New slant to the 419 scams

Dingatron

Just got this in my inbox this morning. :mad: Never seen one like this before and it is slightly disturbing although obviously a scam. What would you do or is it even worth pursuing as it is the tinternet after all?

Hello,
I am very sorry for you , is a pity that this is how your life is going to
end as soon as you don't comply. As you can see there is no need of
introducing myself to you because I don't have any business with you, my
duty as I am mailing you now is just to KILL you and I have to do it as I
have already been paid for that.

Someone you call a friend wants you Dead by all means, and this person
have spent a lot of money in this venture,This person came to us and told
me that he wanted you dead and he provided us with your name ,picture and
other necessary information's we needed about you.

So I sent my boys to track you down and they have carried out the
necessary investigation needed for the operation on you, and they have
done that but I told them not to kill you that I will like to contact you
and see if your life is important to you.I called my client back and ask
him of your email address which I didn't tell him what I wanted to do with
it and he gave it to me and I am using it to contact you now. As I am
writing to you this mail my men are monitoring you and they are telling
me everything about you.

Now do you want to LIVE OR DIE?Since all program ahs be made and draw to
kill you. Get back to me now if you are ready to pay some fees to spare
your life, $15,000 is all you need to spend in this process you will first
of all pay $8,000 then i will send a tape to you which i recorded every
discusion i had with the person who wanted you dead and as soon as you get
the tape, you will pay the remaining balance of $7,000. If you are not
ready for my help, then I will carry on with my job straight-up.

WARNING: DO NOT THINK OF CONTACTING THE POLICE OR EVEN TELLING ANYONE
BECAUSE I WILL KNOW,REMEMBER, SOMEONE WHO KNOWS YOU VERY WELL WANT YOU
DEAD! I WILL EXTEND IT TO YOUR FAMILY, INCASE I NOTICE SOMETHING FUNNY
ABOUT YOUR TELLING THE SECURITY ABOUT IT BECAUSE A GOOD LOOK IS OUT YOU AT
MOMENT.

DO NOT COME OUT ONCE IT IS 7:PM UNTIL I MAKE OUT TIME TO SEE YOU AND GIVE
YOU THE TAPE OF ALL DISCUSSION WITH THE PERSON WHO WANT YOU DEAD THEN YOU
CAN USE IT TO TAKE ANY LEGAL ACTION. GOOD LUCK AS I AWAIT YOUR REPLY

Have put it through spamcop and have message source.

FruitLover

Bold move by the originators - spam is one thing, but death threats are far more likely to get the attention of authorities.

Dingatron

Exactly what I thought. Scammers are 2 a penny but this is a threat at the end of the day and I'd be prepared to take it further if I thought it would make a difference. Have reported it through spamcop but that's propably all that can be done.



***Quick glance out the window looking for the 'boys'***

kmick

FruitLover wrote: »

Bold move by the originators - spam is one thing, but death threats are far more likely to get the attention of authorities.

lol - yeah the Gardai will be following up this one with a fine tooth comb.

mick.fr

Well you have the message header and IP address, where is this crap coming from?

mick.fr

Well ok a quick search on Google revealed this shiit is coming from all over the world.
Since there is no contact detail, no website, a part from the sender's email, this is just pure spam.

People have nothing to do for god sake.

Dingatron

This is it parsed


Parsing header:

Received: from xxxxxxxxxx by host35.hostmonster.com with local-bsmtp (Exim 4.68) (envelope-from <aquadakillingnetwork@gmail.com>) id 1JUHcX-0005wi-4J for x; Wed, 27 Feb 2008 01:26:41 -0700
Ignored

Received: from [195.140.143.60] (helo=redservicio.net) by host35.hostmonster.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.68) (envelope-from <aquadakillingnetwork@gmail.com>) id 1JUHcW-0005wB-DT for x; Wed, 27 Feb 2008 01:26:33 -0700
195.140.143.60 found
host 195.140.143.60 (getting name) no name
Possible spammer: 195.140.143.60
Received line accepted

Received: from localhost ([127.0.0.1] helo=195.140.143.60) by redservicio.net with esmtpa (Exim 4.67) (envelope-from <aquadakillingnetwork@gmail.com>) id 1JUOx0-00009d-TD; Wed, 27 Feb 2008 17:16:10 +0100
Bogus IP in HELO removed:
Received: from localhost ([127.0.0.1] helo=[x.x.x.x]) by redservicio.net with esmtpa (Exim 4.67) (envelope-from <aquadakillingnetwork@gmail.com>) id 1JUOx0-00009d-TD; Wed, 27 Feb 2008 17:16:10 +0100
127.0.0.1 found
host 127.0.0.1 = localhost (cached)
localhost is 127.0.0.1
195.140.143.60 not listed in dnsbl.njabl.org
195.140.143.60 not listed in cbl.abuseat.org
195.140.143.60 listed in dnsbl.sorbs.net ( 127.0.0.7 )
195.140.143.60 is not an MX for host35.hostmonster.com
195.140.143.60 is not an MX for redservicio.net
195.140.143.60 is not an MX for host35.hostmonster.com
195.140.143.60 not listed in dnsbl.njabl.org
127.0.0.1 discarded

Received: from 195.166.241.58 (SquirrelMail authenticated user blessed2) by 195.140.143.60 with HTTP; Wed, 27 Feb 2008 17:16:10 +0100 (CET)
195.166.241.58 found
host 195.166.241.58 (getting name) no name
195.140.143.60 not listed in dnsbl.njabl.org
195.140.143.60 not listed in cbl.abuseat.org
195.140.143.60 listed in dnsbl.sorbs.net ( 127.0.0.7 )
195.140.143.60 is not an MX for host35.hostmonster.com
195.140.143.60 is not an MX for host35.hostmonster.com
195.140.143.60 not listed in dnsbl.njabl.org
Possible spammer: 195.166.241.58
Host 195.140.143.60 (checking ip) = 195.140.143.60
195.140.143.60 not listed in dnsbl.njabl.org
195.140.143.60 not listed in cbl.abuseat.org
195.140.143.60 listed in dnsbl.sorbs.net ( 127.0.0.7 )
Looks like a forgery
Tracking message source: 195.140.143.60:
Routing details for 195.140.143.60
[refresh/show] Cached whois for 195.140.143.60 : ripe@ctn1.net remarks: abuse notifications: abuse@ctn1.com
Using abuse net on remarks: abuse notifications: abuse@ctn1.com
abuse net ctn1.com = abuse@ctn1.net, postmaster@ctn1.com, support@ctn1.net, abuse@ctn1.com, postmaster@ctn1.net
Using best contacts abuse@ctn1.net postmaster@ctn1.com support@ctn1.net abuse@ctn1.com postmaster@ctn1.net
postmaster@ctn1.com bounces (29 sent : 23 bounces)
Using postmaster#ctn1.com@devnull.spamcop.net for statistical tracking.
abuse@ctn1.com bounces (84 sent : 43 bounces)
Using abuse#ctn1.com@devnull.spamcop.net for statistical tracking.
Message is 14 hours old
195.140.143.60 not listed in dnsbl.njabl.org
195.140.143.60 not listed in dnsbl.njabl.org
195.140.143.60 not listed in cbl.abuseat.org
195.140.143.60 listed in dnsbl.sorbs.net ( 127.0.0.7 )
195.140.143.60 not listed in accredit.habeas.com
195.140.143.60 not listed in plus.bondedsender.org
195.140.143.60 not listed in iadb.isipp.com
No body text provided, check format of submission. Spam must have body text.
If reported today, reports would be sent to:

Re: 195.140.143.60 (Administrator of network where email originates)

postmaster#ctn1.com@devnull.spamcop.net
postmaster@ctn1.net
abuse#ctn1.com@devnull.spamcop.net
support@ctn1.net
abuse@ctn1.net

Capt'n Midnight

Oh goody.

If people report this stuff to the police and it's actioned upon then maybe those spammers can be jailed for a long time, under existing laws and put the fear of God into them.

Though I don't think it will happen