Current Status

This blog is not frequently updated because most case-by-case scam reports are now listed in subordinate blogs. At this point in time, most of my efforts are targeted at documenting employment scams in the Suckers Wanted blog.


Job Scam: Agroleeds International

I don't know if there's a company anywhere with the name "Agroleeds International" -- a quick search finds no instances. This particular spam was sent via Hotmail ( []) to the contact address for this blog, using the return address "". I'll make enquiries and see what comes back.

General Importers & Exporters
Tower House Hardwick Road
Great Gransden Bedfordshire
SG19 3BJ

We supply raw materials Into America, Canada, Australia . We are searching
for representatives who can help us establish a medium of getting to our
costumers in America and Canada as well as making payments through you to us.
Please if you are interested in transacting business with Us, we will be very
glad. Please contact our procurement officer,Mark Brian Subject to your satisfaction you will be given the
opportunity to negotiate your mode of which we will pay for your services as
our representative in America or Canada. Please if you are interested get back to
Mark brian
Very Respectfully,
Agroleeds International


Advance Fee Fraud: Marie-laure Anne BILLARD

I've heard of 419 spams in languages other than English before, but I don't recall actually receiving any. I don't actually speak French, but I can recognise a 419 in it. Whether the French is native or a rough mechanical translation is a question I can't answer. This arrived at the contact address for the blog from on Wed, 27 Jul 2005 10:37:54 -0000.

Bonjour .
Avant toute chose, je voudrais m'excuser pour mon intrusion dans votre vie privée.
Je me nomme Mme Marie-laure Anne BILLARD, Cadre au Departement Comptabilité et transaction au sein du groupe EcoBank-Côte d'Ivoire.
Un compte a été ouvert au sein de notre banque en 1985 et depuis 1990,aucune opération bancaire ne s'est effectuée. Ce compte présente à ce jour dans nos livres, un compte créditeur de 20.8 millions de dollars américains.
Après avoir consulté méticuleusement toutes les archives et les dossiers relatifs à ce compte, je me suis rendu compte que je pouvais disposer aisément de cet argent si je réussissais à le virer sur un compte à l'extérieur du pays.
Le possesseur de ce compte feu Mark Davids, un expatrié,ingenieur en chimie fut directeur de Petrol-Technical Support Services Inc.,il trouva la mort suite à un accident de la circulation. Personne ne sait à ce jour l'existence de ce compte. Ce compte ne possède aucun autre bénéficiaire aussi bien dans sa famille que dans son entreprise. Je voudrais transférer l'argent de ce compte sur un compte fiable à l'étranger mais je ne connais personne à l'extérieur.
C'est ainsi que l'idée m'est venue de vous contacter et de vous faire la proposition de virer cette somme sur votre compte bancaire, pour partage. J'ai conscience que ce message vous surprendra car nous ne nous connaissions pas auparavant, mais soyez sûr que c'est une véritable opportunité qui s'offre a vous et a moi.
Je vous demande de me répondre le plus vite possible pour eventuelle finalisation,tout en sachant compter sur votre dicrétion la plus totale .


Marie-laure Anne BILLARD


Advance Fee Fraud: Mr. Joseph Buma

Received: one fairly ordinary 419 scam, sent from on Mon, 25 Jul 2005 12:35:04 +0000. The plot is the usual one, with real names and a link to a real news story to lend the big lie some credibility. Note also the "" contact address -- very typical for 419s. The IP source address belongs to British Telecom -- one of their ADSL pools, apparently.


My name is Mr. Joseph Buma, I am an auditor in Standard Bank of South Africa . I am contacting you of a business transfer, of a huge sum of money from a deceased account. Though I know that a transaction of this magnitude will make any one apprehensive and worried, but I am assuring you that everything has been well taken care off, and all will be well at the end of the day.
I decided to contact you due to the urgency of this transaction. To ease your apprehension, I got your contact from the British chambers of commerce and industry, foreign trade division.
An account was open by a foreigner named GEORGE BRUMLEY, a citizen of Atlanta, United States of America, who died along with his entire family in a plane crash that took place in Kenya, East Africa.
Please, visit the website below for more information,


Since his death, none of his next-of-kin are alive to make claims for this money as his heir, because they all died in the same accident(May his soul rest in peace). We cannot release the fund from his account unless someone applies for claim as the next-of-kin to the deceased as indicated in our banking guidelines.
Upon this discovery, I now seek your permission to have you stand as a next of kin to the deceased, as all documentations will be carefully worked out by a lawyer for the funds Twenty- five million United States dollars (US$25,000,000.00) in a domiciliary account to be released in your favour as the beneficiary's next of kin.

Because after some years the money will be called back to the bank treasury as unclaimed bills and the money shared amongst the directors of the bank. so it is on this note i decided to seek for whom his name shall be used as the next of kin/beneficiary to this funds rather than allow the bank directors to share this money amongst themselves at the end of the year.
It may interest you to know that we have secured from the probate an order of mandamus to locate any of the deceased beneficiaries.
Please acknowledge receipt of this message in acceptance of our mutual business endeavor by furnishing me with the following information if you are interested.

1.A Beneficiary name;. In order for me to prepare the PAPER WORK for transfer of the funds in your name. And also I want you to come down to South Africa to open a non-resident account for onward transfer to your overseas account, and for us to see face to face.

2. Details, particulars of your contact address.

3. Direct Telephone and fax numbers;. For our personal contact and for the confidentiality of this transactions.

I shall be compensating you with 25% of the total sum on final
conclusion of this project for your assistance, as I have also thought of doling out 5% to charity organisation from your locality based on your recommendation another 5% for the services of the lawyer while the balance 65% shall be for me for investment purposes in your country as I cannot bring back this cash to my country.

If this proposal is acceptable by you, please endeavor to contact me immediately. Do not take undue advantage of the trust I have bestowed in you by informing you of this transaction from my bank as I will advise you to kindly desist from responding at all if you do NOT intend to render any assistance.
Endeavor to respond via this my confidential direct e-mail address

Thanks and best regards,

Mr. Joseph Buma.

Pump and Dump: PSIV

I have no prior instances of this stock in my spam corpus here, and a brief search didn't turn up any instances on the web. Due to the fact that the stock is sub-dollar and trades on the Pink Sheets, this is probably a standard case of pump and dump. Only one instance of the spam has arrived so far, received from on Sun, 24 Jul 2005 05:24:00 -0000. This particular spam uses random excerpts from current news stories as filter-buster, and I'll include that part of the text for reference purposes.


Pacific Sunset Investments Inc.
SHORT-TERM:  $1.00

How many times have you heard about this????
adverse drug reactions accounted for more than 2.2 million serious cases and
over 100,000 deaths,


A study published in the Journal of the American Medical Association
reported that adverse drug reactions accounted for more than 2.2 million
serious cases and over 100,000 deaths, making adverse drug reactions (ADRs)
one of the leading causes of hospitalization and death in the United States.

Breaking News for Pacific Sunset Investments

Pacific Sunset Investments Completes Gen ID Acquisition
HUNTINGTON BEACH, Calif.--(BUSINESS WIRE)--May 20, 2005--Pacific Sunset
Investments, Inc. ("Pacific Sunset") (OTC:PSiV announced that it has
completed its acquisition of Gen-ID Lab Services, LLC, a California limited
liability corporation specializing in Single Nucleotide Polymorphism
analysis data. In addition, the board of directors of Pacific Sunset has
appointed Douglas Freedman to its board of directors with experience in
marketing. Additionally, the company has appointed Dr. Steve N. Slilaty,
Ph.D., to head an Advisory Board to assist the company with reviewing new
alternatives in the "SNP" field of technology.

Gen ID will provide "SNP" (Single Nucleotide Polymorphism) analysis data.
The results of SNP analysis provide physicians with a more enlightened
choice of drugs and they will also be able to predict the effectiveness of
the drugs for individual patients. The use of an SNP test to help treat
childhood leukemia is currently being used by doctors and hospitals in the
United States.

Dr. Steve Slilaty is President and Chief Scientific Officer of Advanomics
Corporation, a leading-edge biotechnology company focusing on the
identification of disease related molecular targets using advanced
transriptomics technologies, which he recently developed. Dr. Slilaty also
is an Adjunct Professor at the Universite du Quebec in the department of
Microbiology and Biotechnology. Dr. Slilaty has founded three biotechnology
companies, Advanomics Corporation, Quantum Biotechnologies Inc. (now known
as Qbiogene Inc.) and Geneomics One Corporation. In addition, Dr. Slilaty is
one of the pioneers of Gene Therapy, having developed the first Gene
Transfer system in 1983.

(This is a partial clip of the news.  We suggest you go read the whole
release.  Our opinion is, this is important technology.  Go to yahoo or any
financial site and read the news)

adverse drug reactions accounted for more than 2.2 million serious cases and
over 100,000 deaths,  Doesn't this say it all?

 A company to watch!

PUT Pacific Sunset Investments Inc. PSiV

them 1700 foreigners from 36 countries So far 
the bodies of just 400 foreigners have been 
identified and repatriated elections Ten suicide bombers also 
are reported to have
died in the attacksThousands of people took to 
the streets in Baghdad and Karbala to commemorate 
the day which marks v the martyrdom of Hussein 
the grandson of the Prophet MohammedThe attacks are v 
the latest examples of 
sectarian violence aimed at Shiites who make up 
the majority in Iraq The Shiitebacked United Iraqi 
Alliance won a plurality of votes in the v 
January 30 national assembly elections but fell short 
of an outright majority Sunni Arabs make up 
a minority that dominated the government under Saddam 
Hussein's regime Many Sunnis boycotted the assembly electionsA 
on a bike rode into a funeral tent 
in the AlBaya'a area 

in southwestern Baghdad and detonated himself Three people 
were killed and 38 woundedIn alKadhimiya in central 
Baghdad an Iraqi police car was attacked by 
a rocketpropelled grenade and 
the US military was called in When the 
American troops were on the scene a suicide 
bomber boarded a bus of pilgrims and detonated 
himself The attack killed a US soldier three 
policemen and a civilian Twentytwo civilians were woundedPolice 
said that in alWaziriya in northern Baghdad three v
people launched suicide attacks One detonated killing an 
Iraqi soldier The second as Unity Day when v v 
insurgents can voluntarily surrender The Baquba blast happened v v 
just 500 yards meters 


Meta: Public Domain

This blog is published anonymously because spammers can be vindictive bastards, and I'd rather not make it easy for them to target me. The kinds of people who write and disseminate viruses, or attempt to steal people's money by lying to them, tend not to shrink from mounting the odd denial-of-service attack or Joe Job against those who would shine a light on their schemes. I've borne the brunt of these retaliatory attacks in the past, and I've no desire to go looking for the experience again. Thus, the relative anonymity of this blog, where I am known by the nondescript handle of "Spotter".

Such anonymous publication creates an interesting problem with regards to copyright. When I decide to retire from the deception spotting and reporting game, the copyright on the posts would still belong to me, but nobody would know how to contact me in order to gain permission to reprint something. The work would effectively be trapped in copyright limbo. My goals in creating this blog are purely altruistic -- or possibly purely hostile because I despise cheating and lying. Whatever the case, I've no intention whatsoever to pursue monetary gain through the publication of this resource. Nor can I expect to gain any personal fame through it without compromising my anonymity. Consequently, I think the whole notion of "copyright" is useless to me in the construction of this blog, and I renounce it.

I hereby waive copyright in all original work I have created in this blog to date. I also waive copyright in future work in this blog, up until such time, if any, as I announce a new copyright policy.


This lottery scam arrived from on Sat, 23 Jul 2005 14:19:11 -0000. Like most of the 419 crud I receive, it was sent directly to the (easily harvested) contact address for this blog. The source address is in Germany, according to WHOIS. One wonders whether Germany will be the next popular 419er locale, now that Spain has put its metaphoric foot down. Of course, the fraudster may not be in Germany at all, since it was sent through yet another webmail system that doesn't show the client source address. I've removed double-spacing from the text below.

We are pleased to inform you of the announcement  today, 20th June  
INTERNATIONAL  PROGRAMS held on 22nd May, 2005. Your email  address 
attached to ticket number  131-45637829487580, drew the lucky numbers 
7-14-75-42-48-80,batch number 6365/UK and  consequently won the lottery in 
the 1st category. You have therefore been approved of a lump sum pay 
file LOTTERY REF NO. BSIL/763276/03. This is from the total prize  
money of  GBP10,000,000.00 shared among the seventeen international  
winners in  categories C with serial number: UK/PLW/12-C8645651234. 
All participants were selected through a computer ballot system  drawn 
form 50,000 company email addresses and 50,000,000  individual email 
addresses from Australia, New Zealand, America,  Europe, North 
America,Africa and Asia as part of  the International  Promotions Program, which 
is conducted annually. CONGRATULATIONS!
Your fund is now in custody of a financial Security company  insured in 
your FILE REFERENCE. Due to the mix up of some numbers and names, we  
ask that you keep this award strictly from public notice until your 
claim has been processed and your money remitted to your account.

This is part of our security protocol to avoid double claiming or  
unscrupulous acts by participants of this program. This lottery  program 
was promoted by our group of philanthropist headed by the United Kindgom 
government. We hope that you will participate in our end of year high  
stakes GBP 10,000,000 million  International Lottery. To begin your 
claim, please contact your file/claim officer:

MR.CURTIS BROWN                                                   

Please be aware that the Paying Authority will Effect Payment  Swiftly 
upon satisfactory Report, Verifications and validation of your winning 
for due processing  and remittance of your winning prize to any 
designated account of  your choice. Remember, all prize money must be claimed 
not later than 14th August 2005. After this date, all funds will be 
returned as unclaimed.

NOTE: In order to avoid unnecessary delays and complications, please 
remember to quote your reference and batch numbers in  every one of your 
correspondences with your agent. You are also expected to send your 
full name and contact address for proper verification and assessement  of 
winnings. Should there be any change of your address, do  inform your 
claim agent as soon as possible.You are required to communicate ONLY 
with your claiming agent.


Monica Johnson(Mrs.)
Lottery Co-ordinator

Mail sent from WebMail service at PHP-Nuke Powered Site

Advance Fee Fraud: Miss Amaria Musa

Received this typical 419 scam from ( on Sat, 23 Jul 2005 02:45:17 -0000. This has been sent through Tiscali's webmail system, and it doesn't give me much of a hint where the fraudster is actually located, so the buck stops with them from my perspective.

Miss F.Amaria Musa.
Angré Start7 Villa 12
Abidjan, Cote d'ivoire.
July 23, 2005.

Dear Sir,


I am Miss Amaria Musa the only daughter of late Alhaji Mohd Musa. My father
and mother were farmers and cocoa merchant when they were both alive. After
the death of my father long ago, my mother was controlling his business
untill she was poisoned by her business associates which she suffered and

Before the death of my mother on October 15th, 2004 in a private hospital
here in Abidjan where she was admitted, she secretly called me on her bed
side and disclosed to me about the sum of Four Million Five hundred thousand
US Dollars(USD$4.5million) she left in suspense account in one of the bank
here in Abidjan, it was the money she intended to transfer oversea for
investment before she was strucked down by the posion.She instructed me that
I should seek for a foreign partner in any country of my choice who will
assist me transfer this money in oversea account where the money will be
save and be invested wisely.Because of the current political faction
problems here in Ivory Coast I decided to transfer the money to abroad where
it will be save and invested.

I am seeking for your kind assistance in the following ways:
(1) To serve as a guardian of this fund since I am a girl of 19 years old.
(2) To provide a safe bank account into where the money will be transferred
for investment.
(3) To make arrangement for me to come over to your country to further my
education and to secure a resident permit for me in your country.Sir if you
can help me,please do contact me on my private email address.As soon as I
receive your urgent reply indicating your interest to assist me to
successfully transfer the money into your nominated account I shall inform
the bank of it so that they can do so.

Yours lovely,
Miss Amaria Musa

Pump and Dump: MWIS

This is an ordinary pump and dump, by the look of the sub-dollar stock being promoted. It's also another of those cases where one spam per recipient just isn't cutting it for the sender, so I received six copies.

IP AddressDate Received, 21 Jul 2005 20:55:35 -0000, 22 Jul 2005 04:48:23 -0000, 22 Jul 2005 05:41:19 -0000, 22 Jul 2005 08:13:40 -0000, 22 Jul 2005 10:19:48 -0000, 22 Jul 2005 11:29:22 -0000

Note that in the above table, the first source is in Charter Communications, USA, the next three are in China, and the last two are in Korea.

Sample text follows. Note that I've included the "forward looking statements" disclaimer block this time, because it is amusing to note that they are resorting to "leet speak" to get around filtering. The whole "forward looking statements" thing is such common boilerplate in pump and dump spam that it makes for very easy filter-fodder. In future, we can look forward to spam with "f0rw4rd lo0k1ng statements" and similar variations instead.

Inv^estor Alert--WE HAVE A RUNNER - STOCK IS UP  0.13 (118.18%) JULY 21st





This is the ONE that good make you 500-700% PROFIT  and we see that it
started already...BIG MOVE TODAY.

NEWS: Smart Global Gets m-Wise to the Benefits of a Bespoke Platform

LONDON,  (PRIMEZONE) -- London-based Smart Global, the UK's first
one-stop-shop for mobile data services targeted at SMEs, today announced its
partnership with m-Wise Inc (OTC BB:MWIS.OB - News). m-Wise, a leading
technology provider in the field of content management and provisioning has
developed a tailored solution to suit Smart Global's offering, which is
delivered in partnership with network operator O2. The m-Wise Platform
enables Smart Global to offer an end-to-end service to mobile subscribers
from online registration and over-the-air delivery of the service directly
to the customer's mobile device, to flexible real-time subscription-based
billing. The system also allows subscribers full access to their account,
allowing them to manage the services, add users and view all related
information. The Platform is connected to more than 10 technology vendors,
as well as to various billing, SMS and MMS providers. In total 12 business
mobile services are offered.

Says Rachel Perry, COO of Smart Global: ``We have spent two years developing
a suite of applications that meet the requirements of small and medium
businesses and believe that by removing the need for expensive,
time-consuming back office installation and IT integration we have presented
the ultimate solution to the market.

 Last time we issued a Inv^estor Alert and watched it climb from $2.00 to
  $8.00 faster than you can count the ways to spend your money.
  Now MWIS is on the on the move.

Inf0rmation within this em4il c0ntains "f0rw4rd lo0k1ng statements" within
the meaning of Section 27A of the Securities Act of 1933 and Section 21B of
the Securit13s Exchange Act of 1934. Any st4tements that express or involve
discussions with respect to predictions, expectations, beliefs, plans,
projections, objectives, goals, assumptions or future events or performance
are not statements of historical fact and may be "f0rw4rd l00k1ng
statements."F0rw4rd l0ok1ng st4tem3nts are based on exp3ctations, estimates
and projections at the time the statements are made that involve a number of
risks and uncertainties which could cause actual results or events to differ
materially from those presently anticipated. F0rward l00k1ng st4tem3nts in
this action may be identified through the use of words such as "projects",
"foresee", "expects", "will," "anticipates," "estimates," "believes,"
"understands" or that by statements indicating certain actions "may,"
"could," or "might" occur. As with many micr0c4p st0cks, today's company has
additional risk factors that raise doubt about its ability to continue as a
going concern. Today's featured company is not a reporting company
registered under the S3cur1ties Act of 1934 and hence there is limited
information available about the company. Other factors include an
accumulated deficit since its inception, a negative net worth, nominal cash,
an auditor's going concern opinion and no revenues in its most recent
quarter.It is not currently an operating company and has not had business
operations in over seven years. The company is going to need financing. If
that financing does not occur,the company may not be able to complete some
proposed transactions and the company may not be able to continue as a going
concern in which case you could lose your entire investment. Other risks and
uncertainties include, but are not limited to, the ability of the Company to
complete its business plan,reliance on key personnel, market conditions, the
general acceptance of the Company's products and technologies, competitive
factors, timing, and other risks associated with their business. The
publisher of this news letter does not represent that the information
contained in this message states all material facts or does not omit a
material fact necessary to make the statements therein not misleading.All
information provided within this email pertaining to investing, st0cks,
securities must be understood as information provided and not in-v3stment
advice. The publisher of this newsletter advises all readers and subscribers
to seek advice from a registered professional securities representative
before deciding to trade in stocks featured within this email. None of the
material within this report shall be construed as any kind of investment
advice or solicitation.Many of these companies are on the verge of
bankruptcy. You can lose all your money by investing in this stock. The
publisher of this newsletter is not a reg1ster3d in-vestm3nt advis0r.
Subscribers should not view information herein as legal, tax, accounting or
investment advice. Any reference to past performance(s) of companies are
specially selected to be referenced based on the favorable performance of
these companies. You would need perfect timing to acheive the results in the
examples given. There can be no assurance of that happening. Remember, as
always, past performance is never indicative of future results and a
thorough due diligence effort, including a review of a company's filings
when available, should be completed prior to in vesting. We have no
relationship, directly or indirectly, with ntrz, hisc or afvs. In compliance
with the Securities Act of 1933, Section17(b), The publisher of this
newsletter is contracted to receive fifteen thousand d0llars
from a third party, not an officer, director or affiliate shareholder for
the circulation of this report. Be aware of an inherent conflict of interest
resulting from such compensation due to the fact that this is a paid
advertisement and is not without bias.The party that paid us has a position
in the stock they will sell at anytime without notice. This could have a
negative impact on the price of the stock, causing you to lose money. All
factual information in this report was gathered from public sources,
including but not limited to Company Websites and Company Press Releases.
The publisher of this newsletter believes this information to be reliable
but can make no guarantee as to its accuracy or completeness. Use of the
material within this email constitutes your acceptance of these terms.


News: Spain nicks a load of 419ers

A while ago, I was complaining about Spain being such a ripe source of 419 fraud, particularly of the "you won a lottery" variety. Well, it appears that the local authorities have closed the net on them at last. According to an article in The Register entititled "Biggest 419 bust in history", a total of three hundred and ten people in Malaga, Spain, have been arrested in connection with this fraudulent activity. Here's hoping that justice is served.

Pump and Dump: CDGT again

Our old friend CDGT is back again. Three instances: from on Thu, 21 Jul 2005 06:13:38 -0000; from on Thu, 21 Jul 2005 07:39:34 -0000; and from on Wed, 20 Jul 2005 21:04:24 -0000. Full text of one follows -- all three appeared identical at a glance.



Timing  is everything!!! 

Profits of 200-400% EXPECTED TRADING 

SYMB0L:         CDGT.OB 
Opening Price:  3.20 

Yes, it is MOVING, Thursday could be even BIGGER!!! 

10 Day Target: $7-$8 

News Alert! 

Press Release Source: China Digital Media Corporation 

China Digital Media Corporation Announces an Acquisition of a Media and 
Advertising Agent in China 

HONG KONG, July 13 /Xinhua-PRNewswire/ -- China Digital Media 
("Digimedia") (OTC:CDGT.OB; OTC Bulletin Board: CDGT.OB) with its 
(together the "Group") announced today that the Group signed a Shares 
Transfer Agreement (the "Agreement") to acquire an advertising sales 
agent, Guangdong M-Rider Media Company Limited ("Guangdong M-Rider"), a limited 
company registered in Guangdong in the Peoples Republic of China.  The 
principal operating activities of Guangdong M-Rider are in design, 
production and distribution of advertisements through television 
channels. Guangdong M-Rider is one of the top five reputed advertising agents in 
the Guangdong province and is currently a sole advertising distributor for a 
number of television channels in Guangdong Province and in Guangzhou city. 
Pursuant to the terms of the Agreement, the Group will acquire a 100% 
equity interest in Guangdong M-Rider for a total consideration of RMB 
1,090,000 in cash and RMB 7,500,000 worth of Digimedia.s restricted 
common shares. The management of Guangdong M-Rider in the Agreement warrants 
that the net operating cash inflow in the first year will not be less than 
RMB 10,000,000. 

CDGT.OB is expecting to make an acquisition, once this announcement 
comes out the street should give applause in the form of upward movement
 in the ST0CK price. The ST0CK could trade around $6-$8 per share on this
 type of news. 
GET IN NOW!!! You know the old saying, buy on the rumor and sell on the 
news. Once the news is out it is time to get ready for next valley. 

A $1,000 dollar investment could yield a $5,000 dollar profit in 
just one trade if you trade out at the top. CDGT.OB should be one of the 
most profitable ST0CKs to trade this year. In this range the ST0CK has 
potential to move in either direction in bigs wings. This means you 
should be able to buy at the lows and sell at the highs for months to 


CDGT.OB is also on The REG SHO Threshold list, This means someone is 
short the ST0CK. Any significant volume spike in CHMS could yield drastic
 results. If the people that are short have to cover, they will be buying the 
shares from you at higher prices. This makes this ST0CK a TRIPLE PLAY for 

For pennies you can participate in a ST0CK that could yield results over 
and over again just based on the trading patterns if the company is 
able to effectuate it's business model. 



Pump and Dump: WSMI

Pump and dump seems to be where it's at this month. This is the first occasion on which I've seen WSMI (since starting the blog, at least, and I don't recall seeing it prior to that). Also of note is the fact that only one instance of the spam arrived, as opposed to some of the other recent spams which have been arriving in groups of half a dozen, give or take a couple. This one arrived from on Thu, 21 Jul 2005 15:58:06 +0000.

Inv^estor Alert Newsletter - June Issue 2005


In July's issue we are going to profile a ST+0CK that has just started trading and which would be huge winner in the near future.
JUST STARTED TRADING ground floor opportunity!

WSMI - Just announced Breaking news!!! Wisdom International Announces ST+0CK Trading and Subsidiary Growth

Quote from News "Wisdom International has experienced quarter over quarter growth in its insurance operation,
International Re-Insurance, a wholly owned subsidiary of Wisdom International has achieved slightly over one hundred
and fifty percent net profit increase in the second quarter of 2005 over the corresponding quarter of 2004, and just over one hundred percent increase from the first quarter of 2005. "

ST+0CK Symbol: WSMI (Wisdom International, Inc. )

The ST+0CK is trading at only $1.1 and we expect it could hit $2.75 - $3 by early August July.
Our Last Profile GBIC went from 80 cents to $3

HUGE PR campaign expected this week so grab as much as you can up to $2.10 range

ST+0CK Symbol: WSMI
Current Price: $1.10
We expect the price to go to $2.65 in next 2-3 days
We expect the price to go to $3 in next 2 weeks.

Big news released: Wisdom International Announces ST+0CK Trading and Subsidiary Growth

There are some very positive news expected next week so act before that :)

About the company:

Wisdom International Corporation is a diversified holding company. Wisdom's reinsurance activities are conducted through its subsidiary, International Reinsurance Company, Ltd,
with offices in Nevis, West Indies, Norwich, England and Dallas, Texas.
Wisdom Global Mining conducts mining operations of organic agricultural, and health related products.
Additionally, Wisdom International Corp. owns a real estate development company, Tamarack Development


ST+0CK Symbol: WSMI
Current Price: $1.10
We expect the price to go to $2.65 in next 2-3 days
We expect the price to go to $3 in next 2 weeks.


Typical "forward looking statements" disclaimer present, but not quoted.


Pump and Dump: UAIG

This one arrived in an unorthodox manner: as a bounce message. The spammer in question used one of my addresses as a return address. The original message was sent to a bunch of names at, but the mail server there accepted then later bounced the message, complete with original text. According to the bouncing server, "the original message was received at Thu, 21 Jul 2005 08:14:21 +0200 from []". Accept-and-bounce is a bad practice, precisely because spammers and other miscreants routinely use false sender addresses, so the bounce winds up littering the inbox of an unrelated third party.

                                      ...BREAKING NEWS OUT...
                                STRONG BUY ISSUED JULY 17 AT MARKET CLOSE
        Make sure you keep your eyes glued on UAiG starting TUESDAY.
        UA International Group,
        CURRENT PRICE: .70
        Major financial news was released
        UA International Signs Agreement with Ukrauto Concern
        Thursday July 14, 5:00 pm ET
        KIEV, Ukraine--(BUSINESS WIRE)--July 14, 2005--UA International Group, Ltd.
        (Pink Sheets:UAIG - News), a Ukrainian water and electrical infrastructure,
        delivery and real estate development company, today announced that it has
        entered into an agreement with Ukrauto Concern, a Ukrainian company that
        maintains the distribution rights to import and sell automobiles from the
        Korean automobile manufacturer, Daewoo, the Japanese Nissan, and the USA
        based General Motors brand, Chevrolet. UA International Group will provide
        heat and electricity to Ukrauto Concern.
        Vitaly Zhygun, President of UA International Group, Ltd. commented: "We are
        pleased to continue winning bids to supply crucial infrastructure
        development and services to commercial businesses in Ukraine. Ukrauto
        Concern is a major importer of automobiles to Ukraine, and we are pleased
        that they have chosen UA International Group subsidiary Kyivenergomash as a
        key supplier of their electrical infrastructure and energy needs."
        About UA International Group: Based in Kiev, Ukraine, UA International Group
        is a water and electricity infrastructure, delivery and real estate
        development company. Management believes that the Company is well positioned
        to show significant growth in sales and profits in the months and years
        ahead. Specializing in water treatment, delivery, filtration, drilling,
        sewage and electrical infrastructure, delivery and maintenance, UAIG is in
        position to become the prime service company in Ukraine.
        Americans have watched the real-estate market go absolutely bonkers.  Some
        worry that it might come to an end real soon.  While some of you are still
        thinking, others are taking their monies where they think the same sort of
        boom is just beginning.

Standard "forward looking statements" disclaimer not quoted.

Pump and Dump: Various

There's a lot of pump and dump about at the moment. Here's a roundup of recent arrivals, some of them regulars, some of them new.

StockIP AddressDate Received
PGCN62.193.112.114Tue, 12 Jul 2005 13:13:44 +0000
NTMT70.92.237.31Wed, 13 Jul 2005 03:37:17 +0000
CWTD83.23.34.232Fri, 15 Jul 2005 12:03:00 +0000
CDGT212.159.29.186Mon, 18 Jul 2005 14:29:49 +0000
CWTD218.145.104.177Wed, 20 Jul 2005 04:07:23 -0000
CWTD61.100.111.31Wed, 20 Jul 2005 07:39:48 -0000
CDGT81.192.38.248Wed, 20 Jul 2005 11:25:05 +0000

I'm not going to bother with the text of any of these, since they are all much of a muchness. They were all plain text except for the two most recent CWTD spams, which were HTML and distinguished by arriving at a different account. I'm pleased to announce that this clears my backlog of spam. Yay! Regular service will now resume.

Spam: Tayana

I'm really not quite sure how to categorise this one, but it's funny, so I want to share it.

Hello my hope!
I am not sure you get this message but if you got I want you to know
that I want to travel to your country to work in two weeks and I just
want to meet right man.I live in Russia and my goal is to leave this
country because it is impossible to live here for young pretty woman.
if you have not wife or girlfriend ,maybe we could try to meet?
I am  Tayana ,I am  25 years old ,please write to me directly
to my mail -    See you soon!!!!

This text was followed by several lines of random words in an obvious attempt to foil spam filters. So how about it, chaps? Want a "young pretty" Russian woman easily? Bwahahahaha! Yeah, right! Spam arrived from (in Venezuela!) on Wed, 20 Jul 2005 22:44:12 +0000. I'm not sure what particular kind of hook this bait is concealing, and I'm not going to contact "Tayana" to find out. I'm guessing advance fee fraud or identity theft.


Advance Fee Fraud: Josh Patrick

I've decided to delete without comment a large number of lottery wins and 419 fraud spams just so I can catch up after my recent break. Sorry world, but I can't report every single deceptive spam out there. Anyway, this one is relatively fresh: received from ( on Mon, 18 Jul 2005 15:33:18 +0000, the headers suggest it was injected into the mail system via a webmail system, which is typical modus operandi for a 419er.

I am Josh Patrick I got your contact through a friend who attended a trade
mission in your country, but I did not disclose the nature of the business
to him.I have urgent and very confidential business proposal for you. 
 On June 6, 1999, an America Oilconsultant/contractor, MMr.Charles Ballass
with MICOP PETROLEUM COMPANY, made a numbered time (fixed) deposit for twelve
calendar months, valued at US$20,700,000.00(Twenty Million Seven Hundred
Thousand Dollars )in my branch upon maturity. I sent a rountine notification
to his forwarding address but got no reply.After a month,we sent a reminder
and finally we discovered from his contract employers,the MICOP PETROLEUM
COMPANY that he died in the plane crash of 31 October 1999[with Egyptian
99 0] with other passengers aboaed as you can confirm it yourself via
the website below: 
on further investigation, i found out that he died without making a WILL,and
attempts to trace his next of kin was fruitless. 
I therefore made further investigation anddiscovered that Mr.
Charles Ballassi did not declare any next of kin or relations in all his
official documents, including his bank deposit paperwork in my bank. This
sum of US$20,700,000.00 is still in my bank and the interest isbeing rolled
over with the pricipal sum at the end of each year. No one will ever come
forward to claim it. 
 According to Government law, at the expiration of five)years, the money
will revert to the ownership of the  Government if nobody applies to claim
the fund. Consequently,my proposal is that i will like you as
 a foreigner to stand as the next of kin to Mr.Charles Ballassi so that the
fruit of this old man's labour will not get into the hands of some corrupt
Government officials. This is simple,I will like you to provide immediately
your full name and address so that the Attorney will prepare the necessary
documents and affidavits which will put you in place as the next of kin.

We shall employ the service of two attorney for the drafting and notarization
of the WILL and obtain the necessary documents and letter of probate/administration
in your favour for the transfer. 

Any bank account in any part of the world which you will provide will then
facilitate the transfer of this money to you as the beneficiary/next of kin.
The money will be paid into your account for us to share in ratio of 75%
for me and 25% for you. There
is no risk at all, the paperwork for this transaction will be done by the
attorney and my position as the Branch Manager guarantees the successful
execution of ths transac tion. If you are interested,please reply immediately
via the private email address below,upon your responce,i shall provide you
with more details and relevant documents that will help you understand the

 Please observe utmost confidentiality and be rest assured that this transaction
would be most profitable for both of us because i shall require your assitance
to invest my share in your country. 

Please upon the reciept of this mail message, send to me the following,to
enable start the process of the fund into your bank
1. Your full Name
2. Your private Telephone and fax numbers.
3 Your Addresses. 

Immediately I recieve a mail indicating your
interest I shall send you
more details. 

Thanks and regards,
Josh Patrick

Pump and Dump: CYTGF

This isn't the first time I've reported CYTGF spam, but there's more of it this time. Originating at many sources, and having HTML and plain text variants, these look strikingly similar to the CDGT spams. All were addressed to "account X". CYTGF is a sub-dollar stock, which suggests that the activity is traditional pump and dump.

The following is representative of the plain text variant, minus the "forward looking statements" disclaimer, which is a waste of electrons.

Harold Globe Daily Issues Major Alert:

Better get in before you miss another one
12 month target 4.75
7-Day Price Target: $1.00
30-Day Price Target: $2.00
12 month target 4.75
Shares Outstanding: 5.0 Million
Market Capitalization: $2.25 Million
52 Week Range: 0.18 - 0.65


We are going to profile a stock that is very much undervalued and has just
started trading. Ground Floor opportunity for everybody.

Crystal Graphite Corporation: B.C. Construction Boom Driving Force in
Increased Canada Pumice Sales

   VANCOUVER, British Columbia--(BUSINESS WIRE)----Crystal Graphite
Corporation ("CGC") (CNQ: CYTG) (OTCBB: CYTGF - News) announces Canada
Pumice Corporation ("CPC") sales have increased 44.3% compared to this
period last year. Significant interest in the Construction Aggregate,
Tephralite(TM) along with the horticulture, landscape and retail bagged
products is contributing to the increasing new business and growth. The
British Columbia construction boom is the driving force in the interest in
Canada Pumice Construction Aggregate with several tender quotes for large
projects in Western Canada which includes quoting the largest construction
job to date.

  Reasons to look at Crystal Graphite Corporation:


And, tedious though it is to tidy up slack spammer HTML, here is a representative sample of the HTML variant.

Hot Stock Newsletter

Issue: 1007553
July 2005
Crystal Graphite Corporation
Undervalued Special Situation
Symbol: CYTGF
52 Week Range 0.18 - 0.65
Shares Float: 25,000,000
Current Price: .23
12 Mo.Target Price $2.80
 Buy Level Very Strong

Breaking News Flash!

Big News Expected Monday July 19th
Value should climb quickly!

Crystal Graphite Corporation: B.C. Construction Boom Driving Force in Increased Canada Pumice Sales

VANCOUVER, British Columbia--(BUSINESS WIRE)--June 1, 2005--Crystal Graphite Corporation ("CGC") (CNQ: CYTG) (OTCBB: CYTGF - News) announces Canada Pumice Corporation ("CPC") sales have increased 44.3% compared to this period last year. Significant interest in the Construction Aggregate, Tephralite(TM) along with the horticulture, landscape and retail bagged products is contributing to the increasing new business and growth. The British Columbia construction boom is the driving force in the interest in Canada Pumice Construction Aggregate with several tender quotes for large projects in Western Canada which includes quoting the largest construction job to date.

Crystal Graphite Corporation is an industrial mineral company operating the Black Crystal Project near Nelson, BC producing high purity flake graphite and its wholly owned subsidiary Canada Pumice Corporation which produces volcanic rock material including pumice and scoria at its Nazko Cone quarry near Quesnel, BC. CGC has established an office in Bejing, Peoples Republic of China and has a Registration Certificate of Foreign Enterprises Permanent Office in China from the State Administration for Industry and Commerce of the Peoples' Republic of China which allows CGC to conduct business in China to enable it overall marketing of graphite and conduct its due diligence process on the Desheng Flake Graphite Project.

CYTGF is getting ready to EXPLODE. We recommend this as a VERY strong buy.


The sources of the spams are, so far, as follows.

IP AddressDate ReceivedVariant, 17 Jul 2005 04:17:27 -0000plain, 17 Jul 2005 07:01:42 -0000plain, 18 Jul 2005 06:11:27 -0000plain, 18 Jul 2005 08:03:34 -0000plain, 18 Jul 2005 16:55:51 -0000HTML, 19 Jul 2005 14:16:38 -0000HTML


Pump and Dump: NHVP

This isn't the first time we've seen spam pumping NHVP. The sub-dollar value of the stock suggests that this is classic pump and dump activity. I couldn't say whether this spam originates with the same spammer as some of the other stock spam, but one aspect of the technique is similar: the shotgun approach. It's been characteristic of a number of recent spams that they arrive in large numbers. Presumably the spammer is working on the basis of "the more I send, the more likely that at least some of them will get through." This may also explain the variance in content -- some HTML, some plain text. In any case, here's the list of source IP addresses and arrival times for the recent blast of NHVP, followed by a characteristic sample of the text.

IP AddressDate Received, 16 Jul 2005 06:37:21 -0000, 16 Jul 2005 08:44:32 -0000, 16 Jul 2005 10:40:06 -0000, 16 Jul 2005 16:16:03 -0000, 17 Jul 2005 05:51:05 -0000, 17 Jul 2005 10:54:48 -0000, 17 Jul 2005 20:10:19 -0000

Note the preponderance of addresses starting with "222". They are all part of "Chinanet" (in China, of course). The "60" address belongs to "Beijing Teletron Telecom Engineering", also in China. The other two addresses are a Comcast address, and a Charter address, both broadband providers in the USA. You can see why some people might want to block Chinanet or China as a whole.

Investor Alert Newsletter - July Issue 2005


In June's issue we are going to profile a stock that is very much undervalued and has just started trading. Ground Floor opportunity for everybody.

GroundBreaking News Released: NHVP Entering into Joint Venture Agreement for Laser Marking Facility

This small treasure is: NHVP - Northeast Development Corp.

The stock is trading at only 20 cents and we expect it could hit $1.20 by mid July.

HUGE PR campaign expected this week so grab as much as you can up to $1 range

Stock Symbol: NHVP
Current Price: $0.25
We expect the price to go to $1 in next 2-3 days
We expect the price to go to $1.2 in next 2 weeks.

There are some very positive news expected next week so act before that :)

About the company:

Northeast Development Corporation (NSC) is a real estate construction, development, acquisition and management company focused in the Northeastern United States. It currently does business around Hartford CT. Its' primary objective is to build long-term shareholder value in secondary and tertiary markets that are in exurban growth paths.Northeast Development Corporation (the "Company", unless the context indicates otherwise) is engaged in the construction business. The Company was incorporated in 2004 as a successor to businesses, which had been engaged in providing construction services since 2003 formerly through an operating subsidiary of Rescon Technology, Inc. The Company currently provides general contracting, construction management and design-build services to private clients and public agencies throughout the Northeast United States. It has a limited operating history, but strong developmental ties into its' target geographic markets. To date, it has primarily completed civil works projects in the Northeast US. The Company's construction business will involve two basic segments or operations: building and commercial development; and civil works projects.


Stock Symbol: NHVP
Current Price: $0.20
We expect the price to go to $1 in next 2-3 days
We expect the price to go to $1.2 in next 2 weeks.

News: PHILADELPHIA, Jul 12, 2005 (BUSINESS WIRE) -- Northeast Development Corp., (Pink Sheets: NHVP), announced today that as a further step in the acquisition of a laser engraving and marking facility in Central Europe a preliminary agreement has been reached for a joint venture laser marking plant based in Switzerland.

This completely new facility will include both design and marketing functions to provide fully independent operation as well as development of new market segments.

Northeast Development Corp. and their counterparts in this agreement are confident that a Swiss based, independent and highly qualified operation will satisfy the demands of a highly developed and quality conscious Swiss industry. Specialised markets can be developed in situ with the close cooperation of industry clients. Direct access by the client to a skilled local specialist, as this joint venture is designed to be, will ensure long-term and loyal clientele since the client base will be mainly within small and medium sized, often family controlled businesses, which still make up a major part of the Swiss industrial environment.

______readitbeforeyou proceed

Information within this email contains "forward looking statements" within the meaning of Section 27A of the Securities Act of 1933 and Section 21B of the Securities Exchange Act of 1934. Any statements that express or involve discussions with respect to predictions, goals, expectations, beliefs, plans, projections, objectives, assumptions or future events or performance are not statements of historical fact and may be "forward looking statements." Forward looking statements are based on expectations, estimates and projections at the time the statements are made that involve a number of risks and uncertainties which could cause actual results or events to differ materially from those presently anticipated. Forward looking statements in this action may be identified through the use of words such as: "projects", "foresee", "expects", "estimates," "believes," "understands" "will," "part of: "anticipates," or that by statements indicating certain actions "may," "could," or "might" occur. All information provided within this email pertaining to investing, stocks, securities must be understood as information provided and not investment advice. Emerging Equity Alert advises all readers and subscribers to seek advice from a registered professional securities representative before deciding to trade in stocks featured within this email. None of the material within this report shall be construed as any kind of investment advice. Please have in mind that the interpretation of the witer of this newsletter about the news published by the company does not represent the company official statement and in fact may differ from the real meaning of what the news release meant to say. Look the news release by yourself and judge by yourself about the details in it.

In compliance with Section 17(b), we disclose the holding of NHVP shares prior to the publication of this report. Be aware of an inherent conflict of interest resulting from such holdings due to our intent to profit from the liquidation of these shares. Shares may be sold at any time, even after positive statements have been made regarding the above company. Since we own shares, there is an inherent conflict of interest in our statements and opinions. Readers of this publication are cautioned not to place undue reliance on forward-looking statements, which are based on certain assumptions and expectations involving various risks and uncertainties, that could cause results to differ materially from those set forth in the forward- looking statements.

Please be advised that nothing within this email shall constitute a solicitation or an invitation to get position in or sell any security mentioned herein. This newsletter is neither a registered investment advisor nor affiliated with any broker or dealer. This newsletter was paid $51500 from third party (MayaConsulthing) to send this report. All statements made are our express opinion only and should be treated as such. We may own, take position and sell any securities mentioned at any time. This report includes forward-looking statements within the meaning of The Private Securities Litigation Reform Act of 1995. These statements may include terms as "expect", "believe", "may", "will", "move","undervalued" , "speculative target price" and "intend" or similar terms.


Pump and Dump: CDGT as usual

Ho hum, I say. Will the CDGT spam never end? Here are the latest sightings, accumulated in my spam backlog over the last week or thereabouts. Possibly the most interesting thing about the CDGT spam is the sheer diversity. Not many spams wind up hitting more than one of my accounts in more than one form. CDGT spam appears to be originating at more than one source.

The following is an HTML spam received at "account X". Two instances were received, from on Thu, 14 Jul 2005 01:17:56 -0000, and from on Thu, 14 Jul 2005 16:22:07 -0000.


Issue: 115228
JULY 2005
China Digital Media Corporation
Rapid Growth Alert
Symbol: CDGT
52 Week Range 0.20 - 11.00
Shares Float: 25,000,000
Current Cost: $3.50
12 Mo.Target Cost $16.00
 Growth Rating High

Breaking News Alerts!

Big News Expected Out Wednesday
July 13th

PR Newswire (Wed 8:00am)
China Digital Media Corporation Announces an Acquisition of a Media And Advertising Agent in China

HONG KONG, July 13 /Xinhua-PRNewswire-FirstCall/ -- China Digital Media Corporation (''Digimedia'') (OTC: CDGT - News; OTC Bulletin Board: CDGT - News) with its subsidiaries (together the ''Group'') announced today that the Group signed a Shares Transfer Agreement (the ''Agreement'') to acquire an advertising sales agent, Guangdong M-Rider Media Company Limited (''Guangdong M-Rider''), a limited company registered in Guangdong in the Peoples Republic of China. The principal operating activities of Guangdong M-Rider are in design, production and distribution of advertisements through television channels. Guangdong M-Rider is one of the top five reputed advertising agents in the Guangdong province and is currently a sole advertising distributor for a number of television channels in Guangdong Province and in Guangzhou city.

China Digital Media Corporation (OTC Bulletin Board: CDGT - News) focuses its business in three main areas: Cable TV Operations, Programs Production and Advertising Sales. Arcotect Technology (GZ) Limited, a wholly owned subsidiary of CDGT in China, is the sole contractor and operator of digital television services in Nanhai, a city with 400,000 cable TV subscribers. The service could offer more than 800 digital channels of pay TV programs and value added multimedia services. The Group is seeking to establish similar model elsewhere in China. The Group entered into the strategic alliance with Guangdong HuaGuang Digimedia Culture .

About Guangdong M-Rider Media Company Limited

Guangdong M-Rider is a limited company registered in Guangdong in the Peoples Republic of China with a registered capital of RMB5,000,000. The principal operating activities are in design, production and distribution of advertisement through television channels in which the company is currently a sole advertising distributor for a number of television channels in Guangdong Province and in Guangzhou city. The management of Guangdong M-Rider has over ten years operating experience in the advertising industry in which they have built a valuable business relationship with over 100 international and domestic advertising agencies, renowned international and domestic clients, and television channels operators. They are one of the top five reputed advertising agents in Guangdong Province.

Certain information contained in these materials is "forward-looking" information, such as projections, estimates, pro formas, or statements of intentions, expectations or plans. All forward-looking information is subject to known and unknown risks and uncertainties, many of which are outside of the control of the company. Consequently, actual results may, and probably will, differ materially from the results contemplated in such forward-looking information

CDGT is getting ready to break out. We recommend this as a VERY strong buy.


Next up are two substantially similar plain-text spams. What follows is the substantially similar part of both. They then diverge into different "press releases". One was send to "address X", received from on Thu, 14 Jul 2005 15:08:18 -0000; the other sent to my "legacy" address, received from on Wed, 13 Jul 2005 17:08:38 +0000.


(Ticker: CDGT)
Price: $3.10
5-Day Target: $6
10-Day Target: $9

CDGT is climbing again and we have seen them rocket

Last time we issued a stock watch and watched it climb from $2.00 to
$8.00 faster than you can count the ways to spend your money.
Now CDGT is on the on the move again. With big news to come out.
climbing again from $2.60 and has already reached $3.10 before we =
could even get this alert to you.

Whatever you do WATCH CDGT....


Lastly, another one sent to the "legacy" address. Similar in form to the immediately prior spams, this one also has a recommendation followed by a press release (and then one of those enormous and quite ridiculous "forward looking statements" disclaimers). I include only the "recommendation" part here. It was received from on Sun, 17 Jul 2005 23:28:22 +0000.




Good day to all broker's, Day Trader's and Investor's  World stock report
has become famous with some great stock picks in the otc , small cap
market's!!! Here at World Stock Report we work on what we here from
the street. Rumor's circulating and keeping the focus on the company's
news. We pick our companies based on there growth potential. We focus on
stocks that have great potential to move up in price!!! While giving
you liquitity.





Pump and Dump: EDEX

First appearing in my recent stock spam round-up, EDEX has reappeared with another shotgun-blast of spam. (This is slightly old news, because I'm still clearing a backlog.) Given the stock prices involved, it looks like classic pump and dump. There is a little variation between the spams, but the following sample is typical.

Watch Alert for Tomorrow  JULY 12, 2005


Current Price:  .20

We Expect This To Fly:
World demand for oil is off the charts.


Eldorado Exploration Oil Well
Monday July 11, 4:00 pm ET

IRVINE, Calif.--(BUSINESS WIRE)--July 11, 2005--Eldorado Exploration (Pink
Sheets:EDEX - announced today that its Eastland County Texas wildcat has
multiple zones indicated by logs to have potential oil production. Casing
has been set and the well is waiting a completion rig for further testing.
The well, located on the western edge of the Ft. Worth Basin, was found
using Passive Induced Polarization, passive reflection seismology and
radiometric geophysics along with supportive subsurface geology from other
wells in the area. Several other prospects have been found by the company in
the surrounding area and a leasing program is under way. (partial clip of
the news release)

World demand for oil is off the charts..........

"We are proud of our company and will strive to make it a leader, not a

WE think that says it all and from a man that should know,

The CEO of the company!

Seven instances were received in rapid succession. I'm not going to bother with reverse lookups or WHOIS data for these, since it rarely proves interesting. All were received at "address X".

IP AddressDate Received, 12 Jul 2005 00:41:23 -0000, 12 Jul 2005 04:19:38 -0000, 12 Jul 2005 04:31:16 -0000, 12 Jul 2005 06:51:35 -0000, 12 Jul 2005 11:05:02 -0000, 12 Jul 2005 12:38:49 -0000, 12 Jul 2005 17:33:15 -0000


Job Scam:

I haven't finished clearing out my backlog of spam yet, but job scams get priority over lesser junk like 419 scams and fake lottery wins. This spam was received from ( on Wed, 13 Jul 2005 18:46:54 +0000.


If you are looking for a job in USA  then go right ahead.
You have an opportunity join one of the most successful and fastest growing companie in the world.

SHIP AND PAY INT. is a European company looking for responsible, honest and motivated 
people in USA  to be company customer service managers in your  region.
Great job opportunity working for a great company.You can earn up to $3000-7000 depending on time 
you will spend for this job.

Job Requirements: 
-No specific business experience is required for this business.
-Be able to check your email several times a day .
-Be able to respond to emails immediately. 
-Be responsible and hard working .
-You have to be honest and  independable.
-You should be aged between 21 and 67.
-Male or female
-You should be a resident of a country where you reside.
-You should have internet access.
-You should have phone number.
-About 5-8 hours per week  to dedicate towards the job
-You do not need any capital to start.

You can earn up to $3000-7000 depending on time you will spend for this job. 

Our proposal  oriented to  the:
-unemployed people, 
-people having activity,  
-young mums,
-peoples who would like to earn extra money,
-people who seeking a rewarding second income.


- Spending more time with family and friends.
- Living wherever YOU want.
- Never setting an alarm clock.
- Taking vacations when YOU choose.
- Saying goodbye to that terrible boss.
- Not driving to work in a blizzard. 
- Having more time to play and exercise.
- Investing in your kids' education.
- You don't need to send spam to anyone. All you 
  need is a computer connected to the Internet,   
  phone and free time.
- DOES NOT Require investment.
- You will have a real work.

We look forward in working with you.
Yours Faithfully,
Legal Address:
Ship & Pay International
7760 France Avenue South
Minneapolis, MN 55435
United States

Headquarter Address:
Ship & Pay International
46 Nevskiy Prospekt
191025 St. Petersburg
Russian Federation

Phone:+ 1 (612) 435 33 84
Fax:+ 1 (612) 395 55 24
The information contained in this e-mail message is confidential, may
be legally privileged, and is intended for use only by the individual(s)
named above. If you are not the intended recipient of this message, you 
must not copy, forward, disclose or otherwise use it, or any part of
it, in any way whatsoever. If you have received this message in error, 
please notify the sender immediately by return e-mail and delete the
message and any attachments from your system. Thank you

I've included the "confidentiality notice" footer for ironic effect. To be honest, I'm not 100% sure what this one is about, but I'll wager that it's just the classic "work at home" scam. If I'm right, then getting involved in this means no more than setting up your own website, just like the "ship and pay" one, and then selling others on the opportunity to work at home. The only thing being shipped around and paid for are "starter kits" on how to work at home. It's a real loser's game. As evidence for this hypothesis, I point you to a Google search on a key phrase from their website. Ask yourself -- why are there so many nearly-identical sites offering "everything you need to receive mail from overseas?" Dude, to receive mail from overseas, all you need is a postal address! Then, if you feel like a laugh, check out any one of the set of near-identical pages found by this Google search, which is tuned to the meaningless bundle of buzzwords on their "services" page. They don't actually offer any real services, but they are highly buzzword compliant about it!

In a more helpful vein, here's a link to the (USA) Federal Trade Commission's "Work-at-Home Schemes" warning page.


Info: New Phishing Threat

I'd like to provide you with an executive summary of a new phishing threat that has been put forth in an article fom Earlier this year, a database of customer information at a payment processing facility was compromised. This is bad news, in and of itself, since it means that the culprits have obtained credit card numbers and the address information of the holders. But although the culprits have, no doubt, used the information to their own benefit in a direct manner, they are also phishing for further data. The author of the linked article puzzles as to what kind of information they could want, given that so much information was already compromised in the original breach. His hypothesis: they want Social Security Numbers, since this is the missing piece of the puzzle, and would enable outright identity theft.

In practice, the phishing threat discussed here will come in the form of an email message from your bank, containing a warning about your credit card, and will include a persuasive amount of detail, including your credit card number! This is because these details have already fallen into the hands of the enemy. The message will then, in the usual manner, coax you to follow a link to their website, where you can allegedly "reactivate" your account. This is where they will ask you to provide your SSN as a "security measure". If you divulge this information, you not only demonstrate that your other details are true and correct, but you provide them with enough information to obtain credit in your name, thus landing you in bad credit hell.

If you receive such an email, I recommend that you notify your financial institution immediately, using a medium other than the Internet to do so.


Pump and Dump: Recent Activity

I'm still catching up on my backlog after taking time off for other projects. Today's catch-up concentrates on the stock fraud spam -- and there's been quite a bit of it. There are two ways I could group these: either by stock symbol, or by targeted address. I'll start with a summary by address, then move on to a more detailed report by stock symbol.

I have a large number of email addresses, some of them less active than others, and some of them spam-free! Of the addresses which are currently active, three of them have received stock-pumping spam in the last couple of weeks. One of these is my "legacy" address, an ".org" address that's been around since before 2000. It was harvested years ago, and appears on spam lists all over the place. I actively block incoming mail from known spam sources (including all of China and Korea), and still get quite a bit of spam in that account. The second address is an odd one: I don't actually consider it mine. It was more or less inherited when one ISP bought out another, and it peeves me no end that this merger is the only reason I get spam there. Not that it matters -- it's basically pure spam, so I don't have to sort wheat from chaff. Let's call it "address X". The last address usually attracts job-scam spam, and it happens to be a ".au" address. Call it "address A".


A grand total of nineteen stock spams, covering six stocks. The most prominent is the infamous CDGT, which featured in seven spams across two accounts. EDEX -- a newcomer to my inbox -- made an enthusiastic showing with five instances in one account only. Also not to be ignored are PGCN and CWTD, both seen in the past, with three and two spams respectively, spread over the same two accounts. SNFX.PK and VSUS are newcomers with one appearance each.

Note that there is overwhelming evidence linking the CDGT and PGCN spams sent to account X. These were sent in approximately the same time-frame, using the same HTML format, and in one case shared the same sender address and subject line, despite originating at completely unrelated IP addresses! Whether or not the CDGT and PGCN spams sent to the other accounts are from the same spammer is an open question.

Let's look at them in detail, in order of receipt.

StockAddressSource IPWHOISDate Received
PGCNX220.79.250.110KORNET (Korea)Tue, 21 Jun 2005 07:52:35 -0000
PGCNX61.249.157.113SHINBIRO-INFRA (Korea)Tue, 21 Jun 2005 18:49:29 -0000
CDGTX24.176.247.234RNO-NV-24-176-240 (USA)Tue, 21 Jun 2005 18:52:59 -0000
CDGTX211.246.161.241SCSNET-CATV-SEOKYUNG (Korea)Wed, 22 Jun 2005 10:10:56 -0000
CDGTX210.49.220.108OPTUSINTERNET-AU (Australia)Wed, 22 Jun 2005 19:32:49 -0000
CDGTX220.80.17.106KORNET-HOTLINE2003305226 (Korea)Fri, 24 Jun 2005 07:57:28 -0000
SNFX.PKLegacy195.33.210.107TR-SUPERONLINE-980318 (Turkey)Fri, 24 Jun 2005 09:35:31 +0000
CDGTX200.168.62.134(Brazil, not playing nice with WHOIS)Wed, 29 Jun 2005 08:09:37 -0000
EDEXX84.9.91.202Bulldog (London, UK)Thu, 30 Jun 2005 03:59:17 -0000
EDEXX82.227.96.2FR-PROXAD-ADSL (France)Thu, 30 Jun 2005 15:47:26 -0000
EDEXX211.175.42.210ASCB (Korea)Thu, 30 Jun 2005 19:12:20 -0000
EDEXX61.38.31.32BORANET-1 (Korea)Sun, 3 Jul 2005 04:22:08 -0000
EDEXX81.172.85.46ES-RETECAL-20030114 (Spain)Sun, 3 Jul 2005 15:54:07 -0000
CDGTA66.180.123.113NETBLK-CBEY-2BLK (USA)Tue, 5 Jul 2005 04:43:45 -0000
CDGTA200.232.145.73(Brazil, still not playing nice.)Tue, 5 Jul 2005 14:28:43 -0000
CWTDX58.120.244.176HANANET (Korea)Fri, 8 Jul 2005 06:09:43 -0000
PGCNLegacy24.132.32.66A2000-AMSTERDAM6 (Netherlands)Fri, 08 Jul 2005 14:47:35 +0000
VSUSX211.206.146.105HANANET (Korea)Sat, 9 Jul 2005 07:52:04 -0000
CWTDLegacy82.114.184.228YEMEN-NET-ADSL (Yemen)Mon, 11 Jul 2005 12:15:05 +0000

I don't have a lot to add, except to point out the notable absence of China as a spam source in this list, and the conspicuous preponderance of Korean sources. In case there was any doubt, Korea is a festering hole of compromised Windows boxes on broadband connections, and the rest of the world would do itself a huge favour by blocking all outgoing email from that country -- if not severing the Internet connection altogether. I have no doubt that my legacy account would be receiving vastly more spam, were it not for my active attempts to refuse all email from Korea. What a disgrace.


Phish of the Day: Southtrust

This isn't hot off the presses -- just clearing out a backlog. Two phish targeted at Southtrust customers were received recently, to a relatively spam-free address which I surmise has been obtained through virus-compromised personal computers. The first was received from ( on Fri, 01 Jul 2005 02:00:29 +0000, with URL (WHOIS: TaiYuan GPP Netbar, China). The second was received from (WHOIS: Polish Telecom) on Mon, 04 Jul 2005 07:54:56 +0000, with URL ( These phish used the "GIF image in lieu of text" approach, and just to be different, I'm attempting to upload the image with the new Blogger "images" feature. The linked sites were down by the time I tried reaching them, so no further comment.


Info: the CDGT situation

I've been contacted by one Francisco Moreira of Spam Daily News, in relation to the ongoing CDGT stock spam (reported frequently in this blog). Spam Daily News has already run a couple of articles on the subject, the first in which a law firm retaliates for being used as the "from" address in some of the spam, and the second in which CDGT strikes back with accusations of defamation and whatnot. Francisco asks my opinion on the matter.

Spamming is a nasty business, and the ugly brawl into which the CDGT affair has degenerated demonstrates this admirably. So far as I can tell, the only party that seems to be getting any real benefit from the situation is the spammer. I can only observe the facts and draw inferences, but for what it's worth, here are my inferences in this case.

I don't think the CDGT spam is "pump and dump" in the usual sense of that term. Where traditional pump and dump is concerned, the fraudster obtains a significant quantity of very low-value stock, then publicises a story about how that stock is suddenly going to rise for some reason or other. If people take the bait, then the stock does rise as a consequence of sudden buyer interest. The fraudster then dumps his stock at a profit, and lets everyone else deal with the aftermath.

The pattern of spamming in the case of CDGT doesn't match this scenario. For one, the stock isn't the kind of penny stock that pump-and-dumpers prefer to use, where a few cents difference can mean a 100% gain. Also, the spam has been staggeringly persistent, arriving time and time again. This isn't so much "pump and dump" as "pump and pump and pump and pump".

A big clue as to what's going on here lies in the SDN article entitled China Digital Media Corporation: 'We are not a spammer!', in which we see the following.

...Ng confirmed that his company hired a stock promoter but denied having anything to do with sending spam with Ziegler as the return address. He did not name the promoter and apologized for any embarrassment.

The obvious surmise from this state of affairs is that Ng's "stock promoter" is a spammer, or hires the use of a spammer. Degrees of separation like this are a frequent problem in spam. If party X hires party Y to perform promotion, and party Y is a spammer, party X may become offended when the rest of the world accuses him of spamming. Party X may deny it, as in the following statement from Daniel Ng.

Using spam is not how we operate our businesses. We are building value for shareholders through the old fashioned methods of hard work and skillful execution of our business plan.

Sadly, Mr Ng appears to have employed a spammer, and I don't see any practical or moral difference between "using spam" and "using a spammer". Maybe he didn't know he was hiring a spammer at the time, and he seems dead keen on denying it, but CDGT spam has been flooding the Internet for many months now. I personally have a large swag of CDGT spams (and PGCN spams obviously sent by the same spammer) in my inbox right now. It's possible that a spammer has been acting of his own initiative here, but to what end? The most reasonable explanation is the obvious one: Ng's "stock promoter" is (or uses) a spammer.

In the same article, we see the following statement from Mr Ziegler.

I was amazed that somebody spammed with an e-mail address that was a real e-mail address, thinking that there would be no ramifications.

Understand, Mr Ziegler, that spammers are relentlessly pragmatic, and untainted by the slightest trace of empathy. They deliberately use real email addresses (other than their own) as the sender address, since obvious forgeries are very likely to be blocked by anti-spam measures. If they want to be particularly spiteful, they will use the address of some anti-spam activist who has annoyed them, but any real address will do, in general.

As for "ramifications", spammers such as the CDGT spammer tend to use networks of compromised computers, sometimes called "zombies", to do their dirty work. Thus, even if you know which computer the spam came from, you haven't traced the spammer. Spammers are non-trivial to trace, and they know it. The ramifications of address forgery, along with most of the other negative ramifications of spam in general, tend to naturally fall upon parties other than the spammer. And, being the sociopaths they are, that state of affairs suits them nicely.

If Mr Ziegler goes ahead with this legal action -- and I see no reason why he shouldn't -- my one piece of advice would be as follows: follow the money. Don't just settle for nailing CDGT; use whatever legal means are available to discover who CDGT is paying (directly or indirectly) to send the spam. Nailing an actual spammer makes the world a better place.