Funny (and some not so funny) Scam Spam Emails - Do you have one to share?

[Marc]

It appears this one appears to be spoofed from, Israel --> <[email protected]>

Bcc:
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="Windows-1251"
Date: Thu, 30 Apr 2009 08:12:54 +0200 [02:12:54 AM EDT]
Delivered-To: <snip>@spamcop.net
From: "Brian Casey." <[email protected]>Add Link removed to my Address Book
MIME-Version: 1.0
Message-ID: <[email protected]>
Received:

* (qmail 20040 invoked from network); 30 Apr 2009 11:43:34 -0000
* from unknown (192.168.1.86) by filter7.cesmail.net with QMQP; 30 Apr 2009 11:43:34 -0000
* from mail.gkg.co.il (HELO server3.gkg.co.il) (62.219.235.64) by mxin2.cesmail.net with SMTP; 30 Apr 2009 11:42:55 -0000
* from User ([87.210.54.117]) by server3.gkg.co.il with Microsoft SMTPSVC(6.0.3790.3959); Thu, 30 Apr 2009 08:08:21 +0200

Reply-To: Link removed Link removed to my Address Book
Return-Path:

* <[email protected]>
* Link removed

Subject: Please Reply Urgently ASAP.
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-OriginalArrivalTime: 30 Apr 2009 06:08:21.0546 (UTC) FILETIME=[105BC8A0:01C9C95A]
X-Priority: 3
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter7
X-Spam-Level: **************************
X-Spam-Status: hits=26.1 tests=ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4, DEAR_FRIEND,FORGED_MUA_OUTLOOK,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3, MISSING_HEADERS,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SARE_FRAUD_X6 version=3.2.4
X-SpamCop-Checked:
X-SpamCop-Disposition: Blocked SpamAssassin=26

Dear Friend,

First of all I want you to Know that this is not a scam mail.Because of or based on what is going on all over the internet world, people find it very difficult to believe things like this.If you can garantee me from your side your trust and honesty I will be able to work with you.I will appreciate it alot if you can come down your self and see things for your self before we proceed and this will make things clearer for you.

To Prove my sincerity, you are not sending any money to me. I will cover the expenses down here before the funds that will be packaged as consignment will leave for your country.

I am Brian Casey, a barrister at law. I am the personal attorney/sole executor to the WILL of a late client who worked as an independent oil Business magnate in my country and who died in a car crash with his immediate family on the 5th of Nov 2004. Since the death of my client in Nov, 2004,I have written several letters to the embassy with an intent to locate any of his extended relatives who are beneficiaries of his abandoned Funds and all such efforts have been to no avail.

After the transaction has been accomplished 40% will be for the person involved, 10% for Charity work and the remaining 50% for me. Please if you feel interested, I crave your indulgence to please contact me through this my email address. As I have said earlier, I want you to know that this is the present situation now and do not take this as a scam mail, all I need is your help and support so that we can both carry out this project.

I have decided to contact you so that we can talk and see how we can both put heads together and achieve good result.

On this note, I wish to present you to the finance company, as the surviving relative to the deceased so that we can put in claims for payment with your name as the sole beneficiary of the Will.

I will apprecaite if you can send me the following,

1.Your Full Names
2.Your current telephone and fax numbers
3.Your age
4.Occupation
5.Your Current contact address

This will enable me file necessary documents at our High Court Probate Division for the release of sum of money in your favour.

I intend to invest my shares in your country under your management in any viable business venture.

I will send you more details as soon as I hear from you.

Yours faithfully

Brian Casey

Tracking the source:

SpamCop.net
Here are the results of your submission:

Processing spam:

From: Link removed
Subject: Please Reply Urgently ASAP.


Received: (qmail 20040 invoked from network); 30 Apr 2009 11:43:34 -0000
warning:Ignored

Received: from unknown (192.168.1.86) by filter7.cesmail.net with QMQP; 30 Apr 2009 11:43:34 -0000
192.168.1.86 found
host 192.168.1.86 (getting name) no name
warning:192.168.1.86 discarded

Received: from mail.gkg.co.il (HELO server3.gkg.co.il) (62.219.235.64) by mxin2.cesmail.net with SMTP; 30 Apr 2009 11:42:55 -0000
62.219.235.64 found
host 62.219.235.64 (getting name) = mail.gkg.co.il.
mail.gkg.co.il is 62.219.235.64
Possible spammer: 62.219.235.64
Received line accepted

Received: from User ([87.210.54.117]) by server3.gkg.co.il with Microsoft SMTPSVC(6.0.3790.3959); Thu, 30 Apr 2009 08:08:21 +0200
87.210.54.117 found
host 87.210.54.117 = ip117-54-210-87.adsl2.static.versatel.nl (cached)
ip117-54-210-87.adsl2.static.versatel.nl is 87.210.54.117
62.219.235.64 not listed in dnsbl.njabl.org ( 127.0.0.9 )
62.219.235.64 not listed in cbl.abuseat.org
62.219.235.64 not listed in dnsbl.sorbs.net
62.219.235.64 is not an MX for mxin2.cesmail.net
62.219.235.64 is not an MX for mail.gkg.co.il
62.219.235.64 is not an MX for server3.gkg.co.il
62.219.235.64 is not an MX for mxin2.cesmail.net
62.219.235.64 not listed in dnsbl.njabl.org ( 127.0.0.3 )
Possible spammer: 87.210.54.117
Host server3.gkg.co.il (checking ip) = 62.219.235.64
62.219.235.64 not listed in dnsbl.njabl.org ( 127.0.0.9 )
62.219.235.64 not listed in cbl.abuseat.org
62.219.235.64 not listed in dnsbl.sorbs.net
Chain test:server3.gkg.co.il =? mail.gkg.co.il
Host mail.gkg.co.il (checking ip) = 62.219.235.64
62.219.235.64 is not an MX for server3.gkg.co.il
Host server3.gkg.co.il (checking ip) = 62.219.235.64
ips are identical
server3.gkg.co.il and mail.gkg.co.il have close IP addresses - chain verified
Possible relay: 62.219.235.64
Received line accepted
Tracking message source:87.210.54.117:

Cached whois for 87.210.54.117 : [email protected] [email protected]
Using abuse net on [email protected]
abuse net versatel.nl = [email protected], [email protected]
Using abuse net on [email protected]
abuse net versatel.net = [email protected], [email protected]
Using best contacts [email protected] [email protected] [email protected]
warning:Yum, this spam is fresh!
Message is 2 hours old
87.210.54.117 not listed in dnsbl.njabl.org ( 127.0.0.8 )
87.210.54.117 not listed in dnsbl.njabl.org ( 127.0.0.9 )
87.210.54.117 not listed in cbl.abuseat.org
87.210.54.117 not listed in dnsbl.sorbs.net
Spam report id 4092699036 sent to: [email protected]
Spam report id 4092699048 sent to: [email protected]
Spam report id 4092699055 sent to: [email protected]

 

[CarolX]

Re: Funny Scam Spam Emails - Do you have one to share?

I have received several of these with differnt stories, but all ending with

I will apprecaite if you can send me the following,

1.Your Full Names
2.Your current telephone and fax numbers
3.Your age
4.Occupation
5.Your Current contact address

Let me hop right on it

 

[Wes Bucey]

Re: Funny Scam Spam Emails - Do you have one to share?

I usually click "delete" before I get past the first paragraph. I wonder how many millions, billions, and zillions I missed by my rash action?

 

[Claes Gefvenberg]

Re: Funny Scam Spam Emails - Do you have one to share?

I don't get many of those anymore. My ISP seems to have done a great job at blocking them, and my own spam filters are dealing with most of the remainder.

They annoy me much more via the phone: Only yesterday I got a call where a nice English speaking lady told me about the great vacation I had just won and would I please provide her information so and so to enable them to forward the details... As usual, I responded by asking her to call me later on my other telephone no "at the office where I have all the required data" and provided her the number to the local police station.

Sometimes, as a variation, I get a recorded voice asking me to press this and that button on my phone to get more information.

/Claes

 

[Marc]

Re: Funny Scam Spam Emails - Do you have one to share?

Up until Wednesday of this week I was again getting hundreds of spam emails every day. 99% were coming to the email address vBulletin was using to send out email. The return path is defined in the php.ini file, as I found out. I changed that, killed that email address on my server, and added the new email address as an alias. This way I can change things when it gets bad again.

I'm back to only a couple a day now. Whew....

 

[smryan]

Re: Funny Scam Spam Emails - Do you have one to share?

Here at work the only things that come through as spam are email notices from that pesky elsmar.com and ad-mail from Ohaus. At home..... well I do find it annoyingly ammusing that most of the spam that makes it through is promising to grow something to huge proportions that no-one in my house owns ... not unless you count the two male cats - and size doesn't seem to be their concern. Neutered as they are.

 

[Scott Catron]

Re: Funny Scam Spam Emails - Do you have one to share?

The Adventures of Captain McGillicuddy:

http://outdoorsbest.zeroforum.com/zerothread?id=200606

where someone has a little fun with the spammers.

 

[Claes Gefvenberg]

Re: Funny Scam Spam Emails - Do you have one to share?

The Adventures of Captain McGillicuddy where someone has a little fun with the spammers.

A little fun? It is absolutely brilliant!

/Claes

 

[RickRay]

Re: Funny Scam Spam Emails - Do you have one to share?

Ok well here is one I received just the other day. I have deleted it already so I guess I will never know if it was true or not!

Dear Sir,

Its been a long time now. I have been able to transfer my money to Zurich in Switzerland through the help of one Mr. Jack Robertson. He is a very good man. Well, I just write to inform you that I left behind 50,000$ for you with my former lawyer in South Africa . Its just that I can not forget how you are the very first person I contacted to help me and till today, I still don't know what went wrong.

Anyway, I have forgotten about the past and all I am doing now is to make sure I invest properly my money. Reply me now and I will give you the contact details of that my former lawyer for you to contact him and he will transfer the 50,000$ to you.

You can contact me with this email address (Link removed to enable me give you the details of my former lawyer for you to contact him.

Ok, bye for now.

Mr John Zuma

 

[Marc]

Re: Funny Scam Spam Emails - Do you have one to share?

Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="Windows-1251"
Date: Sat, 2 May 2009 12:35:11 +0200 [06:35:11 AM EDT]
Delivered-To: <snip>@spamcop.net
From: SUSAN FERNANDO <[email protected]>Add Link removed to my Address Book
MIME-Version: 1.0
Message-Id: <[email protected]>
Received:

* (qmail 32171 invoked from network); 2 May 2009 11:13:59 -0000
* from unknown (192.168.1.88) by blade4.cesmail.net with QMQP; 2 May 2009 11:13:59 -0000
* from ns2.benet.ru (HELO smtp.benet.ru) (83.167.4.66) by mxin1.cesmail.net with SMTP; 2 May 2009 11:13:34 -0000
* by smtp.benet.ru (Postfix, from userid 426) id E350C507A11; Sat, 2 May 2009 16:35:15 +0600 (YEKST)
* from User (unknown [62.140.137.157]) by smtp.benet.ru (Postfix) with ESMTP id A646C4C7067; Sat, 2 May 2009 16:34:26 +0600 (YEKST)

Reply-To: Links removed Links removed to my Address Book
Return-Path: <[email protected]>
Subject: ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD ??
To: undisclosed-recipients:;
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Priority: 3
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on blade4
X-Spam-Level: ************************
X-Spam-Status: hits=24.5 tests=ADVANCE_FEE_2,FORGED_MUA_OUTLOOK, JM_SOUGHT_FRAUD_1,JM_SOUGHT_FRAUD_2,JM_SOUGHT_FRAUD_3,MILLION_USD, MSOE_MID_WRONG_CASE,SARE_FRAUD_X3,SARE_FRAUD_X4,SARE_FRAUD_X5,SUBJ_ALL_CAPS version=3.2.4
X-SpamCop-Checked:
X-SpamCop-Disposition: Blocked SpamAssassin=24
Headers: Show Limited Headers

ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD

Mrs Susan fernando.

I am the above named person from Kuwait. I am married to Dr SAZON FERNANDO who worked with Kuwait embassy in Ivory Coast for nine years before he died in the year 2005.We were married for eleven years without a child. He died after a brief illness that lasted for only four days. Before his death we were both born again Christians.Since his death I decided not to re-marry or get a child outside my matrimonial home which the Bible is against.When my late husband was alive he deposited the sum of 18Million Dollars (eighteen Million United State Dollars) with one finance/security company in Amsterderm-Netherlands. Presently This money is still with the Security Company. Recently my Doctor told me that I would not last for the next three months due to cancer problem. Though what disturbs me most is my stroke sickness. Having known my condition I decided to donate this Fund to church or better still a christian individual that will utilize this money the way I am going to instruct here in. I want a church that will use this funds to fund churches orphanages and widows propagating the word of God and to ensure that the house of God is maintained. The Bible made us to understand that Blessed is the hand that giveth. I took this decision because I don't have any child that will inherit this money and my husband relatives are not Christians and I don't want my husband's hard earned money to be misused by unbelievers. I don't want a situation where this money will be used in an ungodly manner. Hence the reason for taking this bold decision. I am not afraid of death hence I know where I am going. I know that I am going to be in the bosom of the Lord. Exodus 14 VS 14 says that the lord will fight my case and I shall hold my peace. I don't need any telephone communication in this regard because of my health and because of the presence of my husband's relatives around me always. I don't want them to know about this development. With God all things are possible. As soon as I receive your reply I shall give you the contact of the Finance/Security Company in Amsterderm-Netherlands. I will also issue you a letter of authority that will prove you as the original- beneficiary of this Funds. I want you and the church to always pray for me because the lord is my shephard. My happiness is that I lived a life of a worthy Christian. Whoever that wants to serve the Lord must serve him in spirit and truth. Please always be prayerful all through your life. Any delay in your reply will give me room in sourcing for a church or christian individual for this same purpose. Please assure me that you will act accordingly as I stated herein. Hoping to hearing from you. I have set aside 20% for you and for your time and 10% for any enpense if there is any . Remain blessed in the name of the Lord. Yours in Christ.
Mrs. susan fernando
Note: reply email to Link removed

Tracking:

Processing spam:

From: Link removed
Subject: ENDEAVOUR TO USED IT FOR THE CHILDREN OF GOD ??


Received: (qmail 32171 invoked from network); 2 May 2009 11:13:59 -0000
warning:Ignored

Received: from unknown (192.168.1.88) by blade4.cesmail.net with QMQP; 2 May 2009 11:13:59 -0000
192.168.1.88 found
host 192.168.1.88 (getting name) no name
warning:192.168.1.88 discarded

Received: from ns2.benet.ru (HELO smtp.benet.ru) (83.167.4.66) by mxin1.cesmail.net with SMTP; 2 May 2009 11:13:34 -0000
83.167.4.66 found
host 83.167.4.66 = ns2.benet.ru (cached)
ns2.benet.ru is 83.167.4.66
Possible spammer: 83.167.4.66
Received line accepted

Received: by smtp.benet.ru (Postfix, from userid 426) id E350C507A11; Sat, 2 May 2009 16:35:15 +0600 (YEKST)
warning:Ignored

Received: from User (unknown [62.140.137.157]) by smtp.benet.ru (Postfix) with ESMTP id A646C4C7067; Sat, 2 May 2009 16:34:26 +0600 (YEKST)
62.140.137.157 found
host 62.140.137.157 (getting name) no name
83.167.4.66 not listed in dnsbl.njabl.org ( 127.0.0.9 )
83.167.4.66 not listed in cbl.abuseat.org
83.167.4.66 listed in dnsbl.sorbs.net ( 127.0.0.6 )
83.167.4.66 is not an MX for mxin1.cesmail.net
83.167.4.66 is an MX for benet.ru
Possible spammer: 62.140.137.157
Host smtp.benet.ru (checking ip) = 83.167.4.66
83.167.4.66 not listed in dnsbl.njabl.org ( 127.0.0.9 )
83.167.4.66 not listed in cbl.abuseat.org
83.167.4.66 listed in dnsbl.sorbs.net ( 127.0.0.6 )
Chain test:smtp.benet.ru =? ns2.benet.ru
Host ns2.benet.ru (checking ip) = 83.167.4.66
83.167.4.66 is an MX for benet.ru
83.167.4.66 is mx
smtp.benet.ru and ns2.benet.ru have close IP addresses - chain verified
Possible relay: 83.167.4.66
83.167.4.66 has already been sent to relay testers
Received line accepted
Tracking message source:62.140.137.157:

Cached whois for 62.140.137.157 : [email protected]
Using abuse net on [email protected]
No abuse net record for vodafone.nl
Using best contacts [email protected]
Message is 8 hours old
62.140.137.157 not listed in dnsbl.njabl.org ( 127.0.0.8 )
62.140.137.157 not listed in dnsbl.njabl.org ( 127.0.0.9 )
62.140.137.157 listed in cbl.abuseat.org ( 127.0.0.2 )
62.140.137.157 is an open proxy
Spam report id 4100667766 sent to: [email protected]