419 | jamesjohnson2004@libero.it - URGENT ASSISTANT PLS

[mindphlux]

Return-Path:
X-Flags: 0000
Delivered-To: GMX delivery to x
Received: (qmail 5012 invoked by uid 65534); 28 Jun 2004 14:28:34 -0000
Received: from smtp3.libero.it (EHLO smtp3.libero.it) (193.70.192.127)
by mx0.gmx.net (mx017) with SMTP; 28 Jun 2004 16:28:34 +0200
Received: from localhost (172.16.1.80) by smtp3.libero.it (7.0.027-DD01)
id 40D05D0F0034394C; Mon, 28 Jun 2004 16:27:24 +0200
Received: from libero.it (172.16.1.85) by smtp3.libero.it (7.0.027-DD01)
id 40D05CC20014F6D5; Mon, 28 Jun 2004 16:27:24 +0200
Date: Mon, 28 Jun 2004 16:27:24 +0200
Message-Id:
Subject: URGENT ASSISTANT PLS
MIME-Version: 1.0
X-Sensitivity: 3
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
From: "jamesjohnson2004"
To: "jamesjohnson2004"
X-type: 0
X-SenderIP: 80.88.139.231
X-Virus-Scanned: by amavisd-new at libero.it
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: -2 (not scanned, spam filter disabled)

Dear Sir,
This letter was borne out of my sincere desire to
establish a mutual business relationship with you.
My name is James yommy, Deputy Minister of Finance
under the Charles Taylor Government who was ousted by
by the recent war.
Though, I do not know to what extent you are familiar
with events and disturbances in Liberia but the
pressure of war drove me and my family out of Liberia
into exile where we have been living under political
asylum since then.
Sadly, my wife died of cancer three weeks ago and was
buried.
Months ago, I made a security deposit with a security
company in London, United Kingdom,which is worth US$
22,000,000.00 (Twenty-two Million United States
Dollars Only). This was money paid to my country by
its
overseas partners in the heat of the conflict. I made
this deposit in my name with the hope of converting it
to my personal use, at the end of the war; but
when the conflict intensified, I have to run to exile
with no hope of ever returning to my home country or
London, UK. to claim my deposit.
I have contacted the Security Company in London, UK to
inform them that the right of ownership to the deposit
I made has been legally transfered to another
beneficiary who will contact them soon.
Therefore, I have decided to solicit for the
participation of an honest and trustworthy person or
company that will assist in transfer and business
re-investment of the money. I can not do it alone due
to my present social status. You will be given a
negotiable percentage at the end of the transaction.
If you are interested in the above proposal, contact
me immediately
through this e-mail:.jamesyommy@yahoo.com. address for more details.
You must maintain absolute confidentiality to ensure
success.
Please, include your personal Telephone/Fax nos. when
replying.
Best regards.
Mr. James yommy

Der weiss nicht mal, wie er wirklich heisst... Johnson oder Yommy.

--------------------------------------------
"Africans, we count people first while money and other material things come after." -- Ann, 419 scammer
Spammer, go to http://www.arghcor.de/

[doka]

Interessant.
Meine liebe gute Mrs. Ann schickte auch über libero.it
ihre erste Mail.
Dort sah der Header ganz ähnlich aus:

Received: from libero.it (172.16.1.107) by smtp2.libero.it (7.0.027-DD01)
id 404F13FC008F0845; Tue, 18 May 2004 00:21:29 +0200

Kannst Du deinem Mugu eine Antwort entlocken?
Vielleicht gehört das ins selbe Lager wie Mrs.Ann
Gruss,
DoKa

[mindphlux]

Na mal sehen:

Top of the day to you, James!
Now what`s your real name? Make up your mind, tick one below and resubmit:
[ ] James Johnson
[ ] James Yommy
[ ] entirely different: _______________________________________
With kind regards,
Dr. med. H. J. S.
Theoretischer Arzt

Wenn du die IP von "Mrs. Ann" kennst, wäre das eine wesentlich bessere Möglichkeit, die Zugehörigkeit zu bestimmen.
--------------------------------------------
"Africans, we count people first while money and other material things come after." -- Ann, 419 scammer
Spammer, go to http://www.arghcor.de/

[mindphlux]

Also libero.it kannste bald als 419-Bude bezeichnen - und irgendwie heissen die alle John:

28.06.2004 18:00:09 [FETCHMAIL] NEW MAIL FROM: <john_fish@libero.it> WITH SUBJECT LINE "URGENT FROM {DR JOHN}"
28.06.2004 18:00:09 [PROCMAIL] MAIL SCORED: 145/100 WITH WORDS foreigner deposit confidential investigation
28.06.2004 18:00:09 [PROCMAIL] FOUND ALTERNATE REPLY-TO EMAIL ADDRESS <e-mail:dr.fish@dcemail.com> IN BODY
28.06.2004 18:00:09 [PROCMAIL] FOUND POSSIBLE REAL NAME "Dr. John" IN BODY
28.06.2004 18:00:09 [PROCMAIL] EMAIL WOULD QUALIFY FOR BEING SCAM MAIL (145>100)
28.06.2004 18:00:09 [PROCMAIL] NEW EMAIL, ADDED TO DATABASE WITH ID #2 AND CRC32 463EDBA2
28.06.2004 18:00:09 [SENDMAIL] FOUND ABUSE ADDRESSES: abuse@libero.it
28.06.2004 18:00:11 [SENDMAIL] SENT COMPLAINTS TO MY OWNER (TEST MODE)

Die IPs der beiden Johns ist aber nicht mal annähernd identisch.
--------------------------------------------
"Africans, we count people first while money and other material things come after." -- Ann, 419 scammer
Spammer, go to http://www.arghcor.de/

[doka]

ich überleg schon die ganze Zeit, wie ich an die IP der guten Mrs. Ann rankomme.
folgende Konstellation:
ich bau ne HP, die sie besuchen muss.
Leider hab ich keinen anonymen Webspace mit scripting.
Aber man könnte ja einen Web-Bug einbauen.
Damit käme man an die IP und die Browserkennung.
Wenn IE, dann könnte man ja ne Falle einbauen, die nach neuesten
ungestopften Sicherheitslöchern nen Trojaner auf dem Mugu-rechner
installiert.
Wenns ein Internetcafe ist, ist doch vielleicht auch eine Webcam mit
dran. Ob man die einschalten und ein Bild machen könnte und hermailen?
Bis zum Infizieren wärs ja noch einfach...
Gruss,
DoKa