From: Chris Santerre [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 09, 2006 1:07 PM
To: Spaml (E-mail); Spamassassin-Talk (E-mail)
Subject: SPAM: Tangled web of fun....
Alright, so I'm eating lunch and catching up on my sports car forum, where a buddy posts about a possible scam from selling something on craigslist. He gets an email (I don't have the headers.) supposedly from the USPS:
I'm sniping a lot of useless info out.....bear with me, this is interesting...
"
From: United States Postal Service [mailto:[EMAIL PROTECTED]]
Dear xxxxxxxxx,
Congratulations! The
order placed by the buyer of your item: Mrs. xxxxxxxx to have a United States
Postal Service branded Money OrderSM $xxx:00 USD sent to you as payment for the
item: xxxxxx has been successfully processed and has consequently been APPROVED.
The financial details of the transaction are stated below:
*snip*
===================================================================================
***ATTENTION***
The order has been
APPROVED, you CAN NOW ship the merchandise to the buyer's shipping address. You
are expected to make the shipment within 48 hours of recieving this Payment
Confirmation Notification and get to our Costumer/Technical Dept. with the
tracking number for Shipment Verification via:
[EMAIL PROTECTED]
The Money OrderSM will NOT be dispatched or get to your resident until the shipment has been verified. This measure is taken in order to protect both seller and buyer interests and to reduce the occurrence of fraudulent activities.
blah blah blah..... ship here:
238 S 8th St.
Blair, NE, 68008 "
Ok, I figure I'll help him, its lunch and I'm bored....Obviously USPS isn't in the escrow business.
accountant.com
Gerald Gorman
33 Knightsbridge Rd.
Piscataway, NJ
08854
US
Phone:
9086960929
Meh...not much to go on....Gorman is a squatter???
Blair Address comes back as...
No Frills
Supermarket
238 S 8th St
Blair,
NE 68008-2410
Phone: (402) 426-4757
1999 image: http://terraserver.microsoft.com/tile.ashx?t=1&s=10&x=3699&y=23016&z=14
hmmmmm...ok....interesting...
nofrillssupermarket.com
The IP host is very
suspect, but not on any RBL: 64.74.134.64
Registrant:
Navigation Catalyst
Systems, Inc
2101 Rosecrans Ave.,
#2000
El Segundo, California 90245
United States
which redirects to prescriptionsmedicines.net
Same Whois info
209.132.212.132
Which points to a ROKSO spammer!!!
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL27304
So has a ROKSO now gotten so desperate they now try to fraud people out of junk on craigslist? :)
Anyone near Blair want to grab some photos of the place for fun?
Chris Santerre
SysAdmin and SARE/URIBL
ninja
http://www.uribl.com
http://www.rulesemporium.com
