[Click to enlarge]I'm fairly sure this is a routine phishing scam to glean valid edresses into responding, so I won't directly. My guess is the account referenced is being spoofed. My point in posting this here is to let those of you who may be inclined to reply with a counter-threat know that will probably only get you on a mailing list you'll wish you weren't on.
That said, "Tick Tock," you total cowardly stool sample, bring it on. Right.
In the mean time, just to validate my claim to self defense should I ever get my hands on said creep, I will, of course, be forwarding this to the police, along with the header information:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtTQ0w9Mg==
X-Message-Status: n:0
X-SID-PRA: Tick Tock
X-SID-Result: Pass
X-AUTH-Result: PASS
X-Message-Info: wCrlMA1YA+hhjftUE3VyvWfIpsaZTb7e9Rg+bJY/YvW/SlYRgGRSes/rDw3uRK4gKSZBAhm3aZxF+S5QZDttvvvLPF92zbTYOd7ASmpuNkE=
Received: from col0-omc1-s8.col0.hotmail.com ([65.55.34.18]) by col0-hmmc2-f2.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 10 Jun 2010 17:27:58 -0700
Received: from COL117-W40 ([65.55.34.9]) by col0-omc1-s8.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 10 Jun 2010 17:25:55 -0700
Message-ID:
Return-Path: maureen_mcaloon@hotmail.com
Content-Type: multipart/alternative;
boundary="_8e4a5869-54bb-48e2-a5a5-e640ab572052_"
X-Originating-IP: [83.138.136.92]
From: Tick Tock
Subject: ACT FAST!!!
Date: Fri, 11 Jun 2010 10:25:55 +1000
Importance: Normal
MIME-Version: 1.0
Bcc:
X-OriginalArrivalTime: 11 Jun 2010 00:25:55.0774 (UTC) FILETIME=[A84005E0:01CB08FC]
--_8e4a5869-54bb-48e2-a5a5-e640ab572052_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hello=2C
This is the only way I could contact you for now=2CI want you to =
be very careful about this and keep this secret with you until I make out s=
pace for us to see. You have no need of knowing who I am or where I am from=
.I know this may sound very surprising to you but it=92s the situation.I ha=
ve been paid some ransom in advance to terminate you with some reasons list=
ed to me by my employer. It=92s someone I beleive you call a friend=2C I ha=
ve followed you closely for a while now and have seen that you are innocent=
of the accusations he leveled against you. Do not contact the police or tr=
y to send a copy of this to them=2Cbecause if you do=2C I will know=2Cand I=
might be pushed to do what I have been paid to do.Besides=2C this is the i=
st time I turn out to be a betrayer in my job.I took pity on you=2Cthat is =
why I have made up my mind to help you if you are willing to help yourself.=
=20
=20
Now listen=2CI will arrange for us to see face to face=2Cbut before that=2C=
I need 30=2C000.00 USD/20=2C700GBP. I will come to your home or you determ=
ine where you wish we meet=3B I repeat=2C do not arrange for the cops and i=
f you play hard to get=2C it will be extended to your family.Do not set any=
camera to cover us or set up any tape to record our conversation=2C my emp=
loyer is in my control now. Payment details will be provided for you to mak=
e a part payment of 15=2C000.00 USD 10=2C350 GBP first=2Cwhich will serve a=
s gurantee that you are ready to you co-orperate=2Cthen i will post a copy =
of the video tape that contains his request for me to terminate you which w=
ill be enough evidence for you to take any legal action against him before =
he employs another person for the job. You will pay the balance of $15=2C00=
0 once you receive the tape.
=20
Warning: do not contact the police=2C make sure you stay indoors once it is=
7.30pm until this whole thing is sorted out=2Cif you neglect any of these =
warnimgs=2C you will have yourself to blame. You do not have much time=2C s=
o get back to me immediately.
=20
Note: I will advise you keep this to yourself alone=2C not even a friend or=
a family member should know about it because it could be one of them. =20
Tick Tock
=20
=20
_________________________________________________________________
Need a new place to live? Find it on Domain.com.au
http://clk.atdmt.com/NMN/go/157631292/direct/01/=
--_8e4a5869-54bb-48e2-a5a5-e640ab572052_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hello=2C
 =3B =3B =3B =3B =3B =3B =3B =
=3B =3B This is the only way I could contact you for now=2CI want you t=
o be very careful about this and keep this secret with you until I make out=
space for us to see. You have no need of knowing who I am or where I am fr=
om.I know this may sound very surprising to you but it=92s the situation.I =
have been paid some ransom in advance to terminate you with some reasons li=
sted to me by my employer. It=92s someone I beleive you call a friend=2C I =
have followed you closely for a while now and have seen that you are innoce=
nt of the accusations he leveled against you. Do not contact the police or =
try to send a copy of this to them=2Cbecause if you do=2C I will know=2Cand=
I might be pushed to do what I have been paid to do.Besides=2C this is the=
ist time I turn out to be a betrayer in my job.I took pity on you=2Cthat i=
s why I have made up my mind to help you if you are willing to help yoursel=
f.
 =3B
Now listen=2CI will arrange for us to see face to face=
=2Cbut before that=2C I need 30=2C000.00 USD/20=2C700GBP. I will come to yo=
ur home or you determine where you wish we meet=3B I repeat=2C do not arran=
ge for the cops and if you play hard to get=2C it will be extended to your =
family.Do not set any camera to cover us or set up any tape to record our c=
onversation=2C my employer is in my control now. Payment details will be pr=
ovided for you to make a part payment of 15=2C000.00 USD 10=2C350 GBP first=
=2Cwhich will serve as gurantee that you are ready to you co-orperate=2Cthe=
n i will post a copy of the video tape that contains his request for me to =
terminate you which will be enough evidence for you to take any legal actio=
n against him before he employs another person for the job. You will pay th=
e balance of $15=2C000 once you receive the tape.
 =3B
Warning: d=
o not contact the police=2C make sure you stay indoors once it is 7.30pm un=
til this whole thing is sorted out=2Cif you neglect any of these warnimgs=
=2C you will have yourself to blame. You do not have much time=2C so get ba=
ck to me immediately.
 =3B
Note: I will advise you keep this to y=
ourself alone=2C not even a friend or a family member should know about it =
because it could be one of them. =3B
Tick Tock
 =3B
Find it on Domain.com.au Need a n=
ew place to live?
=
--_8e4a5869-54bb-48e2-a5a5-e640ab572052_--
Wish I'd have known about the 7:30 PM deadline--there I was chipping plastic perforated golf balls in the front yard with a perfectly good assault wedge.
9 comments:
(snicker!) I think you ought to give him 1600 Pennsylvania Ave. as an address. (snort!)
Just sign that e-mail address up for the most disgusting porn you can find on the internet.
I got something similar to a phishing scam back in college. They received both a man4man posting on craigslist and piles of German scat porn in their inbox.
Love it - a high class international trigger man who doesn't know how spell-check works! This kind of idiot would ignore that 'Front Toward Enemy" instruction and stick a Claymore up like a convex TV screen.
Still, to be on the safe side, I can put you in touch with a new friend in Kenya whose grandfather was their Minister of Vegetable Sales and who left him thirty nine million dollars... he just needs a bank account number so he can transfer the money out of the country, to YOU, so that the government won't seize it. He will split the big bucks with you 50-50.
Hey - maybe the two are related!!
What a freakin' maroon.
Hm. Sure sounds...familiar somehow. Is this not essentially the same threat that the state makes behind everything it does?
Yeah, that's it. "Do my bidding or I'll come after you and everyone I can tie you to."
Condition Yellow...as usual, right? :-)
Random phishing expedition, learned English from Japanese video games. "You have no chance to survive make your time! Someone set up us the bomb." Has an uncle in the toppled regime in Nigeria who needs to move a few $million offshore from the treasury and will pay handsomely for your bank account number cooperation...
X-Originating-IP is the address of the computer the email originated from, as best the system can decipher (thanks to NAT and other network voodoo).
that address traces through the london wing of level3, to some tier 2 called rackspace.net, which looks like a colocation center, and beyond that routes are blocked. the host with that address is titanium.onspeed.com, and onspeed appears to be an ISP of some kind.
my guess is: automated. there's no human at the other end.
one fine day in merry old england, some poor fellow who pays onspeed for a crappy dial-up connection tried to open an email attachment with a filename like prettygirl.jpg.exe, which appeared to come from a friend, but "nothing happened."
now, his computer hosts a simple backdoor that lets someone's spam network bounce email through him to hotmail, and hotmail is notorious for compromised user accounts, as well as swaths of auto-generated ones (captcha is pretty easy to work around).
abuse@rackspace.net or abuse@onspeed.com might be interested to have a copy, with full headers, if they exist. sometimes it's "spam" instead of abuse. a tier 1 like level3 is never involved and shouldn't be contacted.
IP comes back to England even though the admin is from Texas. It6 is already been reported as a phishing scam wit a different theme email.
Anyways, if you see somebody suspicious, let me know. Don't be greedy with stupid targets :)
The tip-off is the lack of your address in the "to:" spot. It was mass-mailed in the hopes of getting some bites. I wouldn't think twice about it. Just go about your life in the same "condition" as always.
Just got that one in the mail today myself.
Post a Comment