Link has been read

Useless thats spam and this is Phising, when they ask you for personal details thats the big difference, and the amazing thing is this person is a ghost him name in the sent section does not exist, its great that you stuck up for you freind but you are no helping me at all.

I will await admins reponse not a user with no security experience.
I know I am sounding rude but you are not helping me by commenting on something that is totally different to what I have been getting in my gmail account and now to top it off in my site mail and from a member that doesnt exist.

Both of you should not have answered the message was for Stacey.

then please use the PM system to contact Stacey Directly. posting in a forum will get replys warrented by yourself or not. (this is a fact of life)

I'm telling ya all that I sure am glad that I don't use the site mail here!

Wrong StaceyG is Moderator of this forum, I did the right thing and posted in the correct place,
Fact of life funny that , a comment directed to Stacey and you and your buddies answer, hmm no wonder everyone complains about forums.

Anyway out of here, have to go to bed its late in australia, I will leave it up to ADMIN to sort out and find the answer to the Mysterious Ghost in Site Mail

you do that. and please do come back in a better mood. and please... we were tying to help. obivousily don't want that help. but it comes anyway. this is forum life. don't like it? don't post. it's that simple...

If its a member that just joined, they wont show up in the regular member search right away. 3Dillusions, could you send the member name thru PM or email to one of us, or StaceyG if you wish,  so we can have a look?

Thanks!

Certainly Jen sending to stacey now

Thanks!

Well, I just got 2 spam emails to this new address which I created especially for this site. I have not used it for anything except to login to this site and post and send  PM's.

Here are the emails. ***The email properties for each definitely show that they were sent to the address I created for here. ***  They were not accompanied by any other email from Renderosity.

Spam#1 (arrived at 6:15pm October 22)**

**

Mrs  Rebeca James Loan Funds Org.
Plott 103 Lan Vanessy Lane
Gariki Abuja FCT.
Tel:+2348052427084.
+2348089551052.

                    MRSREBECA LOAN FUNDS ORGANISATION

Good day Sir/Madam,

     I am Mrs  Rebeca James, a money lender i give out loan to all in
 need of
help. Are you looking for money to pay bills? I want you to know that i
 can help
you with loan and i will be glad to offer you a loan with Guarantee at
 an
affordable interest rate of 2%

I give out the following Loans with guarantee.

Home loans
Auto Loans
Car loans
Mortgage loans
Business Loans
International Loans
Personal Loans.

If you are in need of loan in your next email I want you to let me know
 how much
you need as loan so that I can provide you with the loan terms and
 Conditions.

You can contact me via this Email:
 MRSREBECA_FINANCIALLOANOFFER@YAHOO.CO.UK

                          BORROWERS INFORMATION

Your names................................
Your country...............................
Your address..............................
Your Age...............................
Your Fax Number...................
Your occupation..........................
Your marital status......................
Current Status at place of work.........
Sex...................................
Phone number..............................
Monthly Income...........................
Amount Needed...........................
Propose of Loan:...........................
Loan Duration:...........................
How Urgent do you need the loan:.........
CONTACT E-MAIL MRSREBECA_FINANCIALLOANOFFER@YAHOO.CO.UK
Thanks.
Mrs. Rebeca James
MD.

Spam#2 (Arrived at 1:05 pm October 22)

Attn:Benefuciary,

Good day, Your Long overdue Payment. I saw your name ( in the Central
Computer among the list of unpaid contractors, inheritance next of kin and
lotto beneficiaries that was originated from Africa, Europe, Asia Plus
Middle east, Americans ) among the list of individuals and companies that
your unpaid fund has been located to Arica Development Bank, HSBC,Barclays
Bank and Bank of America. 
 
Your name appeared among the beneficiaries who will receive a part-payment
of $1.500, 000 USD and has been approved already for months. You are
requested to get back to me for more direction and instruction on how to
receive your fund. However, we received an email from one Mr. KENNETH EZE
who told us that he is your next of kin and that you died in a car accident
last week.
 
MR KENNETH EZE
account co-ordinate as follows:
Bank of Lebanon
A/c no:890458984589
Routing No:bl 275-79665
Aba no:BL-ANAJFG-FL
Ben:Mr KENNETH EZE
 
He has also submitted his account for us to transfer the fund to him. We
want to hear from you before we can make the transfer to confirm if you are
dead or not. Once again, I apologize to you on behalf Of IMF (International
Monetary Fund) http://www.imf.org/external/np/omd/bios/rrf.htm" htm failure to pay your
funds in time, which according to records in the system had been long
overdue. pls Reply to Rev Norbert Wright Managing Director, IMF Email: internation_monetary_fund00@yahoo.fr
Reconfirm the below information to him for verification.
 
Full Name..........
Address..............
Tell.................
Occupation..Disabled/unemployed receiving social security/basically government welfare here in america.....
Reply to this E-mail Address(internation_monetary_fund00@yahoo.fr)
Yours Sincerely,
 
Mr Harry Duke
 

can you post the headers on each?

Not sure what a "header" is. Is that what is seen in email "Properties"? if it's the email properties, do I have to edit out anything out other than my own email addresses?

I should add that over the past few days I have been receiving one or two spam emails to my outlook express address, which is where I have my email forwarded to. However, the email properties were ambiguous as to the account it was sent to (IE: no mention of gmail and the outlook express address showing wasn't even "mine") so I haven't mentioned it before. But the 2 that I posted above definitely came to my new email address which was made just for her a few weeks ago.

I get 20 plus of these a day they are phising not SPAM.

If you use GMAIL you can hit the reply button then click on show original, and copy and paste all the info for those, its a waste of time they are being sent from Amsterdam plus other countries. I have been reporting them since July.

Follow instructions for you email reader below to get original headers

http://wiki.castlecops.com/Retrieving_Email_Source_Code

Angela

Quote - I get 20 plus of these a day they are phising not SPAM.

Angela

also to clarify :

"Spam can be used to spread computer viruses, trojan horses or other malicious software. The objective may be identity theft, or worse (eg. advance fee fraud). Some spam attempts to capitalise on human greed whilst other attempts to use the victims inexperience with computer technology to trick them (eg. Phishing, Vishing).Spam can be used to spread computer viruses, trojan horses or other malicious software. The objective may be identity theft, or worse (eg. advance fee fraud). ***Some spam attempts to capitalise on human greed whilst other attempts to use the victims inexperience with computer technology to trick them (eg. Phishing, Vishing). "

Empasis Mine.

Ok, so a "header" is actuall the email properties.  Here they are but I have removed my email addresses from them and substituted them with XXXXX

Spam #1

Return-Path: XXXXX+caf_=XXXXX=mts.net@gmail.com
Received: from wnpgmb01-c600d.mts.net ([172.17.170.24])
          by mx-mtain01.mts.net with ESMTP
          id 20071022231542.OLLE713.mx-mtain01.mts.net@wnpgmb01-c600d.mts.net
          for XXXXX@mts.net; Mon, 22 Oct 2007 18:15:42 -0500
X-SCORE: 3.9 64.233.166.182 159462075
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,313,1188795600";
   d="scan'208,217";a="159462075"
Received: from py-out-1112.google.com ([64.233.166.182])
  by wnpgmb01-c600d.mts.net with ESMTP; 22 Oct 2007 18:15:42 -0500
Received: by py-out-1112.google.com with SMTP id u77so3264010pyb
        for XXXXX@mts.net; Mon, 22 Oct 2007 16:15:42 -0700 (PDT)
Received: by 10.65.212.3 with SMTP id o3mr10760637qbq.1193094942056;
        Mon, 22 Oct 2007 16:15:42 -0700 (PDT)
X-Forwarded-To: XXXXX@mts.net
X-Forwarded-For: XXXXX@gmail.com XXXXX@mts.net
Delivered-To: XXXXX@gmail.com
Received: by 10.64.142.20 with SMTP id p20cs289297qbd;
        Mon, 22 Oct 2007 16:15:41 -0700 (PDT)
Received: by 10.114.94.1 with SMTP id r1mr6097134wab.1193094940875;
        Mon, 22 Oct 2007 16:15:40 -0700 (PDT)
Return-Path: mrsrebecaoffer@comcast.net
Received: from sccrmhc11.comcast.net (sccrmhc11.comcast.net [204.127.200.81])
        by mx.google.com with ESMTP id 22si3355699nzn.2007.10.22.16.15.39;
        Mon, 22 Oct 2007 16:15:40 -0700 (PDT)
Received-SPF: pass (google.com: domain of mrsrebecaoffer@comcast.net designates 204.127.200.81 as permitted sender) client-ip=204.127.200.81;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of mrsrebecaoffer@comcast.net designates 204.127.200.81 as permitted sender) smtp.mail=mrsrebecaoffer@comcast.net
Received: from smailcenter71.comcast.net ([204.127.205.171])
          by comcast.net (sccrmhc11) with SMTP
          id <2007102223071201100ruse9e>; Mon, 22 Oct 2007 23:07:19 +0000
Received: from [196.220.1.58] by smailcenter71.comcast.net;
    Mon, 22 Oct 2007 23:07:11 +0000
From: mrsrebecaoffer@comcast.net
To: MRSREBECA_FINANCIALLOANOFFER@YAHOO.CO.UK
Subject: LOAN OFFER TO ALL
Date: Mon, 22 Oct 2007 23:07:11 +0000
Message-Id: 102220072307.22343.471D2D1D000997600000574722007636929D0A0000010E0C0A0D0A9D9C9D03@comcast.net
X-Mailer: AT&T Message Center Version 1 (Oct  4 2006)
X-Authenticated-Sender: bXJzcmViZWNhb2ZmZXJAY29tY2FzdC5uZXQ=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="NextPart_Webmail_9m3u9jl4l_22343_1193094431_0"

Spam #2

Return-Path: XXXXX+caf_=XXXXX=mts.net@gmail.com
Received: from wnpgmb02-c600a.mts.net ([172.17.170.17])
          by mx-mtain03.mts.net with ESMTP
          id 20071022180501.RQRO714.mx-mtain03.mts.net@wnpgmb02-c600a.mts.net
          for XXXXX@mts.net; Mon, 22 Oct 2007 13:05:01 -0500
X-SCORE: 3.9 64.233.166.178 664587819
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,312,1188795600";
   d="scan'208,217";a="664587819"
Received: from py-out-1112.google.com ([64.233.166.178])
  by wnpgmb02-c600a.mts.net with ESMTP; 22 Oct 2007 13:05:02 -0500
Received: by py-out-1112.google.com with SMTP id u77so3065367pyb
        for XXXXX@mts.net; Mon, 22 Oct 2007 11:05:00 -0700 (PDT)
Received: by 10.64.148.8 with SMTP id v8mr10130013qbd.1193076300485;
        Mon, 22 Oct 2007 11:05:00 -0700 (PDT)
X-Forwarded-To: XXXXX@mts.net
X-Forwarded-For: XXXXX@gmail.com XXXXX@mts.net
Delivered-To: XXXXX@gmail.com
Received: by 10.64.142.20 with SMTP id p20cs270851qbd;
        Mon, 22 Oct 2007 11:04:59 -0700 (PDT)
Received: by 10.141.63.20 with SMTP id q20mr2484935rvk.1193076298514;
        Mon, 22 Oct 2007 11:04:58 -0700 (PDT)
Return-Path: harry_duke_0023@hotmail.com
Received: from bay0-omc2-s39.bay0.hotmail.com (bay0-omc2-s39.bay0.hotmail.com [65.54.246.175])
        by mx.google.com with ESMTP id 3si11790023rvi.2007.10.22.11.04.57;
        Mon, 22 Oct 2007 11:04:58 -0700 (PDT)
Received-SPF: pass (google.com: domain of harry_duke_0023@hotmail.com designates 65.54.246.175 as permitted sender) client-ip=65.54.246.175;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of harry_duke_0023@hotmail.com designates 65.54.246.175 as permitted sender) smtp.mail=harry_duke_0023@hotmail.com
Received: from BLU116-W27 ([10.6.19.62]) by bay0-omc2-s39.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
     Mon, 22 Oct 2007 11:03:19 -0700
Message-ID: BLU116-W273EA774A3225719BABADBA19A0@phx.gbl
Return-Path: harry_duke_0023@hotmail.com
Content-Type: multipart/alternative;
    boundary="b53b3253-06a1-48ae-8eb3-12f7e1864fd3"
X-Originating-IP: [41.223.251.72]
From: harry duke harry_duke_0023@hotmail.com
Subject: VERY URGENT FROM INTERNATIONAL MONETARY FUND
Date: Mon, 22 Oct 2007 19:03:15 +0100
Importance: Normal
MIME-Version: 1.0
Bcc:
X-OriginalArrivalTime: 22 Oct 2007 18:03:19.0441 (UTC) FILETIME=[D3D21810:01C814D5]

OrgName: African Network Information Center
OrgID: AFRINIC
Address: 03B3 - 3rd Floor - Ebene Cyber Tower
Address: Cyber City
Address: Ebene
Address: Mauritius
City: Ebene
StateProv:
PostalCode: 0001
Country: MU

There you go the WHOIS on the Originating IP Address above.
Thats the same for both of them when you put in the Originating IP address.

I just saw that another one arrived at 11:01 pm. This is a brand new email address created on October 9th especially for here.  Renderosity no longer as the ability to send emails from the site and I have not used it to send emails at all.

Based on that I would say that it's pretty conclusive that there is a problem with this site and spammers  are being able to pick up email address "somehow".

**To review:

**1)  I do subscribe to the newsletter
2)  I do subscribe to gallery comments
3)  I do not subscribe to forum threads (occasionally forget to uncheck the box)
4)  I do not subscribe  to notification of gallery uploads

1. I do not subscribe to PM notification

October 9:

New gmail email address created on October 9 specifically for use on this site

*Between October 9 and 11, I received the following from Renderosity:

4 ebots about gallery comments;
1 ebot indicating someone "favourited" me;
Confirmation for an MP purchase;
1 newsletter.

*Between October 12 and October 17:

I forgot to uncheck the "subscribe to thread" box and received a couple ebot notifications about replies to a thread.

Received a few notifications about wish list items on sale.

Between October 18 and 19:

I uploaded an image to my gallery on October 18. During the period of October 18 and 19, I received 15 ebot notifcations of gallery comments.

1 newsletter

Between October 20 and 22:

Ebot notification received that someone "favourited" me

About 6 spam emails to my outlook express address, but the properties did not show my gmail address or that the email had been forwarded, and the outlook address was my ISP domain but the "to" portion was not my "handle"

Here is the latest email spam that I received to my Renderosity exclusive email.

The email:

Ref: UK/9420X2/68
Batch:074/05/ZY369

 You have been approved to claim a sumof £516,778:00

To file for your claims you are to contact our claims agent by email.

Mr Peter Taylor
Email:  info.freelottocontact01@gmail.com)

Provide him with the following information to claim your prize.

Full Name:
Phone Number:
Occupation:
Country:
Age:

Yours Truly,
Lucy Baines
Co-ordinator(Online Promo Programme)
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 

Properties:

Return-Path: XXXXX+caf_=XXXXX=mts.net@gmail.com
Received: from wnpgmb01-c600d.mts.net ([172.17.170.24])
          by mx-mtain02.mts.net with ESMTP
          id 20071023040104.CXWP556.mx-mtain02.mts.net@wnpgmb01-c600d.mts.net
          for XXXXX@mts.net; Mon, 22 Oct 2007 23:01:04 -0500
X-SCORE: 4.6 64.233.162.227 159581888
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,315,1188795600";
   d="scan'208";a="159581888"
Received: from nz-out-0506.google.com ([64.233.162.227])
  by wnpgmb01-c600d.mts.net with ESMTP; 22 Oct 2007 23:01:03 -0500
Received: by nz-out-0506.google.com with SMTP id s18so647171nze
        for XXXXX@mts.net; Mon, 22 Oct 2007 21:01:04 -0700 (PDT)
Received: by 10.65.23.7 with SMTP id a7mr11251979qbj.1193112063577;
        Mon, 22 Oct 2007 21:01:03 -0700 (PDT)
X-Forwarded-To: XXXXX@mts.net
X-Forwarded-For: XXXXX@gmail.com XXXXX@mts.net
Delivered-To: XXXXX@gmail.com
Received: by 10.64.142.20 with SMTP id p20cs298141qbd;
        Mon, 22 Oct 2007 21:01:03 -0700 (PDT)
Received: by 10.90.92.10 with SMTP id p10mr161149agb.1193112050556;
        Mon, 22 Oct 2007 21:00:50 -0700 (PDT)
Return-Path: ssaenez@cox.net
Received: from eastrmmtao104.cox.net (eastrmmtao104.cox.net [68.230.240.46])
        by mx.google.com with ESMTP id m30si8186559elf.2007.10.22.20.59.53;
        Mon, 22 Oct 2007 21:00:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of ssaenez@cox.net designates 68.230.240.46 as permitted sender) client-ip=68.230.240.46;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ssaenez@cox.net designates 68.230.240.46 as permitted sender) smtp.mail=ssaenez@cox.net
Received: from eastrmimpo01.cox.net ([68.1.16.119])
          by eastrmmtao104.cox.net
          (InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
          id 20071023035951.DIXR3686.eastrmmtao104.cox.net@eastrmimpo01.cox.net;
          Mon, 22 Oct 2007 23:59:51 -0400
Received: from eastrmwml25.mgt.cox.net ([172.18.52.85])
    by eastrmimpo01.cox.net with bizsmtp
    id 3fzo1Y0051qHwgC0000000; Mon, 22 Oct 2007 23:59:48 -0400
Received: from 66.212.16.194 by webmail.east.cox.net; Mon, 22 Oct 2007 23:59:51 -0400
Message-ID: 20071022235951.61JHY.100268.root@eastrmwml25.mgt.cox.net
Date: Mon, 22 Oct 2007 23:59:51 -0400
From: Mrs Lucy Baines ssaenez@cox.net
Reply-To: online.programme2007@jmail.co.za
Subject: Lottery foundation
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
Sensitivity: Normal

Yep my email address has been comprimsed so no use getting a new one as I know that one will too, unless the find the leak and plug it there is nothing any of us can do.

I report the phising emails and thats all I can do, I am not going to comment on this thread again, not much use if you ask me.

Yet another. No Renderosity email received with it.

EMAIL:

ATTN.DEAR FRIEND ,

It has come to my notice that a click of former government workers which exist
between the FMF and the CBN has arranged to steal from the CBN  vault were I
have being working for the past six years. Your contract claims, which were
return through a Security & Finance Company to the CBN, vault in the first week
of February.I have meticulously remove the money packed in a metal box and
deposited it through Security Courier service, as  diplomatic documents, note
that I did not disclose the content to the company in order to avoid
perforation. The money is jsut  $45,000.000

For more details and to give me an address to enable me mails the key and
picture of the Box and money to you. Also to finalize arrangement on how the
Courier Company would deliver the consignment to you.Immediately you receive
the money, I would tell you how to send my 20% percent to me. Await your
response. The airway bills will be given to you as soon as I hear from you. 
Regards

ALLEN DONALD

PROPERTIES:

Return-Path: XXXXX+caf_=XXXXX=mts.net@gmail.com
Received: from wnpgmb02-c600a.mts.net ([172.17.170.17])
          by mx-mtain01.mts.net with ESMTP
          id 20071023191759.BQLX713.mx-mtain01.mts.net@wnpgmb02-c600a.mts.net
          for XXXXX@mts.net; Tue, 23 Oct 2007 14:17:59 -0500
X-SCORE: 4.8 64.233.166.182 665168245
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,319,1188795600";
   d="scan'208";a="665168245"
Received: from py-out-1112.google.com ([64.233.166.182])
  by wnpgmb02-c600a.mts.net with ESMTP; 23 Oct 2007 14:17:59 -0500
Received: by py-out-1112.google.com with SMTP id u77so3881675pyb
        for XXXXX@mts.net; Tue, 23 Oct 2007 12:17:59 -0700 (PDT)
Received: by 10.65.59.11 with SMTP id m11mr1220111qbk.1193167078091;
        Tue, 23 Oct 2007 12:17:58 -0700 (PDT)
X-Forwarded-To: XXXXX@mts.net
X-Forwarded-For: XXXXX@gmail.com XXXXX@mts.net
Delivered-To: XXXXX@gmail.com
Received: by 10.64.142.20 with SMTP id p20cs34077qbd;
        Tue, 23 Oct 2007 12:17:57 -0700 (PDT)
Received: by 10.65.214.19 with SMTP id r19mr13101678qbq.1193167077010;
        Tue, 23 Oct 2007 12:17:57 -0700 (PDT)
Return-Path: allendonald2007@yahoo.com
Received: from cl-t021-320cl.privatedns.com (ip-72-55-137-139.static.privatedns.com [72.55.137.139])
        by mx.google.com with ESMTP id z21si3357553qbc.2007.10.23.12.17.46;
        Tue, 23 Oct 2007 12:17:57 -0700 (PDT)
Received-SPF: neutral (google.com: 72.55.137.139 is neither permitted nor denied by domain of allendonald2007@yahoo.com) client-ip=72.55.137.139;
Authentication-Results: mx.google.com; spf=neutral (google.com: 72.55.137.139 is neither permitted nor denied by domain of allendonald2007@yahoo.com) smtp.mail=allendonald2007@yahoo.com
Received: from [127.0.0.1] (helo=localhost)
    by cl-t021-320cl.privatedns.com with esmtpa (Exim 4.68)
    (envelope-from allendonald2007@yahoo.com)
    id 1IkPAA-0003gH-T0; Tue, 23 Oct 2007 15:11:38 -0400
Received: from 196.220.12.10 ([196.220.12.10]) by ezekielinfo.com (Horde
    MIME library) with HTTP; Tue, 23 Oct 2007 15:11:24 -0400
Message-ID: 20071023151124.rspe3qhdkwcg80os@ezekielinfo.com
Date: Tue, 23 Oct 2007 15:11:24 -0400
From: Allen Donald allendonald2007@yahoo.com
To: undisclosed-recipients:;
Subject: ATTN.DEAR FRIEND ,
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="=_2pcvim2wmqg4"
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.1.3)
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cl-t021-320cl.privatedns.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - yahoo.com
X-Source:
X-Source-Args:
X-Source-Dir:

And another that arrived at 10:10 pm on October 23.

Can an admin please address what the status of this investigation is? The problem is definitely stemming from this site and spammers are somehow able to get their hands on our email addresses.

EMAIL:

Are you financially Squeezed?

• Do you seek funds to pay off credits and debts?
• Do you seek finance to set up your own business?
• Are you in need of private or business loans for various purposes?
• Do you seek loans to carry out large projects?
• Do you seek funding for various other processes?
• If you have any of the above problems, I can be of assistance to you
  but I want you to understand that I give out my loans at an interest
  rate of 0.4%.if you are interested contact me via email:springrose_loanlender@hotmail.com
  *Full Name of Applicant`s:
• Amount Requested:
• Loan Purpose :
• Address of Applicant:
• Occupation:
• City:
• State:
• Country:
• Gender:
• Marital Status:
• Age:
• Income Rate:
• Land Phone:
• Mobile:

 As soon as you fil this form you are to get back to me so with the form so that i can stait the trascation immedatily i will be hope to here form you next

Thank for understand

  You are to fill this form 

--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!

PROPERTIES:

Return-Path: XXXXX+caf_=XXXXX=mts.net@gmail.com
Received: from wnpgmb01-c600d.mts.net ([172.17.170.24])
          by mx-mtain02.mts.net with ESMTP
          id 20071024031041.UBEZ556.mx-mtain02.mts.net@wnpgmb01-c600d.mts.net
          for XXXXX@mts.net; Tue, 23 Oct 2007 22:10:41 -0500
X-SCORE: 4.6 64.233.162.239 160038764
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,322,1188795600";
   d="scan'208";a="160038764"
Received: from nz-out-0506.google.com ([64.233.162.239])
  by wnpgmb01-c600d.mts.net with ESMTP; 23 Oct 2007 22:10:40 -0500
Received: by nz-out-0506.google.com with SMTP id s18so66410nze
        for XXXXX@mts.net; Tue, 23 Oct 2007 20:10:40 -0700 (PDT)
Received: by 10.65.196.2 with SMTP id y2mr260689qbp.1193195440690;
        Tue, 23 Oct 2007 20:10:40 -0700 (PDT)
X-Forwarded-To: XXXXX@mts.net
X-Forwarded-For: XXXXX@gmail.com XXXXX@mts.net
Delivered-To: XXXXX@gmail.com
Received: by 10.64.142.20 with SMTP id p20cs55536qbd;
        Tue, 23 Oct 2007 20:10:40 -0700 (PDT)
Received: by 10.82.160.19 with SMTP id i19mr277104bue.1193195438804;
        Tue, 23 Oct 2007 20:10:38 -0700 (PDT)
Return-Path: spring.rose@indiatimes.com
Received: from rx4.indiatimes.com ([220.226.197.15])
        by mx.google.com with ESMTP id d2si234070nfc.2007.10.23.20.10.24;
        Tue, 23 Oct 2007 20:10:38 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning spring.rose@indiatimes.com does not designate 220.226.197.15 as permitted sender) client-ip=220.226.197.15;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning spring.rose@indiatimes.com does not designate 220.226.197.15 as permitted sender) smtp.mail=spring.rose@indiatimes.com
Received: from unknown (HELO tilmb9.indiatimes.com) ([192.168.61.29])
  by x1.indiatimes.com with ESMTP; 24 Oct 2007 08:35:10 +0530
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgAAAHZTHkfAqD0d/2dsb2JhbAAMkDIB
X-IronPort-AV: i="4.21,322,1188757800";
   d="scan'208"; a="21706982:sNHT14726820"
Date: Wed, 24 Oct 2007 08:21:27 +0530 (IST)
From: spring rose spring.rose@indiatimes.com
Message-ID: 2015454305.2918281193194287507.JavaMail.root@mbr9.indiatimes.com
Subject: I offer loan
MIME-Version: 1.0
X-Originating-IP: [127.0.0.1]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

I see this thread is still going - has anything been done by THE STAFF yet after all this time ?

I started getting floods of spam to my dedicated address again....  sigh......

I think it's going to be one of those situations where the staff sit back and just "watch" until we get tired and bored of no responses and "move on".

Well, I'm not moving on. I'm sick of getting spam to an email address that is only used at this site. It doesn't take a rocket scientist to know there is a problem when a brand spanking new email address that has never been used for any other purpose than to login and receive ebots from THIS site, starts to get spam within 2 weeks of creation!

There is a problem here, and Renderosity needs to step up to the plate and find out what it is and fix it! If they can't find it themselves or if they know where the problem is and can't fix it themselves, they need to bring in a professional who knows how to.

This is a matter of personal member security and needs to be made top priority!

Acadia,

thank you for posting this for us.

Where is your post above does it say this came from us. I see google and gmail but I don't see anywhere in that return that mentions Bondware or Renderosity. 

I do know that they are working on this and it takes time so please be patient.  

Sandy

Quote - Acadia,

thank you for posting this for us.

Where is your post above does it say this came from us. I see google and gmail but I don't see anywhere in that return that mentions Bondware or Renderosity. 

I do know that they are working on this and it takes time so please be patient.  

Sandy

I do not want my email address posted on a discussion board so I X'd out my addresses so that I could post the properties here.

Quote - Ok, so a "header" is actuall the email properties.  Here they are but I have removed my email addresses from them and substituted them with XXXXX

These emails were sent to my newly created, exclusive renderosity address. I have that gmail box set for POP3 and forward any mail received to my mts.net address for ease of not having to remember to go to gmail to check my mail.

So because they were sent to my exclusive Renderosty gmail address, which was just created on October 9, 2007 for the purposes of a "spam experiment" and never, ever used for anything other than to login to and receive ebots from Renderosity, the problem has to be with a leak with Renderosity where our emails are concerned, because otherwise that newly created email box should be spam free because no one other than Renderosity and myself has that  new gmail address, and I sure know that I'm not sending myself spam.

I had my other gmail address for years before I used it here. And in all of those years not a single spam / unsolicited email was sent to it:  until I used it here, and then I was getting dozens per day to the point I finally changed it on October 9th, as not only part of an experiment but because I was sick of the spam. But here we are again, another  compromised email address.

I will forward these emails to you as attachments so that you can see for yourself that they were sent to my exclusive Renderosity email address and then forwarded to my Outlook Express via POP3. It does look confusing to see "xxxx" or substitute addresses" instead of the real thing.

Without posting my addresses, the top portion of the paths looked like this:

Return-Path: renderosity_email_address+caf_=outlook_express_address=mts.net@gmail.com
Received: from wnpgmb01-c600d.mts.net ([172.17.170.24])
          by mx-mtain01.mts.net with ESMTP
          id 20071022231542.OLLE713.mx-mtain01.mts.net@wnpgmb01-c600d.mts.net
          for outlook_express_address@mts.net; Mon, 22 Oct 2007 18:15:42 -0500
X-SCORE: 3.9 64.233.166.182 159462075
X-Brightmail-Tracker: AAAAAA==
X-BrightmailFiltered: true
X-IronPort-AV: E=Sophos;i="4.21,313,1188795600";
   d="scan'208,217";a="159462075"
Received: from py-out-1112.google.com ([64.233.166.182])
  by wnpgmb01-c600d.mts.net with ESMTP; 22 Oct 2007 18:15:42 -0500
Received: by py-out-1112.google.com with SMTP id u77so3264010pyb
        for outlook_express_address@mts.net; Mon, 22 Oct 2007 16:15:42 -0700 (PDT)
Received: by 10.65.212.3 with SMTP id o3mr10760637qbq.1193094942056;
        Mon, 22 Oct 2007 16:15:42 -0700 (PDT)
X-Forwarded-To: outlook_express_address@mts.net
X-Forwarded-For: renderosity_email_address@gmail.com outlook_express_address@mts.net
Delivered-To: renderosity_email_address@gmail.com

Ok yes send me these and I will make sure the tech's get them. Thanks

No problem.  They should be arriving to you any minute. 

Quote - Where is your post above does it say this came from us. I see google and gmail but I don't see anywhere in that return that mentions Bondware or Renderosity.

I just noticed that, sorry for not addressing it in my earlier reply. The spam isn't coming from Renderosity. It's coming from others sources but it's going to an address that no one but Renderosity has and which is not used anywhere else for any other purpose except here at Renderosity for logging in and receiving ebots.

Renderosity isn't sending the spam directly, but there seems to be a way for spammers to get the email addresses used here (in this most recent example, within 2 weeks) and then send out their spam to these addresses that they have somehow harvested.

I don't know how they could as those are private since we removed the email funtion in the mail . But will send the emails to the techs to check out.

Well the techs have been looking into this heavily and we think we know whats happening its just a matter of catching it in the act so to speak SO, what we need anyone that gets spam like say directly after they receive the newsletter is to IMMEDIATELY forward it to admin@renderosity.com  with the header info.  We think we have it figured out its just a matter of a little bit more patience while we try to zero in on where this is EXACTLY coming from. 

Thanks

Quote - Well the techs have been looking into this heavily and we think we know whats happening its just a matter of catching it in the act so to speak SO, what we need anyone that gets spam like say directly after they receive the newsletter is to IMMEDIATELY forward it to admin@renderosity.com  with the header info.  We think we have it figured out its just a matter of a little bit more patience while we try to zero in on where this is EXACTLY coming from. 

Thanks

That sounds promising! Thanks for the update!

You are welcome. Just please I need your all's help in sending me the spam with the headers as soon as it comes behind a newsletter or forum ebot.  That is the key getting it to us as soon as possible.

So bad i just deleted the spam that came with the forum ebot that leads mo to this forum... When i think of it now, i think i receive A LOT of spams since some months, and almost only on the adress i use for Rendo (i don't use it only for Rendo). And i think i never receive an ebot or a newsletter (that i receive twice each time) alone. It's always with some spams.

They just fished the e-mail adresses and that's all.. catch it and process.. other no way to stop...

I have sent off some spam to the admins as requested. However I see that there are others in the spam folder of my gmail box. I guess the ones that were forwarded to my outlook box from gmail had somehow circumvented the spam filter at gmail.

I don't know how to retrieve the properties or to forward the mailings from gmail as "attachments" so tha the properties header stays intact.

I tried forwarding one to my outlook but it loses all of the original properties and looks like I sent the spam to myself!  LOL

if someone can tell me how to retrieve the headers from emails in the gmail box I will forward them to the admins. All of the spam arrived within 1 to 2 hours of receiving gallery comment notifications.

**I had the same problem in forwarding it from gmail. And really surprising, it actually went through when I forwarded it, but in replying back to you, Stacey, I got it kicked back to me with this message.

**Technical details of permanent failure:
PERM_FAILURE: SMTP Error (state 16): 554 Failure Message looks like spam, sorry not wanted here q=23113029

**I thought it was just too ironic and funny to boot. Especially the part about it not being wanted.

Gee? Could it be because I put Spam Help in the subject line?

So anyhoos....does anyone know of a method to get the header details when using gmail?**

Let e ask the techs...

Cool. Cause there's 125 more of this type sitting in my junk mail and I just cleared that out yesterday.

Ok, I figured out how to locate the headers in gmail.  You have to open the email and in the upper right corner of the message there is a "reply" button and a down arrow next to it. Click the down arrow icon and you have some hidden options. One is "Show Original" which shows the header/properties along with an HTML text version of the message.

I copied 20 email headers and pasted them to another email and sent that to renderosity.

I also sent gmail a suggestion that will allow emails to be "forwarded as attachment" like outlook express allows. And I asked them to look into adding a feature that allows you to be able to report emails as spam or phishing spam without actually having to open each blasted email to do that! I just reported 42 phishing emails to gmail...one by one! 

LOL

Gmail must hate my I have reported over 400 phising emails, spam I nuke not time for those losers.

Janet to get headers in gmail load the email in question up the top to the right of the message you will see an arrow with reply click the down arrow and choose report phising for gmail, to forwared the whole message from the original sender go to the same place and click show original, it will open an new window with this message.

Just right click with mouse select all and  copy and paste it in a new message to Stacey, but you will find that the address that have been harvested from here have now been sold to various criminals online.  I am even getting phising email from Australia, and from one of the biggest ISP in my country I was on the phone yesterday abusing them for 30 mins, they gave a powerball email address out to a phising criminal, not good enough.

What I have not tested is a whole new email for Renderosity but with nothing enabled, not even the newsletter, this way we can test mail for each of the modules set up for renderosity like Site Mail, Newletter, Forum, and Comments and Favourite artists.

Stacey that is what should be done set up a couple of email address so your techs can see where its coming from, some people say they only get spam I do not get those at all, which is weird. 

thats what I would like to know where exactly is it coming from.  Only way to stop it is plug it.

**I found it, reported them all and sent the headers into admin@renderosity.

Thanks for help Acadia and Angela.

And yep...it would have been nice if I could report without opening.**

Hi ho everybody. I just read all 12 pages of this thread. Sigh.

So here's another datapoint. I've gotten 2 spams so far. Up to last week I:

1. Got forum reply notifications
2. Never subscribed to newsletter
3. Got PM notifications
4. Got Gallery comments
5. Got "You've been favorited" notices
6. Got notices of favorite artists posting to galleries.

In two years I never got a spam on this address.

Then a few days ago, for the first time, **I bought something in the marketplace here.
**
Now I get spam.

Whatever happened with the fresh box experiments?

I'm about to turn off my current Renderosity-specific address, disable all notifies that I can, and make a new one for Rendo.

If I get spam on the new one, I'm going to cut off Renderosity altogether. I sure hope it doesn't come to that because I do a lot of responding to threads when people need help.

One of the fresh box experiments is stil ongoing and so far no spam has entered their email account. Its a slow process as they are turning things on one at a time then waiting for a time period before turning something else on. So far nothing, nothing new to report.

As I posted (I think it was in this thread??) we need spam that comes in right behind say a newsletter ebot the minute you get it with the header information. The techs do have some ideas in mind but its a matter of narrowing it down which is why we need the header info on a spam forwarded the second it comes in.. 

I have set up about 10 test accounts myself over the last few months from different email providers all with different settings as far as subscribing to different types of ebots on here and all having different activity like forum posting, gallery uploads, purchases, etc.. also all with crazy usernames@ and so far I have not gotten one spam on any of the 10 accounts. Some other admins did the same thing and they as well haven't gotten any spam.

We are working on this and we do take it seriously but spammers are very resourceful and its hard to pin down what is happening. We did turn off the email feature here to help this situation out as well.

I'm only making replies regarding the spam issue in this long thread that has the most information, this is why we ask that you don't start multiple threads with the same topic because information gets too scattered when its all over the place in different threads.

No problem. Can I suggest you sticky this? It is now the last thread in the listing - which is why I didn't see it and stupidly made a new one.

Can I also suggest that you make a locked thread, sticky, where you summarize the status, so we don't have to keep read through hundreds of postings to know what's going on? If you had a summary thread like that, I would have known that I should have forwarded the headers to you immediately.

Frankly, all I care about now is what R'osity has to tell us about it.

I would like to thank AnnieD from the above newly-locked thread for straightening out Mr. REAL computer scientist, and explaining what I meant, while I was not around to notice I was being told that what I've seen in my email is essentially "ludicrous".

Damn, and I had a real nice reply whipped up and ready to go. Oh well, maybe next time.
Thank you, AnnieD, if you see this. :-)

Mike  - there's no reason to get snippy. I only mentioned my credentials in hopes that you'd actually give some credence to what I say, as opposed to what you already believe. I'm sorry you still don't understand what I said or even what you said. 

Nobody randomly guessed these email addresses, which is what you suggested. If you think somebody confirmed that for you, that's not correct. These addresses are being lifted from Rendorosity somehow.

Exactly my point, somehow they have been lifted its strange that people are getting SPAM when I dont get taht at all, mine are Phising emails, some nasty ones today about check your bank online, anyone with no experience will get caught at the fake malware site and their goes their money.

All have been reported to Castlecops.  Sniping and pointing the figures at the people that run Renderosity and Forum Users is of no help.

Stacey if you read this, there are people I know that would like to help you find the leak if there is one and plug it for good.

Angela

In that now closed thread bagginsbill said it started with his first purchase from the site after it was changed to php. That is EXACTLY what happened to me. After the site change the SPAM did not start until I made the first purchase on the new version of this site.

Quote - Mike  - there's no reason to get snippy. I only mentioned my credentials in hopes that you'd actually give some credence to what I say, as opposed to what you already believe. I'm sorry you still don't understand what I said or even what you said.

Nobody randomly guessed these email addresses, which is what you suggested. If you think somebody confirmed that for you, that's not correct. These addresses are being lifted from Rendorosity somehow.

Look dude, don't tell me when I can or cannot feel justified in getting "snippy". I feel perfectly comfortable giving credence to what you say.
Consider this: I am not a computer scientist, as you say, but I'm also not completely illiterate. My reply in that thread was an OBSERVATION, something I saw. Now, maybe you eat, sleep, live and breathe computer stuff, but I don't. I was not speaking to you as one computer scientist to another, but as a regular person, making a regular comment. Come to think about it, I wasn't even speaking to you, but just tossing that observation out there, in general.

I did not suggest the email addresses were randomly generated. I suggested that names are selected randomly within a certain domain, which is what it appeared to be, to me. My main email address I use is ***@comcast.net (obviously the asterisks are replacing the real letters) I get emails to **** and ***** and **** , all at comcast.net, where *** is often not anything even remotely close to my real one.
To a NON computer scientist, this seems very strange, and for all intents and purposes appears to be, as I said in the other thread "...get[ting] spam to my email address which isn't even my email addrress".

So don't tell me I don't know what I said.
And also, AnnieD did confirm what I said, more or less. In a NON computer scientist sort of way. She knew what I meant, and I knew what I meant, and when she descrivbed what I was probably seeing, it made sense. Therfore, it was in fact confirmed. I'm sorry that you don't understand what I said.  I don't know if she's a Computer Scientist of the same caliber as you, or even one at all, but to regular human language-speaking people, it made sense. I wasn't aware I'd stumbled into a thread where exact technical terminology was the only communication being accepted.

**I started watching for when these types mails would get by my filters and I've tracked them the last few days. They get to my inbox every time I get notification of site mail at Rendo. Here's the originals from the last 2 that came at the same time as a site mail notification.

I tried mailing these, but it got kicked back once again saying it looked like spam and was not wanted here. Stacey, you have one good spam filter on your mail and since it's Rendo email, I'm assuming all email at Rendo has the same degree of effectivness?

Oh yeah....The last one got sent because apparently I was in a serious accident and am now paralyzed? LMAO

The XXXXX@gmail has been edited, of course.**

                                                                                                                                                                                                                                                             
Delivered-To: XXXXXXX@gmail.com
Received: by 10.141.27.20 with SMTP id e20cs23590rvj;
        Sat, 3 Nov 2007 14:36:18 -0700 (PDT)
Received: by 10.140.161.11 with SMTP id j11mr1594399rve.1194125778873;
        Sat, 03 Nov 2007 14:36:18 -0700 (PDT)
Return-Path: <online_113@indiatimes.com >
Received: from ipc603.indiatimes.com (ipc603.indiatimes.com [203.199.93.226])
        by mx.google.com with ESMTP id 3si9692477rvi.2007.11.03.14.35.59;
        Sat, 03 Nov 2007 14:36:18 -0700 (PDT)
Received-SPF: pass (google.com: domain of online_113@indiatimes.com designates 203.199.93.226 as permitted sender) client-ip=203.199.93.226;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of online_113@indiatimes.com designates 203.199.93.226 as permitted sender) smtp.mail=online_113@indiatimes.com
Received: from unknown (HELO mb1.indiatimes.com) ([192.168.58.225])
  by ipc603.indiatimes.com with ESMTP; 04 Nov 2007 03:05:58 +0530
Date: Sun, 4 Nov 2007 03:05:58 +0530 (IST)
From: Global Medical Equipments online_113@indiatimes.com
Reply-To: Global Medical Equipments <sales-gme11@myway.com >
Message-ID: 601003950.137551194125758718.JavaMail.root@mbv1.indiatimes.com
Subject: Global Medical Equipments(BUSINESS OPPORTUNITY)
MIME-Version: 1.0
X-Originating-IP: [127.0.0.1]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

DQoNCkRlYXIgUHJvc3BlY3RpdmUgUmVwcmVzZW50YXRpdmUsDQoNCiJHbG9iYWwgTWVkaWNhbCBF
cXVpcG1lbnRzIiBpcyBhbiBpbnRlcm5hdGlvbmFsIGRpc3RyaWJ1dG9yL3dob2xlc2FsZXIgb2Yg
bWVkaWNhbCBlcXVpcG1lbnRzLiBUaGUgY29tcGFueSBzdXBwbGllcyBhIHdpZGUgcmFuZ2Ugb2Yg
bWVkaWNhbCBlcXVpcG1lbnQgYW5kIGNvbnN1bWFibGVzIGludG8gQW1lcmljYSBhbmQgQ2FuYWRh
IGFuZCBFdXJvcGUgaW5kdXN0cmFsIE1hcmtldHMuIA0KDQpXZSBoZXJlYnkgcmVxdWVzdCBmb3Ig
eW91ciBoYW5kIGluIHBhcnRuZXJzaGlwIHRvIGFjdCBhcyBvdXIgcGF5bWVudCBBZ2VudC9SZXBy
ZXNlbnRhdGl2ZSB3aG8gc2hhbGwgcmVjZWl2ZSBwYXltZW50IGZyb20gb3VyIGN1c3RvbWVyKHMp
IGluIFVuaXRlZCBTdGF0ZXMsIENhbmFkYSBhbmQgb3RoZXIgcGFydHMgb2YgRXVyb3BlLlBsZWFz
ZSBub3RlIHRoYXQgeW91IHNoYWxsIGJlIGVudGl0bGVkIHRvIDEwJSBvZiBlYWNoIHBheW1lbnQg
eW91IHJlY2VpdmUgb24gb3VyIGJlaGFsZi4NCg0KVXBvbiByZWNlaXB0IG9mIHRoaXMgcmVxdWVz
dGVkIGluZm9ybWF0aW9uLCB3ZSBzaGFsbCBwcm92aWRlIHlvdSB3aXRoIHRoZSBuZWNlc3Nhcnkg
ZGV0YWlscyBvZiBob3cgdG8gYmVjb21lIG91ciBQYXltZW50IEFnZW50L1JlcHJlc2VudGF0aXZl
LlBsZWFzZSBnZXQgYmFjayB0byB1cyB1cmdlbnRseSB2aWEgc2FtZSBlbWFpbCBmb3IgZnV0aGVy
IHByb2NlZHVyZS4NCg0KWW91cnMgU2luY2VyZWx5LA0KDQpNci4gUGF1bCBSb2dlcnMNClNhbGVz
IE1hbmFnZXIvRGlyZWN0b3INCkdsb2JhbCBNZWRpY2FsIEVxdWlwbWVudHMKCi0tCk15IGxpZmUg
aGFzIGNoYW5nZWQuIFdoYXQgYWJvdXQgeW91cnM/CkxvZyBvbiB0byB0aGUgbmV3IEluZGlhdGlt
ZXMgTWFpbCBhbmQgTGl2ZSBvdXQgb2YgdGhlIEluYm94IQo=

                                                                                                                                                                                                                                                             
Delivered-To: XXXXXXXX@gmail.com
Received: by 10.141.27.20 with SMTP id e20cs23163rvj;
        Sat, 3 Nov 2007 14:17:58 -0700 (PDT)
Received: by 10.65.103.14 with SMTP id f14mr9546751qbm.1194124674231;
        Sat, 03 Nov 2007 14:17:54 -0700 (PDT)
Return-Path: <ahamedusman3@earthlink.net >
Received: from elasmtp-kukur.atl.sa.earthlink.net (elasmtp-kukur.atl.sa.earthlink.net [ 209.86.89.65])
        by mx.google.com with ESMTP id e14si2600185qbe.2007.11.03.14.17.51;
        Sat, 03 Nov 2007 14:17:54 -0700 (PDT)
Received-SPF: pass ( google.com: domain of ahamedusman3@earthlink.net designates 209.86.89.65 as permitted sender) client-ip=209.86.89.65 ;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ahamedusman3@earthlink.net designates 209.86.89.65 as permitted sender) smtp.mail=ahamedusman3@earthlink.net; domainkeys=pass (test mode) header.From=ahamedusman3@earthlink.net
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=dk20050327; d=earthlink.net;
  b=TL6jeiDSZOjKOA1s3tYcB8sGAA82WJC7JsyfY9sex+WEq9CPnQkK/cRuTUw5ODZf;
  h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP;
Received: from [ 209.86.224.37] (helo=elwamui-karabash.atl.sa.earthlink.net)
    by elasmtp-kukur.atl.sa.earthlink.net with asmtp (Exim 4.34)
    id 1IoQMp-0005qA-8a; Sat, 03 Nov 2007 17:17:19 -0400
Received: from 41.219.211.5 by webmail.pas.earthlink.net with HTTP; Sat, 3 Nov 2007 17:17:18 -0400
Message-ID: <9715848.1194124639088.JavaMail.root@elwamui-karabash.atl.sa.earthlink.net >
Date: Sat, 3 Nov 2007 22:17:18 +0100 (GMT+01:00)
From: AHAMED USAMAN ahamedusman3@earthlink.net
Reply-To: AHAMED USAMAN < ahamed_usman_cbn@yahoo.se>
Subject: PAYMENT NOTIFICATION/ FINAL ORDER
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: EarthLink Zoo Mail 1.0
X-ELNK-Trace: ca0c338c06869a5f0183b343fd1b5c254d2b10475b571120c597a517c60662dd81e086a5fa31d87c0cc5ab6c389b1c6b350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 209.86.224.37

CENTRAL BANK OF NIGERIA=20
FOREIGN OPERATIONS DEPARTMENT=20
TINUBU SQUARE , LAGOS NIGERIA .=20
TEL: 234-8023091922
E-mail: ahamed_usman_cbn@yahoo.se

Attn: Contractor                            =20

=20
                       PAYMENT NOTIFICATION/ FINAL ORDER:=20

This is to draw your attention that your fund is now ready for payment=20

but we have dictated a lot of irregularity involvements attached to=20

your payment file.=20

(1) Did you at any time delegate any body not even from your family to=20

claim your fund on your behalf?=20
(2) Were you involve in a motor accident?=20
(3) Are you aware or related to one Mr. Thomas Baker from your country?=20

Please reconfirm and answer the above questions because one Mr. Thomas=20

Baker came to our Foreign Payment Department and submitted an=20

application that you have authorized your fund to be paid into the=20

account of Oceanic Bank of Switzerland with Account number=20

SW-A943BDG99. Then he said that the earlier submitted bank account=20

information=C2=A2s for your payment will not be further used as you are now=
=20

paralyzed in the hospital as=20
a result of the ghastly motor accident you had last month.=20

Infect, after processing the application by Mr. Thomas Baker himself=20

which he made known to us that he came from you, he was anxiously ready=20

to clear all the bank charges that you are supposed to pay so as to=20

make sure that we effect this transfer payment as quickly as possible=20

without any further delay. All duplicate copies of his application=20

letter and=20
documents are attached to your files. Due to this reason, we have=20

decided to make this contact and verification to find out exactly what=20

is the true position of Mr. Baker's representation.=20

The delay in the transfer is from us now just because we requested for=20

a power of attorney from him which is an authorization from you, for=20

him to act on your behalf as regards to the pursue of this payment. He=20

asked for a week so as to submit the documents but up till now we have=20

not receive any of the documents from any of you, why? So you are=20

requested to acknowledge this department on your readiness to receive=20

your fund and forward to us a legal authorization (power of attorney)=20

for us to give the final payment instruction to credit your nominated=20

bank account in switzerland without further delay.=20

Thanks for your corporation.=20

Yours faithfully,=20
Alh. Ahmed usman=20
Director, Foreign Operation.