Spyware Warrior Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
 
FAQ :: Search :: Memberlist :: Usergroups :: Register
Profile :: Log in to check your private messages :: Log in

Mugu mail, Feb 15

 
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam
View previous topic :: View next topic  
Author Message
olliver
Expert Developer


Joined: 27 Jan 2006
Last Visit: 02 Dec 2010
Posts: 1157
Location: yes

PostPosted: Sun Feb 15, 2009 5:14 am    Post subject: Mugu mail, Feb 15 Reply with quote

We won the lottery for a change Wink

Headers:
Quote:
Delivered-To: [spamtrap]
Received: by 10.150.215.3 with SMTP id n3cs97875ybg;
Sun, 15 Feb 2009 66:66:66 -0800 (PST)
Received: by 10.90.118.19 with SMTP id q19mr2375999agc.6.6666666666666;
Sun, 15 Feb 2009 66:66:66 -0800 (PST)
Return-Path: <nobody@launch.gosmarts.com>
Received: from LAUNCH.GOSMARTS.COM (launch.gosmarts.com [72.9.149.172])
by mx.google.com with ESMTP id 36si7766545agc.30.2009.02.15.66.66.66;
Sun, 15 Feb 2009 66:66:66 -0800 (PST)

Received-SPF: pass (google.com: best guess record for domain of nobody@launch.gosmarts.com designates 72.9.149.172 as permitted sender) client-ip=72.9.149.172;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of nobody@launch.gosmarts.com designates 72.9.149.172 as permitted sender) smtp.mail=nobody@launch.gosmarts.com
Received: from nobody by LAUNCH.GOSMARTS.COM with local (Exim 4.69)
(envelope-from <nobody@LAUNCH.GOSMARTS.COM>)
id xxxxxx-xxxxxx-xx
for [spamtrap]; Sun, 15 Feb 2009 66:66:66 -0600
To: [spamtrap]
Subject: EMAIL NEWS
From: EUROMILIONES ESPANA INTL <intersweepstake@netscape.net>
Reply-To:
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <xxxxxx-xxxxxx-xx@LAUNCH.GOSMARTS.COM>
Date: Sun, 15 Feb 2009 66:66:66 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - LAUNCH.GOSMARTS.COM
X-AntiAbuse: Original Domain - [spamtrap domain]
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - LAUNCH.GOSMARTS.COM


The origin of the mail defaults to a cPanel login page. It is home to a lot of domains (shared hosting) and one of these appears to have a vulnerable contact form or other script capable of sending mails that allows sending email addresses to arbitrary recipients.
http://search.live.com/results.aspx?q=ip%3A72.9.149.172&go=&form=QBLH

Ironically, the hosting outfit responsible for 72.9.149.172 calls itself "uberhost" Wink

Quote:
CustName: UberHost Net
Address: PO Box 1541
City: San Jacinto
StateProv: CA
PostalCode: 92581-1541
Country: US
RegDate: 2008-06-19
Updated: 2008-06-19

NetRange: 72.9.149.172 - 72.9.149.179
CIDR: 72.9.149.172/30, 72.9.149.176/30
OriginAS: AS30277
NetName: UBERHOSTNET
NetHandle: NET-72-9-149-172-1
Parent: NET-72-9-144-0-1
NetType: Reassigned
Comment:
RegDate: 2008-06-19
Updated: 2008-06-19


body:
Quote:
EUROMILIONES ESPANA INTL
Desk of Approval/Game
Gaming Board Department
MADRID, SPAIN.


FILE REF NUMBERS: MD/908/509528/SP.
TICKET NO: BL8704/163/60.


!!!CONGRATULATIONS YOU ARE A WINNER!


The Board of Directors, members of staff and the International
Promotion Department of the EUROMILIONES INTL, wishes to congratulate you on
your success as one of the THREE LUCKY STAR PRIZE WINNER of 900,165.11
Euros (Nine hundred thousand, one hundred and sixty-five euros, eleven
cents only) of the EUROMILIONES lotto International Promotion (ELP) that
was held on the 15th of january 2009, in Spain .


The selection process was carried out through a random selection in our
computerized email selection system from a database of over 1,000,000
individual and companies E-mail addresses drawn from all the continents
of the world which your email, was among the first THREE (3) lucky
winners. Your email address was attached to Lucky Number
(1-3-16-42-48-2-3), Your Reference number: MD/908/509528/SP and ticket No:
BL/8704/163/60.


Most recently the foundation set up the NEW HOPE LOTTERY to give out
prizes based on the computer balloting system (THEREFORE YOU DO NOT NEED
TO BUY A TICKET TO ENTER FOR IT..YOUR EMAIL ADDRESS WAS RANDOMLY
SELECTED AS A WINNER). You the beneficiary will be require to obtained a
VETT/APPROVAL DOCUMENT of your lucky WINNING EMAIL ADDRESSE to your FULL
NAMES, before your winning prize can be transferred to your designated
account of your choice. To immediately claim your prize, contact the
claim/paying agent on the telephone number & email below.


EURO CLAIM CENTRE
CONTACT PERSON. (MR.MIKE PATERO )
MADRID, SPAIN.
Tel:+34 636891080
Email: archivosecure@aol.es


N.B: Terms and conditions to claiming your prize:
*********************************************************
(1). Please quote your Reference number in all correspondence with the
claim/paying agent above to enable the process of your winning. (2).
indicate your full names and address, Country, Contact telephone
numbers, mobile, fax number, occupation and your Lucky numbers and Reference
number to your claim/paying agent above.


3. Your winning Prize is not DEDUCTABLE until your winnings has been
processed, approved and transferred to you by your claim agent above.
Please, note that you the beneficiary will be require to obtained a
VETT/APPROVAL DOCUMENT of your lucky WINNING EMAIL ADDRESSE CHANGED to your
FULL NAMES, before your winning prize can be transferred to your
designated account of your choice by the claim/paying agent above.


The above claim/paying agent will assist you in the processing and
remittance of your winning prize to you. Also note that you are to contact
and process your winning prize not later than one week, after this date
if you do not contact and process your winning prize, all funds will
be returned to the MINISTERIO DE ECONOMIA Y HACIENDA as unclaimed.


Please be informed that due to mix up in cash pay-outs, we ask you to
keep your winning Information confidential until your winning prize of
(900,165.11 Euro) has been processed and transferred to your designated
account of your choice; this is to avoid double claim and unwarranted
abuse of the programme by some participants.


We wish you the best of luck as you spend your good fortune.


Sincerely,


Mrs. Jane Manolo.
Online co-ordinator


dropboxes:
archivosecure@aol.es
intersweepstake@netscape.net

The latter must be a legacy leftover, as today you no longer can register free netscape.net accounts.

And of course, in case you have received that mail too, you have nothing won but a good laugh Wink. True lotteries require purchase of tickets and would hardly send winning notifications via free anonymous email accounts.

Olliver
_________________
Petcord netlabel :: Synflict post-digital arts :: Leftob audio cast
Each click on any of the links above will save the life of a cute kitty somewhere in the universe.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam All times are GMT - 8 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group