Thread View: ucam.comp.mail
2 messages
2 total messages
Started by DR de Lacey
Fri, 21 May 2004 08:04
Another nasty scam
Author: DR de Lacey
Date: Fri, 21 May 2004 08:04
Date: Fri, 21 May 2004 08:04
71 lines
3340 bytes
3340 bytes
[fu to cam.misc in case any interested party can't access ucam groups]
Just received a confirmation of an order I never placed, stating that my
bank account will be debited �1099.99 and with a url to track my order
or query it. Company calls itself SunLight Electronics of London: no
address or phone no of course.
I'd almost have been taken in were not the message (a) sent to a number
of @cam addresses and (b) sent again in a different name to a different
randon set of @cam addresses.
The helo appears to be unforged so tele.dk will be informed; the other
copy is better disguised and from ja.net on traceroute only gives
numerical addresses.
Shorn of the list of addresees, the message is:
Return-path: <shyefq@msn.com>
Envelope-to: del2[at]cus.cam.ac.uk
Delivery-date: Fri, 21 May 2004 01:36:47 +0100
Received: from gold.csi.cam.ac.uk ([131.111.8.12])
by virgo.cus.cam.ac.uk with esmtp (Exim 4.34)
id 1BQy1n-0007HS-Dg
for del2[at]cus.cam.ac.uk; Fri, 21 May 2004 01:36:47 +0100
Received: from [195.215.119.67] (helo=0xc3d77743.rdonxr1.ras.tele.dk)
by gold.csi.cam.ac.uk with smtp (Exim 4.20)
id 1BQy1b-0004aY-PG; Fri, 21 May 2004 01:36:37 +0100
Received: from 16.188.87.112 by 195.215.119.67; Thu, 20 May 2004
19:30:43 -0600
Message-ID: <AMUTAPKSWYSKGXCLAYUYRRD@yahoo.com>
From: "Krista Bright" <shyefq@msn.com>
Reply-To: "Krista Bright" <shyefq@msn.com>
To: [blah]
Subject: Order summary
Date: Fri, 21 May 2004 03:30:43 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--902407520343648871"
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
X-Cam-AntiVirus: No virus found
X-Cam-SpamDetails: scanned, SpamAssassin (score=2.1, RAZOR2_CHECK 2.06)
X-Cam-SpamScore: ss
Thank you for your order!
You order summary:
IBM ThinkPad R50 Intel Pentium 1700 Mhz
512Mb RAM, 40 Gb Hard Drive, 15 " TFT XGA, 64Mb Shared Graphics, MS
Works 7.0 Software, 5 x USB Connections, Windows XP Home
Edition,
1 Year Free Warranty
Your bank account is billed for:
�1099.99 (inc. VAT)
Your order would be shipped to the address confirmed at order.
To track your order visit:
http://sunairthebest.org/index.html?trackorder=29992kkE999
To cancel or delay the order visit:
http://sunairthebest.org/index.html?stoporder=29992kkE999
Thank you for choosing Sun Light Electronics!
SunLight Electronics
London UK
http://sunairthebest.org/
Re: Another nasty scam
Author: Jón Fairbairn
Date: Fri, 21 May 2004 09:07
Date: Fri, 21 May 2004 09:07
59 lines
2958 bytes
2958 bytes
DR de Lacey <del2@cam.ac.uk> writes: > [fu to cam.misc in case any interested party can't access ucam groups] > Just received a confirmation of an order I never placed, > stating that my bank account will be debited �1099.99 and > with a url to track my order or query it. I got one too. Where yours has > From: "Krista Bright" <shyefq@msn.com> mine has "From: "Rory Bower" <effvoygawckc@hotmail.com>" but otherwise looks much the same > Company calls itself SunLight Electronics of London: no > address or phone no of course. whois sunairthebest.org says: ... Registrant ID:D108490598178149 Registrant Name:LEW inc Registrant Organization:LEW inc Registrant Street1:200 Sutton Passeys Crescent Registrant City:Wollaton Registrant State/Province:NA Registrant Postal Code:NG8 1DZ Registrant Country:GB Registrant Phone:+44.07899980958 Registrant FAX:+613.86242499 Registrant Email:hillaryjknowles@yahoo.co.uk Admin ID:D108490598178146 Admin Name:Hillary Knowles Admin Organization:LEW inc Admin Street1:200 Sutton Passeys Crescent Admin City:Wollaton Admin State/Province:NA Admin Postal Code:NG8 1DZ Admin Country:GB Admin Phone:+44.07899980958 Admin Email:hillaryjknowles@yahoo.co.uk ... > I'd almost have been taken in were not the message (a) sent > to a number of @cam addresses and (b) sent again in a > different name to a different randon set of @cam addresses. What would have happened if you had been "taken in"? The random-looking part of the URLs > http://sunairthebest.org/index.html?trackorder=29992kkE999 > > To cancel or delay the order visit: > > http://sunairthebest.org/index.html?stoporder=29992kkE999 in the one you got is the same as mine, so they aren't even going to get much information if you follow the link. -- J�n Fairbairn Jon.Fairbairn@cl.cam.ac.uk http://www.chaos.org.uk/~jf/Stuff-I-dont-want.html (updated 2004-03-03)
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads