spf.google.com)
Received: from smtp21.orange.fr ([80.12.242.49]) IP Address Location: Country: France, Region: Ile-de-France, City: Paris, Net Speed: COMP, ISP: Mail Essentials Project, Domain: SMTP-IN.ORANGE.FR
Received: from User (unknown [41.203.230.208]) IP Address Location: Burkina Faso, ISP: ONATEL by mwinf2124.orange.fr (SMTP Server) with ESMTP id 0D0B51C0010F; Wed, 1 Oct 2008 15:34:31 +0200 (CEST)
X-ME-UUID: 20081001133432535.0D0B51C0010F at mwinf2124.orange.fr
Reply-To: maikebama@hotmail.com
From: "Mike Bama" maikebama@gmail.com
Subject: From Mike Bama(banker)
Date: Wed, 1 Oct 2008 13:34:49 -0000
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: 20081001133431.0D0B51C0010F at mwinf2124.orange.fr
To: undisclosed-recipients:;
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 7bit

Read more and learn some useful steps to discover, delete, scan for viruses, protect and have strong firewall to protect your system at http://www.squidoo.com/internet-security-news

TD Commercial Bank

Spammers send email spam using Phishing URLs to banking and other services to hunt login information from many users. The following email is an example of Phishing emails to get my login info to TD Canada Trust & TD Commercial Bank although I have no any account or even any information about that bank.

Dear TD Canada Trust & TD Commercial Banking customer,

TD Group Customer Serice would like to inform you that we are currently carrying out a scheduled upgrade of TD Security software.

In order to guarantee high level of security to our customers, we require you to complete “EasyWeb Form” (for TD Canada Trust customers) or “Web Business Banking Form” (for TD Commercial Banking customers).Please select and complete your form using the link below:
http : // customerform. td. com/service/serverid/form.aspx?user=and there are 51 numbers here&id=9909817

Thank you for being a valued customer.
Sincerely,TD Group Customer Serice

Spam from African Development Bank

From the desk of Dr Isa muda
Bill And Exchange Manager
African Development bank (ADB)
TEL: (00226) 78893998
West Africa
Dear Friend,

CONFIDENTIAL

I know that this mail will come to you as a big surprise; I am the bill and exchange manager in African development bank. I hoped that you will not expose or betray this trust and confident that I am about to repose on you for the mutual benefit of our both families.

In my department I discovered an abandoned sum of 10.5m us dollars in an account that belongs to one of our foreign customer (Dr. Eric MORGAN) 59 years American citizen who died 11th September 2001with event of terrorist attack on World Trade Canter.

I need your urgent assistance in transferring the mentioned sum Immediately to your account, the money has been dormant for years in our bank here without any body coming for the claim, I don't want the money to go into our bank treasury as an abandoned or unclaimed fund, so this is the reason why I contacted you, so that we can release the money to you as the nearest person to the deceased customer.

please I will like you to keep this proposal as a top secret and delete if you are not interested and if you are interested reply and call me for my urgent attention, upon receipt of your reply, I will send you full details on how the business will be executed and also note that you will have 30% of the above mentioned sum if you agree to transact the business with me and 10% will be for any expenses that will occur during the transfer why I will have 60% as my own share.
or call me by my private mobile number (00226) 78893998 for more explanations.

Best regards
Dr Isa muda

(FILL THIS FORM BELLOW PLEASE AND RESEND IT TO ME).

1) Your Full Name........................

2) Your Age.................................

3) Marital Status.............................

4) Your Cell Phone Number.......................

5) Your Fax Number...............................

6) Your Country...................................

7) Your Occupation.................................

8) Sex..............................................

9) Your Religion....................................

10) Your Private E-mail Address........................
--------------------------------------------------------------------------------
Portal Universia Chile - Red de universidades red de oportunidades.
universia dot cl

Bank of America Password Infiltrator Trojan

An email supposed to be sent from Bank of America, tried to infiltrate my system with a Trojan. The email spam I received from this bank, although I do not have any relation with it, has the same kind of Trojan that uses passwords infiltration to expose all your passwords.

The scam message goes this way:

Dear Bank of America Direct User:

Our records indicate that a new digital certificate has been issued to your Bank of America Direct user ID.

Digital certificates are computer-based records issued to individual user IDs that allow Bank of America Direct to validate your identity and protect your information from unauthorized access. In order to access Bank of America Direct, you must use a valid digital certificate.

Installation Instructions
To install your newly-granted digital certificate, please access the Digital Certificate Pick-Up site at:

http://direct-certs.bankofamerica.com/direct/certpickup.asp?session=29373540803937876657850317333991332044708496495978631

Please have your Bank of America Direct login information readily available when completing this process.

Should you have any questions regarding this process, please consult your Company Administrator or contact your regional customer support center for further assistance.

Sincerely,
Bank of America Direct Technical Care Center

NOTE: This is an automatically generated communication.

More Information:

Return-Path: < auto_notify.id8453551-4759474cert @ bankofamerica.com >
Delivered-To: .........
Received: (qmail 32605 invoked from network); 17 Apr 2008 14:22:36 -0000
Received: from bzq-79-177-237-13.red.bezeqint.net (79.177.237.13) by ...... with SMTP; 17 Apr 2008 14:22:34 -0000
Received-SPF: softfail (.....................: transitioning SPF record at bankofamerica.com does not designate 79.177.237.13 as permitted sender)
Received: from malaysia.net (unknown [96.36.108.120]) by slavhost. com with SMTP id PH52HS3UMG for < ............. >; Thu, 17 Apr 2008 10:22:29 -0500
From: "Bank of America" < auto_notify.id8453551-4759474cert @ bankofamerica.com >
To: .............
Subject: important instructions: new digital certificate issued [message id: H2043446EF]
X-Spam-Level: 0
User-Agent: MIME-tools 5.503 (Entity 5.501)
X-Mailer: MIME-tools 5.503 (Entity 5.501)
X-Priority: 3 (Normal)
X-Scrubber-List: not listed
X-Scrubber-ClamAV: clean
X-Scrubber-VpopQuota: space available
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_xMHEJFcwoaNCcyuiYzHzRfUjBcztAVyzL"

------=_xMHEJFcwoaNCcyuiYzHzRfUjBcztAVyzL
Content-Type: multipart/alternative; boundary=--VPrv7x1mz9nvn45dgXV

----VPrv7x1mz9nvn45dgXV--

------=_xMHEJFcwoaNCcyuiYzHzRfUjBcztAVyzL
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

This message was modified by F-Secure Anti-Virus E-Mail Scanning.

------=_xMHEJFcwoaNCcyuiYzHzRfUjBcztAVyzL--

HSBC Password Infiltrator Trojan

This summary is not available. Please click here to view the post.

Using National Bank of Dubai to Spam

I received an email spam yesterday with the subject line: i tried to call you please

What is interested about this spam is that it has passed through many IP addresses although it ran through a Yahoo email service.

Those are the IP addresses with some details:

203.188.202.150 TW TAIWAN - - ISP: YAHOO! TAIWAN TEIPEI TAIWAN
202.43.196.225 US UNITED STATES - - ISP: INTERNET CONTENT CROVIDER
217.12.4.214 UK UNITED KINGDOM ENGLAND LONDON ISP: YAHOO! EUROPE
216.252.122.218 US UNITED STATES NEW YORK NEW YORK ISP: YAHOO
69.147.65.156 US UNITED STATES NEW YORK NEW YORK ISP: YAHOO
127.0.0.1 - - - - ISP: LOOPBACK
213.42.2.24 AE UNITED ARAB EMIRATES DUBAI DUBAI ISP: EMIRATES INTERNET

The following received from and other paths are even interesting:

Return-Path: al_haj_mohf @ yahoo.com
Received: from abcd...... by abcd..... (InterMail vM.7.08.03.00 201-2186-126-20070710) with ESMTP id 20080202085314.BIOV1228........ for my email address; Sat, 2 Feb 2008 09:53:14 +0100
Received: from n7d.bullet.mail.tp2. yahoo.com ([203.188.202.150])
Received: from [202.43.196.225] by n7.bullet.mail.tp2. yahoo.com with NNFMP; 02 Feb 2008 08:53:10 -0000
Received: from [217.12.4.214] by t2.bullet.tpe. yahoo.com with NNFMP; 02 Feb 2008 08:53:09 -0000
Received: from [216.252.122.218] by t1.bullet.ukl. yahoo.com with NNFMP; 02 Feb 2008 08:53:09 -0000
Received: from [69.147.65.156] by t3.bullet.sp1.yahoo.com with NNFMP; 02 Feb 2008 08:53:08 -0000
Received: from [127.0.0.1] by omp404.mail.sp1. yahoo.com with NNFMP; 02 Feb 2008 08:53:08 -0000
Received: (qmail 27502 invoked by uid 60001); 2 Feb 2008 08:53:08 -0000
Received: from [213.42.2.24] by web45613.mail.sp1. yahoo.com via HTTP; Sat, 02 Feb 2008 00:53:08 PST
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 813117.94241.bm @ omp404.mail.sp1. yahoo.com
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo. com; h=Received:Date:From:Subject: To:MIME- Version: Content-Type: Content-Transfer-Encoding: Message-ID; b=YeAMHJGJE3IRGBE2tQw7Ura+kh1qn9uP6FP4qpo+n6oRNWcOV+HBBNWJL+TydRlLcE/OtgVHscaCnsLkoxM+MsP2rcS8ANPEHq8gJgGqeCfZWrnwmWG8/H0dKsf5ZNhsNAv3XT8bDt/cOnTCmah00m+GdBvqYyhNz3Wh61Ne4so=;
Date: Sat, 2 Feb 2008 00:53:08 -0800 (PST)
From: abdul moh al_haj_mohf @ yahoo.com
Subject: i tried to call you please
To: bob_singer2005 @ yahoo.com (and this is not my email address)
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1125663496-1201942388=:27221"
Content-Transfer-Encoding: 8bit
X-Old-Message-Id: 321359.27221.qm @ web45613.mail.sp1. yahoo.com>
Fra: abdul moh al_haj_mohf @ yahoo.com
Til: bob_singer2005 @ yahoo.com

The Message Body:

Mohd Abdul Rahim
Manager National Bank of Dubai.
BurJuman Centre Branch, Khalid Bin Waleed Street ,
BurJuman Centre,
Dubai United Arab Emirate (U.A.E.).
please reply to : (al_haj_mohb@yahoo.com )


Dear , I am Mr. Mohd Abdul Rahim Branch Manager of national bank Of Dubai. I am writing following an Opportunity in my office that will be of immense benefit to both of us. In my department I discovered an abandoned sum of $7.5 million ($7, 500, 000, 00 United state dollars) in an account that belongs to one of our foreign customers, Late Toni Choatean American who unfortunately lost his life in a plane crash

Since we got information about his death, we have been expecting his Next of kin or relatives to come over and claim his money because we Cannot release it unless somebody applies for it as next of kin or Relation to the deceased as indicated in our banking guidelines.

Unfortunately I learned that his supposed next of kin being his only Daughter died along with him in the plane crash leaving nobody with The knowledge of this fund behind for the claim, and the banking law and guidelines here in united Arab emirate states that if such money should Remain after five years, the money will be transferred into banking treasury as unclaimed Deposit,

NOTE : Under a clear and legitimate agreement between you and me, we shall work together and present you as the next of Kin so that the bank can release the funds through you.

We shall share the deposit in the following ratios: 40% for you and 60% for me. I want to believe this sharing ratio is fair enough. I am prepared to welcome any amendment or suggestion you have on how much each of us will get. Contact me on my private email address (al_haj_mohb @ yahoo.com) so that I can disclose other information relating to this deposit. Thank you very much for your anticipated acceptance while I expect your prompt response.

Never miss a thing. Make Yahoo your homepage. http:// us.rd.yahoo.com/evt=51438/*http://www.yahoo .com/r/hs

Looking for last minute shopping deals? Find them fast with Yahoo! Search. http :// us.rd. yahoo.com/evt=51734/*http:// tools.search. yahoo.com/newsearch/category.php?category=shopping

Unreasonable Compensation in Email Spam

The same story in many email spam, which goes even without mind to everybody, nevertheless they have something to do with such compensation or not.

From: Mrs. Alice Bunnet with the subject line: Contact Mr. Eric Wright for your Compensation

COMPENSATION HEAD OFFICE.

GOOD NEWS!!!

Dear Friend,

How are you today? Hope all is well with you and your family? I hope this mail meets you in a perfect condition. I am using this opportunity to thank you for your great effort to our unfinished transfer of fund into your account due to one reason or the other best known to you.

But I want to inform you that I have successfully transferred the Cheque out of the company to someone else who was capable of assisting me in this great venture.

Due to your effort, sincerity,courage and trust worthiness you showed at the course of the transaction I want to compensate you and show my gratitude to you with the sum of 500,000.00(five hundred thousand United StatesDollars) in addition to your lottery winnings of $2.5m now amounting to $3,000,000.00(three million United States Dollars).

I have authorized the finance house where I deposited my money to issue you International Certified Bank Draft cashable at your bank. My dear friend I will like you to contact the finance house for the collection of this international certified bank draft. The name and contact address of the Person with your Cheque Mr.Eric Wright is as follows.

COMPENSATION OFFICER
CONTACT AGENT Mr.Eric Wright
EMAIL:eric_wright115 at yahoo.fr

At the moment, I am very busy here because of the investment projects which myself and my new partner are having at hand.

Finally, remember that I have forwarded instruction to the finance house on your behalf to send the bank draft to you as soon as you contact them without delay.

Please I will like you to accept this token with good faith as this is from the bottom of my heart.


Thanks and God bless you and your family.Hope to hear from you soon.

Best Regards,
Mrs.Alice Bunnet.
-----------------

Nationwide Banks Spam

Check "Fighting Spam" in August 11, 2006 here: http://no-way-to-spam.blogspot.com/search?q=Nationwide+Building+Society to connect to the story of this bank:

Email spam carries this URL to an image: Image URL: http : // nationwide .co. uk/_common_images/NWlogo.gif

It dropped in through the following details:

Return-Path: wwwrun at h957889 dot serverkompetenz dot net
Received: (qmail 30760 invoked from network); 27 Jul 2006 04:32:33 -0000
Received: from motwest14.de (HELO h957889.serverkompetenz.net) (85.214.55.215)
(domain at h957889.serverkompetenz.net does not designate permitted sender hosts)
Received: by h957889.serverkompetenz.net (Postfix, from userid 30) id 604BE4CB7F8; Thu, 27 Jul 2006 06:23:12 +0200 (CEST)
Subject: Important Notice From Nationwide Building SocietyFrom: Nationwide Building Society security dot alert dot services at nationwide dot co dot ukReply-To: Message-Id: 20060727042312.604BE4CB7F8 at h957889.serverkompetenz dot net Date: Thu, 27 Jul 2006 06:23:12 +0200 (CEST)

The message boday says:

Dear Valued Customer,

Due to concerns, for the safety and integrity of the nationwide account we have issued this warning message.

It has come to our attention that your nationwide account information needs to be updated as part of our continuing commitment to protect your account in this year 2006 and to reduce the instance of fraud on our website.

If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service.

Once you have updated your account records your nationwide account service will not be interrupted and will continue as normal.

To update your nationwide records click on the following link:
http : // www . nationwide . co . uk/signon?LOB=CONS&screenid=Update_Ac ct

Thank You.

Accounts Management

As outlined in our User Agreement, nationwide will periodically send you information about site changes and enhancements.

Visit our Privacy Policy and User Agreement if you have any questions.

http : // www .nationwide. co. uk/help/index.jhtml