Lottery Scam: Euro Stakes

A correspondent informs me that he received the following lottery scam from 62.81.235.112 (smtp12.eresmas.com. -- in Spain) on Mon, 30 May 2005 03:24:15 -0000.

EUROPEAN UNION INTERNATIONAL LOTTERY
INTERNATIONAL WINNERS/PRIZE AWARD DEPT.
Ref. Number:AMS/1232/04
Batch Number:18/3439/NL
ATTENTION.
Sir/Ma/Miss,
We are pleased to inform you of the result of the
winners of the EURO STAKES (eul)LOTTERY euro lottery programs held on the
21st of JAN, 2005.
Your e-mail address attached to ticket number
5647--45363763--568 with serial number 2113--05 drew lucky numbers
24-5647-577 which consequently won in the 3rd category.

This promotional program takes place every three years in different
developed countries,the lottery was promoted
and sponsored by the President of the World Largest software,Bill Gates to
increase the awareness of microsoft software packages.
All participants were selected through a computer ballot system drawn from
over 20,000 company and 30,000,000 individual email addresses and
names from all over the world.

You have therefore been approved for a lump sum pay
of 500,000,00 euros(Five hundred thousand euros)
in cash,credited to your file with the Ref. Number:AMS/1232/04 and Batch
Number:18/3439/NL.
This is from a total cash prize of US $3.750.000.00(Three million seven
hundred and fifty thousand dollas)shared among the
fifteen international winners in this category.
Due to mix up of some numbers and names we ask that you keep your
winning information confidential until your claims have been processed and
your money remitted to you.This is part of our security
protocol in order to avoid double claiming and unwarranted abuse of this
program by some participants.

We hope with part of your winning you will take part in our next year
50 million euro international lottery.
To file for your claims please contact our financial agent:

MR ANSLEM MANN,
Foreign Operations Manager,
of the (HILLSTAR FINANCE AND SECURITIES),
Holland.
email:(hillstarfinance4u@yahoo.de)

Remember all winning must be claimed not later than 17th of june 2005.
After this date all unclaimed funds will be included in the next stake.
Please note in order to avoid unnecessary delays and complications endevour
to quote your reference and batch numbers in all first correspondence.

Furthermore,should there be any change of address do inform our agent
as soon as possible.
Congratulations!!

Once more from our members of staff and thank you for being part of our
promotional program.
Note: Anybody under the age of 18 is automatically disqualified.

Sincerely yours,
MRS.MELODY GREEN,
Lottery Cordinator.

Lottery Scam: Lottery Winners International

This lottery scam was sent directly to the contact address for this blog, sent from 213.132.215.69 (WHOIS: NL Hosting Internet) on Mon, 30 May 2005 16:04:19 -0000.

Dear Winner,

WINNING FINAL NOTIFICATION
We are pleased to inform you of the result of the Lottery Winners International programs held on the 3rd march 2005 . Your e-mail address attached to ticket number 77007742781005-18721 with reference number 414-3721060 drew winning numbers 7-00-71-00-66-49 and credited to batch number 121cfg, which consequently won in the 3rd category. You have
therefore been approved for a pay out of 1,800,000.00 (One Million Eight Hundred Thousand Pounds).

CONGRATULATIONS!!!
You funds are now deposited and insured with a security firm to be transferred into your nominated bank account either by means of wire transfer or by whatever suitable means. Due to mix up of some numbers and names, we ask that you keep your winning information very confidential till your claim has been processed and your prize/money Remitted to you.

This is part of our security protocol to avoid double claims and unwarranted abuse of this program by some participants.

All participants were selected through a computer ballot system drawn from over 800,000 company and 1,000,000 individual email addresses and names from all over the world. This promotional program takes place annually. We hope with part of your winning you will take part in our next year 20 Million Pounds International Lottery. To file for your claim, you will be contacting Capital Financial Investment Corporation the accredited finance agent authorised to process your claims for your payment(You will receive more information upon your acknowledgment of this email).

This lottery is promoted and sponsored by software corporations and other private organisations to help individuals generate fortunes which would encourage them to expand their business frontiers and assist with humanitarian concerns. Please Note that winnings must be claimed not later than 14th June 2005. After this date all unclaimed, funds will be included in

the next stake coming up in 2005. Please note that in order to avoid unnecessary delays and complications remember to quote your reference number in all correspondence.

Furthermore, should there be any change of address do inform us as soon as possible.

Congratulations again from our organisation and thank you for being part of
our promotional program.

N.B: Anybody under the age of 18 is automatically disqualified from this program.

Sincerely yours,


Paul David
Programs coordinator
(Capital Group)

Info: Proof That Lottery Scams are 419s

Up until quite recently, I was categorising lottery scams in the same group as advance fee fraud. I still refer to the people behind both these scams as "419ers" -- and I've now got proof positive that the same people are behind both types of scam. Specifically, a lottery scam that's just arrived (and which I will document shortly) came from the same IP address as the earlier queenmakeni 419 spam. Coincidence? Well, a correspondent informs me that he performed a search for the address 62.81.235.112 after receiving a lottery scam spam (to be documented shortly) from that address, and found that my Ali Salaki 419 had originated at the same address.

I don't know of anyone who has expressed serious doubt that these two scams are variations on the same theme run by the same criminals. However, if there was doubt, this evidence should prove it beyond reasonable doubt, as they say in the courts.

Lottery Scam: The National Lottery

The winnings notifications just keep rolling in here at iDeceive. I'm also getting pretty sick of the useless information provided by reverse DNS lookups and WHOIS. This spam arrived from 80.179.102.222, for which the reverse DNS lookup yields "80.179.102.222.ispeednet.net.", but a lookup on that name yields "no such domain". Broken! Useless, stupid, so-called "Internet" service provider that can't adhere to Internet standards. The WHOIS information is not much more useful: the netname is "Gilat-ART293" -- uninformative; the description is "Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il" -- so that's an Israel address, but otherwise not helpful in identifying the address delegate; the country is listed as "GB" -- so there's a British component here; the contact addresses are also in Israel. The domain name "ispeednet.net" gets us pretty much nowhere -- there are no active websites obviously attached to the name, and the name is registered via Yahoo! to someone giving the name "Julian Hook" and claiming to be from London. The contact email address is also at the domain "ispeednet.net", and the MX for that domain is "mailrelay.ispeednet.net.", and a lookup on that address failed to find any active servers! What a slum of a netblock. Utterly, utterly inexcusable. If it were a block of flats, they'd condemn it.

Anyway: best guess is this came from Israel, but basically it came from a slimy hole somewhere on the Internet that should be disconnected for the common good.

The National Lottery
P O Box 1010
Liverpool, L70 1NL
UNITED KINGDOM
(Customer Services)
Ref: UK/9420X2/68
Batch: 074/05/ZY369
 FROM: THE DESK OF THE DIRECTOR OF PROMOTIONS,
INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT               
                   WINNING NOTIFICATION:
We happily announce to you the draw (#982) of the UK NATIONAL 
LOTTERY,online Sweepstakes International program held on Saturday 
21st of May, 2005. Your e-mail address attached to ticket number: 
56475600545 188 with Serial number 5368/02 drew the lucky
numbers:14-34-38-43-47-48(bonus no.09), which subsequently won you the 
lottery in the 2nd category i.e match 5 plus bonus.You have therefore 
been approved to claim a total sum of    £1,113,656   (One Million One 
Hundred thirteen Thousand,Six Hundred And Fifty-Six pounds sterling) in 
cash credited to file 
KTU/9023118308/03.This is from a total cash prize of  £16,212,965  
shared amongst the  (13) lucky winners in this category i.e Match 5 
plus bonus.
All participants for the online version were selected randomly from
World Wide Web sites through computer draw system and extracted from 
over 100,000 unions, associations, and corporate bodies that are listed
online. This promotion takes place weekly.
   Please note that your lucky winning number falls within our European
booklet representative office in Europe as indicated in your play
coupon. In view of this, your  £1,113,656   (One Million One Hundred 
thirteen Thousand,Six Hundred And Fifty-Six pounds sterling) would be 
released to you by any of our payment offices in Europe.
   Our European agent will immediately commence the process to
facilitate the release of your funds as soon as you contact him.
  For security reasons, you are advised to keep your winning
information confidential till your claims is processed and your money 
remitted to you in whatever manner you deem fit to claim your prize. 
This is part of our precautionary measure to avoid double claiming and 
unwarranted abuse of this program. Please be warned.
To file for your claim, please contact our fiduciary
agent:
SIR PETER KELLER
Phone:447031845767
Fax:44871 994 0278
Email: ukonlinelottery2005@yahoo.co.uk
Goodluck from me and members of staff of the UK
NATIONAL LOTTERY.
Yours faithfully,
Richard K. Lloyd.
Online coordinator for UK NATIONAL LOTTERY
Sweepstakes International Program.
Copyright © 1994-2005 The UK National Lottery Inc.
All rights reserved. Terms of Service - Guidelines  

Lottery Scam: Combo National

These lottery scam spams are as regular as clockwork right now. The best thing about this one is the sender's name: Mrs. Blessing Carlos. Isn't that nice? "Hello, Blessing! How are you?" Anyway, enough of that -- let's document it and move on. The spam was received from 80.224.189.145 (WHOIS: AUNA S.A.U, Barcelona, Spain) on Fri, 27 May 2005 15:01:27 -0000. That IP address is a very close neighbour of the previous lottery scam that turned up, so it's pounds to pennies that it's the same set of con artists at work. Hey, Spain, give them what for -- they're tarnishing your reputation. Also note that this was sent direct to the contact address for this blog, and the fraudsters are using a "netscape.net" email address for their contact.

FROM THE PROMOTIONS MANAGER
COMBO NACIONAL LOTERIAS SP
CALLE ALBERTO 1-5A
MADRID BRANCH, SPAIN.
REFERENCE NUMBER: SP/54-C2278630

DEAR SIR/MADAM,

            RESULTS FOR CATEGORY "A" DRAWS

Congratulations to you as we bring to your notice, the results of theCategory" A" draws of Combo National Loterías Sp. We are happy to inform you that you have emerged a winner under the First Category, which is part of our promotional draws. The draws were held on the 24TH MAY 2005 and results were officially announced today 27THMAY Participants were selected through a computer ballot system drawn from 4,000,000 names/email addresses of individuals and companies from Africa, America, Asia, Australia, Canada, Europe, Middle East, and New Zealand as part of our International Promotions Program.

You/Your Company, attached to ticket number 369-555-876/6181-22, with serial number 90-77 drew the lucky numbers 29, 41, 20, 39,48,44 (01), and consequently won in the Category "A". You have therefore been awarded a lump sum pay out of U$1,000,000.00 (0NE MILLION EUROS) which is the winning payout for Category "A" winners. This is from the total prize of 2 MILLION EUROS Shared among the 2 international winners in this category.

CONGRATULATIONS!

Pina Agency, a reputable firm in Spain has been assigned to be your agent. In your best interest and also to avoid mix up of numbers and names of any kind, we request that you keep the entire details of your award strictly from public notice until the process of transferring your claims has been completed, and your funds remitted to your account. This is part of our security protocol to avoid double claiming or unscrupulous acts by participants/no participants of this program.

We also wish to bring to your notice our mid year (2005) high stakes where you stand a chance of winning up to €10.Million, we hope that with a part of your prize you will participate.
Please contact your claim agent immediately, to begin your claim process;

MR.GILBERT FERNANDEZ
DIRECTOR OF OPERATIONS
CONPINA AGENCY
TEL: +34-669-413-328
EMAIL: frnndz420@netscape.net

for due processing and remittance of your prize money to a designated account of your choice. Remember, you must contact your claim agent within Three weeks, after this time frame, all funds will be returned as unclaimed.

Congratulations once again from all our staff and thank you for being part of our promotional program.

Sincerely,
Mrs. Blessing Carlos.
Combo Nacional Loterías Sp.

NOTE: If you are under the age of 18, you are automatically disqualified for this star prize.
Please do not reply to this mail. Contact your claim agent with the contact information given above.

Advance Fee Fraud: queenmakeni

Another tale of millions to be discreetly repatriated. And yet I'm sure there are still people who haven't heard of 419 scam spams. Anyway, this one is entirely straightforward: we note that the source of the spam is in the Netherlands again (the Netherlands and Spain are fighting for first place here) and the return address is "queenmakeni@netscape.net" ("netscape.net" is very popular with 419s). Also note that they are obtaining the address by harvesting them from the web -- easy to tell, since they sent it directly to the contact address for this blog. This spam was received from 213.132.215.69 (WHOIS: NL Hosting Internet offers webhosting, co-location and adsl / sdsl services) on Thu, 26 May 2005 18:59:55 -0000.

Dearest,beloved

How are you hope all is well with you and your family,am a girl from sierra lone, am25 years old am a house girl as my profession,but i have this thing to tell you which i believe it can be helpful to both off us.

Like i told you at the beginning that i am a house help am working under a woman but she is dead now and she is a very well know woman and she is a diamond marshant in Ghana but she lives in sierra lone and am with her all this years working under her,so she is dead now and she is not having any kid nor husband,and she is having a fund in a Europe about 8.5 million us dollars which she willed to me as a beneficiary and right now am in sierra lone and the fund is in Europe So i want you to help me and invest it in your country,that is while am pleading for your assistance so that you can help am claim the fund to your country and invest it there for me.So that i can come there for schooling and you use the other to for investment
Am going to give you 20% off it to you for helping me, please i really need your assistance.

my late madam lawyer can reach you and tell the firm securing the funds to release it immediately i make you my beneficiary if you wish to contact him for assistance.

Thanks for your understanding

Best regard

Lottery Scam: Nacional Loterias

My email address here at iDeceive continues to win lotteries without lifting a finger. The latest winning notification is from Spain, received from 80.224.189.125 (125-189-ADSL.red.retevision.es.) on Wed, 25 May 2005 15:06:24 -0000. This lark is getting boring, don't you think?

Nacional Loterias Sp
Calle aberto 1-5a
Madrid Branch, Spain.
Reference numbers: SP/67-B1174832
                       YOUR E-MAIL ADDRESS WON THE LOTTERY.
We wish to congratulate you over your success in our computer balloting sweepstake held on 21st May 2005. This is a millennium scientific computer game in which email addresses were used. It is a promotional program aimed at encouraging internet users; therefore you do not need to buy ticket to enter for it.
Your email address attached to ticket number 12 15 21 27 35, drew the lucky star numbers which consequently won the draw in the Second category. You have been approve for the star prize of One million one hundred thousand euros(1.1m euros).
CONGRATULATIONS!!!
You are advised to keep this winning very confidential until you receive your lump prize in your account.This is a protective measure to avoid double claiming by people you may tell. Send your winning ticket numbers, reference numbers amount won and your personal data
for processing of your claim to both emails infowwin@consultant.com
NacionalLoterie@walla.com
Name:Sanchez Fernandez
Tel:+34 62 8740 597.
Address: Avenida de America 12
Madrid Spain.
All prizes must be claimed within three weeks.
NOTE: If you are under the age of 18, you are automatically disqualified for this star prize.
Yours faithfully,
Mrs. Eva Carlos.
cc:NacionalLoterie@walla.com

Advance Fee Fraud: Zokolu Zabuanga

Egad! Another African with millions of dollars seeking a random "business partner" on the Internet. I like his name -- I shall always think of him as "Zee Zee". The spam was sent to the contact address for this blog from 62.163.137.223 (a137223.upc-a.chello.nl. -- in the Netherlands) on Tue, 24 May 2005 14:08:17 -0000. Note also that it uses a "netscape.net" return address, which is very typical 419 M.O., and that the Netherlands seems to have taken the lead from Spain in their 419 spewage stats. Time for another big catch of West African Males in Amsterdam, by the look of it. I've preserved the original line breaks in the text below, regardless of the fact that they make no sense, by and large.

Dear Partner,
You may be suprised to received this letter from me since you do not know
me personally.
I am Zokolu Zabuanga the first son of Kuanzo Zabuanga ,the most popular farmer in zimbabwe who was murdered in the land dispute in my country.I got your contact through network online hence deceided to write you.Before the death of my father he had taken me to johannesburg to deposite the sum of 12.000000.00 dollars (twelve million dollars)in one of the private security
company in South Africa, as he foresaw the looming danger in Zimbabwe this money was deposited in a box as gemstones to avoid much dumorrage from the security company,this
amount was meant for the purchase of new machines and chemicals for farms and establishment of new farms in Swaziland.
This land problem came when Zimbabwean president.Mr Robert Mugabe introduced a new land act reform wholly affecting the rich white farmers and some black farmers,and this resulted to the killing and mob action by Zimbabweean war veterans and some lunatics in the society.Infact a lot of people were killed because of this land reform act for which my father was one of the victims and may his soul rest in perfect peace.
It is against this background that i and my family fled Zimbabwe for fear of our lives and are currently staying in the Nederlands where i am seeking for asylum and moreso have deceided to trasfer my father's money to a more reliable foreign account since the law of the Nederlands prohibits a refugee(asylum seeker) to open a bank account or to involve in any financial
transaction throughout the territorial zone of the Nederlands,as the eldelst son of my father,I am saddled with the responsibilt of seeking a genuine foreign account where this money could be transferd without the knowledge of my goverment who are bent on taking everything we have got.
The south African government seems to be playing along with them,i am faced with the dilemma of moving this amount of money out of South Africa for fear of going through the same experience in future,both countries have similar political history and as a business man i am seeking for a partner who i have to entrust my future and that of my family in his hands,i must let you know that this transcation is risk free.
If you accept to assit me and my family,all i want you to do for me is to make arrangements with security company to clear the consignment (funds)from their afilate office here in the Nederlands as i have already giving dirctives for the consignments to be brought to the Nederlands from South Africa but before then all modalities will be put in place like the change
of ownership to the consignmen(funds)and more importantly this money i intend to use for investments.
I have two options for you,firstly you can choose to have certain percentage of the money for nominating your account for this transaction ,or you can go into partnership with me for a proper profitable investment of the money in your country,which ever the option you want please feel free to notify me,i have also mapped out 5% of this money for all kind of expences
incurred in this process of this transaction.
If you do not prefer a partnership i am willing to give you 15% of the total sum while the remaning 80% will be for me and my family also for the investment in your country.Contact me with the above email address while i implore you to maintain the absolute secrecy required in this transaction till we put claims to the consignment (funds).
NOTE:PLEASE REPLY TO MY PERSONAL EMAIL ADDRESS:zokolu1@netscape.net
Thanking you,and GOD bless you.
Your's Truely ,
Zokolu Zabuanga.

Lottery Scam: EuroMillions

I've won another lottery that I never entered. No tall tales of "you didn't have to buy a ticket to win", this time -- just an honest mistake where the winning notification was sent to the contact address for this blog instead of to the real winner due to "the mix up of some numbers and name's". Seems like they can't organise a lottery -- or a sentence in English, for that matter. This is plain fraud: these people have nothing to do with the EuroMillions lottery.

Spam was received from 199.181.134.43 (wmailmta06of.seamail.go.com. -- the go.com webmail system, which shows that webmail is still a popular vector with the 419 crowd) on Mon, 23 May 2005 13:27:43 -0000. Note that the contact address is also a webmail system: netscape.net (popular with 419ers also). The usual guff follows, minus the webmail-added advertising line.

EUROMILLIONS LOTTERY INTERNATIONAL.BE
www.euromillions.be


LOTTERY WINNING NOTIFICATION/ FINAL NOTICE EMAIL LOTTERY SWEEPSTAKES (ACCREDITED LICENSED AGENT TO EUROMILLIONS LOTTERY) Ref. Number:6-7-13-28-47-5-8 Batch Number: 6-13-20-GF 51

DATE: 23/05/2005
Sir/Madam
We are pleased to inform you about the result of the Euromillions Lottery Winners International programs held on Friday the 20th of May 2005. Your e-mail address attached to ticket number 7-17-71-27-36-0-9 with serial number 50-6-35-99-00 drew lucky numbers 5-72-22-34-10-68, which consequently won in the 1st category, you have therefore been approved for a lump sum pay out of € 1,000,000.00 (One Million Euros)

CONGRATULATIONS!!!

Due to the mix up of some numbers and name's we ask that you keep your winning information confidential until your claims has been processed and your money Remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 25,000 company and 40,000,000 individual email addresses and names from all over the world. This promotional program takes place every three years. This lottery, was promoted by the software corporation and president of e-lottery/euro millions to compensate some few individuals with website and email addresses, we hope that with part of your winning you will take part in our next year €50 million international lottery.

To file for your claim, please contact our FIDUCIAL AGENT:
Mr. John Black of EUROMILLIONS AGENCY.
TEL: +32-497-924-514
Email: euromillioninfo@netscape.net

Remember, all winning must be claimed not later than 20th of June 2005. After this date all unclaimed funds will be included in the next stake. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all Correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program.
Note: Anybody under the age of 18 is automatically disqualified.
Sincerely yours,
Mrs. Ann Van Elsein.
(Lottery Coordinator

Pump and Dump: RLYC

Newsflash: spam touts sub-dollar stock; predicts massive gains in immediate future. Not news? Sorry. I'll just document the facts, then. Spam received from 210.213.226.24 (WHOIS: MyDSL_Professional -- apparently under the aegis of Philippine Long Distance Telephone Company) on Mon, 23 May 2005 04:00:22 +0000. The following blurb does not include the boring "forward looking statements" boilerplate.

The profile for the month of May is RLYC - Relay Capital Corporation

_________________________________________________
Symbol: RLYC
Price: $0.25
Expected possible price in next 5 days: 75 cents
_________________________________________________


Breaking News Announced : Relay Capital Corp. Retains Corporate Network for Joint Ventures and Acquisitions in the Stored Value Card Industry


_________________________________________________
Symbol: RLYC
Price: $0.25
Expected possible price in next 5 days: 75 cents
_________________________________________________


Relay Capital Corporation (RLYC) is a developer and marketer of a wide range of prepaid financial services, including pre-paid stored value cards, reward cards, employee payroll cards, gift, retail and affinity group cards, travel cards and fund transfer cards. It encompasses both the marketing and distribution of pre-paid and pay-transfer cards in concert with the development of loading centers. Loading centers are retail locations, such as convenience stores, check cashing facilities or other types of retail facilities serving to dispense or receive cash facilitating transactions for the stored-value card consumer.

_________________________________________________
Symbol: RLYC
Price: $0.25
Expected possible price in next 5 days: 75 cents
_________________________________________________

---------------------------------------------------------

Breaking News: Relay Capital Corporation (RLYC) has retained Corporate Network of Los Angeles to identify and negotiate business joint ventures, acquisitions and partnerships within the stored value card industry. Several companies that currently hold transferable joint venture contracts have been identified by Corporate Network, and negotiations have begun on behalf of Relay Capital.
Corporate Network currently is negotiating on behalf of Relay Capital with Ascot Investments, Inc. (www.ascotinc.com) to acquire specific stored value assets held by the firm. The acquisition contracts under negotiation includes a firm registered with MasterCard as a Member Service Provider that has MasterCard and Maestro-ATM pre-paid re-loadable cards, and another company with over 40,000 retail loading stations throughout North America.
"Our goal is to provide Relay Capital with a wide range of the best possible solutions to offer their current and expanding client base," said Harold Gregg, CEO of Corporate Network. "We will continue to identify and execute agreements that provide Relay with new and expansive annuity based revenue streams that not only are in the stored value sector but at the forefront of communications and information technology."
Relay Capital anticipates that the successful acquisition of these contractual assets, will enable it to offer expanded payroll products as well as define a niche market for its private label stored value solutions. With Corporate Network's assistance, it expects to add new and expansive products linked to its card platform and provide its customers with a growing range of superior products and increased customer loyalty.



+++++++++++++++++++++++++++++++++++++++

Phish of the Day: SouthTrust

How convenient: two unrelated phish for SouthTrust so close together that I can report both at once. One of them came in to my "legacy" address -- the one that's been around for so long that it's on lots and lots of spam lists, and I don't bother directing any real correspondence there anymore as a result. That phish was the kind that uses an embedded GIF image instead of text. It was received from 200.103.168.188 (200-103-168-188.fozit7001.dsl.brasiltelecom.net.br.) on Sun, 22 May 2005 21:07:51 +0000, and the phishy URL was http://202.99.223.139/rpm/. That site is in China somewhere, and the version of the SouthTrust page that they've knocked off includes a whole bunch of extra phishing detail in the login form. They prompt for full name, card numbers, PINs, expiration dates, user IDs, passwords, and email address! They also use an annoying Javascript trick to re-open the window if you attempt to close it, and another to keep the window on top if you try to minimise it, or similar.

Our second SouthTrust phish was sent to the contact address for this blog. One of the reasons I created a contact address was to attract spam, which is why I haven't tried any silly tricks to hide it. The phish was received from 65.98.57.114 (address delegated to Pegasus Web Technologies, NJ, USA, according to WHOIS) on Sun, 22 May 2005 14:53:17 -0000. I'll copy the email text here, then continue with comments.

Dear SouthTrust^� Client:

Recently, our Account Review Team identified some unusual activity in your
account. In accordance with SouthTrust's User Agreement and to ensure that your
account has not been compromised, access to your credit card account was limited. Your
account access will remain limited until this issue has been resolved. This
is a fraud prevention measure meant to ensure that your credit card account is not
compromised.

In order to secure your account and quickly restore full access, we may
require some specific information from you for the following reason:

We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your account
is our primary concern, we have limited access to sensitive SouthTrust account
features. We understand that this may be an inconvenience but please
understand that this temporary limitation is for your protection.

Case ID Number: SS-293-455-573

We encourage you to log in and restore full access as soon as possible.
Should access to your account remain limited for an extended period of
time, it may result in further limitations on the use of your account.

However, failure to restore your records will result in credit card account suspension.
Please update your records on or before May 25, 2005.

Once you have updated your account records, your SouthTrust session will not be
interrupted and will continue as normal.

Please update your SouthTrust record:
http://69.90.47.8/st/retail/verify.html

Thank you for your prompt attention to this matter. Please understand that
this is a security measure meant to help protect you and your account. We
apologize for any inconvenience.


Sincerely,
SouthTrust^� Account Review Department



SouthTrust Email ID PP719

Accounts Management As outlined in our User Agreement, SouthTrust will
periodically send you information about site changes and enhancements.

Visit our Privacy Policy and User Agreement if you have any questions.
http://www.southtrust.com/st/AboutUs/PrivacySecurity/Privacy/default.htm

The "please update your SouthTrust record" link is actually to http://updateinfo-secure.com.lhost9.atlantic.net/southtrust/wf34gPaymentLanding&ssPageName=hhpayUSf&=userhgads&secure&ssl7r2vbd7d888httpsloginyoutsecure/, which resolved to 209.208.54.96 (delegated to Internet Connect Company, Inc., FL, USA) when I queried it. This links to another knock-off SouthTrust login page, albeit one that's not nearly as ambitious as the phish I mentioned first, since it only asks for username and password details.

Also of some interest is the fact that the phish email reports that it is copied from http://www.sproot68.com/st/retail/letter.htm (resolving to 69.90.47.8, known canonically as ns6.servepower.com.), and I also find that the phish web page seems to appear at the parent address, http://www.sproot68.com/st/retail/. All this appears to be hosted by "WebServe Canada", so I'll shoot them an email to report their phishy little customer.

Pump and Dump: PHXI

Pump and dump remains a popular spam application for the time being with this spam (sent to a WHOIS contact address for a domain name registration) received from 166.82.80.86 (166-82-80-86.quickclick.ctc.net. -- CTC Internet Services, NC, USA) on Sat, 21 May 2005 23:45:03 -0000. This looks like classic pump and dump, since PHXI is a sub-penny-per-share junk stock right at the moment. If you can persuade such a stock to go up in value a few cents, you can make a decent return on investment -- fraudulently, of course, but legalities and ethics don't feature prominently on the radar of spammers in general.

MAY 2000                                        COMPANY REPORT                          HTTP://WWW.BETBARN66.COM

                                                                                                                                    PHXI

Phoenix Interests, Inc.
An Online Horse Wagering and Entertainment Portfolio Company
 
  
Phoenix Interests, Inc.                               Symbol:  PHXI                
Stock Rating:                                                  Strong Buy
Current Price:                                                       $0.007
Target Price:                                            $0.05 (+700%)
52 Week High/ Low:                               $0.0045 - $0.07
Public Float:                                                130,252,032

SIGNIFICANT GROWTH POTENTIAL

About the Company and Industry:

Phoenix Interests, Inc.  is a business development company that makes investments into, develops and operates business lines within the gaming and entertainment industry. The company has recently launched its own premier online wager site for horse racing. BETBARN66.COM users can list other related industry products for sale in an online auction format. The company's long term growth plans include investment into strategic acquisitions in the gaming and entertainment industry that complement their business lines.

The online wagering industry both domestically and internationally is one of the fastest growing industries in the world. Over the last year $2 billion alone was wagered online on horse racing. Overall the pari-mutuel horse wagering market is estimated to be a $15 billion industry. The company believes that with few real players in the market, BETBARN66.COM is poised to receive a portion of the up-trend from traditional wagering to online wagering.

The horse wagering industry is gaining more popularity with the addition of slot machines implemented in numerous tracks. This has increased the size of purses and has brought new spectators to the sport as a whole.
                             

Breaking News - 04/16/05

Phoenix Interests, Inc. (OTCBB:PHXI) announced today that its wholly owned subsidiary, Online Enterprises, Inc., is ready to "roll out" its aggressive marketing plan for its online account wagering site, BetBarn66.com. The plan is geared to signing up large numbers of online wagering accounts, just in time for the Triple Crown. BetBarn66.com is an online site offering its customers the ability to watch and bet on great horse racing action from across the country and world. Customers with active open accounts pay no fees to wager and no subscription fees for their accounts. BetBarn66 offers a full range of options. Customers of BetBarn66.com make advance deposits in their accounts and are provided with a full range of wagering options, 20 channels of streaming video, hundreds of races daily, and thousands of replays. This combination of no-cost services, great racing, and wagering options makes BetBarn66 the best account-wagering site in the industry.

The company has run marketing campaigns in several test markets with solid results and is achieving its targets of adding new customers as well as handle. Jim D. Tilton, Jr., Chairman, CEO and President of Phoenix Interests, stated: "We instituted a marketing plan earlier this year and are seeing the fruits of those labors. Since then we have consistently added new accounts and increased handle. Our top weekly handle number was set and passed three times in March alone. The only week in March that didn&apst see an increase in total handle was the one which included Good Friday and leading up to Easter Sunday, which had a significantly reduced number of tracks offering racing Our week-to-week growth was strong throughout the month, with weekly increases of 74%, 96%, 101%, (4%) and 19%. March 31st was our single largest day of handle, exceeding the previous record for the site set earlier the same week. Annualized, these daily handle amounts would exceed $1.5 m illion in total handle. While we are pleased with our initial efforts, we anticipate continued growth in number of accounts as well as handle, and expect to continually have record days, weeks and months going forward."

The company, which began only taking wagers in January of this year, has set a target of 3,000 active accounts through the 2007 Triple Crown, or over the next two years. The company believes this "critical mass" of customers will enable the company to be "cash flow" positive, allowing the company to leverage this asset into other ancillary revenues. "We believe the company is now out of its startup phase and is now positioned to build our customer base and drive revenue," commented CEO Tilton. "We believe BetBarn66.com and Barn66.com will become household brands within the industry, starting with the Kentucky Derby on May 7th, 2005." All account wagering activity on www.BetBarn66.com is handled by AmericaTab, Ltd. a multi-jurisdictional simulcasting and interactive-wagering totalizator hub licensed by the State of Oregon. AmericaTab, Ltd. is licensed to operate by the Oregon Racing Commission and BetBarn66.com is a member of the AmericaTab affiliate system.
         

Recent Events

• March 2005: The Company announced the implementation of a major marketing program in order to attract and expand its customer base for BETBARN66.COM.  

• February 2005: The Company announced it has hired a mergers and acquisition firm in order to seek strategic acquisition opportunities.

• January 2005: The Company announced that it has hosted its first online gaming tournament in which the winner will have a chance of competing for $500K.

Key Selling Point: The company is following a similar business model as UBET.COM, NASDAQ UBET. UBET is a highly profitable business whose stock has doubled in the last 6 months! PHXI is positioned to be the next UBET or could be a potential acquisition target once they achieve their target account goal.

Statements made in this news release that relate to future plans, events or performances are forward-looking statements. Any statement containing words such as "believes," "soon," "anticipates," "plans," or "expects," and other statements which are not historical facts contained in this release are forward-looking, and these statements involve risks and uncertainties and are based on current expectations. Consequently, actual results could differ materially from the expectations expressed in these forward-looking statements. Reference is made to the Company&apss filings with the Securities and Exchange Commission for a more complete discussion of such risks and uncertainties.

DISCLAIMER

GP is not a registered financial advisor. The  information presented by GP is not an offer to buy or sell securities. GP  accumulates then distributes opinions, comments and information based on  other public sources. Penny stocks are considered to be highly speculative  and may be unsuitable for all but very aggressive investors. GP may hold  positions in companies mentioned and may buy or sell at any time. This  Profile of PHXI was a paid opinion by PHXI. PHXI has compensated GP $50,000  for investor related services. Paid advertisements by an affiliated public  relations group or third party do not necessarily reflect the views of GP.  Target prices may fluctuate Please consult a registered financial advisor  before making any decisions. This report is for entertainment and advertising  purposes only and should not be used as investment advice.

 

Pump and Dump: CWTD

This is a little odd in that it doesn't follow the usual patterns for pump and dump operations. We've seen this particular stock pumped via spam several times before, but they've been quite widely spaced out. Contrast this with the recent CDGT spam which came in an intense burst over a short period. Previous CWTD spams have been received on 2005-03-23, 2005-04-04, and 2005-04-12. This one was received from 69.229.116.251 (adsl-69-229-116-251.dsl.frs2ca.pacbell.net.) on Sat, 21 May 2005 10:18:58 -0000. Full text follows.

                         Major Financial NEWS was released Today
(SYMBOL:  CWTD)
Price: $1.97
Short Term Target: $27-$35
12month Target:   $50.00

     China World Trade Corporation SYMBOL: CWTD Reports Significant
Improvement in Operating Results for the First Quarter 2005
Thursday May 19, 1:18 pm ET
First Quarter Operating Revenues Increase Five Fold from the Same Period in
the Previous Year; Net Loss Continues to Narrow

  TIANHE, GUANGZHOU, China, May 19 /Xinhua-PRNewswire/ -- China World Trade
Corporation (OTC Bulletin Board: CWTD - News) announced first quarter
results and the filing of a Quarterly Report on Form 10-QSB with the
Securities and Exchange Commission for the first quarter, ended March 31,
2005. CWTD is set to move much higher over the next weeks with major trading
profits expected immediately.Don't miss out on this opportunity.May 23-May
27

    Financial Highlights for First Quarter 2005

     * Operating revenues for the first quarter were $1.9 million, a 530%
       increase from the same corresponding period last year.  The sharp
 rise
       was predominantly attributable to our Business Travel Services
 division,
       which was part of the acquisition of the New Generation group of
       companies in August 2004, and to our Business Value-Added Services
       division, which provides various consultancy services to our
 corporate
       clients.



       * Net loss narrowed sharply from $1.5 million for the same
 corresponding
       period in year 2004 to only $177,000 for the first quarter of 2005.
       This was predominantly attributable to our acquisition in August 2004
       of the New Generation group of companies, with their higher margin
       businesses. Net loss per share for the period ended March 31, 2005
 was $.01 compared to a loss per share of $.09 in the same period for the
       previous year.

     * Including unrealized gain of short-term investments (from shares of
       common stocks received as compensation for the Company's consultancy
       services), the Company reported its first ever consolidated income of
       $582,999 for the first quarter of 2005.

     * Gross profit margin reached 81.5% for the quarter ended March 31,
 2005
       compared to 38.8% in the same corresponding period in the previous
 year.

     * As of March 31, 2005, cash and cash equivalents totaled $1.8 million.
     
Disc:
    Information within this email contains "forwardlooking statements"
within the meaning of
Section 27Aof the Securities Act of 1933 and Section 21B of
theSecurities Exchange Act of 1934. Any statements that express or
involve discussions with respect to predictions, expectations, beliefs,
plans,projections, objectives, goals, assumptions or future events or
performance are not statements of historical fact and may be "forward
looking
statements."Forwardlooking statements are based on
expectations,estimates and projections at the time the statements are
made that involve a number of risks and uncertainties which could cause
actual results or events to differ materially from those
presently anticipated. Forward looking statements in this action may be
identified through the use of words such as"projects", "foresee", "expects",
"will,""anticipates," "estimates," "believes," "understands"or that by
statements indicating certain actions"may," "could," or "might" occur.
 Risk factors include general economic and business conditions, the ability
to
acquire and develop specific projects, the ability  to fund operations and
changes in consumer and business consumption habits and other factors
overwhich the company has little or no control. The publisher of this
newsletter does not represent that the information contained in this message
states all material facts or does not omit a material fact necessary to
make the statements therein not misleading. All information provided within
this email pertaining to investing, stocks, securities must be understood
as information provided and not investment advice. The publisher of this
newsletter advises all readers and subscribers to seek advice from
a registered professional securities representative before deciding to
trade in stocks featured within this email. None of the material within this
report shall be construed as any kind of investment advice
or solicitation. Many of these companies are on the verge of bankruptcy.
You can lose all your money by investing in this stock. We urge you to read
the company's SEC filings now, before you invest. The publisher of this
newsletter is not a registered investment advisor. Subscribers should not
view information herein as legal, tax, accounting or investment
advice. In compliance with the SecuritiesAct of 1933, Section
17(b),The publisher of this newsletter is contracted to receive free
trading shares from a third party, not an officer,director or
affiliate shareholder for the circulation of this report. Be aware of an
inherent conflict of interest resulting from such compensation due to
the fact that this is a paid advertisement and is not without bias.The
party that paid us has a position in the stock they will sell at anytime
without notice.This could have a negative impact on the price of
the stock, causing you to lose money. All factual information in this
report was gathered from public sources, including but not limited to SEC
filings,Company Websites and Company Press Releases. The publisher of
this newsletter believes this informationto be reliable but can make no
guarantee as to its accuracy or completeness. Use of the material
within this email constitutes your acceptance of these terms.

Advance Fee Fraud: Madam Rose Pallasigui

A fairly ordinary 419, this, so not much commentary. It was received from 196.201.75.12 (Adsl-196-201-75-12.aviso.ci. -- and note that the ".ci" country code is Cote d'Ivoire, which is not Nigeria, but it's close to it) on Fri, 20 May 2005 13:40:08 -0000.

My Dear,
My name is Madam Rose Pallasigui. A citizen
of Gambia, widow to the late former minister
of finance in Philippine who died on 15th of May 2004.
My husband fell sick and he was flown to France for
treatment but later died of ulcer and he has been
buried.
I inherited a total sum of 11 million dollars from my
late husband, this money which is concealed in a
metallic trunk box is deposited with a security and
finance company here in Philippine. Due to the
instruction I laid down before I deposited the box,
that I needed maximum security/safety of my
consignment and no body nor government organization
can trace the where about of the box until I am ready
and prepare to claim it. for this reason the security
company used their diplomatic means to send the box
out of Philippines to Abidjan- Cote d'Ivoire where
they have their underground secrete vault. This
deposit was coded under a secret arrangement as a
family treasure. This means that the security company
does not know the content of this trunk box that was
sent from the Philippine to Abidjan- Cote d'Ivoire
under a diplomatic coverage for safe keeping.
My main purpose of sending you this mail is because of
the way I found you and perhaps trustworthy to give
you this priority of shipping the box of
money to any address that you think is very secure and
save in your country with your percentage of which we
shall chat on soon.
In fact, since the death of my husband, his brothers
has been seriously chasing me around with constant
treats, trying to suppress me so that they might have
the documents of his landed properties and confiscate
them. They have successfully collected all his
properties, yet they never stopped there, they told me
to surrender all bank account of my late husband,
which I did, but I never disclose to them this deposit
with the security company in Abidjan- Côte d’Ivoire,
because this is where my future and destiny lies upon.
The family of my late husband never aware of the
secret existence of this deposit which I made with the
security company and they can never be aware of it.
Out of fear of my late husbands family, and when the
situation becomes uncontrollable because of pressure
on me from the Government of the Philippines, I decide
to look for a trustworthy person who could assist me
retrieve this box of money from the security company
for onward lodgement into his account for the purpose
of future investment. Consider my situation as a widow
and come to my rescue.
There is need for urgent action because I'm paying
$50 dollars per day as a demurrage to the security
company for safe keeping this consignment.. I will
send you
the Authorization Certificate to call them in my next
mail which is the Certificate of deposit that they
gave me on the very day when the box of money was
deposited under their company.
I give thanks immensely for your co-operation as I
look forward to hear from you soon.
All the best,
Madam Rose Pallasigui.

Lottery Scam: Software International Lottery Stake

Another lottery scam, sent directly to the contact address for this blog. Received from 82.169.147.7 (82-169-147-7-mx.xdsl.tiscali.nl. -- thus establishing a recent pattern of lottery scams originating in the Netherlands via Tiscali's network) on Thu, 19 May 2005 15:30:38 -0000. There's nothing particularly noteworthy about this scam: it looks like the usual combination of advance fee fraud and identity theft.

SOFTWARE INTERNATIONAL
 LOTTERY STAKE NL

 Sir/Madam,
You are a winner!!. We are delighted to notify you
that you are one of the lucky winners in the
distinctive result of the SOFTWARE LOTTERY PROGRAM
which was held on 19th May 2005. Your e-mail
address was selected by computer generated method and
attached to ticket number: 9874300 with serial
number 00923/78 which drew lucky numbers:
32-68-17-20-43-8-11 and won in the 2nd division. In
this regard, you are to receive a prize sum of
1,200,000.00 Euros (One Million Two Hundred Thousand
Euros).
Please you are advised to keep your winning
information undisclosed till you make claim of your
prize money.
It is a part of our security caution to avert
impersonation and abuse of this program by
unscrupulousindividuals.
All winners were selected by a computer ballot system
pulled from over 80,000 companies and 40,000,000
individual e-mail addresses world wide. Please be
informed that anyone who has access to your
e-mail password could claim your prize. The security
of your winning information is your own
responsibility.

CONGRATULATIONS!!!

Your funds is now in custody of a Financial Security
company insured in your file Reference. This lottery
program was promoted by our group of philanthropist
headed by the Netherlands government. We hope with a
part of your prize, you Will participate in our end
of year high stakes EURO 25,000,000 million
International Lottery Programme .To begin your claim,
please contact your claim AGENT:

David Briggs{CLAIM AGENT}
PRUDENT SECURITY
PHONE:+31649218796
EMAIL:prudent_secbv@yahoo.com

Please be informed that NON RESIDENCE of THE
NTHERLANDS will be required to make a NON DEDUCTABLE
advance payment for processing and legal documentation
charges of (€869.10 Cent) Eight Hundred And Sixty Nine
EuroTen Cent, to enable our legal department acquire
Notarisation papers from the Court prior to award
payment policy as required by the paying Financial Security
Company. Please be aware that your paying authority
will effect payment swiftly upon satisfactory report,
verifications and validation provided by our
Processing Agent, that would be designated to your file. For due
processing and remittance of your winning prize to
your designated account of choice. Remember all prize money must be
claimed not later than 15th June 2005. After this date,
all funds will be returned as unclaimed.
In order to avoid unnecessary delays and
complications, please remember to quote your Reference
and Batch numbers in all correspondences. Furthermore, should
there be any change of address do inform us as soon as
possible.

Once more congratulations!! from our members of staff
and thank you for being part of our promotionalprogram.
Note: Any one Under the age of 18yrs is automatically
disqualified.

Best Wishes,

Sonia Quay

{Loterij Co-ordinator}

Meta: New Category

Up until now, I've been lumping Lottery Scams together with 419 Advance Fee Fraud. Although the two are closely related, there is enough of both and enough difference between them to warrant separate classification. I'm not going to retro-actively re-label all the lottery fraud in the archive so far, because doing so will also change the URLs for the articles and break any links people have made. For the record, advance fee fraud is a normal part of a lottery scam, but there's usually more to it than that -- thus the distinction.

Advance Fee Fraud: Richard Yengeni

Spare me! I can't get through reporting all the nasty lies without another one arriving in the meantime! Oh well, at least 419s aren't hard to spot or classify. This is the standard tale of someone with millions seeking a "business partner" to assist in the spiriting away of the funds. We've heard it all before a thousand times at least -- only the names change. This was sent directly to the contact address for this blog from 195.234.171.50 (in Italy, so far as I can tell) on Thu, 19 May 2005 01:06:47 -0000.

                        SOLICITATION FOR BUSINESS VENTURE AND PARTNERSHIP

Dear Sir/Madam 
My name is Richard Yengeni South African citizen I am the Brother to Mr. Tony Yengeni Mr. Tony 
Yengeni was the chairman of parliaments in South Africa and the former chief whip of the ruling political 
party ANC.
My Brother has mandate that I search for a reliable and trustworthy foreign partner, who will help receive 
some fund, which we have in cash totaling (US$35Million) Thirty five million united states dollars only, into 
a personal company or any reliable foreign bank accounts our family bank accounts within and outside 
the country have been frozen by the authorities.

This sum of US$35Million has been secretly deposited into a reputable security company, where it can 
easily be withdrawn or paid to a recommended beneficiary the fund will be released to you by the security 
company based on my recommendations, on that note you will be presented as my family business 
partner who will be fronting for me and my family in any subsequent ventures. 

I sincerely hope you are that we can do this transaction with absolute trust, because we do not want 
anyone that will sit on the money once received, the total sum will be share as follows: 25% for you 70% 
for my family and then the remaining 5% is to be set aside for any eventual cost that may occur in the 
process of this transaction.
There is no risk involved what so ever on this transaction, these funds will be received in your favour 
upon proper application 
Please, I need your full support and co-operation for the success of this venture. I plead with you to treat 
as urgent and confidential. This is a delicate issue, which demands a great degree of secrecy.
Further modalities of this business will be given to you as soon as I receive your response indicating your 
interest to co-operate and assist me

I will be most grateful if you can come forward and help me.

I wait your prompt response.
Best regards,
Richard Yengeni 
Email: yengeni_77@excite.com 
Telephone:0031-619-098-799

Payment Processing Job Scam: Waterman

Want a job laundering money? A job that will attract the attention of the local authorities? A job that is guaranteed to result in your commission being confiscated by the law? Then you've come to the right place. Received from 200.97.184.85 (in Brazil) on Thu, 19 May 2005 03:03:46 +1000 (note Australian time zone) to a ".au" email address, one poisonous job offer targeted specifically at Australians. I've written off to them from a ".au" address for more details, and I'll update this post if I get a response. I have no doubt that this involves the transfer of money into the "employee's" account by phishers who have gained access to other accounts, then sending this money overseas to the actual phishers -- probably via one or two more layers of indirection.

HELLO! TODAY ONLY WE OFFER YOU A UNIQUE OPPORTUNITY TO EARN TOGETHER WITH OUR UNIQUE PARTNERSHIP PROGRAM.

We have many clients world-wide and today we are taking a closer and better look at the
market&apss potential in AUSTRALIA for a possible sale of our merchandize.

To send the money from our clients back here to Switzerland we must pay an obligatory 20%
percent from the total sum of every transaction. But if the money is sent by a natural person,
the percent is considerably less.

That&apss why we are opening a unique Partnership Program for YOU! You can earn up to 2000-3000$
per month.

ATTENTION!!!
This might not be your general income. All You need to do is to receive money from
our clients and to send the money back to us. No special skills or experience is required.

You get 6% from the total sum for every successful money transfer.
For example we send 4000$ AUD to You. You take 6% from this money - that is 240$AUD.

Next You send the rest of the money to us.
Attention!

You pay for all the commission fees from our money. This means that You get guaranteed 6% for
every successful money transfer with no additional charges or taxes.
To get any additional information about our site and to get the contract from us,
send us an email and we&apsll reply in a couple of hours.

Thank You!

Contact us: jobau@waterman-style.ws

-WATERMAN.

Advance Fee Fraud: Mega City Lottery

This particular instance of El Fraudo Lottery was "promoted and sponsored by eminent personalities like Mr.Bill Gate and sultan of Brunei". Bill Gate? Well, what does a minor typo matter when contained in such a big lie? So the 419ers are still using "you won a major prize in a lottery without buying a ticket" as bait on their hooks. Let's do the forensics and see where they're coming from. This one was sent directly to this blog's contact address, by the way -- most convenient. It was received from 82.168.128.38 (82-168-128-38.static.tiscali.nl.) -- in the Netherlands, which is not uncommon for 419ers, although less common recently -- on Wed, 18 May 2005 12:56:11 -0000. It's not entirely obvious whether this 419er is purchasing connectivity directly from Tiscali in the Netherlands, or using a compromised host. The former approach, using hit-and-run Internet access, is the more common modus operandi among 419ers.

MEGA CITY LOTTERY
NETHERLANDS
REF NUMBER: 039/054/336
BATCH NUMBER: 561701-DBQ117
Sir/Madam,
We are pleased to inform you of the result of the lottery winners international programs held on 15th of may, 2005. your e-mail address attached to ticket number 27522465896-6543 with serial number 3772-554 drew lucky number 7-14-18-23-31-45 which consequently won in the 2nd category, you have therefore been approved to pay the lump sum of €500,000.00 (five hundred thousand euros).
CONGRATULATIONS!!!!
For security purpose and clarity, we advise that you keep your winning information confidential until your claim have been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of 20,000 companies and 30,000,000 individual e-mail adresses and names from all over the world.
This program takes place every year. This lottery was promoted and sponsored by eminent personalities like Mr.Bill Gate and sultan of Brunei, we look forward to your active participation in our next year USD 8million slot.
You are requested to file in your winning, however if you are unable to make it to the netherlands, please contact our clearance office to assist you with the claim and send your cashier's check to your home adress.
Note that, all winnings must be claim not later than 2nd june,2005. After this date, all unclaimed funds will be null and void.
Please note in order to avoid unnecessary delays and complications, remember to quote your reference number and batch number in all correspondences, you can contact us at the following e-mail address: megacitylotto@yahoo.com.
Furthermore, should there be any change of adress, do inform our agent as quickly as possible. congratulations once more and thank you for been part of this program.
Note: Any person under the age of 18 is automatically disqualified.
Yours sincerely,
Mr.Barry Juhnson

Pump and Dump: FNPL

It's official: pump and dump spam has reached epidemic proportions. Not only do I have another sample, but the CDGT spammers haven't finished spamming after all -- they just took a short break. This one pumps the stock symbol FNPL, and was received from 216.179.3.114 (dialin-622-tnt.nyc.bestweb.net. -- where "nyc" very probably stands for "New York City") on Wed, 18 May 2005 15:04:07 +0000. I'm not going to bother looking up stock price history for this one -- there's too much spam to report right now. Text follows.

      Market Insider Report - FNPL Is On The Move!

This Weeks Hot Pick Is FNPL. With a 52wk high of 1.50
it is sitting at .52 at the moment and expected to explode
over the next 2 weeks with huge promotions and a booming
market for the company and great news. This is a real
company with real clients and revenue! FNPL is a proven
company that is making a major impact to cut costs for
builders and create faster projects. Construction had
a 12% gain last month. This is a exploding industry
and FNPL is leading the way as a major provider. Don't
miss this one. They will have more exciting news coming
out in the future and this one can move very quickly
very fast. Below is the detailed information:

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Company:First National Panel
Ticker:FNPL
Current-Price:0.52
52Wk High:1.50
Estimated 3-5 Day target:1.50
Estimated-6months-target:3.50

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Detailed Information About The Company:

First National Panel Acquires Pre-Cast Manufacturer
SAINT PAUL, Minn.--(BUSINESS WIRE)--May 13, 2005
First National Panel Company, Inc., a pre-cast
concrete building supply manufacturer, is pleased
to announce that it has acquired Engineered Panel
Systems, Inc. (EPS), a leading commercial pre-cast
concrete manufacturer. A mainstay in the commercial
building industry for more than 2 decades, EPS supplies
architectural wall panels, pre-cast concrete and light
gauge steel frames. The EPS pre-cast panel is an
industry proven building product.

The EPS Pre-cast Wall System was developed to provide
builders with lower labor costs and faster construction
times. The wide variety of colors and finishes available
further enhance design flexibility and options. EPS is
committed to delivering superior levels of product
quality and total customer satisfaction. FNPL will
incorporate their unique concrete mix into the EPS
Pre-cast Forms Wall System. This will create stronger,
lower weight commercial pre-cast concrete panels that
will be easier to work with, lower product costs and
speed construction times. 

Additionally, the Company announced that it has purchased
a Lindstrom, Minnesota-based concrete manufacturing plant.
The Lindstrom manufacturing facility is a fully equipped
plant set up to produce pre-cast concrete panels. EPS
will utilize the plant to produce its products, and this
facility will serve as the base of FNPL operations. 

"With this location, First National Panel is set to focus
corporate expansion in Minnesota, Wisconsin, Illinois and
North Dakota. Targeting expansion in Minnesota and
surrounding states will provide additional savings in
shipping costs," stated Ricci D. Null, the Company's
Founder and President. 

FNPL is also launching an aggressive sales and marketing
campaign designed to make developers, builders, engineers
and architects in its region aware of the cost savings,
design flexibilities, strength and long lasting properties
of its pre-cast concrete products. 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Company:First National Panel
Ticker:FNPL
Current-Price:0.52
52Wk High:1.50
Estimated 3-5 Day target:1.50
Estimated-6months-target:3.50

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Get FNPL Immediately, Don't Miss Out On Great Gains
All Week Long. It will be featured in over
45 Newsletters To Millions Of Investors All Week And A Fax
Campaign Starts On Friday So Next Monday WIll Be Explosive
Growth! Be Sure To Tell Your Associates and Friends About
FNPL Get It Before Friday!

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Pump and Dump: ABZT

It must be a very good day for pumping and dumping, because this is the third one I've had to report in the last 24 hours or less. This is a stock we've seen pumped before: Ablaze Technologies (ABZT). Maybe the same pump-and-dump spammer is still trying to offload their junk, because the share price has remained stubbornly low since the last round of spam according to the stock history at Yahoo! finance. It was eight cents back on 26th April, and now it's around four or five cents. The pumpers are still promising the moon, of course, but that's the name of the pump and dump stock fraud game.

Technical details: spam received from 80.133.62.42 (p50853E2A.dip.t-dialin.net. -- in Germany) on Wed, 18 May 2005 02:38:11 +0000. A partial copy of the spam text follows.

Symbol: ABZT
Current Price: $0.04

Expected Speculat1ve price in next 3 days: 15 cents

Hot News released on Friday - This situation is HOT
NEws Release out: "Ablaze Technologies Announces Focus on Online Payment Processing"

Don't Miss Out!! M1cro Cap Stocks Are Providing HUGE Investor Profits!!
STR0NG BUY Rat1ng on aBlaze Technologies, Inc..!!

Did you turn a 100% gain on your investment last month. If you bought eMax Holdings Corporation. (OTC PK: EMXC) you would have realized a 300% GAIN in less than 5 days!!! EMXC was priced at 13 cents and surged to $0.40


+++++++++++++++++++++++++++++++++++++++
Symbol: ABZT
Current Price: $0.04

Expected Specu|ative price in next 3 days: 15 cents

NEws Release out: Ablaze Technologies Announces Focus on Online Payment Processing

++++++++++++++++++++++++++++++++++++++


Our latest featured company (OTC PK: ABZT ) is priced in a similar range and has the potential to be another winner. ABZT is a microcap company emerging as a leading provider of internet services from VOIP to Pay Per Click Search engines and online payment systems!!!

Many low-priced stocks provided HUGE GAIN opportunities for investors who capitalized and jumped on them early enough.

Don't miss out on our latest Hot Pick!

Our latest hot pick OTC BB: ABZT is another golden opportunity! Buy now, before the word gets out. ABZT is an emerging growth Internet company.

Pump and Dump: RXPC

Today's a good day for pumping and dumping, apparently. This nondescript little pump-and-dump spam turned up in the inbox while I was away from the keyboard, along with the usual "discount meds" spam that I never bother reporting here. The spam was received from 200.28.133.159 (159-133-28.dial.terra.cl. -- that's "Chile", in case you're not familiar with the ".cl" code) on Tue, 17 May 2005 19:54:15 +0000. I've excluded the obligatory "forward looking statements" disclaimer from the copy below.

As an aside, I thought I'd check up the stock price online, and sure enough, it is trading at eight cents a share, as they say. The stock symbol to search for is "RXPC.PK", where the ".PK" part means it's listed on the "pink sheets" (and no current stock exchange wants to touch it with a bargepole). The Yahoo! five-day chart for the stock shows a flurry of activity on the stock early on the 16th (possibly the spammers buying up prior to pumping), and some activity on the 17th, but not enough to do anything terribly significant to the stock price -- yet.

Rx Processing Corp.(OTC: RXPC)
Revenues Year Ending 12/31/04: $822,130 (Unaudited: Source: 15c-211, 5/4/05)

Market Leader in Providing Prescription Drugs, Lab Tests and Drug Tests to
U.S. Citizens, Corporations, Unions, and Members Through FDA-Approved
Patient Service Centers for Their Lab Testing and Licensed Pharmacies in the
United States and Canada. (Source: News 5/10/05)

Current Price: .08

INVESTMENT HIGHLIGHTS: (Source: Recent News Releases)

1)Rx Processing Corp. Announces Strategic Partnership Agreement with
Financial Services International, Inc.- This alliance is anticipated to
increase sales of the Rx Processing's discounted prescription drugs and lab
services within large groups through the added benefit of FSI's Stored Value
Cards for payroll and payment services as well as improve the Company's
member ID card distribution process essential to servicing corporate
clients.

2)Rx Processing Corp Secures Five-Year Contract with The Health Advantage-
The contract is a five-year agreement establishing Rx Processing's ``Lab
Pass Network'' as the exclusive provider of discounted diagnostic testing to
The Health Advantage's large corporate clients, representing millions of
individuals.

ABOUT RXPC (Source: News 3/29/05)

Rx Processing is rapidly becoming a market leader in providing prescription
drugs, lab tests and drug tests to U.S. citizens, corporations, unions, and
members through FDA-approved patient service centers for their Lab testing
and licensed pharmacies in the United States and Canada. The Company
provides access to more than 1,500 approved brand name and generic
medications and provides access to over 1,000 diagnostic tests including:
heart disease risk assessment, cancer detection and several other wellness
tests and early detection diagnostics ready for distribution an service in
the U.S. market through its company-owned and operated storefront locations
and affiliated storefronts with access to 3,000 FDA-approved patient service
centers. By utilizing Rx Processing, U.S. citizens can save up to 84% on
their daily prescriptions up to 50% on their lab testing and drugs
screening.

Please Watch This One Trade. These little stocks can surprise in a big way
sometimes....
                        _______________________________

Pump and Dump: QOIL

There are some clues worth noting to suggest that this latest pump-and-dump spam is from the same lot that sent out the recent CDGT spam. For starters, the spam was sent to the same account -- an account that hasn't received a lot of pump-and-dump. Also note that it's hot on the heels of the last spam stopping. Then note that I received two instances of the spam, as per last time.

The spams themselves were received from 200.208.143.206 (c8d08fce.sts.virtua.com.br.) on Tue, 17 May 2005 05:09:17 -0000, and 220.70.95.17 (in Korea) on Tue, 17 May 2005 09:59:43 -0000. The delivery pattern thus also is a close match for the CDGT spammers.

Oil prices are flirting with all time highs, and oil company stocks, which generally move with oil prices, have outperformed the market this year.  Some analysts say if you don&apst make oil stocks part of your portfolio you have to be nuts.  $50 a barrel, $60, $70, $80 to $100 a barrel have been predicted.  NO one knows for sure how high it will go.  Most agree it will head higher. 

News was released after the market close Friday

Quest Oil Engages Midtown Partners to Provide Funding for Acadia Gas Project
Friday May 13, 5:02 pm ET <--after the market close Friday

ARLINGTON, Texas, May 13, 2005 (PRIMEZONE) -- Quest Oil Corporation (OTC BB:QOIL), is pleased to announce that the Company has engaged the services of Midtown Capital Partners Co., LLC to negotiate and secure a financing to forward its Acadia gas projects. Upon closing definitive agreements the Company will announce terms and conditions of the transaction through an 8K filing. (Partial clip only. Go read the entire announcement now)

 An immediate watch is being issued right now. Anyone wondering why oil and gas companies are one of the hottest sectors out there?

Quest Oil Corporation

***QOIL***QOIL***QOIL***QOIL***QOIL***QOIL***QOIL***

Important Recent news,

Quest Oil Successfully Completes and Closes Acquisition of Acadia North Gas Reserve

Quest Oil Corporation (OTCBB:QOIL) today announces that it has completed the acquisition to acquire a 100% working interest in the two-section Acadia North prospect, located in Alberta, Canada. A third party reservoir engineering firm "Chapman Engineering" confirms reserves proved and probable of 3 BCF with a revenue value of $18 million. (Partial clip only.  Go to yahoo to read the entire release)

Quest Oil Appoints TransAction as its Operator For its Acadia North Gas Project

Quest Oil Corporation (OTCBB:QOIL) (www.questoil.com) announces the engagement of TransAction Oil & Gas Ventures Inc. of Calgary, Alberta (TransAction) as their operators for the Acadia North project. The agreement with TransAction will cover the drilling of the test well, all follow up wells and other activity in the area. Herb Miller, P.Geol., is the President of TransAction with over 46 years of experience. His team includes such notables as Charlie Chapman of Chapman Petroleum Engineering. (Partial clip only, go to Yahoo and read the entire release)

Mission Statement

Quest Oil&apss mission is to deliver a competitive and sustainable rate of return for our shareholders by acquiring, exploring and delivering oil & gas properties around the world.

Their Strategy

Quest is a publicly funded oil & gas company that maintains a balanced risk portfolio. We target large impact projects with high net revenue interests, where risk has been substantially reduced by meticulous technical evaluation and geophysics, where applicable.

Our primary goal is to identify underdeveloped reservoirs achieving substantial growth with efficient reservoir maintenance and innovative technology. Quest&apss expertise implemented with strategic partnering insures high returns on investment and substantial cash flow.

Corporate Profile

Quest&apss most valuable resource is our wealth of successful experience from a highly qualified team of seasoned professionals bringing over 100 years of experience with both Major and Independent companies to the exploitation, exploration and production of long-lived, high rate of return reserves.

By exhibiting our creativity and balancing a tolerance for risk along with a relentless pursuit of efficiency, we maintain a corporate culture that values originality and invention while developing essential, long-term relationships via honesty, trust and integrity.

Make sure you keep a keen eye on this company and add it to your radars now.  The oil and gas sectors are some of the hottest watches out there.  Our opinion is, after looking at the charts and recent volume and price activity,  it&apss worth watching closely.

 

Disc.laimer, All material herein was  prepared based upon information believed to be reliable. The  information contained herein is not guaranteed by us to be accurate, and  should not be considered to be all-inclusive. All information was taken from websites and previously announced news.  The companies that are discussed in this opinion have not always approved the statements made in this opinion.  This opinion contains forward-looking statements that involve risks and uncertainties. As with many Bulletin board and pink sheet companies this company has an accumulated deficit since inception, a negative net worth, relied on loans from officers or directors and an auditors going concern.  This material is for informational purposes only and should not  be construed as an offer or solicitation of an offer to buy or sell  securities. We are not a licensed broker, broker dealer, market maker, investment banker, investment advisor, analyst or underwriter. Please consult a  broker before purchasing or selling any securities viewed or mentioned  herein.  We have been compensated by a third party  shareholder , or with cash from the company on  behalf of one or more of the companies mentioned in this opinion. The third party is AVA Investments.  We have been compensated three hundred thirty four thousand free trading shares of qoil by a non affiliated third party for this advertisement. A mistake was made, take note to the correction please.  We were paid three hundred thirty four thousand free trading shares, In addition to any  compensation mentioned above, additional compensation can be equal to ten  percent of any newly issued or registered securities of the profiled  companies. Our affiliates, officers, directors and employees may also  have bought or may buy the shares discussed in this opinion and may profit in  the event those shares rise in value. We will not advise as to when it  decides to sell and does not and will not offer any opinion as to when others  should sell; each investor must make that decision based on his or her judgment  of the market

Phish of the Day: LaSalle

A little phish just swam in, attempting to trick members of LaSalle Bank into divulging their online banking passwords. At a glance, it appears to be a fairly ordinary phishing attempt, not combined with any obvious attempts to compromise security via browser exploits. Here's how it looks.

[LaSalle Logo]

Dear LaSalle Bank customer,

We recently noticed one or more attempts to log in your LaSalle Bank online banking account from a foreign IP address and we have reasons to believe that your account was hijacked by a third party without your authorization.

If you recently accessed your account while traveling, the unusual log in attempts may have initiated by you.

However if you are the rightful holder of the account, click on the link below and submit, as we try to verify your account. (In case your are not enrolled use your Social Security Number as User ID and  first 6 digits of Social Security Number as password):

https://secure.lasalle.com/CVS/

The log in attempt was made from:

IP address: 159.255.11.185
ISP host: 159.255.11.1.prov.T1fast.net

If you choose to ignore our request, you leave us no choice but to temporally suspend your account.

We ask that you allow at least 48hrs for the case to be investigated and we strongly recommend not making any changes to your account in that time.

If you received this notice and you are not the authorized account holder, please be aware that is in violation of LaSalle Bank policy to represent oneself as another LaSalle Bank account owner.Such action may also be in violation of local, national, and/or international law. LaSalle Bank is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the Internet to commit fraud or theft.
Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the fullest extent of the law.

* Please do not respond to this email as your reply will not be received.

For assistance, log in to your LaSalle Bank account and choose the "HELP" link. 

Thanks for your patience as we work together to protect your account.

Regards,

2005 LaSalle Investment Management, Inc. A member of the Jones Lang LaSalle group. All rights reserved.

The details provided about the "attempted login" are a fabrication, and should be ignored. The phish itself was sent from 66.179.134.23 (delegated to "Ultimate Information Systems" in Phoenix, Arizona) on Sun, 15 May 2005 23:48:20 +0000. Much of the information in the headers of the message identifies the sending host as running Knoppix, which is a live-CD Linux distribution. This is probably not falsified -- it's a good way for a spammer with physical access to a computer to temporarily gain complete control of that computer without leaving any traces on it.

The actual link was not to LaSalle (of course), but to http://chenster.info/albums/sif/default_location/ plus some additional extra rubbish which may have been included for tracking purposes. That address is sufficient to bring up the page, however. It appears that "chenster.info" has been compromised, and the phisher has loaded his additional web pages onto their server. It does not appear that this particular phisher has registered any domains as a part of his phishing attempt. The address of "chenster.info" is currently 210.17.20.129, which is in Taiwan. I'll send a note to the WHOIS contact for that domain about the situation.

Advance Fee Fraud: Mikhail Khordokovsky

Those crazy 419ers are always looking for a real-world tale to back up their spurious claims of wealth beyond the dreams of avarice. In this particular case, one "Virgilio Servile" (I love that name, by the way -- I want a henchman with a name like that) claims to be associated with this particularly rich and infamous Russian. Beyond that, it's the usual case of "get in touch with us -- we have a few million dollars that need discreet repatriation, and although we've never heard of you, we trust you to do it for us, and we'll cut you in on the booty!" This particular cock and bull story has actually been around for a while now.

This spam was sent to an address that was harvested from Usenet. The address is a spamtrap -- it never receives any legitimate mail. It was received from 66.18.69.6 (mailout06.infosat.net. -- note that infosat.net is registered in South Africa) on Sat, 14 May 2005 21:32:57 -0000. The URLs in this particular spam are harmless -- they are just the kind of thing you would find if you did a search on "Mikhail Khordokovsky".

Dear sir,

I am Virgilio Servile and I represent Mr. Mikhail
Khordokovsky the
former C.E.O of Yukos Oil Company in Russia. I have a very
sensitive and confidential brief from this top (oligarch)
to ask
for your partnership in re-profiling funds over US$45
million. I
will give the details, but in summary, the funds are in
europe.
This is a legitimate transaction. You will be paid your
"management fees".

If you are interested, please write back by email and
provide me
with your confidential telephone number, fax number and
email
address and I will provide further details and
instructions. Please
keep this confidential; we can?t afford more political
problems.
Finally, please note that this must be concluded within two
weeks.
Please write back promptly. I will also suggest you visit
these
news sites on the internet to be better informed about this
project.



http://newsfromrussia.com/main/2003/11/13/51215.html



http://www.supportmbk.com/mbk/mbk_bio.cfm



http://www.disinfopedia.org/wiki.phtml?title=Mikhail_B._Khodorkovsky



http://www.pbs.org/frontlineworld/stories/moscow/khodorkovskyinterview.html



http://www.forbes.com/finance/lists/75/2004/LIR.jhtml?passListId=75&passYear=2004&passListType=Person&uniqueId=M1IF&datatype=Person



http://mikhail_khodorkovsky_society.blogspot.com/


Write me back. I look forward to it.



Regards,

Virgilio servile