PM SpamFollow

Leticia

This is the message.



Seems suspicious enough.

Hmmm.... I haven't gotten any pm spam, it all just comes straight to my regular e mail. currently deleting 15+ spam messages a day, with no response from info@zam.com or accounts@allakhazam.com. I have e-mailed them everyday for 20 days and counting. I recieve the messages from my account to my account. Example below:
Stop the spam!! I have found some of these messages to have viruses. It seems to be randomly virused. There is always an attachment: SPAMDeli.txt, SpamMe.txt, SpamReMe.txt, SpamYour.txt, SpamReOrder.txt

All in all, these spam messages are getting through the system and my E mail system is not auto deleting these. For thoes that have to ask the question, yes I have controls in place to auto delete spam and other crap. I am not a novice. I have also traced the e mails, points to a location in Indonesia...

My hope here is to have some action done about these e mails.



From: thenewdays@allakhazam.com
To: thenewdays@allakhazam.com
Subject: *****SPAM***** Re: Order status, *****SPAM***** Your order, *****SPAM***** Delivery Status Notification (Failure), *****SPAM***** RE: Message, *****SPAM***** Delivery Status Notification

Spam detection software, running on the system "db.allakhazam.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Anti-crisis crazy sale from Spurs would be off target shots
by Zokora. RicardoA penalty by Christiano Ronaldo in the 76th minute was
[...]

Content analysis details: (19.9 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
2.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.0 MISSING_MID Missing Message-Id: header
0.0 MISSING_DATE Missing Date: header
0.0 HTML_MESSAGE BODY: HTML included in message
1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
0.1 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar to background
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: therewisdom.com]
1.9 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: therewisdom.com]
1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: therewisdom.com]
1.5 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: therewisdom.com]
1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
[URIs: therewisdom.com]
2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?200.186.202.101>]
3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[200.186.202.101 listed in zen.spamhaus.org]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: therewisdom.com]
0.0 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.



X-Envelope-From: <tenter@allakhazam.com>
X-Envelope-To: <tenter@allakhazam.com>
Received: from alfagomma.it ([200.186.202.101])
by db.allakhazam.com(8.13.8/8.13.8) with SMTP id mBCCrfnR084969
Fri, 12 Dec 2008 04:53:41 -0800 (PST)
(envelope-from <tenter@allakhazam.com>
X-Envelope-To: <thenewdays@allakhazam.com>
To: <thenewdays@allakhazam.com>
Subject: Re: Order status
From: <thenewdays@allakhazam.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html

AnnaDaniel

From Mr.Daniel Johnson and sister
Private and Confidential
Abidjan - Côte d'Ivoire
private(dan_johns_anna81@yahoo.fr)


My dear ,

It is our pleasure to contact you for a business
venture which I and my Sister,intend to establish in
your country.Though we have not met with you before
but we believe, one has to risk confiding in someone
to succeed sometimes in life.There is this amount of
FIFTEEN Million US Dollars ($15.000.000.00)which our late Father deposited in a private security company here in Abidjan Capital city of Cote d'Ivoire which he wanted to used for his political ambition in our Country before he was assassinated.

Now I and my sister have decided to invest these money
in your country or anywhere safe enough for security and political reasons.We want you to help us contact the security company here as my late fathers foreign business partner and the beneficiary of the deposited trunk box containing the fund and give them immediate instruction to release and deliver the trunk box to you through their
international diplomatic courier service to your
Country.

As soon as you comfirm the trunk box to your possession, I and my only sister will come over to meet you for the possible investment and continue our education in your country.We will like to invest part of the money into these three investment in your Country but, if there is any other business that is better than our suggestion, wewill be very glad to follow your advice.you can cell me us this +225 07 18 19 43,or private email;(dan_johns_anna81@yahoo.fr)

1). Real estate
2). The transport industry
3). Five star hotel

If you can be of an assistance to us we will be
pleased to offer to you 20% Of the total fund while
the balance will be invested by you.

We await your soonest response.

Respectfully yours,
Mr. Daniel Johnson and sister



No seriously this looks TOTALLY legit. I already sent them my SS#, Bank Accounts and address. I should expect my first 1.2 Million to be deposited on Monday. Least thats what KleepKlop told me.

The most prevelent recent spam attack, the ones that appear to be from "staff@allakhazam" or "anyrandomadminname@allakhazam" are originating out of several servers in China. The attacks are being orchestrated by the same ******** who keep spamming the forum with the "naked wife satalite" crap, and the PM spam from "randomfemalenamewith4extraletters" advertising dating sites.

This is a full on attack, though largely ineffective so far due to the forum protections. They are using a script to generate new accounts. in the last week, my personal banned account count has tripled my total for the entire time I have been an admin.

We are under siege, but we will prevail, because there is one thing these ******** didn't count on:

Wombats!!!

Captcha at best keeps the totally clueless spammers away. At worst it drives away people from using the site. We've done as much as we can to prevent having to resort to captcha over the years. I think you'd be quite surprised at how many attempts there are a week by spammers that are either killed within 30 minutes or just never really become an issue.

Personally I find captcha extremely annoying. Any captcha that isn't easy cracked is also really hard for me to read, personally. I have excellent eyesight but that is not the problem. The problem is that the text is so obfuscated that it takes several attempts to get it right. By this point I'm sufficiently annoyed that I usually give up or never go back.

If you are interested in reading how crackable captcha is, you might be interested in this article.

The lengths that this pm spammer had to go through just to put out the number of PMs they did is rather impressive. It wasn't even close to worth their effort.

That's one of the worst captchas I've seen yet.

Kao is the shiznit!