Canadian Pharmacy – sayfinish.com (Spam)

An Amazing Canadian Pharmacy is available_at your_Fingertips!
No Doctor Needed! Browse our Site Today! -> http://sayfinish.com

“Canadian Pharmacy” is property of some of the worst criminals on the Internet. Don’t let them fool you, as they lie just about everything. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you endanger your health by eating those drugs.

It’s your personal and credit card information they are after, and they’d do anything to get their filthy hands on that information. Their greed knows no measure, and they would probably sell their own mother for a quick buck. Of course they don’t have one, as this kind of filth breeds in drains.

Read more about this unrivaled fraud:
http://www.spamtrackers.eu/wiki/index.php/Canadian_Pharmacy

Header Analysis

The following IP addresses were extracted from your headers:

IP Address Probable Country Additional Info
74.42.73.118 United States (Thorntown)* Whois Google DNSStuff Urgentmessage.org
207.115.36.102 United States (Richardson)* Whois Google DNSStuff Urgentmessage.org
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

From Randal Ford Wed Jun 10 15:40:56 2009
Return-Path:

Authentication-Results: mta141.sbc.mail.mud.yahoo.com from=datasul.com.br; domainkeys=neutral (no sig); from=datasul.com.br; dkim=neutral (no sig)
Received: from 74.42.73.118 (EHLO nlpi086.prodigy.net) (207.115.36.102)
by mta141.sbc.mail.mud.yahoo.com with SMTP; Wed, 10 Jun 2009 15:40:55 -0700
Received: from fa87sf1 (static-74-42-73-118.dr01.shlw.az.frontiernet.net [74.42.73.118])
by nlpi086.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with SMTP id n5AMeNjN013251;
Wed, 10 Jun 2009 17:40:53 -0500
Message-ID: <000701c9ea1c$851353b0$4a37416a@datasul.com.br>
Reply-To: “Randal Ford” <ford_rr@datasul.com.br>
From: “Randal Ford” <ford_rr@datasul.com.br>
To: ScamFraudAlert
Subject: We have anti anxiety medications!!
Date: Wed, 10 Jun 2009 17:40:56 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset=”windows-1250″
reply-type=original
Content-Transfer-Encoding: 7bit
Content-Length: 134

Address lookup

canonical name sayfinish.com.
aliases
addresses 203.93.208.86
58.17.3.41

Domain Whois record

Queried whois.internic.net with “dom sayfinish.com“…

   Domain Name: SAYFINISH.COM
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Referral URL: http://www.xinnet.com
   Name Server: NS1.WITHPIOUS.COM
   Name Server: NS2.WITHPIOUS.COM
   Name Server: NS3.DADOBJECT.COM
   Name Server: NS4.DADOBJECT.COM
   Name Server: NS5.CENTAROMA.IM
   Name Server: NS6.CENTAROMA.IM
   Status: ok
   Updated Date: 08-jun-2009
   Creation Date: 06-jun-2009
   Expiration Date: 06-jun-2010

>>> Last update of whois database: Thu, 11 Jun 2009 04:54:59 UTC <<<

Queried whois.paycenter.com.cn with “sayfinish.com“…

Domain Name      : sayfinish.com
PunnyCode        : sayfinish.com

Registrant:
  Organization   : CAO XINXIN
  Name           : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269

Administrative Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Technical Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Billing Contact:
  Name           : CAO XINXIN
  Organization   : CAO XINIXN
  Address        : DONGFANGLU26
  City           : SHANGHAI
  Province/State : Shanghai
  Country        : CN
  Postal Code    : 200269
  Phone Number   : 86-021-69512325
  Fax            : 86-021-69512325
  Email          : CAOXINIXN566251@QQ.COM

Network Whois record

Queried whois.apnic.net with “203.93.208.86“…

inetnum:      203.93.0.0 - 203.93.255.255
netname:      UNICOM-CN
descr:        China Unicom IP network
descr:        China Unicom
country:      CN
admin-c:      CH1302-AP
tech-c:       CH1302-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CNCGROUP
mnt-routes:   MAINT-CNCGROUP-RR
status:       ALLOCATED PORTABLE
changed:      hm-changed@apnic.net 20040116
changed:      hm-changed@apnic.net 20060124
changed:      hm-changed@apnic.net 20090507
changed:      hm-changed@apnic.net 20090508
source:       APNIC

person:       ChinaUnicom Hostmaster
nic-hdl:      CH1302-AP
e-mail:       abuse@chinaunicom.cn
address:      No.21,Jin-Rong Street
address:      Beijing,100140
address:      P.R.China
phone:        +86-10-82993155
fax-no:       +86-10-82993144
country:      CN
changed:      abuse@chinaunicom.cn 20090408
mnt-by:       MAINT-CNCGROUP
source:       APNIC

Advertisement

Assistant Teacher Position (Pre K/Childcare) – Career-Network

Job offers as such are nothing more than a marketing ploy or deceptive marketing practices by non other than Mr. Alex Difrawi aka Alec Difrawi aka Ayman A. Difrawy aka Ayman A. El-Difrawi aka Alex Simon dba Three Stars Media dba 3Starsinc dba Three Stars Inc dba Internet Solutions Corporation and his many aliases. Mr. Difrawi goal is to get you to sign up for continuing education. He should say outright what it is he’s peddling.



An Example of What scamFRAUDalert seek from Mr. Difrawi – Good Business Practices

MORE INFO ABOUT THE CRAIGSLIST POSTING/donsmithfabrics01@googlemail.com

The Purpose of This Post Is To ALERT You That The Job You Are About To APPLY TO or May Have Applied For or is CONSIDERING APPLYING FOR Is Fraudulent. A LEGITIMATE COMPANY IDENTITY HAS BEEN STOLEN OR A BOGUS ONE CREATED

These job postings are an attempt to lure you into cashing counterfeit checks and have you wire funds via Western Union or MoneyGram -Essentially You Become A Money or RePackage Mule

Money Mule Explained

Read All About This at Symantec Corp.

Subject: MORE INFO ABOUT THE CRAIGSLIST POSTING

From: Don Smith donsmithfabrics01@googlemail.com

Dear Prospective Candidate,

Greetings to you,

Am contacting you in respect of the craigslist posting You replied to,

Thank you for showing interest in the Job Opportunity given by the Company by replying my email. All you have to do is to receive payment (money order, checks etc) on behalf of the Company from its clients.
Then you will help cash them at your bank. When you have cashed them you will take 10% and send the rest back to the Company via 
Western Union Money Transfer or MoneyGram Money Transfer as you would be directed. The western union charges to send the Company’s money would be deducted from the remaining money after you have taken your 10%.

For example, if you get your first payment as $5,000, your income would be $500 and you will send the rest to the Company when the you have cashed the Checks. When you complete processing the first payment, you will get another payment and it will go on like that. The
faster you cash each payment, the 
more money you make at the end of the month.

I would like to let you know that you don’t have to pay any form of taxes for doing this or any money whatsoever. The only charges involved is the western union charges which you would deduct from the company’s funds.

The company has decided to consider you to be our payment representative their in the United States because its the Company’s policy that its clients make their payments only in form of checks and Money Orders and this is a contract binding on all of our clients. These checks are not readily cashable in the United Kingdom because they are American Checks and they can only be Cashed in the United States. This is why the job offer has been posted to you to know if
you would accept the offer and help receive the payments from our clients, cash them and send the remaining to us after taking off 10% of the Money which will be your income for working for the Company.

That’s all you have to do, if there is anything else you would like to know pls feel free to ask me.

Thanks and hope to hear back from you with the following details if you are still interested so we can get to work immediately.

FULL NAME:
ADDRESS:
CITY:
STATE:
ZIP CODE
:
BANK NAME:
OCCUPATION:
AGE:
PHONE NUMBER:
EMAIL ADDRESS:

Best Regards.
Don Smith
donsmithfabrics01@googlemail.com

 

From: Smithtextile@AOL.COM

Dear Prospective Candidate, 

Greetings to you,

Am contacting you in respect of the craigslist posting You replied to,Thank you for showing interest in the Job Opportunity given by the
Company by replying my email. All you have to do is to receive payment
(money order, checks etc) on behalf of the Company from its clients.
Then you will help cash them at your bank. When you have cashed them
you will take 10% and send the rest back to the Company via Western
Union Money Transfer or MoneyGram Money Transfer as you would be
directed. The western union charges to send the Company’s money would
be deducted from the remaining money after you have taken your 10%.

For example, if you get your first payment as $5,000, your income
would be $500 and you will send the rest to the Company when the you
have cashed the Checks. When you complete processing the first
payment, you will get another payment and it will go on like that. The
faster you cash each payment, the more money you make at the end of
the month.

I would like to let you know that you don’t have to pay any form of
taxes for doing this or any money whatsoever. The only charges
involved is the western union charges which you would deduct from the
company’s funds.

The company has decided to consider you to be our payment
representative their in the United States because its the Company’s
policy that its clients make their payments only in form of checks and
Money Orders and this is a contract binding on all of our clients.
These checks are not readily cashable in the United Kingdom because
they are American Checks and they can only be Cashed in the United
States. This is why the job offer has been posted to you to know if
you would accept the offer and help receive the payments from our
clients, cash them and send the remaining to us after taking off 10%
of the Money which will be your income for working for the Company.

That’s all you have to do, if there is anything else you would like to
know pls feel free to ask me.

Thanks and hope to hear back from you with the following details if
you are still interested so we can get to work immediately.

FULL NAME:
ADDRESS:
CITY:
STATE:
ZIP CODE:
BANK NAME:
OCCUPATION:
AGE:
PHONE NUMBER:
EMAIL ADDRESS:

Best Regards.
Don Smith