Welcome to www [  [ net!

     Modules
· Home
· AvantGo
· Content
· Feedback
· Forums
· Journal
· Members List
· Private Messages
· Recommend Us
· Search
· Statistics
· Stories Archive
· Submit News
· Surveys
· Top 10
· Topics
· Web Links
· 

     Who's Online
There are currently, 3 guest(s) and 0 member(s) that are online.

You are Anonymous user. You can register for free by clicking

     Content Categories
· Features (1)
· InfoSec (2)
· Spicey Chicken Cartel (8)

     Amazon


 MORE stupid personalized spam, revealed (and skewered)

spam, Skewered

Oct 12 2003 Update: I have received evidence, which I feel is credible, that the spams from DegreeInfo and Wholintegral are not the work of Chip White, and that in fact Chip White and DegreeInfo.com have been victims of what is known as a 'joe-job'. I am preparing a follow-up article, which should be available RSN. While I am leaving this article more or less intact, I want to make it clear that I do not consider Chip White to be a spammer, and that any references to Mr. White, Wholintegral, and DegreeInfo.com should be considered 'pointers' to the real spammers, who have committed what is, in my opinion, character assassination.


If at first you don't succeed, try, try again...

This must be the philosophy of ''Chip White'', spammer ordinaire. For, after I skewered one of his 'personalized' spams on this very site, he goes off and sends me another one. The reason it took me so long to write this one up was that (1) I had to pick myself off the floor after I quit laughing, and (2) I saved the spam away, then forgot where I saved it to. Oh well.



Anyway, Without Further Ado: The Spam!


Return-Path:

Right out of the starting gate, we can tell that the Chipster is still abusing open proxy servers (compare the Return Path: header above to our earlier example.)

Received: from psmtp.com (exprod5mx22.postini.com [64.75.1.137])
by (8.10.2/8.10.2) with SMTP id h1H1gcA22101
for <[the.me]@.net>; Sun, 16 Feb 2003 19:42:38 -0600
Received: from source ([]) by exprod5mx22.postini.com ([64.75.1.245]) with SMTP;
Sun, 16 Feb 2003 17:42:40 PST

These headers are legit, and show the mail coming from the server in Japan to my server, via Postini. Lest you think that Postini does a poor job of filtering spam, let it be known that I keep the settings pretty liberal, as I need some spam to skewer.

Received: (from httpd @ localhost)
by ns36.kabir-ken.com (8.10.2/8.10.2) id h1H1gaf29042;
Mon, 17 Feb 2003 10:42:36 +0900

This is simply the proxy server handing off the email to the SMTP server running on the same box.

Received: from mail-gw.biglobe.ne.jp (mailsv15.biglobe.ne.jp [2])
by mail2s.biglobe.ne.jp (8.9.1+3.1W/3.7W-99020213) with ESMTP id CAA01931
for <[the.me]@.net>; Mon, 17 Feb 2003 10:42:36 +0900 (JST)
Received: from mail-relay.biglobe.ne.jp by mail-gw.biglobe.ne.jp (8.8.8/3.6W-INET_GW)
id CAA22785 for <[the.me]@.net>; Mon, 17 Feb 2003 10:42:36 +0900 (JST)
Received: from mvf.biglobe.ne.jp by mail-relay.biglobe.ne.jp (8.8.8/3.6W-BIGLOBE_RELAY)
id CAA00201 for <[[email protected]>; Mon, 17 Feb 2003 10:42:36 +0900 (JST)

These last 3 Received: headers are most likely forgeries. Note the fact that they have the exact same time stamp as the one above them - email travels fast, but not THAT fast! In addition, some of the host names do not resolve, the format of the Received: lines is not consistent with the others, those IP addresses that are shown don't make a proper chain (you can't follow the path from SMTP server to SMTP server.)

DATE: Mon, 17 Feb 2003 10:42:36 +0900 (JST)

Note the date / time stamp on this header is the same as the Received: headers above.

Message-ID: <000001bjhb8768768d24cd85 @ rwm22051>
X-Mailer: Becky! Ver 1.24.16

I checked for info on this mailer, all I got was a bunch of pages that looked like emails, with many of them from the Far East (Japan/Taiwan/East Asia.) Many of the ones I could read mentioned ''spam'', so this may be indicative of a specific spamhaus or spamware product.

MIME-Version:
To: [the.me]@.net
From:
Reply-To:
Subject: TOLD YOU WILL DIE? WE CAN CURE YOU

YOU CAN? I am all ears. (Actually, that is my son, in his clown costume. The resemblance is so 'eerie', it scares me. But, I digress...)

Dear [name]

Well, hello there, [derogatory term for spammer]

We can HEAL your cancer. GUARANTEED!*

You CAN?*

We are located at 6929 Stockton Avenue, in El Cerrito, CA
(about 5 minutes north of Berkeley, and 20 minutes from San Francisco)

This is your brain, on second-hand marijuana smoke...

for those facing the challenges of serious degenerative diseases
including cancer, arthritis, heart disease, MS, lupus, and many other
disorders. Not too far from [location] where you live.

According to Continental Airlines, only about 1,650 miles.

Visit our sites.

http://www.wholintegral.com
http://www.awhw.com
http://www.ascentwellness.com

You are facing the challenges of a degenerative disease? We know how you
feel [name], and we CAN CURE YOU*.

You DO, [derogatory term for spammer]? YOU CAN?!?*

You'll learn about residential and outpatient options for healing the
whole person, read stories of recovered patients who were facing
challenges similar to yours [name], and find out how you can arrange for
Wholintegral treatment. Extraordinary results are possible.

TOLD YOU WILL DIE [name]? You WILL NOT, we guarantee it*

I know some folks on Death Row in Texas who would like to take you up on that guarantee.

Numerous patients, told that they would die, have successfully used the
elements of Wholintegral treatment to overcome such difficult diseases
as metastasized melanoma, breast cancer, lung cancer, rheumatoid
arthritis, lupus erythematosus, breast cancer, prostate cancer, heart
disease, colorectal cancer, and many other disorders, living healthy,
active lives for ten, twenty, thirty -- in some cases as much as sixty
years after being told they would die.

''Wholintegral''? I looked that up on as well, and can't find any instance of this word that isn't associated with our friend from degreeinfo.com,

President

Chip White

Also owner and Administrator of the worlds most popular distance
learning forum. http://www.degreeinfo.com

Ah, yes. Cure your Deadly Disease, and Get A PhD in Criminal Justice, or an Associates Degree in Accounting or Web Design, Too!

Please DO NOT REPLY to this email, visit our sites only.

*No treatment has a 100% guarantee.

But, but...[splutter] I thought you GUARANTEED it?!?* Oh, maybe that was only a 20% guarantee, sort of like weather forecasters use.

..BCC hidden for confidentiality. This is not spam.

Horse[expletive]


So, the self-proclaimed King of the Degree Mills and snake oil salesman, Chip White, is trying out his latest scam on us. Some day, he will figure out how to push this thing as an MLM, and then he will Make $$$$MONEY$$$$$ FA$T!

Oops, I don't want to give him any ideas, now, do I?

Anyway, I thought I would post my own response to Mr. White and his 'medical miracle workers', right here for all to read:


Dear [spammer]

I received your latest spew, titled [title of spam]. I am as unamused by this [digital excrement] as I was by the previous missives you have sent me. Despite your pathetic bleatings to the contrary, this IS spam, and I don't like you filling my inbox with the stuff. TOLD YOUR INTERNET ACCESS WILL DIE, [spammer]? I GUARANTEE IT!*

By the way, [derogatory term for spammer], do you know that, to practice medicine in the State of California, you are REQUIRED to have a valid Medical License? And, if you don't, you might be entitled to an All Expenses-Paid Vacation to San Quentin, where you will be placed in a residential program and share a bunk with a d00d named ''Spike'', who will make you his [female dog]? 100% GUARANTEED*

Of course, after your time with ''Spike'', you just may require the [run-on word that sounds fancy but makes no sense] services of your medical center / degree quacktory. GUARANTEED!*

Regards,
-etee

* No guarantee is 100%, but... Do You Feel Lucky Today, [spammer]?




 
     Login
Don't have an account yet? You can . As a registered user you have some advantages like theme manager, comments configuration and post comments with your name.

     Related Links
· More about spam, Skewered
· News by etee


Most read story about spam, Skewered:
URGENT 'Nigeria-419' Scam from South Africa


     Article Rating
Average Score: 0
Votes: 0



     Options

 Printer Friendly Page  Printer Friendly Page

 Send to a Friend  Send to a Friend


Sorry, Comments are not available for this article.




Web site powered by PHP-Nuke

All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2003 by
You can syndicate our news using the file backend.php or ultramode.txt
Web site engine's code is Copyright © 2003 by PHP-Nuke. All Rights Reserved. PHP-Nuke is Free Software released under the GNU/GPL license.
Page Generation: 0.144 Seconds