ar Deadbeats Hall of Lame - 2011 Phish Scam Edition
Anti-Spam The Deadbeats Hall of Lame
Warning: Not all menu items are working. We're working on this but this site is a low-priority project.
Want to do some recording? On-Site recording available, up to 48 tracks with full mixdown and mastering capabilities.

Deadbeats' Hall of Lame
2011 Phish Scam Edition

WARNING!

Do not sign me up for any mail lists. Studio42 does not accept such unsolicited business. Also, since I've recently been getting a flood of such e-mail from various people and organizations I don't wish to deal with, their names will end up here, along with their home and business addresses, and phone numbers, whenever possible.
Please realize that 99.9% of internet users DON'T want your crap in our e-mail boxes.
Minimum fine for violation of this policy allows me to legally bill/invoice for $500 and this can be escalated to a court of law.

This page created on January 9. 2011


Subject: Account Summary Alert Re-activation From Chase
Date:        1/9/2011 02:01
Received:    1/9/2011 21:35
From:        Chase Online, Chase@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Raping Taiwan from Multilinksin Nigera to pretend to be a bank and to
do the scam on a movie site. 1 of 3


  • See the lookups

    
Subject: Account Summary Alert Re-activation From Chase
Date:        1/9/2011 05:19
Received:    1/9/2011 21:37
From:        Chase Online, Chase@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Raping Taiwan from Multilinksin Nigera to pretend to be a bank and to
do the scam on a movie site. 2 of 3


  • See the lookups

    
Subject: Account Summary Alert Re-activation From Chase
Date:        1/9/2011 06:47
Received:    1/9/2011 21:36
From:        Chase Online, Chase@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Raping Taiwan from Multilinksin Nigera to pretend to be a bank and to
do the scam on a movie site. 2 of 3


  • See the lookups

    
Subject: Security of all our Microsoft Outlook Web Access Users
Date:        1/19/2011 05:35
Received:    1/19/2011 09:33
From:        LUGGERI M. (555058), M.LUGGERI.555058@swansea.ac.uk
To:          noreply@microsoftoffice.org


  • See the spam

British Phisher using a GoDaddy-registered domain that uses Google drop.
Site hosted by InforTech in California


  • See the lookups

    
Subject: Upgrade Your Account.
Date:        1/31/2011 09:30
Received:    1/31/2011 09:32
From:        Mariann Schmudde, mschmudd@stetson.edu
To:          undisclosed-recipients:;


  • See the spam

Raping a blind server at a school in Florida for a site hosted on WebNX in California,
registered in the UK via GoDaddy.


  • See the lookups

    
Subject: ECHOWEB.NET WEBMAIL TEAM SUPPORT UPDATE/MAINTENANCE OF USER ACCOUNT
Date:        2/7/2011 03:13
Received:    2/7/2011 17:36
From:        UPGRADE ECHOWEB.NET WEBMAIL TEAM, webmaster@echoweb.net
Reply-To:    webmal.accounts@pwdh.net
To:          undisclosed-recipients:;


  • See the spam

Spammer from California ISP AnchoFree raping a service in Canada.


  • See the lookups

    
Subject: Action Required, Schedules Maintainance
Date:        2/14/2011 22:58
Received:    2/14/2011 23:02
From:        Lloyds TSB, customerservices@lloydstsb.com
To:          undisclosed-recipients:;


  • See the spam

New Zealand rape through AT&T's network via a retard block in Texas.
Scam wants to be British, yet is safe-havened by the Dutch.
Spam sent by Ross Marketing Assoc.


  • See the lookups

    
Subject: ****Update Your Webmail Account****
Date:        2/16/2011 18:51
Received:    2/16/2011 19:56
From:        WebMail HelpDesk, info@helpdesk.com
Reply-To:    supportemail@mail2webmaster.com
To:          undisclosed-recipients:;


  • See the spam

Abusing Australia via an ISP located in North Carolinia


  • See the lookups

    
Subject:
Date:        2/24/2011 16:07
Received:    2/24/2011 16:03
From:        Tate, Timothy O., Ozzie.Tate@cityofdenton.com
To:          undisclosed-recipients:;


  • See the spam

Phish scam from Texas involving a Dutch redirector that points deeep into Microsoft.


  • See the lookups

    
Subject: System Administrator
Date:        3/1/2011 04:28
Received:    3/1/2011 09:35
From:        JABR, Samar, S.JABR@UNRWA.ORG
To:          info@SystemAdministrator.org


  • See the spam

Spammer uses an ISP in Jordan with no whois contact, for a site already 404 on
a Russian ISP that doesn't lists any whois contacts.


  • See the lookups

    
Subject: Halifax Bank. Important Update
Date:        3/14/2011 03:51
Received:    3/14/2011 10:03
From:        help_desk@halifax.co.uk, help_desk@halifax.co.uk
To:          undisclosed-recipients:;


  • See the spam

Pretending to be a British bank, but is sending trash from AT&T's network, which is based in Texas, through New Zealand. Domain owner is listing an Illinois address and a Yahoo drop.
Domain is registered through Register.com and is hosted by SoftLayer.
This spam is a documented second phish scam from a netblock listed as Ross Marketing Assoc.,
which is also what sent this spam


  • See the lookups

    
Subject: Halifax E-mail Alert !
Date:        3/15/2011 03:49
Received:    3/15/2011 12:41
From:        help_desk@halifax.co.uk, help_desk@halifax.co.uk
To:          undisclosed-recipients:;


  • See the spam

Ross Marketing Assoc. from AT&T in Texas lets this dirtbag continue to abuse New Zealand.
Site is registered through Gandi to a Brazilian and is hosted in the European Union, which
isn't specific enough. The phone number leads to Germany.


  • See the lookups

    
Subject: Your Webmail Account awaits de-activation
Date:        3/28/2011 05:42
Received:    3/28/2011 09:51
From:        Ruth PEATTIE, RPEATTIE@clapton.hackney.sch.uk
To:          noreply@microsoftoffice.org, noreply@microsoftoffice.org


  • See the spam

Phish scam from the UK for a site located with a marketting firm in California.


  • See the lookups

    
Subject: Your mailbox has exceeded the storage limit
Date:        4/11/2011 03:56
Received:    4/11/2011 08:05
From:        Nolen, Fred M, Fred.Nolen@ws.edu
To:          info@update.org, info@update.org


  • See the spam

Spammer rapes a blind school and uses a Google site for the deed.


  • See the lookups

    
Subject: YOUR ACCOUNT SUMMARY
Date:        4/11/2011 07:08
Received:    4/11/2011 08:06
From:        Alliance-Leicester, noreply@alliance-leicester.co.uk
To:          undisclosed-recipients:;


  • See the spam

Webmaster won't be fooled by spammers.
Abuse of New Zealand from the UK. Spammer's site is hosted on GoDaddy in Arizona and
registered to some organization in Texas.


  • See the lookups

    
Subject: YOUR ACCOUNT SUMMARY
Date:        4/11/2011 06:52
Received:    4/11/2011 10:09
From:        Alliance-Leicester, noreply@alliance-leicester.co.uk
To:          undisclosed-recipients:;


  • See the spam

The anti-spam account isn't amused either with a repeat of this spam.
Abuse of New Zealand from the UK. Spammer's site is hosted on GoDaddy in Arizona and
registered to some organization in Texas.
The New Zealand ISP's block has now been blacklisted and should never be able to deliver here
again.


  • See the lookups

    
Subject: Your Summary status
Date:        4/12/2011 02:29
Received:    4/12/2011 08:44
From:        TD WATERHOUSE, noreply@tdwaterhouse.co.uk
To:          undisclosed-recipients:;


  • See the spam

Despite sending this one and this one, both the New Zealand ISP and the UK ISP
have flat out refused to do nothing. Through some sort of over-sight, I failed to block
this trash from coming in.
The web site is now Indian via country code, but happily hosted in the Ukraine.


  • See the lookups

    
Subject: Webmail Account Update
Date:        4/22/2011 19:39
Received:    4/21/2011 23:36
From:        Webmaster, info@webmaster.com
Reply-To:    web@cyber-wizard.com
To:          undisclosed-recipients:;


  • See the spam

Phishing via New York though a UK server.


  • See the lookups

    
Subject: Webmail Account Update
Date:        4/22/2011 21:25
Received:    4/22/2011 06:49
From:        Webmaster, info@webmaster.com
Reply-To:    web@cyber-wizard.com
To:          undisclosed-recipients:;


  • See the spam

Phishing via New York though a UK server.
A repeat of this one but with a different server on the same UK ISP taking the relay.


  • See the lookups

    
Subject: Helpdesk Require Your Quick Response
Date:        4/30/2011 03:24
Received:    5/2/2011 09:08
From:        Lynn Duffield, MSW, LCSW, LynnD@lfcs.org
To:          undisclosed-recipients:;


  • See the spam

Spammer rapes a church that has a blind server. It appears the church is on Texas, as well
as AT&T, which is the church's ISP. Spammer pushes a  web site that appears to already
be shut down.


  • See the lookups

    
Subject: Helpdesk Require Your Quick Response
Date:        5/2/2011 08:20
Received:    5/2/2011 10:58
From:        Smith, William E, wesmith@tva.gov


  • See the spam

Same as above but they abuse government resources in Tennessee to spew forth crap this
time. They forgot the URL though.


  • See the lookups

    
Subject:
Date:        5/8/2011 13:29
Received:    5/8/2011 13:25
From:        Korssjżen Mari Ann	, mari-ann.korssjoen@trondheim.kommune.no
To:          undisclosed-recipients:;


  • See the spam

Raping Norway via blind services. Site is on Hurricane Electric in California.


  • See the lookups

    
Subject: System Administrator
Date:        5/10/2011 04:01
Received:    5/10/2011 07:45
From:        Culbertson, Amos V. (AVCULBERTSON), AVCULBERTSON@fortlewis.edu
To:          info@webupgrade.org, info@webupgrade.org


  • See the spam

1 of two involving raping a blind school. Spanish URL, but part of the British Virgin Islands.
School is in Colorado.


  • See the lookups

    
Subject: System Administrator
Date:        5/10/2011 04:13
Received:    5/10/2011 07:49
From:        Culbertson, Amos V. (AVCULBERTSON), AVCULBERTSON@fortlewis.edu
To:          info@webupgrade.org, info@webupgrade.org


  • See the spam

2 of two involving raping a blind school. Spanish URL, but part of the British Virgin Islands.
School is in Colorado.


  • See the lookups

    
Subject: System Administrator
Date:        5/11/2011 10:05
Received:    5/11/2011 10:13
From:        Ashlee L. Gunter, algunter@nola.gov
To:          info@webupgarde.org


  • See the spam

Different rape, but same as this trash and this trash.
Raping Cisco in California via an idiot network on downstream Level3.
Again, Spanish web site is hosted in the British Virgin Islands.

1 of 2.


  • See the lookups

    
Subject: System Administratore
Date:        5/11/2011 10:04
Received:    5/11/2011 10:19
From:        Ashlee L. Gunter, algunter@nola.gov
To:          info@webupgarde.org


  • See the spam

Different rape, but same as A HREF="#2011-00200">this trash and this trash.
Raping Cisco in California via an idiot network on downstream Level3.
Again, Spanish web site is hosted in the British Virgin Islands.

2 of 2 so far. I see a pattern I can block with.


  • See the lookups

    
Subject: Helpdesk Require Your Quick Response
Date:        5/19/2011 13:29
Received:    5/19/2011 16:53
From:        Kalick, Scott, SKalick@meridianhealth.com
To:          undisclosed-recipients:;


  • See the spam

Spammer rapes a blind server in New Jersey.
Site appears to be Hungarian, but is actually in the British Virgin Islands, which would
therefore tie this spam to this one and this one.


  • See the lookups

    
Subject: **** Increase Your MailBox Capacity ****
Date:        5/20/2011 07:08
Received:    5/20/2011 09:36
From:        James Roger Madalena, jrmadalena@fsipinc.org
To:          undisclosed-recipients:;


  • See the spam

Abusing a blind server in Colorado from Time Warner for a phish site on
Google's network in California.


  • See the lookups

    
Subject: **** Increase Your MailBox Capacity ****
Date:        5/20/2011 13:30
Received:    5/20/2011 14:02
From:        Christopher D. Stoll, cstoll09@austincollege.edu


  • See the spam

Not sure if true school abuse or not, but the site and the relaying is done through
Google in California. Otherwise, same as this spam but different rape/abuse location.


  • See the lookups

    
Subject: We have restricted access to your account
Date:        5/26/2011 04:55
Received:    5/31/2011 22:18
From:        Amazon Service, noreply@security.Com


  • See the spam

Abuse from the UK for a scammer site in Israel


  • See the lookups

    
Subject: Help Desk
Date:        6/2/2011 16:25
Received:    6/2/2011 17:39
From:        Grable, John, John_Grable@URMC.Rochester.edu
To:          undisclosed-recipients:;


  • See the spam

Double layer of school rapes for a Google site in California.
One school is in New York. The other is in Missouri.
Very similar method of operation as this spam and this spam because of the Google site.


  • See the lookups

    
Subject: =?iso-8859-1?Q?Importante:_Actualizaci=F3n_de_la_base_de_datos_de_manteni?= =?iso-8859-1?Q?miento!_!_!?=
Date:        6/26/2011 10:56
Received:    6/26/2011 11:40
From:        Gallucci, Kathleen, Kathleen_Gallucci@URMC.Rochester.edu
To:          undisclosed-recipients:;


  • See the spam

Raping a school for a Dutch site apparently in Germany, but in Spanish from what I
can tell. Site already 404 compliant.


  • See the lookups

    
Subject: Update Your Mailbox
Date:        6/26/2011 13:46
Received:    6/26/2011 13:47
From:        toddsmith@iprimus.com.au
To:          undisclosed-recipients:;


  • See the spam

Phish scam going through Australia, hosted in Florida.


  • See the lookups

    
Subject: =?iso-8859-1?Q?Importante:_Actualizaci=F3n_de_la_base_de_datos_de_manteni?= =?iso-8859-1?Q?miento!_!_!?=
Date:        6/29/2011 00:02
Received:    6/30/2011 09:41
From:        Cutaia, Sonia J, SCUTAIA@houstonisd.org
To:          undisclosed-recipients:;


  • See the spam

Raping a school in Texas for a phish form hosted on Google in California.


  • See the lookups

    
schoRape a blind server in at a school in Arkansas for a Ukraine site hosted by the British
Virgin Islands.


  • See the lookups

    
Subject: Your mailbox is almost full.
Date:        8/11/2011 08:20
Received:    8/11/2011 10:33
From:        Manning, Sarah, Sarah.Manning@ucdenver.edu
To:          info@emailadmin.com, info@emailadmin.com


  • See the spam

1 of 2. Raping a school in Colorado with a pair of useless links. One is a Microsoft link,
the other ends up being a redirector to a survey to harvest cell phone and charge users
$9.99 a month for some contest thing.


  • See the lookups

    
Subject: Your mailbox expires in 24 hours
Date:        8/11/2011 06:00
Received:    8/11/2011 10:33
From:        Manning, Sarah, Sarah.Manning@ucdenver.edu
To:          info@emailadmin.com, info@emailadmin.com


  • See the spam

2 of 2. Raping a school in Colorado with a pair of useless links. One is a Microsoft link,
the other ends up being a redirector to a survey to harvest cell phone and charge users
$9.99 a month for some contest thing.


  • See the spam

    
Subject: Your mailbox expires in 24 hours
Date:        8/15/2011 03:41
Received:    8/15/2011 10:14
From:        Mckenney, George, george.mckenney@acps.k12.md.us
To:          info@administrator.com, info@administrator.com


  • See the spam

Tied to this spam and this spam.
Raping a school in Maryland, yet the access reseller is in Utah while Level3 is in Colorado.
Microsoft web site.


  • See the lookups

    
Subject: E-Mail Account Maintenance
Date:        8/20/2011 00:57
Received:    8/19/2011 00:08
From:        E-Mail Account Maintenance, info@hotmail.com
Reply-To:    upcaccount@admin.in.th
To:          undisclosed-recipients:;


  • See the spam

Abusing Austria from India and pretending to be Thia while forging a Hotmail drop.


  • See the lookups

    
Subject: E-Mail Account Maintenance
Date:        8/20/2011 03:34
Received:    8/19/2011 09:16
From:        E-Mail Account Maintenance, info@hotmail.com
Reply-To:    upcaccount@admin.in.th
To:          undisclosed-recipients:;


  • See the spam

Same crap as above, just different IP's on the same providers.
Abusing Austria from India and pretending to be Thia while forging a Hotmail drop.


  • See the lookups

    
Subject: E-Mail Account Maintenance
Date:        8/20/2011 14:17
Received:    8/20/2011 00:36
From:        E-Mail Account Maintenance, info@hotmail.com
Reply-To:    upcaccount@admin.in.th
To:          undisclosed-recipients:;


  • See the spam

Same crap as above, just different IP's on the same providers.
Abusing Austria from India and pretending to be Thia while forging a Hotmail drop.

Also same as this Same crap as unwanted crap.


  • See the lookups

    
Subject: Your Mailbox Has Exceeded Storage Limit.
Date:        9/2/2011 13:52
Received:    9/5/2011 12:23
From:        Jennings, Abby {PBC}, Abby.Jennings@pepsico.com
To:          info@upgrade.com, info@upgrade.com


  • See the spam

Pepsi gets spam from Frito-Lays, which got it from Norway. Scam is fully enabled by
Google.


  • See the lookups

    
Subject: Important Security Message
Date:        10/10/2011 10:15
Received:    10/10/2011 10:46
From:        JPMorgan Chase Bank, Chase@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Bank account phisher. British relay and origination, site is on a zombie in India.


  • See the lookups

    
Subject: Important Security Message
Date:        10/10/2011 09:58
Received:    10/10/2011 10:47
From:        JPMorgan Chase Bank, Chase@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Different British rape and apparent origination, but same site in India.


  • See the lookups

    
Subject: Mailbox Quota Exceeded
Date:        10/20/2011 10:31
Received:    10/20/2011 10:36
From:        Cox, Estella, ECox@ShastaCollege.edu
To:          undisclosed-recipients:;


  • See the spam

Account stealing stuff. Raping a school in California for a Google site.
Google is in California.


  • See the lookups

    
Subject: Mailbox Quota Exceeded
Date:        10/24/2011 10:05
Received:    10/24/2011 10:42
From:        Tammy Price, tprice@cnv2.k12.wy.us
To:          undisclosed-recipients:;


  • See the spam

Raping a school in Wyoming and it shows signs of trouble in the whois, so I am blacklisting
it ASAP. Google destination site in California.


  • See the lookups

    
Subject: Account Maintenance Update (Must-Read)
Date:        11/6/2011 19:23
Received:    11/6/2011 19:41
From:        Chase, customerservice@emailinfo.chase.com
To:          undisclosed-recipients:;


  • See the spam

Abusing GCI in Alaska from RR.Com, based out of Virginia.
Spammer's web site is on SingleHop in Illinois. Domain is registered uing GoDaddy to 
someone using a Google  drop and an address in India.


  • See the lookups

    
Subject: Warning! Your mailbox is almost full.  
Date:        11/7/2011 09:25
Received:    11/7/2011 10:54
From:        Webmail System Administrator, info@webmail.com
To:          undisclosed-recipients:;


  • See the spam

Mailbox almost full, but has to do some zombie rape in Brazil to abuse a server in
Nebraska so it can tell me about a fake form on Google.


  • See the lookups

    
Subject: Verify Your Webmail Email Account 
Date:        11/26/2011 01:17
Received:    11/26/2011 11:04
From:        Beights, Nancy, BeightNa@collierschools.com
To:          undisclosed-recipients:;


  • See the spam

Apparently on my non-existant account on a school server in Florida, I'm expected to hand
over my bogus credentials to a document hosted on Google in California.


  • See the lookups

    
Subject: WEB SERVICE
Date:        11/26/2011 01:25
Received:    11/26/2011 11:04
From:        webmaster, Iinfo@webmaster.net
To:          Iinfo@webmaster.net


  • See the spam

Abusing an ISP in Arizona from Russia.
Site is hosted New Jersey and registered to someone with a Yahoo drop in Kuala Lampur. 


  • See the lookups
[an error occurred while processing this directive]

    • If you are one of the dilweeds who sent me unsolicited email or are someone thinking about it, drop dead.

    Also, if you've got a complaint about my anti-spam feelings or want to scold me for being justifiably sick of spam, I have the following words of wisdom for you:

    BLOW IT OUT YOUR ASS!

    Anyone else, I'd like to hear from you. Click below and drop me a line.
    Anti-Spam Site administrator