Spamming AdSensonia Group

The following spammer has spammed AdSensonia Group using a gmail account to send Lottery Notification scams.

The email fraud says:

ASEAN LOTTERY INTERNATIONAL
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: MLI/231-ILGI0431/04
BATCH: IPD/17/096/PTNL
RE: WINNING FINAL NOTIFICATION

Sir/Madam,

We are pleased to inform you of the result of the Lottery Winners International programs held on the 17th of September 2007. Your e-mail address attached to ticket number xxxxxxxxxxx-xxxx with serial number xxx-xxxxxx drew lucky numbers x-xx-xx-xx-xx-xx which consequently won in the 3rd category, you have therefore been approved for a sum pay out of USD $ 500,000 000. (Five hundred Thousand United States Dollars). CONGRATULATIONS!

Due to mix up of some numbers and names, we ask that you keep your winning information very confidential until your claim has been processed and your prize/money Remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants.

All participants were selected through a computer ballot system drawn from over 200,000,000 company and 300,000,000 individual email addresses and names from all over the world. This promotional program takes place annually.

We hope with part of your winning you will take part in our next year USD10 million international lottery. To file for your claim, please contact our/your fiducial agent Dr. William Stone of the, Lottery Coordinator Agent: +668--494-31313.
Email: aseanlotto at gmail.com;

Note: all winning must be claimed not later than 30th of October 2007. After this date all unclaimed, funds will be included in the next stake.

Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible.

Congratulations once more from our members of staff and thank you for being part of our promotional program.

Note: Anybody under the age of 18 is automatically disqualified.

Sincerely yours,
Mrs. Nariporn Suchada,
Lottery President

REPLY EMAIL TO aseanlotto at gmail.com

Using PayPals brands to Spam

How many spammers are there using PayPal's brands to send email frauds?

The email spam with the same message below came in from different spammers with the following information:

IP: 69.94.112.129 UNITED STATES/ CONNECTICUT/ TRUMBULL/ ISP: OLM LLC
IP: 69.159.192.117 CANADA/ ONTARIO T/ ORONTO/ ISP: SYMPATICO HSE
IP: 80.160.76.196 DENMARK/ - / - / ISP: TDC-SOLUTIONS-HOSTING-OPA
IP: 216.207.233.105 USA/ OHIO /CLEVELAND/ ISP: BREEZEWAVE BROADBAND
IP: 63.205.94.82 USA/ CALIFORNIA/ SAN RAMON/ ISP: KAPUR & ASSOCIATES INC
IP: 216.201.240.138 USA/ TEXAS/ DALLAS/ ISP: LOGIX COMMUNICATIONS INC


Some email spammers and scammers do not know their frauds will not reach its target. Those of them, who are using PayPal to send warning notifications to people, do not know that is not a Pay Pal’s way of notifying customers and clients. They do not know even, since those spammers are different, their frauds may come in through different IP addresses and different ISPs.

West African scam

Well, I'll start it with the email spam backlinks, IPs and other details and then follow to the body of the message:

West African scam details:

To: my email address
Subject: Dear Sir/Madam.
From: Miss. Anita Mohammed anita_moham99 at myway. com
Reply-To: anita_moham99 at myway. com

Important part of the tracking abuse:

Message-Id: E1IcyDV-0002FT-BA at server02. clanspyhosting. net
Date: Wed, 03 Oct 2007 00:00:21 -0700

This header was added to track abuse, please include it with any abuse report

Primary Hostname - server02. clanspyhosting. net
Originator/Caller UID/GID - [99 99] / [47 12]
Sender Address Domain - server02. clanspyhosting. net

IP adresses:

([74.86.23.218]) Country: USA - ISP: Softlayer Technologies Inc.
(domain at server02. clanspyhosting. net does not designate permitted sender hosts)

The Message:

From Miss. Anita Mohammed
Rue 114 Ave.13 Marcory
Abidjan Ivory Coast
West Africa,
Email: anita_moham99 at blablabla

Hello Dear,

How are you and your activities hoped all is fine.

I am Miss Anita by name, but even if we never knew each other before, I believe firmly that bases on the right of humanitarian assistance that a real confidence can be built from our communication and equally a good partnership between us.

I wish to request for your assistance in a financial transaction. I wish to invest in any lucrative Business, such as real estate management in your country.

I have Four Million Eight Hundred Thousand United State Dollars ($4.800.000.00) to invest in the establishments and I will require your assistance in receiving this fund in your account and establishing in your country. This fund was lodged and save-guarded in one of the leading Holding Security Firm here by my late father before his sudden death.

Your percentage in assisting me is negotiable as we proceed. I would like to count on your human, virtuous and professional qualities.

Please reply as soon as possible so that I furnish you with more details before we proceed.

NOTE: Please let me hear from you immediately only in my private email anita_moham99 at blablabla

Thanks in advance,

Yours Truly,
Miss. Anita Mohammed
_________________

You should never get yourself trapped in such scam. Take care.

Sincerely yours @
www.child-book-publishing-ezine.com

Email swindles using PayPal

The PayPal's Spoof or phishing email landed into my email inbox with information about unauthorized activities under my account. It dropped there from the following IP Address and its location: 69.66.179.177 US Iowa Harlan Iowa Telecom

It is well known that PayPal sends emails to clients using a method that belongs only to PayPal. PayPal's users are aware of this method. Therefore, they can easily discover any fraud.

Unfortunately, the scammer who sent email fraud like this forgot that he would get naked in front of the recipient.

Amazon's Phishing-Spammers

Those spammers who send emails out using Amazon brands think they can simply cheat people.

One late email spam from them indicates that they're not aware of what they are doing. They simply don't know that they will be tracked and their hidden places will be exposed.

These are four IP Addresses the late Phishing email spam came from:

IP Address: 85.187.59.175 Country: BG Bulgaria Region: Sofiya City: Sofia ISP: Evro
IP Address: 82.103.69.2 Country: BG Bulgaria Region: Sofiya City: Sofia ISP: Spectrum Net LTD
IP Address: 213.169.56.25 Country: BG Bulgaria Region: (-) City: (-) ISP: Development Center
IP Address: 69.15.220.193 Country: US Region: Georgia City: Atlanta ISP: CBEYOND COMMUNICATIONS LLC

They provided some links in that email spam, one of them appears like this: http:// www. amazon. com/gp/subs/primeclub/account/homepage.html/ref=ya_hp_sub_1/10
4-4436503-7329515?ie=UTF8&method=GET and points at: http : //85.187.59.175/ amazon.com

The email spam goes this way:

Dear Amazon® member,

We are contacting you to inform you that our Account Review Team identified some unusual activity in your account. In accordance with Amazon's User Agreement and to ensure that your account has not been compromised, access to your account was limited.

Your account access will remain limited until this issue has been resolved. To secure your account and quickly restore full access, we may require some additional information from you for the following reason: We have been notified that a card associated with your account has been reported as lost or stolen, or that there were additional problems with your card.

This process is mandatory, and if not completed within the nearest time your account or credit card may be subject for temporary suspension.To securely confirm your Amazon information please click on the link bellow:

http:// www. amazon. com /gp/ subs/primeclub/ account/homepage.html/ ref= ya_hp_sub_ 1/104-4436503-7329515?ie=UTF8&method=GET

We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.

For more information about how to protect your account please visit Amazon Security Center.

We apologize for any incovenience this may cause, and we apriciate your assistance in helping us to maintain the integrity of the entire Amazon system.

Thank you for using Amazon!

The Amazon Team

Privacy Notice © 1995-2007, Amazon.com, Inc. or its affiliates.

_____________________

More details:

Return-Path: <>
Received: from mail. fastnetbg. com ([82.103.69.2])
Received: from mailer. lindner. bg (mailer. lindner. bg [213.169.56.25]) by mail. fastnetbg .com (8.13.8/8.13.1) with ESMTP id l8E1x4hZ020601; Fri, 14 Sep 2007 04:59:04 +0300 Received: from User [69.15.220.193] by mailer. lindner. bg with ESMTP (SMTPD-8.20) id
ADE403C8; Fri, 14 Sep 2007 05:11:48 +0300 From: "security @ amazon-inc . com" <>
Subject: Account Review Team identified some unusual activity in your account
Date: Thu, 13 Sep 2007 22:07:01 -0400
_____________________

See more spammers and more malware attacks here and use the list to block them:
http://www.ezine-act-politics-business-and-love.com/malware.html