Email Spam Filter:
jwSpamSpy
Try it for free!


About spam / "419" / Blog
jwSpamSpy
Recent spam domains
Spam domain blacklist

Software
Links
joewein.de
joewein.net
Contact
Google

 

419 Scam – 419 scammers solicit funds for tsunami victims

The same criminals who pose as email lotteries, corrupt bank employees, lawyers or family members of dead dictators in the "419" advance fee fraud seem to be taking advantage of the death of hundreds of thousands and the suffering of millions of people in the Indian Ocean tsunami desaster.

Here are several examples of emails, most of which are from Africa, that bear marks of the "419" advance fee fraud but are solicitations for money supposedly destined for tsunami victims in Asia.

This one is not a fraud, but was sent as spam anyway:

Other websites documenting tsunami-related frauds:

Other charity scams:

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Example #1:

Return-Path: <tsunami.aidsappeal@eramail.co.za>
Received: from mail02.infosat.net (mailout06.infosat.net [66.18.69.6])
 by ############## (Postfix) with ESMTP id 6CA1CD83FF
 for <##############>; Mon,  3 Jan 2005 00:57:00 +0000 (GMT)
Received: from [196.38.110.44] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 175626736; Mon, 03 Jan 2005 02:59:10 +0200
Received: from [213.255.201.11] (account tsunami.aidsappeal@eramail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 578456025; Mon, 03 Jan 2005 02:59:10 +0200
From: "Tsunami Victims Aids Appeal" <tsunami.aidsappeal@eramail.co.za>
Subject: TSUNAMI VICTIMS AIDS APPEAL
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Mon, 03 Jan 2005 02:59:10 +0200
Message-ID: <web-578456025@mail01.infosat.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
To: undisclosed-recipients:;

TSUNAMI VICTIMS AIDS APPEAL
Dear Sir/Madam,

We are from a small village in the Aceh Region in
Indonesia affected by the recent Tsunami Quakes/floods
disaster that swept through South Eastern Asia.
We have been rendered homeless and have lost all we
have in life. Many foreign tourists also were affected
by the quakes/floods.

Since we have no other way to survive as of now and
have lost most of our relations and children, we have
decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any
amount of money to enable us start a new lease of
life. Our little business have been swept off by the
floods and we cannot go and steal. All we need is
money to rehabilitate and start business again to make
a living. No amount is too small to assist in this
relief efforts.

We are sending this mail to many people all over the
world for assistance as we cant help ourselves. The
United Nations and other world bodies/organisations
are helping but it is not enough. So we need your
assistance.

 Sir/Madam we pray that God/Allah will reward you
abundantly for listening to the voice of the less
priviledged and people whose lives have been
devastated by a natural disaster.

Any Donation can be sent to us through our nominated
bank account below:

FIRST INTERNATIONAL MERCHANT BANK PLC
THE PLAZA COMMERCIAL CENTRE
BISAZZA STREET
SLIEMA, SLM 15-MALTA
SWIFT CODE: FIMB MTM3
FAVOR: EASTLINE INTERNATIONAL SERVICES LTD
A/C No: MT65FIMB3301900001361CALLUSD 012



Please do not hesitate to reach us with a copy of the
transfer slip for any money sent to our designated
account above for our records and also for
reconciliations with the
bank.Email(tsunamivictims_aidappeal@yahoo.com)

Your assistance will be appreciated.

Thanks for your anticipated cooperation.

Mr Teh Ho
For: Aceh Victims of Tsunami
Indonesia

It seems highly unusual that someone from Aceh, Indonesia would be using a webmailer in South Africa and a bank account in Malta for such an appeal. Furthermore, the IP address this was sent from (which belongs to a worldwide satellite broadband provider) has a history. We received a total of 8 "419"-scam emails originating from this very same IP address between Dec 02 and Dec 30, 2004. We therefore assume the IP to be statically assigned to an Internet service provider or Internet cafe in Nigeria or somewhere else in Africa.

We contacted SkyVision Global Networks, the service provider and asked them to confirm if the IP was assigned to a customer in Indonesia or a different country. They responded by saying they were unable to provide any information about their customers without a court order. However they were investigating the incident I reported in accordance with their Acceptable Use Policies, concluding their response with these words:

"I would suggest you make your donations to this cause via well-known charities."

Here is the originating network:

     inetnum:      213.255.192.0 - 213.255.255.255
     org:          ORG-SGN1-RIPE
     netname:      UK-SKYVISION-20030324
     descr:        PROVIDER
     descr:        SkyVision Global Networks
     country:      GB
     admin-c:      SVAC-RIPE
     tech-c:       SVNC-RIPE
     status:       ALLOCATED PA
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-lower:    SV-MNT
     mnt-routes:   SV-MNT
     notify:       noc@sky-vision.net
     changed:      hostmaster@ripe.net 20030324
     source:       RIPE
     
     route:        213.255.192.0/18
     descr:        SkyVision Network Services
     origin:       AS25228
     mnt-by:       SV-MNT
     changed:      noc@sky-vision.net 20030324
     source:       RIPE
     
     organisation: ORG-SGN1-RIPE
     org-name:     SkyVision Global Networks
     org-type:     LIR
     address:      SkyVision Global Networks
                   Kinetic Business Centre
                   Theobald Street
                   Borehamwood
                   Hertfordshire WD6 4PJ
                   United Kingdom
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       lir@sky-vision.net
     admin-c:      SVAC-RIPE
     admin-c:      SVNC-RIPE
     admin-c:      YURI
     admin-c:      TATA-RIPE
     admin-c:      SB106-RIPE
     mnt-ref:      SV-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     changed:      bitbucket@ripe.net 20040428
     changed:      bitbucket@ripe.net 20041229
     source:       RIPE
     
     role:         SkyVision Network Coordination Center
     org:	      ORG-SGN1-RIPE
     address:      SkyVision Global Networks
     address:      Kinetic Business Centre
     address:      Theobald Street
     address:      Borehamwood
     address:      Hertfordshire WD6 4PJ
     address:      United Kingdom
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       noc@sky-vision.net
     admin-c:      SVAC-RIPE
     tech-c:       SVTC-RIPE
     nic-hdl:      SVNC-RIPE
     mnt-by:       SV-MNT
     notify:       noc@sky-vision.net
     changed:      noc@sky-vision.net 20011220
     source:       RIPE
     
     person:       SkyVision Administrative Contact
     address:      SkyVision Global Networks
     address:      Kinetic Business Centre
     address:      Theobald Street
     address:      Borehamwood
     address:      Hertfordshire WD6 4PJ
     address:      United Kingdom
     org:	      ORG-SGN1-RIPE
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       ripeadm@sky-vision.net
     nic-hdl:      SVAC-RIPE
     mnt-by:       SV-MNT
     notify:       noc@sky-vision.net
     changed:      noc@sky-vision.net 20011220
     source:       RIPE


Example #2:
If example #1 was not suspicious enough, compare it with the following, remarkably similar email:

From: "stones" <tsunamirehab@hotmail.com>
Sent: Monday, 10 January, 2005 7:25
Subject: TSUNAMI RELIEF AIDS APPEAL

Dear Sir/Madam,

We are from a small village in the Aceh Region in Indonesia affected by the recent Tsunami Quakes/floods Disaster that swept through South Eastern Asia.

We have been rendered homeless and have lost all we have in life. Many foreign tourists also were affected by the quakes/floods.

Since we have no other way to survive as of now and have lost most of our relations and children, we have decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any amount of money to enable us start a new lease of life. Our little business have been swept off by the floods and we cannot go and steal. All we need is money to rehabilitate and start business again to make a living. No amount is too small to assist in this relief efforts.

We are sending this mail to many people all over the world for assistance as we can't help ourselves. The United Nations and other world bodies/organisations are helping but the funds are not well circulated. So we need your assistance.

Sir/Madam we pray that God/Allah will reward you abundantly for listening to the voice of the less privileged and people whose lives have been devastated by a natural disaster.

Any donation can be sent either by Western Union Money Transfer Services or Money Gram Transfer to:

Mr. Musliman Musliman
Kp Kurus RT 009-RT0089
Utara, Jakarta,
Indonesia,
14130.

As soon as you effect the Payment, email me the relevant Money Transfer details vis: Money transfer control number, senders name and address as it appears in the transfer receipt, amount sent, test question and answer (if any).

My email for further contact is: tsunamirehab@netscape.net

Your assistance will be appreciated. Thanks for your anticipated cooperation.

Mr. Musliman Musliman
For: Aceh Victims of Tsunami
Indonesia
email: tsoonamirehab@netscape.net

___________________________________________________________________________
Mail sent from Penny's Research service at
- http://iresearch-solutions.com

This spam avoids several of the red flags of the first example, but nevertheless is very suspicious:

  • The sending host is no webmailer in Africa but a website in Australia, at least a neighbour country to Indonesia. However the spam was not sent via regular webmail. The abused website was more or less dormant until the spam hit people's mailboxes (only 315 hits in total from June-December 2004). This spam was sent through an insecure PHP-Nuke installation, a spammer trick currently exclusively used by 419 scammers. As in those 419 spams that go through a PHP-Nuke host the sender address is that of a regular webmail account at a common free webmail provider, in this case a Hotmail account. The sender name "stones" is an unusual choice.
  • The subject line is written in ALL CAPITAL LETTERS, a peculiarity of Nigerian scams.
  • The money is to be sent to someone in Jakarta, which admittedly is less suspicious than a bank in Malta (Example #1), but nevertheless Jakarta is located some 1600 km from Banda Aceh, anything but an easy trip for a homeless villager.
  • We did a Google search for "Musliman Musliman", to see if the name used by the sender of this spam could be Indonesian. We did not find a single hit for Indonesia. Instead, almost all hits came from Bosnian websites (Serbo-Croat language), with Turkish websites a distant second.
Here are the message headers, which don't reveal the location of the original sender. This type of abused mailserver does not publicly track the IP from which the message was posted, which is why 419 scammers like to use it:
Return-Path: <nobody@server2.pe-servers.com>
Received: from 64.71.151.83  (EHLO server2.pe-servers.com) (64.71.151.83)
  by mta107.mail.scd.yahoo.com with SMTP; Sun, 09 Jan 2005 14:32:55 -0800
Received: from nobody by server2.pe-servers.com with local (Exim 4.43)
	id 1CnlV8-0003yN-1x; Sun, 09 Jan 2005 14:25:34 -0800
To: 
Subject: TSUNAMI RELIEF AIDS APPEAL
From: stones <tsunamirehab@hotmail.com>
X-Priority: 3 (Normal)
CC: 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: RLSP Mailer
Date: Sun, 09 Jan 2005 14:25:34 -0800

Example #3:
An almost identical version of the letter from Example #2 but using a different sender address (tsunamivictims_aa@tiscali.co.uk) was reported on 2004-01-03 (see here), reproduced below. The domain tiscali.co.uk is the third most frequently used webmailer in 419 scams (netscape.net, used in example #1, happens to be the most frequent one). The bank account used there was located in Korea, using the name "MOJEKWU VICTOR". According to our research via Google, "Mojekwu" appears to be a Nigerian surname. This spam used the same name as in Example #1, "Teh Ho". In other words, Example #1, Example #2 and Example #3 are all variations of the same scam.

TSUNAMI VICTIMS AIDS APPEAL
DearSir/Madam.

We are from a small village in the Banda/Aceh Region in Indonesia affected by the recent Tsunami Quakes/floods disaster that swept through South Eastern Asia.
We have been rendered homeless and have lost all we have in life. Many foreign tourists also were affected by the quakes.

Since we have no other way to survive as of now and have lost most of our relations and children, we have decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any amount of money to enable us start a new lease of life. Our little business have been swept off by the floods and we cannot go and steal. All we need is money to rehabilitate and start business again to make a living.

We are sending this mail to many people all over the world for assistance as we cant help ourselves. The United Nations and other world bodies/organisations are helping but it is mostly in Clothes, water and medicaments. So we need your assistance Sir/Madam and we pray that God will reward you abundantly for listening to the voice of the less priviledged and people whose life have been devastated by a natural disaster.

Any Donation can be sent to us through our nominated bank account below:

BANK: KOREA EXCHANGE BANK, ITAEWON BRANCH,
SEOUL. SOUTH KOREA
SWIFT CODE: KOEXKRSE,
A/C #: 089-JSD-101464-3,
A/C NAME: MOJEKWU VICTOR,
BENEFICIARY: TSUNAMI AIDS APPEAL

Please do not hesitate to reach us with a copy of the transfer slip for any money sent to our designated account for our records and also for reconciliations with the bank.

Your assistance will be appreciated.

Thanks for your anticipated cooperation.

Mr Teh Ho
For: Banda/Aceh Victims of Tsunami
Indonesia


Example #4
(196.200.81.140 / Mon, 03 Jan 2005 06:35:05 -0500):

From: "Economics Community Of West African States (ECOWAS)" <ecowasheads@post.com>
To: <ecowasheads@post.com>
Sent: Monday, 03 January, 2005 20:35
Subject: Tsunami Disaster Aid Raises.

Branch Headquarters: (Rue 27 VoxDar Porte 111 Bamako Mali
Contacts : 00223 6711675 Fax : 00223 228 5553

E-mail : ecowasheads@post.com

Website : www.ecowasbranch70.tripod.com



Ref: 0073220 Date:- 03, Jan 2005



U.N.: Tsunami aid rises to $2 billion



Attention Sir,

The ECONOMIC COMMUNITY OF WEST AFRICAN STATES (ECOWAS) wants to draw your attention to the terrible disaster that claims about 140 thousands lives and properties in Thialand, Siri lanka and Indonesia,

Pledges of international financial support for countries devastated by this disastser needs emergency financial support, according to the U.N.'s emergency relief coordinator. The estimated death toll in the disaster now is more than 140,000,

Ecowas needs your financial aid to sustain the victims affected by this disaster.

Also Ecowas has raised an open donation to any body who feels concern to make a generous nonation to aid the victims. Ecowas expects to raised about $1.5 Billion USD.

So far, Ecowas has organized to pump 850 40 Ft containers of food items to the countries affected. Some of those supplies began reaching victims in remote areas of Indonesia on Saturday, while relief workers were expected to arrive in Colombo in Sri Lanka, later in the day.

No amount of donation like funds, food,medicines,clothes is small, please make your donation today for the survival of the victims and God pay back to those who donate.The money will allow relief workers to feed, clothe, and provide emergency medical services to the affected victims.

Payment instruction to the Ecowas Relief Management Coordinator BEN IDOWU

ECO BANK BAMAKO BRANCH MALI WEST AFRICA

BP E 1272 BAMAKO MALI.
Account No:- 440030102018
Swift Code:- ECOCMLBA
Beneficiary:- BEN IDOWU

Correspondent in USA
Citibank New York
Finance Institutions Africa
111 Wall Street
19th Floor / Zone 1
New York 10043
Account:- 36219282
Swift:- CITIUS 33

GOD Bless you as you donate.

Thanks.

Dr. Musa Owo

(Ecowas Procurement Manager)

What's wrong with the picture?

  • This was sent as spam.
  • Mali as a landlocked country in Western Africa is not in the best position to send shipping containers to Indonesia.
  • Instead of using a Tripod.com webpage, the real ECOWAS has it's own domain (www.ecowas.int/).
  • A google search for the street address given for the "ECOWAS regional headquarters" finds exactly one match: The scam warning page you are now reading! Even the website the scammers give lists a different street address.
  • Page http://www.ecowasbranch70.tripod.com/id6.html on that website offers gold and gemstones for sale. We have come across a variation of the "Ghana Gold scam" from an ISP in Mali before (IP 196.200.92.18, see here). There may well be a connection.

This spam was sent from Mali, West Africa:

     % This is the RIPE Whois query server #1.
     % The objects are in RPSL format.
     %
     % Rights restricted by copyright.
     % See http://www.ripe.net/db/copyright.html
     
     inetnum:      196.200.80.0 - 196.200.83.139
     netname:      IKATEL-BACKBONE
     descr:        bacbone IP IKATEL
     country:      ML
     admin-c:      SD2024-RIPE
     tech-c:       MA1231-RIPE
     status:       ASSIGNED PA
     remarks:      http://www.ikatelnet.net
     remarks:      ***************************************************
     remarks:      For spam use :   abuse@ikatelnet.net
     remarks:      ***************************************************
     notify:       noc@ikatelnet.net
     mnt-by:       MNT-IKATEL
     mnt-lower:    MNT-IKATEL
     notify:       noc@ikatel.net
     changed:      sekou.drame@ikatel.net 20040713
     source:       RIPE
     
     route:        196.200.80.0/20
     descr:        IKANET
     origin:       AS30985
     mnt-by:       MNT-IKATEL
     changed:      noc@ikatelnet.net 20040923
     source:       RIPE
     
     person:       Sekou DRAME
     address:      IKATEL SA
     address:      Immeuble SONAVIE BP: E 3391
     address:      Bamako ACI 2000
     phone:        +223 6299908
     e-mail:       sekou.drame@ikatel.net
     nic-hdl:      SD2024-RIPE
     changed:      sekou.drame@ikatel.net 20040331
     source:       RIPE
     
     person:       Mohamed Aboubacrine
     address:      IKATEL SA
     address:      Immeuble DT BP 3991 Bamako Mali
     phone:        +223 499 9932
     phone:        +223 629 9932
     nic-hdl:      MA1231-RIPE
     changed:      mohamed.aboubacrine@ikatel.net 20040607
     source:       RIPE


Example #5:

From: "dyspraxia" <dyspraxiafoundation@yahoo.com>
Sent: Tuesday, 04 January, 2005 19:49
Subject: I NEED YOUR ASSISTANCE


THE DYPRAXIA FOUNDATION
8 WEST ALLEY
HITCHIN
HERTFORDSHIRE SGS 1EG
UNITED KINGDOM

The dyspraxia foundation is a charitable foundation headquartered in uk [london] which serves to promote music, theater, art, literature, projects in the social and political arena with a focus on health, as well as science, research, and higher education. Most recently the foundation set up as a foundation that caters for the needs of the poor and the lees privelage in the society

The TSUNAMI DISASTER as it is now known the world over took everybody by surprise. It rought with it horror, death and destruction of a very high magnitude that has not been withnessed for a long time.
We are co-orditaing activities towards providing relief materials, shelter and food to the displaced survivors of the disaster. As you are aware over one hundred and fifty thousand innocent people including six thousand tourist perished in the disaster. We are using this medium to solicite and appeal to well meaning organization and individuals to come to their rescue by contributing their own quota towards helping the survivors. To this end we request that you make a generous donation of at least 100 pound(215 dollars) towards this cause. For further information on how you can be of help please respond to;

MR WILLIAM BECKS
THE DYSPRAXIA FOUNDATION, LONDON ;UK
EMAIL ADDRESS: williamsbecks@london.com
TELEPHONE NUMBER :44 - 704 - 010 - 4605

You will be greatly rewarded as you give to the less fortunate in our society. Certificate of appreciation and citation would be issued to those who support this noble cause.

Yours faithfully,

Susan Khan.

___________________________________________________________________________
Mail sent from WebMail service at PHP-Nuke Powered Site
- http://www.thaitestdrive.com

The real Dyspraxia Foundation owns its own domain, dyspraxiafoundation.org.uk and associated email address: admin@dyspraxiafoundation.org.uk

It doesn't have to use free webmailer accounts such as london.com (a service operated by Outblaze.com) to send email. We reported the scammer to Outblaze who promptly took action.


Example #6: "Sanko Dami"

This email was forwarded to us, so it didn't come with any message headers (that's why we prefer submissions via "Forward as attachment"). We contacted the email address and received a reply from a source in Nigeria.

The plot seems rather far fetched. How likely is it that the son of one of several dozen fishermen's families in Somalia makes it all the way to an internet cafe in Nigeria and finds your email address somewhere on the WWWW? Give me a break! Somalia has little trade with Nigeria, which is a long trip by sea around the Cape of Good Hope. By contrast, it has much closer ties with Kenya and with the Arab peninsula.

From: "sanko dami" <sanko4dami@tsamail.co.za>
Sent: Sunday, January 16, 2005 8:00 AM
Subject: Tsunami victim

Hello sir,

My name is sanko dami a good citizen of somalia. I am from a family of
six including my parents. On the 26 december 2004 by 10 am in the morning
I lost my parents and my two kid brothers to Tsunami disaster and left me
and my kid sister sahar. My parents are fishing in the sea near more remote
village before this deadly disaster came.

One week after this disaster one of my relation who sales cattle in nigeria
came back home to pick me and kids sister to nigeria where he offer me to
be in the cattle business which I am not interested in and also to feed
3 times a day is a war. Before this deadly disaster claim my parents, I
am about to entry one of the colleges in somalia but now things have changed
to the wrong side.

Please I am pleading to the good citizen of the world to help me and my
kids sister to get a better life and education. Here in nigeria, there education
is better than ours and I really like to finish my education.i intended
to study economic which my parent promised me that they will spornsor me.
My kid sister is 3 year and she will like to be in nursery schools. Please
which ever way you will help me and sister who is the whole thing I have
in this world, please do. Anything you offer to me with have a positive
affect on life and that of my sister. If you can give me a text book on
economic, I will apperiate it. It will help me to know more about the course
I choose to study.

Here I nigeria I have met some friends who are of great help to me in terms
of food and clothing for me and my sister. Remember that anything you offer
with have a great change in the life of me and my sister.

Thanks as I await you favorable responses

Sincerely yours,

Sanko dami


Note. Our major promble is food and clothing. Please help.


RIPE-lookup of the sending IP 193.219.234.165
     inetnum:      193.219.234.0 - 193.219.234.255
     netname:      ORBITILS-NET-NG
     descr:        Orbit Infolink Systems Ltd
     country:      NG
     admin-c:      LNW1-RIPE
     tech-c:       LNW1-RIPE
     status:       ASSIGNED PA
     remarks:      --------------
     remarks:      T-IP-20040427
     remarks:      --------------
     mnt-by:       TAIDE-NOC
     notify:       lawrence@orbitinfolink.com
     notify:       admin@orbitinfolink.com
     changed:      registry@taide.net 20040427
     source:       RIPE
     
     route:        193.219.192.0/18
     descr:        TAIDE-NET
     origin:       AS5377
     mnt-by:       TAIDE-NOC
     changed:      registry@taide.net 20010402
     source:       RIPE
     
     person:       Lawrence Nwezza
     address:      No 3 First Avenue, Independence-Layout
     address:      Enugu, Nigeria.
     phone:        +234 42 458903
     phone:        +234 804 611211
     fax-no:       +234 42 458903
     e-mail:       lawrence@orbitinfolink.com
     e-mail:       admin@orbitinfolink.com
     nic-hdl:      LNW1-RIPE
     changed:      registry@taide.net 20040427
     source:       RIPE


In addition to the donation frauds, the tsunami disaster is also woven into many existing scam storylines. Here are some examples:

Example ("Roger Hankin"):

From: "Roger Hankin" <rogerjh@tsamail.co.za>
Sent: Thursday, 06 January, 2005 11:10
Subject: Urgent Help......

Good day,

Compliments of the Season to you and your Family.

My name is Roger Jame Hankinsa, a merchant from London,in England. I have been diagnosed with Esophageal cancer which was discovered very lately after the incident of the Tsunami disaster which I know you are aware of,I and my lost or as the case may be late family came to Aceh Province of Indonesia to spend the Christmas/New Year holiday but I didnt Know it was going to be the last time of seeing my wife and lovely children.Presently I'm in the hospital undergoing treament apart from the injuries incured in the Disaster I was told by the Doctors that This desease has defied all forms of medication and right now I have only about a few moments to live on earth, according to medical experts.

http://www.msnbc.msn.com/id/6754820
http://www.servicesmind.com/list.php?page=215

Now that God! has called me,I want God to be merciful to me and accept my soul and so, I have decided to give alms to charity organizations, as I want this to be one of the last good deeds I will do on earth but my health has deteriorated so badly, that I can not do this myself.
The last of my money which is the huge
cash deposit of "US$8.3M" that I lodge as precious materials with a Security company.
I need you, as God fearing and trustworthy person to help me give out this to charity as that is the only ideal thing to do because I have seen people cry because they are homeless and helpless even I too is heartbroken because I have lost all that I worked and Lived for.

I will be trusting to hear from you soon, remain blessed and God be with you and your family.

Kind regards,
Roger Jame Hankinsa
rogerjh59@yahoo.co.uk

Here are the message headers for this spam:

Received: from [196.38.110.54] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 176995579; Thu, 06 Jan 2005 04:10:24 +0200
Received: from [212.199.137.66]
 (account rogerjh@tsamail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 581616676; Thu, 06 Jan 2005 04:10:24 +0200
From: "Roger Hankin" <rogerjh@tsamail.co.za>
Subject: Urgent Help......
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Thu, 06 Jan 2005 04:10:24 +0200
Message-ID: <web-581616676@mail01.infosat.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-MailScanner-SpamCheck: spam, SpamAssassin (score=9.01,
	required 5, BAYES_60 0.37, MISSING_HEADERS 0.12,
	NIGERIAN_SUBJECT2 2.09, RCVD_IN_BL_SPAMCOP_NET 1.22,
	RCVD_IN_SORBS_SPAM 2.00, URIBL_OB_SURBL 3.21)
X-MailScanner-From: rogerjh@tsamail.co.za

Here is the source network for IP 212.199.137.66, Golden Lines, a satellite broadband provider in Israel that is used by many ISPs in Nigeria and other African countries:

     inetnum:      212.199.0.0 - 212.199.255.255
     org:          ORG-GLIC1-RIPE
     netname:      IL-GOLDENLINES-20000726
     descr:        Golden Lines International Communication Services Ltd.
     descr:        PROVIDER Local Registry
     country:      IL
     admin-c:      DR5299-RIPE
     tech-c:       DR5299-RIPE
     status:       ALLOCATED PA
     notify:       lir@linux.goldenlines.net.il
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-lower:    AS9116-MNT
     mnt-routes:   AS9116-MNT
     changed:      hostmaster@ripe.net 20000726
     changed:      hostmaster@ripe.net 20001206
     changed:      hostmaster@ripe.net 20010710
     changed:      lir-help@ripe.net 20011217
     changed:      hostmaster@ripe.net 20040525
     source:       RIPE
     
     route:        212.199.0.0/16
     descr:        Golden Lines
     origin:       AS9116
     mnt-by:       AS9116-MNT
     changed:      lir@linux.goldenlines.net.il 20010807
     source:       RIPE
     
     organisation: ORG-GLIC1-RIPE
     org-name:     Golden Lines International Communication Services Ltd.
     org-type:     LIR
     address:      25 Hasivim St.
                   K. Matalon
     address:      41970
     address:      Petach Tikva
     address:      Israel
     phone:        +97239291122
     fax-no:       +97239274608
     e-mail:       dnsreg@012.net.il
     admin-c:      DR5299-RIPE
     admin-c:      AG914-RIPE
     admin-c:      GE2074-RIPE
     admin-c:      MH21010-RIPE
     admin-c:      IB737-RIPE
     mnt-ref:      AS9116-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     changed:      bitbucket@ripe.net 20041105
     source:       RIPE
     
     role:         DNS REG
     address:      25 Hsivim st. Petach-Tiikva, Israel
     e-mail:       dnsreg@012.net.il
     trouble:      abuse@012.net.il
     admin-c:      GE2074-RIPE
     tech-c:       IB737-RIPE
     tech-c:       AG914-RIPE
     nic-hdl:      DR5299-RIPE
     notify:       lir@linux.goldenlines.net.il
     changed:      lir@linux.goldenlines.net.il 20030715
     mnt-by:       AS9116-MNT
     source:       RIPE

Example ("Madhi Albalawi"):

From: "madhi" <madhi178@netscape.net>
Sent: Friday, 07 January, 2005 22:12
Subject: Response Needed

From Mr. Madhi Albalawi
Email: madhi178@netscape.net
Good Day.
It is my sincere prayers and wishes that the year has been fulfilling and rewarding for you and your family. Sorry to surprise you and take some of your time in going through this unexpected letter of plea for your understanding and assistance.

This message may come as a surprise as we have not met, but we are desperately in need of help. I got this contact out of desperation and frustration, via a comprehensive search on the Internet.
I am a victim of the last Sunday the 26th of December 2004 Tsunami Strike where I lost my whole family and virtually everything I have labored for, My name is Madhi Albalawi a Saudi national and a merchant in Indonesia, Now I have been diagnosed with prostate, esophageal Cancer and High Blood Pressure that was discovered after the strike and shock from the heavy under water wave that claimed many lives. I have only about a few months to according to medical experts.

I have not particularly lived my life so well, as I never really cared for anyone not even myself but my business. Though I am very rich, I was never generous, I was always hostile to people and only focus on my business as that was the only thing I cared for. But now I regret all this, as I now know that there is more to life than just wanting to have or make all the money in the world.
Presently, I'm in my house here in London where I have been undergoing treatment for esophageal cancer. I have now lost my ability to talk and my doctor have told me that I have only a few months to live. It is my last wish to see that my money distributed to Victims of the Tsunami using the allocated Agencies like the UNICEF, UN. SAVE THE CHILDREN etc.

The last of my money, which is the huge cash deposit that I have with Financial Firm in London .I will want you to help me collect this deposit and dispatched it to charity organizations in charge of the tsunamis victims and let them know that it is I, Madhi Albalawi that is making this generous donation.
I am writing this from my laptop computer in my hospital bed where I wait for my time to come. I pray that God uses you to support and assist me with good heart

I am not afraid of death hence I have seen plenty of them in recent times. I don't need any telephone communication in this regard because of my soundless voice and inability to talk. As soon as I receive your reply I shall give you the contact details of the holding firm in London where the funds are presently been held in safe custody.
I await your response and please send me further mails to Email: madhi178@netscape.net

Trustfully Yours
Madhi Albalawi.




___________________________________________________________________________
http://kija.snurkle.net


Example ("James Brooks"):

Return-Path: <endtime05@teenmail.co.za>
Received: from [66.18.69.6] (helo=mail02.infosat.net)
	by mx.mailix.net with esmtp (Exim 4.24-ND)
	id 1CtH63-0001FE-Ua
	for #######; Mon, 24 Jan 2005 19:10:28 -0800
Received: from [196.38.110.52] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 188641637; Tue, 25 Jan 2005 04:28:33 +0200
Received: from [80.88.128.12] (account endtime05@teenmail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 604231634; Tue, 25 Jan 2005 04:28:33 +0200
From: "james brooks" <endtime05@teenmail.co.za>
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Tue, 25 Jan 2005 04:28:33 +0200
MIME-Version: 1.0
X-SA-Exim-Connect-IP: 66.18.69.6
X-SA-Exim-Mail-From: endtime05@teenmail.co.za
Subject: CAN WE HELP THE TSUNAMIS VICTIMS? 
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
	southcarolina.backend
X-Spam-Status: No, score=9.2 required=10.0 tests=FROM_ENDS_IN_NUMS,
	J_CHICKENPOX_101,J_CHICKENPOX_23,J_CHICKENPOX_33,J_CHICKENPOX_41,
	J_CHICKENPOX_51,J_CHICKENPOX_54,J_CHICKENPOX_63,J_CHICKENPOX_71,
	J_CHICKENPOX_83,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SUBJ_ALL_CAPS 
	autolearn=no version=3.0.0
X-Spam-Level: *********


All correspondence should be forwarded to 
email: endtime_ministry2005@yahoo.co.in
phone number:+44 2070 600 459 
Calvary Greetings. 
I am a preacher with the End Time Ministry,and I will like
to get advice from you.I believe the advice I need is
secular to some extent,but do have the patience to
understand my intention.

Few months ago I was in Sri-Lanka were I had established a
little congregation where I preached regularly in
collaboration with some other preachers from Sri-Lanka.On
one fateful day, one christian Missionary/ Philantropist
from Thailand came to the church and gave 
the Ministry a donation of US$8M towards the development of
the church.After a few days,I travelled back to London to
continue my ministry.Although,he deposited the US$8M in a
Security Deposit/Bank in Madrid-Spain. 
But, When the TSUNAMI flood incident arose,I was intimated
by a fellow preacher that the Philantropist (MR.BOSCO
WHENG) and his entire family were killed. 
I am interested in using a small fraction of this
money,much less than one percent for a reorganisation of
the work of God,but I do not need the rest and do not want
to have any direct dealing with it.but I need 
someone who will be able to use the fund better maybe for
charity and to support the Tsunami victims,I have thought
of doing it myself, but my ministry is the apocalypse and I
believe and preach the soon coming of the Lord which make
me not to indulge in reliance on money or wealth in 
any form.I will be glad if you have any interest in the
direction of maybe managing or transmitting the fund as you
prefer inyour capacity and understanding. 
Please if you are interested,I would want you to send me
the following 
informations: 
1.Your legitimate name. 
2.Your contact address. 
3.Your phone number. 
4.Your fax number. 
With all these informations,I will take it that you are
interested and I will immediately forward your details to
the Security Deposit/Bank to enable them effect payment to
you.You must promise me that you will use the fund for 
the purpose which it is meant for. 
I will be glad to get a response from you to show your
interest. 
I am presently In the U.k{LONDON} where I am conducting a
deliverance service for cancer patients. 
To further throw more lights on the procedures and
requirements involve In receiving this funds you can call
me on this 
number:+44 2070 600 459 
email: endtime_ministry2005@yahoo.co.in
Regards, 
Pastor James Brooks.




Date: Mon, 21 Feb 2005 21:53:11 +0600
Message-Id: <200502211553.j1LFrBNF012687@w3ext.druknet.bt>
To:
Subject: APPOINTMENT AS A TRUSTEE
From: asiapacificfoundation <asiapacificfoundation@web-mail.com.ar>

ASIA PACIFIC FOUNDATION,UK
# 15 MORGAN MANSION,
MORGAN ROAD LONDON N7. 8NA.
EMAIL: asiapacificfoundation@web-mail.com.ar
TEL/FAX: 44- 870-135-5036
DATE: 21 February, 2005.


ATTN: PRESIDENT/CEO.

RELIEF FUND FOR DISTRIBUTION IN ACEH REGION INDONESIA.

Sir,

The ASIA PACIFIC FOUNDATION, in the United Kingdom has for the past fifteen (15) years been a leading contributor in the development of a peaceful,prosperous and open South East Asia region.

With a network of 17 offices throughout the United Kingdom and Overseas, the ASIA PACIFIC FOUNDATION, supports programmes in the SOUTH EAST ASIA that contribute to poverty alleviation, and other humanitarian purposes.

The ASIA PACIFIC FOUNDATION is funded by contributions from corporations, foundations, individuals, governmental organizations in the U.S. and Asia Countries, and annual appropriation from the U.K. Parliament.

The Foundation has today raised the sum of US55 million Dollars. The fund of US55 million Dollars will be used for charitable and humanitarian work in ACEH REGION INDONESIA FOR THE TSUNIMI FLOOD DISASTER especially in the areas of Hospitals, Ambulances, schools and Foods for refugees rehabilitation etc.

WE SEEK for you to act as the TRUSTEE of this fund (US55 million Dollas ). We believe you are a person of integrity, vision and organizational skill and ability.

As a TRUSTEE of the funds, you will be given the entire funds to manage, disburse and distribute to charitable purposes in ACEH REGION OF INDONESIA.

The TRUSTEE will receive a compensation / commission for his duties. This will be 15% of the total Trust Fund of US55 million Dollars.

Your acceptance of this offer / letter of interest should be directed to the above office fax or e-mail address.

Regards,

DR. RAHMAN ALI.(PHD) (DIRECTOR).

FOR: ASIA PACIFIC FOUNDATION ( UNITED KINGDOM

___________________________________________________________________________
http://www.telecom.net.bt


"Nancy Doyles" (Thailand)

This series of scams was perpetrated in August, 8 months after the desaster:

From: "nancy doyles" <nancy_doyles2@yahoo.com>
To: <emailaddress>
Sent: Friday, 12 August, 2005 11:00
Subject: YOUR LOST ONE IN THE TSUNAMI HAS BEEN FOUND

Dear,

I am ms Nancy doyles,co-ordinator of a non governmental organisation by
name(MISSING TSUNAMI VICTIMS)This is an organisation that helps in
locating missing survivors of the Tsunami and rejoining them to their
families and loved ones.

We just found your lost one micha maurits,and he is currently in a local
hospital here in phuket thailand receiving treatments,reply me and you
will arrange on how to come to thailand urgently and meet him in
hospital.

Awaiting your reply.

Nancy


nancy doyles

Send instant messages to your online friends
http://in.messenger.yahoo.com

When contacted, this person replied:

Dear,

We found micha maurits at a local herbalist home in phuket before the organisation took the patient to wanachi private hospital and the patient is currently responding to medical treatment,the patient has been in coma for the past months and the doctors are hoping the patient will get out of come in few days time after a major operation is carried out on the patient within the week .

In your reply tell me when you are planning to come to thailand for a possible transfer of the patient to your country for further medical treatments.this is my number:+51247842.

Nancy

Now we start talking cash:

Dear,

The hospital doctor informed me that the patient will be undergoing a major operation in 2 days time,the operation if succesful will get the patient out of coma,the doctor requires you to make an urgent payment of US$12,000 to enable the operation take place as planned.

Nancy


nancy doyles


--------------------------------------------------------------------------------
Check out Yahoo! India Rakhi Special for Rakhi shopping, contests and lots more.
http://in.promos.yahoo.com/rakhi/index.html

Message headers:

Received: from [203.144.160.244] by web34405.mail.mud.yahoo.com
 via HTTP; Thu, 18 Aug 2005 09:45:08 BST
Date: Thu, 18 Aug 2005 09:45:08 +0100 (BST)
From: nancy doyles <nancy_doyles2@yahoo.com>
Reply-To: nancydoyles@hotmail.com, doyles@walla.com
Subject: OPERATION

WHOIS details for sending network (IP 203.144.160.244):

     inetnum:      203.144.128.0 - 203.144.255.255
     netname:      ASIAINFO-TH
     descr:        Internet Service Provider
     country:      TH
     admin-c:      WP1-AP
     tech-c:       SK1-AP
     mnt-by:       APNIC-HM
     mnt-lower:    MAINT-ASIAINFO-AP
     remarks:      Aggregated small blocks to be one /17.
     changed:      hostmaster@apnic.net 20000403
     changed:      hm-changed@apnic.net 20021216
     status:       ALLOCATED PORTABLE
     source:       APNIC
     
     person:       Wongchai Piyakavarnich
     address:      17 th floor ,Fortune House
     address:      1 Ratchadaphisek Road, Din Daeng
     address:      Bangkok 10320
     country:      TH
     phone:        +662-6411800 ext 4794
     fax-no:       +662-6411831
     e-mail:       cmsv@asianet.co.th
     nic-hdl:      WP1-AP
     mnt-by:       MAINT-ASIAINFO-AP
     changed:      cmsv@asianet.co.th 19980901
     source:       APNIC
     
     person:       Supachai Kitwongpak
     address:      17 th floor, Fortune House
     address:      1 Ratchadaphisek Road, Din Daeng
     address:      Bangkok 10320
     country:      TH
     phone:        +66-2-641-1800
     fax-no:       +66-2-642-1540
     e-mail:       kitwongp@asianet.co.th
     nic-hdl:      SK1-AP
     mnt-by:       MAINT-ASIAINFO-AP
     changed:      kitwongp@asianet.co.th 19990210
     source:       APNIC

"Nancy" asks for money by Western Union, the preffered mode of payment in online scams:

Dear,

There is not much time left,so the doctor prefer you to send the money urgently via western union money transfer or money gram,the hospital is wanachi hospital,soi 13 rama pattani phuket,and the name of the doctor is mokane mosimanegape,send the money directly to him with this name.

The doctor assured me that the patient will be alright after the opeartion he gave me a 100% assurance on that.

Nancy

Message headers:

Received: from 203.144.160.245 by by18fd.bay18.hotmail.msn.com with HTTP;
 Thu, 18 Aug 2005 10:02:50 GMT
X-Originating-IP: [203.144.160.245]
X-Originating-Email: [nancydoyles@hotmail.com]
X-Sender: nancydoyles@hotmail.com
Reply-To: doyles@walla.com

The name given for the doctor is a name from Botswana, a bit unusual for a hospital in Thailand.

This scam is run by the same people as the "Doyles Football Club" scam:

"Doyles Football Club"

FROM:THE PRESIDENT

DOYLES FOOTBALL CLUB DUBLIN

RE:FOOTBALL PLAYERS NEEDED.

Dear,

I know you must be very surprised to be reading from me,considering the fact that you dont know the identity of the person writing you,but be rest assured that i am writing you with good intentions.

I am mrs nancy doyles,the president and owner of DOYLES FOOTBALL CLUB,a 3rd division clubside based in dublin,republic of ireland.I got your e-mail contact adress from an internet directory here in bangkok thailand,while browsing the web,searching for talented,fit and skilled young football stars to build my new team with.

DOYLES FOOTBALL CLUB is a clubside i inherited from my late husband,mr patrick doyles.The clubside was disbanded after my husband's untimely death 2 years ago,but was re-opened late last year to carry on with my late husbands dreams of taking the team to unimaginable heights.

For best results for the team,i hired the services of an experienced english coach that has been a former assistant coach in a premiership side in london,i also hired the services of many experienced english technical advisers and assistant coaches.I trust that with their services and that of talented young boys,the sky will be the limit for DOYLES F.C and our aim is to be at the top of the irish 3rd division league,and onward gradual progress to the 1st division and then finally to the premier league.This feats can't be achieved without the help and assistance of young football stars.

DOYLES FOOTBALL CLUBis a football club we want to build around young football stars because we want to start from the grass roots level.The team is currently in bangkok thailand on a 2 months training and trial tour of Thailand.

REASON FOR CONTACTING YOU:If you can play active football well,or if you can not play,but knows or have a brother or a friend that can play well,please contact me on mail by replying to the e-mail adress below.

BASIC REQUIREMENTS:each player must be 17 - 29 years old,each player must report at the teams hotel camp here in bangkok thailand for the screening and trial of the player.Interested players should reply to the adress below for more informations on the travel procedures.

So far we have gotten 14 players from africa,8 from south america,4 asians and 6 europeans,1 american has confirmed his flight ticket and will join the rest of the team next week.

The selected players will return to the teams base in dublin,and must sign a compulsory 1 year contract with the team for the kickoff of the ireland 3rd divison league,starting later this year.The dropped players will be compensated and they will return to their home country with their return tickets.

best regards and hoping to hear from you soonest.

nancy doyles.

for best correspondence,reply this mail only to: doyles_nancy05@yahoo.co.uk


parisbasecharity@msn.com

Good Day My Dear Friend,

How is things going with you, hope is fine. Let me introduce myself to
you, I am Robert Oliver Anderson, the Account Officer to Medicines Sans
Frontieres Paris-based Charity Home in collaboration with Asia Tsunami
Victims. I am writing to you in respect of the charity donation campaign,
were there was an over estimated amount of 22 million euro from the total
sum of 105 million euro allocated for Aids projects collected by MSF from
its 19 branches across the globe donated by individual, NGO, and Government.
MSF wants to redirect unspent money to other crises and Tsunami donors who
do not support those causes can have their money back by seeking for a
reimbursement.

Please check the web link for more information:
http://www.planetark.com/dailynewsstory.cfm/newsid/30849/newsDate/18-May-2005/story.htm

I am soliciting for your kind support, co-operation and trust warden
companion to work with me in the transfer of this fund, by acting as one of
those that have donated fund to this organization and would want his/her
fund reimbursed back to him/her since the fund is mark as unspent. So that
this over estimated fund will be transfer to you for us to share.
If there is any way you find consistencies, interest and willingness to give
me assistances in the transfer of this fund, reply to my personal mailbox:
r_o_anderson@yahoo.fr for details. And I will then send you all backing
documents that were issue to those who donated to victims of tsunami through
MSF. This over estimated fund has being put under control and do not
entertain doubt in assisting me on this fund transfer. In regards to your
agreement with me, I will then inform you on your percentage for your
assistance.



Best Regards,
Robert Oliver Anderson
Account Officer,
To Medicines Sans Frontieres Paris-Base Charity Home.

Message headers:

Message-ID: <BAY5-F720202B79DA728DC3435BD58E0@phx.gbl>
Received: from 80.179.251.122 by by5fd.bay5.hotmail.msn.com with HTTP;
 Sat, 01 Oct 2005 19:17:43 GMT
X-Originating-IP: [80.179.251.122]
X-Originating-Email: [parisbasecharity@msn.com]
X-Sender: parisbasecharity@msn.com
From: "sans frontieres" <parisbasecharity@msn.com>
Date: Sat, 01 Oct 2005 19:17:43 +0000

WHOIS details for sending network (IP 80.179.251.122):

inetnum:      80.179.251.120 - 80.179.251.127
netname:      Gilat-ART1920
descr:        Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il
country:      GB
admin-c:      DR5299-RIPE
tech-c:       DR5299-RIPE
status:       ASSIGNED PA
mnt-by:       AS9116-MNT
mnt-lower:    AS9116-MNT
source:       RIPE # Filtered

role:           DNS REG
address:        25 Hsivim st. Petach-Tiikva, Israel
remarks:        trouble:      abuse@012.net.il
admin-c:        GE2074-RIPE
tech-c:         IB737-RIPE
tech-c:         AG914-RIPE
nic-hdl:        DR5299-RIPE
mnt-by:         AS9116-MNT
source:         RIPE # Filtered
abuse-mailbox:  abuse@012.net.il

% Information related to '80.179.251.0/24AS9116'

route:          80.179.251.0/24
descr:          Golden Lines
origin:         AS9116
mnt-by:         AS9116-MNT
source:         RIPE # Filtered

Email sender history for this IP address:
80.179.251.122
2005-04-15 16:29:19 UTCsuha@mrssuha.com
2005-04-15 16:33:12 UTCsuha@mrssuha.com
2005-04-15 16:35:03 UTCsuha@mrssuha.com
2005-04-15 16:40:37 UTCsuha@mrssuha.com
2005-04-15 16:40:48 UTCsuha@mrssuha.com
2005-04-15 16:43:58 UTCsuha@mrssuha.com
2005-04-15 16:44:18 UTCsuha@mrssuha.com
2005-04-15 16:44:41 UTCsuha@mrssuha.com
2005-04-15 16:50:39 UTCsuha@mrssuha.com
2005-04-15 17:00:28 UTCsuha@mrssuha.com
2005-04-19 12:17:28 UTCanna_evain@bononews.com
2005-06-02 16:07:51 UTCadmin@britttrust2005.com
2005-06-02 16:08:33 UTCadmin@britttrust2005.com
2005-06-03 11:01:54 UTCadmin@britttrust2005.com
2005-06-23 11:56:16 UTCfeis@tsamail.co.za
2005-06-23 12:07:20 UTCfeis@tsamail.co.za
2005-06-23 14:15:41 UTCjohnmill.inc@tsamail.co.za
2005-06-23 14:23:17 UTCjohnmill.inc@tsamail.co.za
2005-06-29 11:15:07 UTCsupport@mailconnections.net
2005-08-01 17:21:21 UTCinter_lottonl@befeared.com
2005-09-17 20:24:31 UTCparisbasecharity@msn.com
2005-09-17 20:27:48 UTCparisbasecharity@msn.com
2005-09-19 10:25:29 UTCparisbasecharityhome@msn.com
2005-09-19 10:31:00 UTCparisbasecharity@msn.com
2005-09-24 14:03:38 UTCj_mills1@msn.com
2005-09-26 13:20:43 UTCparis_basecharity@msn.com
2005-09-26 13:21:18 UTCparis_basecharity@msn.com
2005-09-27 11:08:41 UTCparisbasecharity45@msn.com
2005-10-01 19:17:43 UTCparisbasecharity@msn.com


UNICEF donation spam

On January 18 we received a spam email made to look like it came from UNICEF, but directing people to a website using the domain "cbnserjlwe.com". Most of the message body was a graphics image that acted as a hypertext link to a website. At first we thought this was a decptive-looking scam. However, more investigation showed that it actually a case of a legitimate organisation hiring a spammer to drive traffic to their website. The oddly named domain redirects to "unicefusa.org", a domain registered in 1995.

Click here to view the graphics image of the UNICEF solicitation (make sure to blow up to full size if viewing in Internet Explorer):

Here is the full message with headers:

Return-Path: 
Received: from 4.z-deals.com ([63.214.155.101] helo=consumerselects.biz)
	by ############### with esmtp (Exim 4.43)
	id 1CqzlX-0003nl-Ij
	for ##################; Tue, 18 Jan 2005 21:15:51 +0100
Received: from cbnserjlwe.com (10.0.1.102)
  by pogobuzz.com with QMQP; 18 Jan 2005 12:15:22 -0800
Message-Id: <3ji1eg$s9psvh@pogobuzz.com>
To: ##################
Date: Tue, 18 Jan 2005 10:56:21 -0800
From: "U.S. Fund for UNICEF" <U.S.FundforUNICEF@cbnserjlwe.com>
MIME-Version: 1.0
X-Mailer: 2044962036
Content-type: text/html; charset=us-ascii
X-MailScanner-SpamCheck: spam, SpamAssassin (score=14.559,
	required 5, autolearn=spam, BAYES_95 2.06, DOMAIN_RATIO 3.18,
	HTML_90_100 0.02, HTML_MESSAGE 0.00, HTML_MIME_NO_HTML_TAG 0.14,
	MIME_HTML_ONLY 0.18, RCVD_IN_BL_SPAMCOP_NET 1.22,
	RCVD_IN_NJABL_RELAY 1.40, RCVD_IN_SBL 0.11, RCVD_IN_SORBS_SPAM 2.00,
	URIBL_SBL 4.26)
X-MailScanner-From: u.s.fundforunicef@cbnserjlwe.com
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by ################
 id j0IKFsJf001750


<!--      NFORME DE FEDERICO: Informe del dia 16 de enero del 2005 pacien=
te amanece ,en buen estado de animo no presenta otras ccomplicaciones,sol=
o presenta herida en los gluteos lado del ano,asta el momento todavia no =
se recupera bien, se esta teniendo encuenta cada rato que se contamine co=
n las heces mixion ,se esta ventilando cada vez mas,se esta teniendo en p=
revio curacion , le hecho su ba=F1o general,curaciones ,dar su alimentaci=
on por via oral como siempre,toque su guitarra,se le hace sus ejercicios,=
masjes,curaciones,administracion de medicamentos,por via oral,poner de cu=
bito ventral ,dorsal,colocar de posicion lateral derecho y lateral izquie=
rdo,lavar su babero,hacxer sepillado de dientes tocar su guitarra,cantar,=
etc.,solo me ausentado de la 1 de la tarde hasta las 6 de la tarde ,por h=
aber tenido mis horas libres nada mas,solo he ocupado mis horas de descan=
so casi durante doto los dias,porque mi descanso es dos horas en cada dia=
,entonces en un mes solo tengo 4 horas de vacaciones concideradas en los =
domingos,y otros domingos trabajando todo los dias durante las 24 horas,s=
in salida,hoy dia Azucena y Susana se an engargado de cuidar a Se=F1or Di=
onicio de las 1 de la tarde hasta las 6 de la tarde,me parece que mi tiem=
po de salida debe ampliarse mas,teniendo en cuenta en buenas moralidades.=
 se=F1ora Yuri no se si usted tendria la bondad de darme permiso por un m=
es entero,porque tengo la necesidada de sacar su Libreta Militar de Azuce=
na,por estuve verificando su voleta de inscripcion ,su canje ha vensido e=
l dia 31 del 2004,me parece que voya pagar una multa de 300 nuevo soles,p=
or omistia.    INFORME DE FEDERICO: INFORME DEL DIA 15 -01-05 Paciente Di=
onisio Duran paciente que amanece tranquilo ,con buenas energias de comer=
 hablar,preguntar,las 7 de la ma=F1ana converzan,con el se=F1or Lucio Roq=
ue,don Dionsio le reconocio su nombre y le pregumto subre sus hijas, plat=
icaron por una hara luego llega la se=F1ora Sara cuidador futura de Dioni=
sio Duran las 9 de la ma=F1anay se converzando con Susana y luego con Dio=
nicio,misma hora hago su limpieza genital donde la se=F1ora Sara se queda=
 observando mi trabajo y le ense=F1o tambien de como ba=F1arlo y sobre su=
 estado que se encuentra el paciente,se retira la se=F1ora Sara las 11 de=
 la ma=F1ama Durante todo el dia hago mis cosas como siempre , cumpliendo=
 con mis labores diarios ,concreniente al paciente,por ejemplo le hago co=
mer,contar tocar su guitarra,converzar,hacer sus ejercicios,masajes,paral=
o de pie,colocar de posiscion de cubito ventral,dorsal,lateral derecho y =
izquierdo,hacer su ba=F1o genital,hacer su higiene bucal, lavar su babero=
,lavar sus pltos y tasas despues de las comidas como siempre,realizo tamb=
ien exploracion fisica del paciente, curacion de heridas producida por le=
sion en el ba=F1o a ducha combiar su ropa del paciente ,cortar sus u=F1as=
 del pie y del mano. Visitas por Lucio Roque,Pepe Duran,dondellega las 5 =
de la tardey luego se regresa despues de saludar su Pap=E1y compro=B4 una=
 caja de guantes a s/ 11 ,etecetra.  INFORME DE FEDERICO:. Informe del di=
a 14 -01 -05 paciente Dionisio ,paciente q amanece con ganas de converzar=
,comer su herida ya esta recuperado,duerme bien ,come bien sus alimentos,=
se peina solo se limpia la boca solo,solo quiere rascarse pero se le cort=
a las u=F1as y se le coloca los guantes se le hace sus higiene personal,c=
omo siempre ,tambien para curar las heridas,las heridas se le cura todo l=
os dias y para eso se le hace higiene y lavado de herida con jabon para c=
urar,hago mis labores completas como siempre ,ejercicios,masajes,administ=
racion de medicamentos,,hacer comer sus alimentos,,cantar tocar su guitar=
ra,lo coloco al paciente de cubito ventral,para evitar prision gluteal co=
ntrol de funciones vitales PA=3D10/ 50 paciente q conversa todo los dias =
conla Se=F1ora Yuri Duran 2 a tres veces por dia,mediante internet VISITA=
S Cuando son las 10 y 10 de la noche ,llegan Lurdes y su Papa ,su Papa se=
 queda a dormir en al casa ,lurdes se va asu casa las 10 y 20 de la noche=
.  -->  <a href=3D"http://www.cbnserjlwe.com/bb.pl?j=3D9395ZphjJjKQ204496=
2036woZDkydI14432">  <img src=3D"http://cbnserjlwe.com/images/c/c169a.gif=
?i=3D2044962036_9395" border=3D"0"></a>  <br>  <a href=3D"http://www.cbns=
erjlwe.com/bb.pl?u=3D9395ZphjJjKQ2044962036woZDkydI14433">  <img src=3D"h=
ttp://cbnserjlwe.com/images/c/c169b.gif?i=3D2044962036_9395" border=3D"0"=
></a>


jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!