Re: new meds spam agaianst SARS viruses? this may help

2005-05-23 Thread Jeff Chan
On Sunday, May 22, 2005, 10:19:39 AM, Bookworm wrote:
 However, here's the chuckle part.  It's a quote from a NY Times article.

 But apparently even the swindlers have sometimes been stung. We accept
 Western Union Money Transfer as the only payment method due to some
 reasons from our past experiences, the fraudulent message says. Credit
 card is not acceptable, please. 

Western Union is abused by scammers.  The scammers often
illegitimately ask for a private number that's issued by Western
Union so that the bad guys can get their money without providing
any identification at the receiving end.

If you use Western Union, NEVER give out the private number they
give you.  That's only for your own use.  Without the private
number the bad guys must provide identification to Western Union
in order to get the money.  Presumably the bad guys like to
avoid that so they ask for the private number as part of their
scam.

Jeff C.
-- 
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/



Re: new meds spam agaianst SARS viruses? this may help

2005-05-22 Thread Bookworm

List Mail User wrote:


Follow the trail;  Chris Terrebonne's NFP Inc. - snakeoil and
spam/scammers of Slidell, LA - (985) 726-0928.  They've been around a very
long time (domains change weekly, but a few constants like remain
conradpromotions. com, rednecks. com and myownemail.com).  They used to
sell (but not deliver) pills - now mostly snakeoil.

Paul Shupak
[EMAIL PROTECTED]
 



Just as a chuckle - Last October, an NFP domain (winningteam.com) was
involved with a Green Card lottery scam.  (They probably got just a
little bit investigated by the State Department for that).

However, here's the chuckle part.  It's a quote from a NY Times article.

But apparently even the swindlers have sometimes been stung. We accept
Western Union Money Transfer as the only payment method due to some
reasons from our past experiences, the fraudulent message says. Credit
card is not acceptable, please. 

BW



new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread hamann . w


Hi,

I believe treatment of certain diseases should be left to physicians,
rather than to spam mails. The unique collection of dissimilar illnesses should
make for a good rule :)

Wolfgang

 begin spam  

The New Breakthrough of The Antidote 
PROVEN FORMULA Not available in any retail outlet - 

To Learn More please follow: 
http://www.fjtrsfer.us/fvd


Ships direct from the medical research facility. 
Kills all Known Viruses  Bacteria kept in the body as diseases before they 
attack. 


 *Common flus/colds 
 *Influenza 
 *SARS 
 *Cancer 
 *HIV 
 *Etc. 


The Antidote is the answer for virus/bacteria free-living. 


We are the only company in the world who have developed this product for sale. 
We're so confident you'll find it works that we offer a full-guarantee. 


To Learn More please follow: 
http://www.fjtrsfer.us/fvd


If you have received this and are not part of the Health Monthly Newsletter 
then follow. 

http://www.myfriend lyshop.com/gone/




Re: new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread jdow
It's Chinese in origin. Send a message to their ISP thanking them for
their order for 1000 Feng Shui information packets. Now that I have
your attention please note that ns006.bogebor.info, hosted on your
servers, is spamming the world with utterly bogus information.

Those in the US should cc the message to the Federal Death Administration
for their amusement.
{^_^}
- Original Message - 
From: [EMAIL PROTECTED]


 Hi,

 I believe treatment of certain diseases should be left to physicians,
 rather than to spam mails. The unique collection of dissimilar illnesses
should
 make for a good rule :)

 Wolfgang

  begin spam  

 The New Breakthrough of The Antidote
 PROVEN FORMULA Not available in any retail outlet -

 To Learn More please follow:
 http://www.fjtrsfer.us/fvd


 Ships direct from the medical research facility.
 Kills all Known Viruses  Bacteria kept in the body as diseases before
they attack.


  *Common flus/colds
  *Influenza
  *SARS
  *Cancer
  *HIV
  *Etc.


 The Antidote is the answer for virus/bacteria free-living.


 We are the only company in the world who have developed this product for
sale.
 We're so confident you'll find it works that we offer a full-guarantee.


 To Learn More please follow:
 http://www.fjtrsfer.us/fvd


 If you have received this and are not part of the Health Monthly
Newsletter then follow.

 http://www.myfriend lyshop.com/gone/





Re: new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread List Mail User
...

Hi,

I believe treatment of certain diseases should be left to physicians,
rather than to spam mails. The unique collection of dissimilar illnesses should
make for a good rule :)

Wolfgang

 begin spam  

The New Breakthrough of The Antidote 
PROVEN FORMULA Not available in any retail outlet - 

To Learn More please follow: 
http://www.fjtrsfer.us/fvd


Ships direct from the medical research facility. 
Kills all Known Viruses  Bacteria kept in the body as diseases before they 
attack. 


 *Common flus/colds 
 *Influenza 
 *SARS 
 *Cancer 
 *HIV 
 *Etc. 


The Antidote is the answer for virus/bacteria free-living. 


We are the only company in the world who have developed this product for sale. 
We're so confident you'll find it works that we offer a full-guarantee. 


To Learn More please follow: 
http://www.fjtrsfer.us/fvd


If you have received this and are not part of the Health Monthly Newsletter 
then follow. 

http://www.myfriend lyshop.com/gone/


Follow the trail;  Chris Terrebonne's NFP Inc. - snakeoil and
spam/scammers of Slidell, LA - (985) 726-0928.  They've been around a very
long time (domains change weekly, but a few constants like remain
conradpromotions. com, rednecks. com and myownemail.com).  They used to
sell (but not deliver) pills - now mostly snakeoil.

Paul Shupak
[EMAIL PROTECTED]



Re: new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread Gerald V. Livingston II
On Sat, 21 May 2005 16:06:25 -0700 (PDT) List Mail User wrote:

 Follow the trail;  Chris Terrebonne's NFP Inc. - snakeoil and
 spam/scammers of Slidell, LA - (985) 726-0928.  They've been around a very
 long time (domains change weekly, but a few constants like remain
 conradpromotions. com, rednecks. com and myownemail.com).  They used to
 sell (but not deliver) pills - now mostly snakeoil.
 
 Paul Shupak
 [EMAIL PROTECTED]

A, the group that makes me think firebombing may be an acceptable
deterrent for use in discouraging people who may consider spamming as a
source of income. The most hated housewife in America.

Gerald



Re: new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread List Mail User
...

On Sat, 21 May 2005 16:06:25 -0700 (PDT) List Mail User wrote:

 Follow the trail;  Chris Terrebonne's NFP Inc. - snakeoil and
 spam/scammers of Slidell, LA - (985) 726-0928.  They've been around a very
 long time (domains change weekly, but a few constants like remain
 conradpromotions. com, rednecks. com and myownemail. com).  They used to
 sell (but not deliver) pills - now mostly snakeoil.
 
 Paul Shupak
 [EMAIL PROTECTED]

A, the group that makes me think firebombing may be an acceptable
deterrent for use in discouraging people who may consider spamming as a
source of income. The most hated housewife in America.

Gerald


For long time followers, there was one actually a link from a 
Mary Kay Cosmetics page into their realm (one of the pharmacies they
used to run).  Anyway, most of the new domains registered in China by
bizcn and are fake names or operated directly by bizcn (stong ties with
4everdns. com for most new stuff).

Paul Shupak
[EMAIL PROTECTED]


Re: new meds spam agaianst SARS viruses? this may help

2005-05-21 Thread List Mail User
Just a little more history on Chris Terrebonne:  The page at

http://www.ipswitch.com/support/utilities.html

has a list of tools used to harvest email accounts and user names written
by Chris Terrebonne (though quite a while ago, and most are no longer
available - reasons not given).

Some more good history (dates of some details back to 1992) at

http://www.shigh.co.kr/product/imail/casestudy/casestudy5.htm

Paul Shupak
[EMAIL PROTECTED]

P.S.  No one should get confused with the Chris Terrebonne, who is associated
with the U.S. Olympic Committee and the United States Field Hockey Association.
That is a different person with the same name.


'meds' spam

2004-11-18 Thread Peter Campion-Bye

The only spam that's getting through on my system these days seems to have
'meds' and 'rx' in common. I would have thought that antidrug was the
ruleset to pick up stuff such as this:

--Spam Start---
Subject: meds saving zone

your assorted meds at better than Canadian pricing

A wide variety of medications for your paticular
eyes...Depression-Anxiety,
Muscle Relaxants, Pain Relief, Sexual Health, Sleeping Aids, drugs for
weight reduction, allergy...

overnight delivery for meds

gorgeous service for quality rx meds at low price

Internet pharmacy really makes things easier for me. Now I don't even step
out of the room to get rx refilled and meds delivered to my door.  --Delta
--Spam End-

but this message scores nothing for content, apart from BAYES_80 which is
not enough to push it over the threshold...

  X-Spam-Score: 3.19 BAYES_80,RCVD_IN_SBL,SPF_HELO_PASS,URIBL_SBL

Is there a ruleset I should be using to pick this stuff up?
I've put in a custom rule to pick up meds in the subject:

header  PCB_MEDSSubject =~ /(?:\bmeds|meds\b)/i
describePCB_MEDSSubject contains meds
score   PCB_MEDS5

Before I start adding body rules to pick up words like those in the
message above, is there already something around that does the job?
Thanks


Re: 'meds' spam

2004-11-18 Thread Matt Kettler
At 11:35 AM 11/18/2004 +, Peter Campion-Bye wrote:
I've put in a custom rule to pick up meds in the subject:
header  PCB_MEDSSubject =~ /(?:\bmeds|meds\b)/i
describePCB_MEDSSubject contains meds
score   PCB_MEDS5
erm.. I'd STRONGLY suggest \b's on both, not one end.
The above will match any word beginning with, or ending in meds.
I'd also suggest matching medz as well as meds:
 /\bmed[sz]\b/i
Note that \b does not require a space, so it will match meds at the start 
or end of a line just fine. \b is just a word boundary requirement. 
Punctuation also counts as a word boundary... so it will match :meds just 
fine too.