The Anyang Spammer

And his Nigerian phishing friends

[Home] [Previous Anyang phishing attacks from 2004-2005] [Back to Heresy & Propaganda]

 

Scrool down the page for examples of Anyang spams and Nigerian phishing scams from the Anyang spammer's friends.

Comment date: September 15, 2007.

Anyang wouldn't be so obnoxious for the content of their emails is somewhat honest and not offense by itself. Unfortunately these guys like to immediately sell names of their email recipients to Nigerian "419" scammers and credit card phishing scammers. The emails below from Anyang Forging Press company are excellent examples. The sender is promoting machinery from a company that makes the lowest quality machinery in China. The message is not offensive and website URLs do actually take the viewer to the company's website. These hammers are very cheap and sold by several vendors in the United States.

An indicator of hidden problems at Anyang. Some people reading this page for the first time might guess that spamming might be an indicator of more problems with the product Anyang sells. You would be correct. Anyang has serious quality control problems with their hammers, and they will not support their product line once the customer purchases a hammer that doesn't work. But this is not what I want to write about on this page.

Here is the problem. I receive emails from this scumbag several times each year. And I noticed that I always begin receiving phishing scams from lesser sophisticated scammers and a near doubling of the more sophisticated phishing scams within a few days to a few weeks later. These scams include everything from typical Nigerian phishing attacks, the bogus Ebay scams, bogus Pay Pal scams, fake bank information update scams that direct the recipient to give personal and bank account information and internet passwords, and fake charity scams in which the scammers are targeting a victim that they know some basic characteristics or the occupation of the victim. Anyone want proof that there is a connection between all of these clowns? Then scroll down the page for some examples of the garbage that begins arriving immediately after each round of spams from Anyang.

Definitions: Spoofed email address- sender fraudulently uses a return email address to make themselves appear to be part of company or organization and whose customers they are targeting for fraud and theft. Examples below, the sender of the fake bank information update websites are using the return email address of their targeted banks so that recipients of the email will see their banks email address in their email browser and will be more likely to feel comfortable with complying with the instructions in the email and give away their personal bank account information to the thief.

419 Scam - Gets its name from the specific legal code of Nigerian law that this type of scam violates. Most commonly known versions involve a story line of an African criminal that wants to move a large amount of money out of their country and asks the dupe to help them in exchange for a commision or large fee. The dupe is asked to send money 'up front' to cover fees and other phony costs involved with the scam. The dupe is sometimes asked to come to the African nation to meet with the scammer at which time the scammer will try to involve the dupe in illegal activities to compromise them and extract more money from the dupe. In the end, the dupe gets nothing and loses all the money he/she sent to cover the 'up front' fees to move the imaginary fortune.

419 Scam - (Overpayment Version) This is a newer version in which the dupe is a business owner or seller of an item by internet. The targets are usually eBay sellers and business owners or owners of websites such as my website here. The scammer is often not very experienced at speaking English and will rely on the use of a generic form-letter to begin the scam. The form-letter appears as an "URGENT" request to purchase something from the dupe. The scammer looks at the dupe's website and chooses an item at random to plug into the subject of the form-letter. The item is a decoy and is used only to make the letter look more authentic and genuine. They really want the dupe's money! This is a bogus check scam! Price doesn't matter. The scammer will agree to pay whatever price the dupe requires for an authentic (legitimate) sale- BUT there's a hitch! The scammer will send a check written for an excessive amount of money, and the dupe is instructed to wire the remainder back to the scammer. Remember the term "URGENT"? The scammer is in a hurry. Boy is he in a hurry. He sends the check by mail?! Some hurry. He begs the dupe to ship the item as soon as possible- before the check has time to clear. But he needs his "excess" money back as soon as possible. The dupe is asked to use an instant bank wire transfer of the alleged "excess" of monies to the scammer. The dupe's bank will credit the amount of the scammer's check to the dupe's account on the day of deposit. But when the bank discovers that the scammer's check is bogus, they will immediately withdraw that money from the dupe's account along with any additional fees for bounced checks. The dupe is stuck with a bogus check and is liable for any funds they withdraw from their bank account. Meanwhile, bank wire transfers are instantaneous. All monies wired to the scammers bank, are now lost. Any items shipped to the scammer are also lost.

The eBay scam takes advantage of the requirement by eBay, that the seller must ship their item immediately to the winning bidder after auction- even before the fake check is received and processed and discovered to be bogus! Sellers on eBay are targeted in a similar way as are website owners.

Domain names created by thieves. Thieves seldom ever pay registration fees for their domain names. Doing so would create a paper trail that allows police to locate them. Check the listing again in 90 days, and the domain will show cancellation as a result of failure to pay domain registration fee. Thieves often hack into a server to host their credit card phishing scam websites, using their temporary (unpaid) domain to point the victim's computer to the phishing website. Then by sending emails through a series of (difficult to track) relays, the victim is instructed by email to visit the scam website. The fake domain will be cancelled after 30 days for failure to pay, so the thief continues to set up new domain names and point them to the domain where the scam website is running.

Scam websites. Appearance ranges from a simple graphic with hot links that take the victim's computer to a simple automated form filler page, to the very sophisticated website with impressive profiles and photos of actual people stolen from other websites on the internet. Warning! Many of the scam sites place trojan horse installers in their webpages. Clicking on one will install a trojan horse to hijack the victim's computer and/or steal passwords and bank accounts and credit card accounts. Remember these words - All Spam Is Fraud! If you don't know the sender of the email, and they hid their identity, then any and all information in the email is a lie and the spammer intends to steal from you. All Spam Is Fraud! It is about stealing a dupes money. Don't be a dupe.

-----------------------------------Original email from Anyang September 12, 2007--------------------------------------------------------------------------------------------------

NOTES: Anyang Forging Press Machinery - extremely low quality machinery. Even their own distributors consider Anyang to be the "worst" hammer manufacturer in the world. This company's hammers often have severe mechanical problems and some of their machines don't work at all. Laughed at by many smiths that see these hammer running during forging demonstration- that is IF the hammers run during the demonstration. The manufacturer does not support their machines if the customer has a problem. This manufacturer ignores their own distributors after the machines delivered to their distributors fail. Lies about quality improvements. Sells and/or trades email addresses of customers to spammers and scammers.

The Original Anyang email (above) arrived September 12, 2007. The phishing scam (below) arrived 3 days later on September 15, 2007.

And as if on schedule, Anyang has again sold my email address to spammers and scammers. Up until this time (for nearly 3 months now) I have not received phishing scams until the latest Anyang spam this week.

---

September 15, 2007

COMMENT: This is the typical phishing email scam in which the scammer directs the recipient to visit a bogus website and give personal information to allow the scammer to steal money from the dupe and use the dupe's identity to continue stealing money in the dupe's name. Phishing scam to steal money and personal password information from customers of a targeted bank. No bank would ever send an email like this to one of their customers. A real bank would simply block access to any accounts in question and force the customer to contact the bank in person. Thank you Anyang Forging Press Company of China. You suck.

NOTES: Spam killer detected a bogus email address. Spoofed email address is proof of fraud! The website has a slick automated form-filler page that requires the dupe to give his/her passwords, and challenge questions and answers.

Phishing Scam

This is a fraud. Do not fill out the forms on the webpage linked below!

Dear business or corporate customer of Citizens Bank,

Citizens Bank Customer Service requests you to complete Money Manager GPS Online Form.

This procedure is obligatory for all Money Manager Global Processing Solutions™ (GPS) users.

Please click hyperlink below to access Money Manager GPS Online Form.
 

http://moneymanagergps-id6085641.citizensbank.com/gps/userdir/onlineform.aspx

Please do not respond to this email.

________________________

© Copyright 2007 Citizens Financial Group. All rights reserved.

X-Spam-Status: Yes, score=24.39 tag=-999 tag2=0 kill=0
tests=[FORGED_IMS_HTML=2.184, FORGED_MUA_IMS=2.48,
HELO_DYNAMIC_HCC=3.28, HELO_DYNAMIC_IPADDR2=3.28,
HELO_DYNAMIC_SPLIT_IP=2.88, HTML_40_50=0.611,
HTML_FONT_LOW_CONTRAST=1.335, HTML_MESSAGE=0.001,
MIME_HTML_ONLY=0.414, MIME_HTML_ONLY_MULTI=0, MISSING_MIMEOLE=1.664,
MPART_ALT_DIFF=0.425, MSGID_FROM_MTA_ID=1.103, RCVD_NUMERIC_HELO=1.44,
SARE_FORGED_CITIZEN=3, SPOOF_OURI=0.293]

 

---

September 21, 2007

Comment: This is the latest from Anyang Forging Press Machinery. Received this email just 9 days after the latest round of spam from Anyang. I am still expecting a "419 - Overpayment variant" scam to arrive in my email during the next couple weeks. A diploma mill offering fake college diplomas. I would not be surprised to find that they don't even deliver the fake diploma after the dupe sends them money. The sender is using hotmail because it is a free anonymous account that hides his identity.

NOTES: Forged email address is proof of fraud! The telephone number is fake- it is not currently in use and is listed as "available" on the Intellius telephone lookup webpage. Email did not originate through hotmail. Bogus email server address forged to appear as to be originated through a server with domain name "motmail.com." Spam killer detected the forged email address. Thief is hiding his identity by using hotmail address.

Diploma Mill Scam

Fri, 21 Sep 2007 18:47:45 +0300
Message-ID: <LAW11.OE649yfB4mvo409653d5@motmail.com>
Date: Fri, 21 Sep 2007 12:46:45 -0300
From: "Nelda Chappell" <izjowcz@hotmail.com>
To: ------------------------

Subject: Masters Based on Working Experience

Lazy to attend exam or classes?

We have Diplomas, Degrees, Masters' or Doctorate
to choose from any field of your interest.

Only 2 weeks require to delivers the prestigious non-accredited
universities paper to your doorstep.

Do not hesitate to give us a call today!
1-270-913-8215

X-Spam-Status: Yes, score=2.934 tag=-999 tag2=0 kill=0
tests=[FORGED_HOTMAIL_RCVD2=1.653, PREST_NON_ACCREDITED=1.28,
UNPARSEABLE_RELAY=0.001]

---

October 4, 2007

Comment: The bogus email address says it all. The email domain belongs to a charity organization- NOT the gambling website linked in the email. The thief spoofed a legitimate domain to hide his real identity. This clown will milk every last dollar from gambling addict's credit card account. Thanks for the scam Anyang Forging Press Machinery Industry. You suck!

NOTES: Fake email address is proof of fraud. The thief sent this through an untraceable relay to prevent spam killer from detecting the spoofed email address. The domain for the fake gambling website was created on September 27, 2007- just one week before Anyang sent this phishing scam. The IP (116.199.136.29) for this bogus website is located in Bejing, China.

Bogus Gambling/Credit Card Phishing Scam

Credit card fraud. Do not fill out the forms on the webpage linked below!

 

From: "Ahmad Barrera" <JulescalculiAlford@crwrc.org>
To: <  >
Subject: Huge progressive jackpots, slots, multi-hand, and single-hand blackjack.

Get to know your new casino home!
  
Free money free fun.

We have it all!

We give out BONUSES to anyone who joins.

http://greatvegasgame.com/

---

October 8th, 2007

U.S. Healthcare INC is a fraud!

Credit card fraud. Do not fill out the forms on the webpages linked here!

Comment: Ever since the first round of attacks from Anyang, I have been receiving between 4-12 of these perverted scams each day. I chose this one to demonstrate how a fake website domain is used by criminals. Bogus email address says it all- see the next paragraph for more about this scammer's location.

NOTES:  The email domain used for this fake address, belongs to a local internet service provider in the state of Iowa (United States). People residing in California or China or Budapest Hungary, or South Korea, or China, do not have local access to this ISP. The email address is a fake.

It gets even more bizarre. The domain "Lztalsole" was created on September 22, 2007 - approximately 16 days before I received this scam. Now check this out- I first looked up the domain for Lztalsole earlier today and the IP address (75.22.82.177) was in Pasedena, California. Luckily I printed it out because I wouldn't have believed what I found just 12 hours later. After a second look to confirm some questions concerning this thief's identity, I found he changed his IP (89.147.117.29) to somewhere in Budapest Hungary. The personal information given in the lookup appears to be from China- not California, and not Budapest. The scammer apparently doesn't remember what country he lives in- or could it be, he doesn't pay his bills. Keep in mind that a scammer can easily register temporary domain names and continue to use them for 30 days until the domain is cancelled for failure to pay registration fees. The purpose of the fake domain is to point the victim's computer to another website www.pillareff.com  A quick visit to this other website and we find that the name of this scam company is U.S. Healthcare, INC . The lookup says that the IP for pillareff (218.53.147.152) is located in Kyonggi-do (Seoul), South Korea. And the scammer created and registered the website domain (www.pillareff.com) on 10/8/07- today! Wow! He's been in business for only a few hours.

PROOF OF FRAUD! - Identity theft and stolen materials from a legitimate Canadian Pharmacy website. Read the 'About Us' page here: http://www.pillareff.com/aboutus.php The photos, identities, and text, were stolen from a Canadian Pharmacy website. The scammer replaced the words "Canadian Health&Care Mall" with the words OurGlobalPharmacy. The photos were all stolen from the Canadian website. The people shown in the webpage do not work for US Healthcare INC .

Okay, let's review the facts. This scammer's true location is unknown. The scammer claims to be a U.S. company but his website is in Korea and his personal information is from China, and he does not have an American office that we can verify. The scammer stole identities and background information from a legitimate Canadian Pharmacy and modified and posted it on his website. The scammer used an email address for which they cannot be a customer because they don't actually live in the area that local internet service provider is located. The scammer used a fake domain name that points to a different website (www.pillareff.com) that was only first registered today! The scammer is hiding his true identity (we can't see who sent the email). The scammer bombards family email addresses with inappropriate unsolicited and often pornographic emails pushing drugs. There is no online drug store. This is a credit card phishing scam. Place an order and pay dearly.

Bogus Drug Dealer/Credit Card Phishing Scam

X-Sender: <m_stonegp@iowatelecom.net> FAKE EMAIL ADDRESS!
To: <      >
From: "Marcelo Stone" <m_stonegp@iowatelecom.net> FAKE EMAIL ADDRESS!

Quality LowPrice Pharmacy

: Pick the meds you want to order & checkout (2 steps to finish an order) : Fast delivery & discrete packaging to your doorstep : We sell both BRAND(100% original brand) & GENERIC(35% cheaper) : We give up to 80% discount (on retail shop price) for BOTH brand & generic meds : Meds we sell: XanaxValium, AmbienPhetermin, Cia|lisViagra, UltramAtivan, CelebrexSoma, MeridiaClenbuterol, LuvoxPaxilZoloft & other 20 popular meds & other 20 popular meds   View all medications we have (1st link) If above link not load up, try this (2nd link)

food bread lady truly; horses fancy hurrying between bread teacher affect? 13agsh3ibd6dc2 zkipjl2t95et

Credit card fraud - phishing scam. Do not fill out the forms on the webpage linked below!

Shown here below, is the About Us page from the scam site www.pillareff.com The people shown below have never worked with the bogus US Healthcare INC. Everything on the page below is a fraud. The identities and information was stolen from other websites.

Home | Search          Weight Loss *NEW*  Hoodia Maxx (Pure Hoodia) Lipitor (Atorvastatin) Zocor view all products Men's Health Tadalafil SoftTabs Viagra SoftTabs Levitra Propecia *NEW* Viagra Oral Gel Cialis Generic (Tadalafil) Viagra Generic (100mg) Viagra Generic (50mg) view all products Anti-Depressant / Anti Anxiety *NEW*  Provigil / Modafinil Zoloft Generic (Sertraline HCL) Atarax Zyban (Bupropion Hcl) view all products Pain Relief / Muscle Relaxant Carisoma (carisoprodol) Ultram Generic view all products Anti-Diabetic Glucophage view all products Blood Pressure / Choleserrol Norvasc view all products                       About Us     OurGlobalPharmacy combines all the benefits of Internet Pharmacy and your local community Pharmacy. At OurGlobalPharmacy, our number-one goal is to provide outstanding service and value to our customers & mdash while meeting their healthcare needs and making their overall shopping experience as easy as possible. We've been delivering on this promise for more than 7 years. And today & mdash with about 80,000 satisfied customers, 6 distribution centers, regional business offices, and 24/7 customer support in Woonsocket, R.I. & mdash we are well positioned to continue that growth and introduce our special brand of service to a diverse group of new customers in communities and neighborhoods across the globe. At the core of our company's efforts to satisfy our customers are our Mission, Vision and Values. Together, they shape the culture here at OurGlobalPharmacy and fuel our drive to make things easy and convenient for our customers, stores, and colleagues. OUR MISSION We will be the easiest pharmacy for customers to use. OUR VISION We help people live longer, healthier, happier lives. OUR VALUES Respect for individuals Integrity Teamwork Openness to new ideas Commitment to flawless execution Passion for extraordinary customer service OurGlobalPharmacy is your convenient, safe and private online source for approved pharmacy prescriptions. We sell exact generic equivalents of US FDA approved prescription drugs through our fully-licensed pharmacies. In our team, board certified urologists and endocrinologists have come together to set up this comprehensive infrastructure to supply effective drugs at competitive prices.  We look forward to constantly improve customers& rsquo quality of life. Quality of all our medications is guaranteed with the strictest of manufacturing standards. Shopping at OurGlobalPharmacy you may be absolutely sure that you buy medication of the best possible quality, licensed and working. We are working shoulder to shoulder with largest pharmacopoeia distributors of the world, so we have direct access to the latest inventions of the drugs world.  We have same suppliers but we do not store our online assortment at any local warehouses, we use direct supplies and that is how we save your and our money. Rent fees are also not a problem for our online resource. So, we work for you, and do all we can to decrease prices with any possible means and ways. We work under highest security standards. All our order pages are being obligatory secured with SSL certificates. My Global Pharmacy avoids any kind of spam activities in advertisement or any other ways of business advancement. We hope that when you visit our stores you will see these core elements of our company in action. From the orders you place, to the products you purchase, to the service you receive, you can always expect something extra from OurGlobalPharmacy. NOTE: Much of the company bio shown above was stolen from a legitimate website and modified for use in this scam.   OurGlobalPharmacy Consultants   Dr. E(removed)ton Dr. E(removed)on is the Clinical Pharmacology Professor in University of Western Ontario. For 10 years he was lecturing clinical pharmacology in University of Ottawa. Last 12 years he is a leading specialist in University of Western Ontario. In 1999 he and his friend (removed) founded OurGlobalPharmacy as a multistore. Now he is CEO of one of the pharmaceutical market leaders. Also he is one of the founders of the Canadian Pharmacists Association (CPhA). His major is imported drugs quality control. Dr. E(removed)ton   NOTE: In the stolen bio shown above, the scammer copied the background of a real person and changed the year and the name of the company that the real man founded- to a fake year and the fake company name (OurGlobalPharmacy) used in this scam.   Dr. W(removed)nt Dr. W(removed)nt graduated from the the Medical University of South Carolina, Department of Pharmacy and Clinical Sciences in 2000. He has practiced as a family physician for two years before he was invited as a top professional to our company. Now he is a leading pharmacist and co-owner of OurGlobalPharmacy. His major is drug quality assurance. For more than two years now he's lecturing drug metabolism/toxicology and pharmaceutical sciences in University of Toronto. NOTE: In this second stolen bio shown above, the scammer copied the background of a real person and changed the name of the company to the fake company name (OurGlobalPharmacy) used in this scam.     [privacy policy]    [shipping policy]    [refund/cancellation policy]    [Shopping Cart] Copyright 2007 © US HEALTCARE INC. All rights reserved.

 

---

---

---

May 2007 - Anyang attempts to spam my old internet forum

Below are some of the spams and scams I received from Anyang and their friends during May and June of 2007. Note that this time I did not receive an email first, rather Anyang attempted on May 5, 2007, to spam an internet forum that I was trying to set up during the spring of 2007. On May 17, 2007, the scams began arriving. There were so many this time that I deleted most of them. After 7 weeks lesser sophisticated phishing scams stopped and the more sophisticated ones had dropped to around half the volume from their peak (shortly after Anyang spammed me). Below are just 4 of the many phishing scams and spams I received this time around.

---

May 17, 2007

COMMENT: This guy claims to be a "MR JEFF LAWRENCE FROM CALIFORNIA". Well MR JEFF LAWRENCE, you are a fraud. Are you really from CALIFORNIA? Obviously not. English is not your primary language. When you begin an email with a lie, people tend to not believe you.

NOTES: Use of a generic form-letter in which the scammer adds one or two words in their product description to target a specific online vendor. Note also that he says he will describe the features of the product that he wants, but he never does. This scammer can't speak English. He doesn't see the problems with his message. He isn't from "CALIFORNIA."

Not convinced? Need more proof of the use of a generic form-letter?  Then see another form-letter scam that I received that was targeting my "camelback drills" page here: http://www.beautifuliron.com/heresy&_email_fraud.htm Scroll half way down the page and look for "Camelback Drills" in very large letters.

419 Scam: Over-Payment Variation - Bogus Check & Return of "Excess Money"?

From: ras bowbow <bowbowras@yahoo.com>
Subject: URGENT ORDER
To: <  >

HELLO SIR/MADAM,   
       I AM  MR. JEFF LAWRENCE FROM CALIFORNIA AND I WILL LIKE TO MAKE AN URGENT ENQUIRY OF A PRODUCT WHICH I WILL LIKE TO PURCHASE IN YOUR COMPANY.THE PRODUCT I NEED IS  ANVIL  ,  FOR  MY BRANCH COMPANY IN WEST AFRICA ( GHANA). BELOW ARE SOME FEATURES OF THE PRODUCT WHICH I NEED: I WILL LIKE TO KNOW IF YOU HAVE THE ABOVE PRODUCTS INSTOCK  ,  IF YOU HAVE SEND ME THE UNIT PRICES OF EACH SO THAT I CAN CONTINUE WITH MY PURCHASE OKEY.....I WILL ALSO LIKE TO KNOW  THE OTHERE PRODUCTS YOU HAVE IN STOCK, THIS PRODUCT IS OF AN URGENT SERVICE SO I WILL REALLY LIKE YOU TO BE VERY FAST IN GETTING BACK TO ME.
KIND REGARDS...
................................JEFF LAWRENCE(MANAGING DIRECTOR OF JEFF LAWRENCE AND SONS CO.LTD

---

Yahoo! oneSearch: Finally, mobile search that gives answers, not web links.

---

May 18, 2007

COMMENT: It gets worse. The next day (May 18, 2007) I receive this bank phishing scam. This is a typical phishing email scam in which the scammer directs the recipient to visit a bogus website and give personal information to allow the scammer to steal money and from the dupe and use the dupe's identity to continue stealing money in the dupe's name. SPOOFED email address! No bank would ever send an email like this to one of their customers. A real bank would simply block access to any accounts in question and force the customer to contact the bank in person.

NOTES: Phishing scam to steal money and personal password information from customers of a targeted bank. Spoofed email address is proof of fraud!

Phishing Scam

This is a fraud. Do not fill out the forms on the webpage linked below!

 

Dear Regions Financial Corp Interact Service client!

Our Technical Unit is carrying out a scheduled Treasury Services update.

By following the link below please launch the procedure of the member details approval:

http://interact.regions.com.ref26ewyheeds/update/ibsregions/cmserver/verify.cfm

These directions are to be emailed and followed by all Business Internet Cash Management customers of the Regions .

The Regions does apologize for the troubles caused, and is very appreciative for your collaboration.

If you are not user of the The Regions Bank Corporate Banking please disregard this e-mail!

Copyright © 2007 Regions USA Corporate Banking All Rights Reserved.

X-Spam-Status: Yes, score=2.289 tag=-999 tag2=0 kill=0
tests=[EXTRA_MPART_TYPE=0.733, HTML_MESSAGE=0.001,
MIME_QP_LONG_LINE=0.234, SPOOF_OURI=1.321]

---

June 11, 2007

COMMENT: Approximately 3 weeks later (June 11, 2007) I receive another bank phishing scam. There were so many scams and spams from Anyang during this time period that I was deleting most of my emails without reading them.

This is the typical phishing email scam in which the scammer directs the recipient to visit a bogus website and give personal information to allow the scammer to steal money and from the dupe and use the dupe's identity to continue stealing money in the dupe's name. SPOOFED email address! No bank would ever send an email like this to one of their customers. A real bank would simply block access to any accounts in question and force the customer to contact the bank in person.

NOTES: Phishing scam to steal money and personal password information from customers of a targeted bank. Spoofed email address is proof of fraud!

Phishing Scam

This is a fraud. Do not fill out the forms on the webpage linked below!

 

Dear PNC Bank corporate/business online client:

The PNC Customer Service requests you to complete the PNC PinacleWeb Online Confirmation Form.

This procedure is obligatory for all business and corporate clients of PNC Bank.

Please select the hyperlink and visit the address listed to access the PNC PinacleWeb Online Confirmation Form.
 

http://treasury-session7521835557.pnc.com/esec/customercare/form.jsp

Again, thank you for choosing PNC Bank for your business needs. We look forward to working with you.

Please do not respond to this email.

This mail is generated by an automated service.
Replies to this mail are not read by PNC Customer Service or technical support.

X-Spam-Status: Yes, score=3.708 tag=-999 tag2=0 kill=0
tests=[HTML_30_40=0.137, HTML_FONT_LOW_CONTRAST=1.335,
HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.414, MIME_HTML_ONLY_MULTI=0,
MPART_ALT_DIFF=0.425, MSGID_FROM_MTA_ID=1.103, SPOOF_OURI=0.293]

---

June 28, 2007

COMMENT: Approximately 2 weeks later (June 28, 2007) I receive another bank phishing scam, Regions Bank customers were being targeted again. This is the typical phishing email scam in which the scammer directs the recipient to visit a bogus website and give personal information to allow the scammer to steal money and from the dupe and use the dupe's identity to continue stealing money in the dupe's name. SPOOFED email address! No bank would ever send an email like this to one of their customers. A real bank would simply block access to any accounts in question and force the customer to contact the bank in person.

NOTES: Phishing scam to steal money and personal password information from customers of a targeted bank. Spoofed email address is proof of fraud!

Phishing Scam

This is a fraud. Do not fill out the forms on the webpage linked below!

Dear business client of Regions Bank:

The Regions Customer Service requests you to complete the Regions InterAct Confirmation Form.

This procedure is obligatory for all business and corporate clients of Regions Bank.

Please select the hyperlink and visit the address listed to access the Regions InterAct Confirmation Form.
 

http://interactsession-3097695.regions.com/ibsregions/cmserver/iform.cfm

Again, thank you for choosing Regions Bank for your business needs. We look forward to working with you.

***** Please do not respond to this email *****

This mail is generated by an automated service.
Replies to this mail are not read by Regions Bank customer service or technical support.

X-Spam-Status: Yes, score=5.708 tag=-999 tag2=0 kill=0
tests=[FROM_LOCAL_HEX=2, HTML_30_40=0.137,
HTML_FONT_LOW_CONTRAST=1.335, HTML_MESSAGE=0.001,
MIME_HTML_ONLY=0.414, MIME_HTML_ONLY_MULTI=0, MPART_ALT_DIFF=0.425,
MSGID_FROM_MTA_ID=1.103, SPOOF_OURI=0.293]
 

---

---

---

March 9, 2006

COMMENT: Spams and scams from Anyang updated March 9, 2006. Hundreds of spams have been arriving since the first round of attacks by Anyang around 4 or 5 years ago. Mostly the illegal drug advertisements, fraudulent computer software sales, fake loan company scams. All the usual fraud and illegal garbage.

NOTES: Anyang is considered by smiths around the world, to be the cheapest-lowest quality hammers available. The company is abusive and callous towards customers and will sell/trade customer emails addresses to scammers- some of these scams republished here on this webpage.

-----------------------------------------Original email below from Anyang March 9, 2006----------------------------------------------------------------------

Dear Sir/Madam:
   
Knowing you from internet,we are the biggest and the best manufacturer of forging hammers in China.Our company is Anyang Forging Press Machinery Industry Co.,Ltd which is appointed to produce the forging hammers by the government of China.We have an over 50 years experience in producing forging
hammers and other forging press equipments,our C41-75 brand hammer awarded the golden prize, the highest prize of china. we have passed ISO9000:2000 quality certificate.Our customer distributed more than 50 countrys all over the world.

 

If you want to know more about us and our products, please visit our website: http://www.chinesehammers.com

 

If you have any interest in importing from China,please let us know your specific inquiry.Kindly send your email to bravy88@163.com or ericli@chinesehammers.com

 

Thanks for your attention and hope a fruitful business cooperation with your company!

 

Best regards,

 

Eric li
bravy88@163.com & ericli@chinesehammers.com
Anyang Forging Press Machinery Industry  Co.,Ltd
www.chinesehammers.com  
Tel:0086-372-5931234
Fax:0086-372-5931234

 

First spam arrived March 13, 2006

Comment: This spam arrived within 4 days after receiving the latest spam from the Anyang spammer. The email was loaded with approximately 6 megabytes of picture files that the spammer was not authorized to send to my email account. This spammer uses the same server (163.com) as Anyang.

Low Quality Metalwork - Large Unauthorized Picture Files

Dear Sirs, 
We are a company specializing in manufacture and export stairs and iron products in
China.
We had exported our products to
USA,Bahrian,India,Iceland,Russia,Greece,France,UK,Czech Republic,Slovakia,Iron,Korea
and many country before.
Please visit to our website www.nbhuihuang.com  to see all of our products.
Also we will take part in CAC Fairs in  Guangzhou on Apr.
15-19th.The CAC Fairs is face to Canton Fair Pazhou Complex.The building called
"continental Exhition you  to center".
Welcome you to our booth in CAC Fairs.You will see our samples by yourself.
If you have any question please contact with us ,our E-mail is
brightstair@yahoo.com.cn 
We are looking forward to hearing from you !
 
 
 
Yours Sincerely
Yang Yinfen
 
 
Ninghai County Huihuang Decorating CO.,Ltd.
Ningbo,Zhejiang Province,China.
Tel:+86-574-65510223
Fax:+86-574-65528208

---------------------------------New round of Anyang spams started arriving July 6th, 2006----------------------------------------------------------------------------------------------

COMMENT: We begin with a penny stock pump and dump scam. Keep in mind that the company being hyped by this email probably does not know about this spam. Take a look at the strange text that comes below the dashed line at the bottom of this pump and dump scam!

Penny Stock Pump & Dump Scam

FALCON ENERGY INC (fcyi)
Current Price: $ 0.70

OverView
An independent resource exploration and production company whose
current projects range from the production of natural gas and oil in Alberta
to the exploration for minerals such as copper and gold in Mongolia.

Is FCYI Ready To Go? If You Think So, You know what to do, happy earnings :)
Current news for the company

Falcon Energy, Inc. (fcyi . PK - News) is pleased to announce that it has
fully acquired the exploration licenses for five mining properties in the
mineral rich region of Mongolia. Management felt that the Opportunity
presented by these properties was significant enough to forgo a planned
participation by a second resource company. These licenses will be held
for a minimum of three years and grant Falcon Energy Inc. access to the
mineral rights for the licensed properties.

Mongolia has a wide variety of mineral resources. As of 1998, about 88%
of the country had been geologically mapped but only 20% of the
country's landmass had been licensed for exploration and exploitation.

Falcon Energy's interest in the region is driven in part by the
anticipation of deploying modern prospecting methods to an area that abounds
in both base and precious metals. Exploitable mineral resources found in
the area in which the licenses are held include: Gold, base metals such
as Copper, Molybdenum, Lead and Zinc as well as Fluorite and Uranium.


So GET IN NOW - WILL EXPLODE in next 2 weeks!!

-----------------------
What's good for the goose is good for the gander. Sturdy as an oak.   Which came first, the chicken or the egg. Walking on water. Sitting on the fence. That's a whole new can of worms.   Were you born in a barn? Walking on water. As uneasy as a cat near water.   The silly season.   The scum of the earth.   You can't teach an old dog new tricks.  So hungry I could eat a horse. Rain, rain go away; come again some other day.

Where man is not nature is barren. Through the grapevine.   Spring rain, Fall gold. Run to seed.  Rare as walking on water.  Scraping the bottom of the barrel.  Stop, look and listen. Timber! What's done is done.  Sweet as honey.   Your all washed up. Tall as a tree.   Through the grapevine.   When the cows come home.  Spring forward fall back. Were you born in a barn?
.

COMMENT: Received this spam about brightstair on July 24, 2006. Same spam as near the top of this webpage but with a different email address. Maybe they are worried about people adding the first email address in their spam filters. Same creepy method of operation- they fill recipient's email with 5 megabytes of photos without authorization. Did I mention that their product is very poor quality. Note the yahoo address.

Low Quality Metalwork - Large Unauthorized Picture Files

  Hello,Sir/madam,       We are a company specializng in stairs and iron products in
China.Please see our  products in the attachment, also you may visit our website
www.nbhuihuang.com  to see our all products .We also can manufacture the products
as clients' request.
      We had exported our products to
USA,Bahrian,India,Iceland,Russia,Greece,France,UK,Czech
Republic,Slovakia,Iran,Korea and many countries before.
      We will attend the CAC Fair in autumn,welcome to our booth to visit our products.
      If you have any question please contact us !  
      We are looking forward to hearing from you !
   
   Yours Sincerely,
    Tong youdan
   
   
   
  Ninghai County Huihuang Decorating CO.,Ltd.
  Ningbo,Zhejiang Province,China.
  Tel:+86-574-65510223
  Fax:+86-574-65528208


   

                 
---------------------------------
 Mp3·è¿ñËÑ-иèÈȸè¸ßËÙÏ