Article View: ucam.comp.mail
Article #4Another nasty scam
From: DR de Lacey
Date: Fri, 21 May 2004 08:04
Date: Fri, 21 May 2004 08:04
71 lines
3340 bytes
3340 bytes
[fu to cam.misc in case any interested party can't access ucam groups]
Just received a confirmation of an order I never placed, stating that my
bank account will be debited �1099.99 and with a url to track my order
or query it. Company calls itself SunLight Electronics of London: no
address or phone no of course.
I'd almost have been taken in were not the message (a) sent to a number
of @cam addresses and (b) sent again in a different name to a different
randon set of @cam addresses.
The helo appears to be unforged so tele.dk will be informed; the other
copy is better disguised and from ja.net on traceroute only gives
numerical addresses.
Shorn of the list of addresees, the message is:
Return-path: <shyefq@msn.com>
Envelope-to: del2[at]cus.cam.ac.uk
Delivery-date: Fri, 21 May 2004 01:36:47 +0100
Received: from gold.csi.cam.ac.uk ([131.111.8.12])
by virgo.cus.cam.ac.uk with esmtp (Exim 4.34)
id 1BQy1n-0007HS-Dg
for del2[at]cus.cam.ac.uk; Fri, 21 May 2004 01:36:47 +0100
Received: from [195.215.119.67] (helo=0xc3d77743.rdonxr1.ras.tele.dk)
by gold.csi.cam.ac.uk with smtp (Exim 4.20)
id 1BQy1b-0004aY-PG; Fri, 21 May 2004 01:36:37 +0100
Received: from 16.188.87.112 by 195.215.119.67; Thu, 20 May 2004
19:30:43 -0600
Message-ID: <AMUTAPKSWYSKGXCLAYUYRRD@yahoo.com>
From: "Krista Bright" <shyefq@msn.com>
Reply-To: "Krista Bright" <shyefq@msn.com>
To: [blah]
Subject: Order summary
Date: Fri, 21 May 2004 03:30:43 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--902407520343648871"
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
X-Cam-AntiVirus: No virus found
X-Cam-SpamDetails: scanned, SpamAssassin (score=2.1, RAZOR2_CHECK 2.06)
X-Cam-SpamScore: ss
Thank you for your order!
You order summary:
IBM ThinkPad R50 Intel Pentium 1700 Mhz
512Mb RAM, 40 Gb Hard Drive, 15 " TFT XGA, 64Mb Shared Graphics, MS
Works 7.0 Software, 5 x USB Connections, Windows XP Home
Edition,
1 Year Free Warranty
Your bank account is billed for:
�1099.99 (inc. VAT)
Your order would be shipped to the address confirmed at order.
To track your order visit:
http://sunairthebest.org/index.html?trackorder=29992kkE999
To cancel or delay the order visit:
http://sunairthebest.org/index.html?stoporder=29992kkE999
Thank you for choosing Sun Light Electronics!
SunLight Electronics
London UK
http://sunairthebest.org/
Technical Details
Message-ID:
<c8kd4p$hs3$1@pegasus.csx.cam.ac.uk>Path:
arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!newshub.sdsu.edu!logbridge.uoregon.edu!feed3.jnfs.ja.net!jnfs.ja.net!pegasus.csx.cam.ac.uk!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII X-Google-Thread: 102f53,99c1a8ad650e2532,start X-Google-Attributes: gid102f53,public Path: arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!newshub.sdsu.edu!logbridge.uoregon.edu!feed3.jnfs.ja.net!jnfs.ja.net!pegasus.csx.cam.ac.uk!not-for-mail From: DR de Lacey <del2@cam.ac.uk> Newsgroups: ucam.comp.mail,ucam.misc,cam.misc Subject: Another nasty scam Followup-To: cam.misc Date: Fri, 21 May 2004 09:04:12 +0100 Organization: University of Cambridge, England Lines: 72 Message-ID: <c8kd4p$hs3$1@pegasus.csx.cam.ac.uk> NNTP-Posting-Host: venn.csi.cam.ac.uk Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 X-Accept-Language: en