{"id":562,"date":"2008-02-05T10:14:49","date_gmt":"2008-02-05T17:14:49","guid":{"rendered":"http:\/\/weblog.javazen.com\/?p=562"},"modified":"2008-02-05T13:29:59","modified_gmt":"2008-02-05T20:29:59","slug":"email-noir","status":"publish","type":"post","link":"https:\/\/weblog.javazen.com\/?p=562","title":{"rendered":"Email Noir"},"content":{"rendered":"

Every couple of months I get around to clearing out my inbox and so came across this…er…generous death threat I received…let’s see…7 WEEKS AGO! Geesh. Where are my priorities? Wasn’t very prompt in my (still pending) reply.<\/p>\n

From: “Alex Brown” <costa04ltd@hotmail.com>
\nSubject: PAY ASSASIN OR LOOSE YOUR LIFE
\nDate: Sat, December 15, 2007 5:01 pm
\nTo: undisclosed-recipients:;
\nPriority: Normal<\/font><\/p>\n

I want you to read this message very carefully and diligently.<\/font><\/p>\n

I’m a professional; hence you have no need of knowing who I am, where I am from, until I arrange for a one on one meeting. I have been mandated to terminate your life for some reasons listed to me by the contractor – someone I believe you know very well and very close to you. Consequently, I have been following you closely for a month now and have seen that you are innocent of the accusation leveled against you.<\/font><\/p>\n

In your best interest, do not contact the Police or try to send a copy of this to any security agents, because if you do, I will certainly know through the impeccable assistance of one of the secret agents who is a friend, and you will leave me with no option than to be forced to do what I have being duly paid to do, beside this is the first time I\u00e2\u20ac\u2122m turning out to be a betrayer against the ethics of my profession.<\/font><\/p>\n

Now listen, I will arrange for us to see one on one but before that I need the amount of $14,000.00, you have nothing to be afraid of. I will be coming to see you in your home or you determine where you wish we meet, do not set any camera to cover us or set up any tape to record our conversation, I seem to hold the four aces now. You will need to transfer $7, 000.00 to the account I will provide for you, before we will set our first meeting, after you have make the first advance payment to the account, I will provide you with the tape that contains his request for me to assassinate you, which will be enough proof for you to take up a legal action against him (if you wish to do so) and will tell you what to do and protect you, then the balance will be paid later.<\/font><\/p>\n

You don’t need my phone contact for now till I am assured you are ready to comply, and being silence on this matter is very dangerous. The choice remains yours, and you have the next 72hrs to make that choice, otherwise you will live your limited life watching your back. A word is enough for the wise!<\/font><\/p>\n

Signed,
\nAlex.
\ni\u00e2\u20ac\u2122m is proud to present Cause Effect, a series about real people making a difference. Learn more<\/font><\/p><\/blockquote>\n

Fortunately for me, the priority is only “Normal.” Yet, Alex’s message has all the earmarks of the dreaded Northern Yukon Maphia. Uh-oh.<\/p>\n

Hmmmmmmm, the message originates from Nigeria. Dang! I can’t count the number of “very well known and close” friends I have that are in and out of Nigeria. I’m in trouble. And oops, I’ve posted Alex’s message on the World Wiiiiiiiiiiide Web for his handlers to see and now they’re after his betraying ass.<\/p>\n

Well, Alex may be holding all the aces, but that just tells me he’s 48 cards short of a full deck. Spellchecker, Alex. Use it. But whatever.<\/p>\n

OK, Alex. Lets meet here.<\/a> We’re expecting your visit.<\/p>\n

Do people actually fall for this crap?<\/p>\n

Here’s the header:<\/p>\n

Return-Path: <costa04ltd@hotmail.com>
\nX-Original-To: #######################
\nDelivered-To: #######################
\nReceived: by ################## (Postfix, from userid ####)
\nid DF26A77488B; Sat, 15 Dec 2007 17:01:30 -0700 (MST)
\nX-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on ##################
\nX-Spam-Level: *
\nX-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_40,HTML_MESSAGE,
\nSUBJ_ALL_CAPS autolearn=no version=3.2.3
\nReceived: from ################## (localhost.localdomain [127.0.0.1])
\nby ################## (Postfix) with ESMTP id 2A3057748A6
\nfor <#######################>; Sat, 15 Dec 2007 17:01:28 -0700 (MST)
\nEnvelope-to: #######################
\nDelivery-date: Sat, 15 Dec 2007 19:00:56 -0500
\nReceived: from #################
\nby ################## with POP3 (fetchmail-6.3.6)
\nfor <#######################> (single-drop); Sat, 15 Dec 2007 17:01:28 -0700 (MST)
\nReceived: from blu139-omc2-s21.blu139.hotmail.com ([65.55.175.191])
\nby server21.snhdns.com with esmtp (Exim 4.68)
\n(envelope-from <costa04ltd@hotmail.com>)
\nid 1J3gwC-00054G-GU
\nfor #######################; Sat, 15 Dec 2007 19:00:56 -0500
\nReceived: from BLU124-W45 ([65.55.162.186]) by blu139-omc2-s21.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
\nSat, 15 Dec 2007 16:01:09 -0800
\nMessage-ID: <BLU124-W459789C97059BCE2029E59DD610@phx.gbl>
\nContent-Type: multipart\/alternative;
\nboundary=”_81da18aa-2829-41b2-b7e0-3c784b12b99c_”
\nX-Originating-IP: [82.128.18.8]
\nReply-To: <alexabrown2000@yahoo.com>
\nFrom: Alex Brown <costa04ltd@hotmail.com>
\nSubject: PAY ASSASIN OR LOOSE YOUR LIFE
\nDate: Sat, 15 Dec 2007 14:01:09 -1000
\nImportance: Normal
\nMIME-Version: 1.0
\nX-OriginalArrivalTime: 16 Dec 2007 00:01:09.0184 (UTC) FILETIME=[C3176400:01C83F76]
\nTo: undisclosed-recipients:;<\/font><\/p><\/blockquote>\n

And the trace:<\/p>\n

WHOIS – 65.55.175.191<\/font><\/strong><\/p>\n

Location: United States [City: ]<\/font><\/p>\n

OrgName: Microsoft Corp
\nOrgID: MSFT
\nAddress: One Microsoft Way
\nCity: Redmond
\nStateProv: WA
\nPostalCode: 98052
\nCountry: US<\/font><\/p>\n

NetRange: 65.52.0.0 – 65.55.255.255
\nCIDR: 65.52.0.0\/14
\nNetName: MICROSOFT-1BLK
\nNetHandle: NET-65-52-0-0-1
\nParent: NET-65-0-0-0-0
\nNetType: Direct Assignment
\nNameServer: NS1.MSFT.NET
\nNameServer: NS5.MSFT.NET
\nNameServer: NS2.MSFT.NET
\nNameServer: NS3.MSFT.NET
\nNameServer: NS4.MSFT.NET
\nComment:
\nRegDate: 2001-02-14
\nUpdated: 2004-12-09<\/font><\/p>\n

RTechHandle: ZM23-ARIN
\nRTechName: Microsoft Corporation
\nRTechPhone: +1-425-882-8080
\nRTechEmail: ***@microsoft.com<\/font><\/p>\n

OrgAbuseHandle: ABUSE231-ARIN
\nOrgAbuseName: Abuse
\nOrgAbusePhone: +1-425-882-8080
\nOrgAbuseEmail: *****@msn.com<\/font><\/p>\n

OrgAbuseHandle: HOTMA-ARIN
\nOrgAbuseName: Hotmail Abuse
\nOrgAbusePhone: +1-425-882-8080
\nOrgAbuseEmail: *****@hotmail.com<\/font><\/p>\n

OrgAbuseHandle: MSNAB-ARIN
\nOrgAbuseName: MSN ABUSE
\nOrgAbusePhone: +1-425-882-8080
\nOrgAbuseEmail: *****@msn.com<\/font><\/p>\n

OrgNOCHandle: ZM23-ARIN
\nOrgNOCName: Microsoft Corporation
\nOrgNOCPhone: +1-425-882-8080
\nOrgNOCEmail: ***@microsoft.com<\/font><\/p>\n

OrgTechHandle: MSFTP-ARIN
\nOrgTechName: MSFT-POC
\nOrgTechPhone: +1-425-882-8080
\nOrgTechEmail: ******@microsoft.com<\/font><\/p>\n

WHOIS – 82.128.18.8<\/font><\/strong><\/p>\n

Location: Nigeria (high) [City: ]<\/font><\/p>\n

% Information related to ‘82.128.0.0 – 82.128.127.255’<\/font><\/p>\n

inetnum: 82.128.0.0 – 82.128.127.255
\norg: ORG-AFNC1-RIPE
\nnetname: AFRINIC-NET-TRANSFERRED-20050223
\ndescr: This network has been transferred to AFRINIC
\nremarks: These IP addresses are assigned in the AFRINIC region.
\nremarks: Authoritative registration information for this network
\nremarks: is available for query and modification in
\nremarks: the AFRINIC whois database: whois.afrinic.net or
\nremarks: web site: https:\/\/www.afrinic.net
\nremarks: The routing registry information (route(6) objects)
\nremarks: may be published in any Routing Registry, including
\nremarks: RIPE Whois Database
\ncountry: EU # country is really somewhere in African Region
\nadmin-c: AFRI-RIPE
\ntech-c: AFRI-RIPE
\nstatus: ALLOCATED PA
\nmnt-by: RIPE-NCC-HM-MNT
\nmnt-routes: RIPE-NCC-RPSL-MNT
\nchanged: **********@ripe.net 20050223
\nsource: RIPE<\/font><\/p>\n

organisation: ORG-AFNC1-RIPE
\norg-name: African Internet Numbers Registry
\norg-type: RIR
\naddress: see https:\/\/www.afrinic.net
\ne-mail: *********@ripe.net
\nadmin-c: AFRI-RIPE
\ntech-c: AFRI-RIPE
\nremarks: For more information on AFRINIC assigned blocks, use
\nremarks: AFRINIC’s whois database, whois.afrinic.net.
\nmnt-ref: RIPE-NCC-HM-MNT
\nmnt-by: RIPE-NCC-HM-MNT
\nchanged: *********@ripe.net 20050223
\nsource: RIPE<\/font><\/p>\n

role: The African Internet Numbers Registry
\norg: ORG-AFNC1-RIPE
\naddress: AFRINIC, see https:\/\/www.afrinic.net
\nadmin-c: AFRI-RIPE
\ntech-c: AFRI-RIPE
\nnic-hdl: AFRI-RIPE
\ne-mail: *********@ripe.net
\nremarks: For more information on AFRINIC assigned blocks, connect
\nremarks: to AFRINIC’s whois database, whois.afrinic.net.
\nmnt-by: RIPE-NCC-HM-MNT
\nchanged: **********@ripe.net 20050223
\nsource: RIPE<\/font><\/p>\n

% Information related to ‘82.128.18.0\/23AS36954’<\/font><\/p>\n

route: 82.128.18.0\/23
\ndescr: MLTL IP ADDRESS BLOCK
\norigin: AS36954
\nmnt-by: RIPE-NCC-RPSL-MNT
\nmnt-by: MLTL-INT-MNT
\nchanged: ****@multi-links.com 20070617
\nsource: RIPE<\/font><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Every couple of months I get around to clearing out my inbox and so came across this…er…generous death threat I received…let’s see…7 WEEKS AGO! Geesh. Where are my priorities? Wasn’t very prompt in my (still pending) reply. From: “Alex Brown” <costa04ltd@hotmail.com> Subject: PAY ASSASIN OR LOOSE YOUR LIFE Date: Sat, December 15, 2007 5:01 pm […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"_links":{"self":[{"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=\/wp\/v2\/posts\/562"}],"collection":[{"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=562"}],"version-history":[{"count":0,"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=\/wp\/v2\/posts\/562\/revisions"}],"wp:attachment":[{"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/weblog.javazen.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}