Would anyone go to this much bother to spam me?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Dec 30, 2009 5:08 am

I placed an add to sell a car on Craigslist and received a few spam/scam replies. One was just a weak attempt to get me over to a "work from home" site. Another was from someone who claimed she was named Angelena. We exchanged a few emails where she asked if the car was available, etc. But then she sent this:

Quote:

Delivered-To: [email protected]
Received: by 10.231.8.150 with SMTP id h22cs28295ibh;
Sat, 26 Dec 2009 07:00:50 -0800 (PST)
Received: by 10.224.25.3 with SMTP id x3mr6758016qab.159.1261839649859;
Sat, 26 Dec 2009 07:00:49 -0800 (PST)
Return-Path: <[email protected]>
Received: from snt0-omc2-s14.snt0.hotmail.com (snt0-omc2-s14.snt0.hotmail.com [65.55.90.89])
by mx.google.com with ESMTP id 2si27393050qwi.17.2009.12.26.07.00.49;
Sat, 26 Dec 2009 07:00:49 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.90.89 as permitted sender) client-ip=65.55.90.89;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.90.89 as permitted sender) [email protected]
Received: from SNT135-W25 ([65.55.90.71]) by snt0-omc2-s14.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 26 Dec 2009 07:00:45 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_70c6408f-288f-4d8e-91f8-439ebca1fc6d_"
X-Originating-IP: [201.164.230.36]
From: Angelena White <[email protected]>
To: Scott Salmon <[email protected]>
Subject: RE: 2005 TOYOTA CAMRY
Date: Sat, 26 Dec 2009 15:00:45 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References:
<[email protected]>,<[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 26 Dec 2009 15:00:45.0734 (UTC) FILETIME=[33B80C60:01CA863C]

--_70c6408f-288f-4d8e-91f8-439ebca1fc6d_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi There

Great When is a good time for me to come take a look?

I need to make sure I can afford the insurance but I couldn't get this quote to work on my dial up connection. (slowww) Can you do me a huge favor and go to Auto Quotes and see how much the average quote is for our area?

Let me know!

The part I made blue was a titled link. The url behind it was:

http://www.premiumsearchresults.cXm
(change the .cXm to .com if you want to check it out, but do it at your own risk. I wasn't brave enough to click on it.)

IP checked to Mexico (I think).

Here is the whois:

Quote:

Registration Service Provided By: NameCheap.com
Contact: [email protected]
Visit: http://www.namecheap.com

Domain name: PREMIUMSEARCHRESULTS.COM

Registrant Contact:
WhoisGuard
WhoisGuard Protected ()

Fax:
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US

Administrative Contact:
WhoisGuard
WhoisGuard Protected ([email protected])
+1.6613102107
Fax: +1.6613102107
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US

Technical Contact:
WhoisGuard
WhoisGuard Protected ([email protected])
+1.6613102107
Fax: +1.6613102107
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US

Status: Locked

Name Servers:
dns1.registrar-servers.com
dns2.registrar-servers.com
dns3.registrar-servers.com

Creation date: 23 Dec 2009 18:10:20
Expiration date: 23 Dec 2010 18:10:20

I don't know much about attack/spam/scam sites, but that looks pretty dodgy to me.

Again, I never clicked on the link, instead I told her how much I pay for insurance and I never heard from her again so no harm done. Still I'm curious about why anyone would try to bait me into clicking a link. Confused