Comments on: A very odd e-mail I received

By: Patricia_C

Patricia_C — Wed, 10 Feb 2010 03:14:12 +0000

However did you know?

By: Ausonius

Ausonius — Wed, 10 Feb 2010 02:36:19 +0000

“remove this tag under penalty of law”!!!

Probably your e-mail is from an independent minion, hoping to spread socialist dependence on Fearless Leader.

It is curious indeed, whatever it is and whoever wrote it.

By: Patricia_C

Patricia_C — Wed, 10 Feb 2010 02:15:39 +0000

The above response was meant for you.
Dang it.

By: Patricia_C

Patricia_C — Wed, 10 Feb 2010 02:13:49 +0000

I still say there is something here that doesn’t pass the proverbial smell test. I put nothing past Obama’s drones. With their long awaited dreams of “fundamentally changing” the very foundation our country was built upon only to have thier dreams crushed by the will of We The People to maintain that foundation just as it is… they are desperate… and desperate people do desperate and dangerous things.

One thing though… In spite of the interestingly vague threat should I decide to report the message as spam rather than elect to be removed from their list… I damned the torpedos and… reported them as spam… and although it may not have been (in their words) “a good thing for all”… I sure enjoyed the gesture. But, then again, I am the sort who intentionally opens the opposite side of any package marked, “Open this end”.

By: Ausonius

Ausonius — Wed, 10 Feb 2010 02:04:24 +0000

Coincidence?

It also contains an “Ann Taylor” dress shop!

I tried zooming in on the Directory of businesses, but it was too blurry!

By: Ausonius

Ausonius — Wed, 10 Feb 2010 01:48:00 +0000

See:

http://ip-address-lookup-v4.com/lookup.php?ip=66.150.10.138

It is in a building at 6th Avenue and Union Street in Seattle: Google Maps are amazing!

That could just be the company providing the server, and not the actual source of the e-mail.

But maybe Jack Bauer or his new and very deadly friend Renee could shake them down for some information!

By: RoguePolitics

RoguePolitics — Wed, 10 Feb 2010 01:24:34 +0000

By: Patricia_C

Patricia_C — Wed, 10 Feb 2010 00:33:00 +0000

The e-mail originates from:

mta1023.mail.mud.yahoo.com

A quick Google of that address took me to a site called ScamWarners/ Internet Fraud Center.

Here is what the Full Header revealed as a whole. I am not familiar enough to do any proper sloothing so, maybe someone else can give it a go?

From Free Money Tue Feb 9 06:58:49 2010
X-Apparently-To: pc_in_tampa@yahoo.com via 68.142.200.157; Tue, 09 Feb 2010 07:04:37 -0800
Return-Path:
X-YMailISG: 2pEhhBMWLDvV7UXsc1WUp3VVSKI3.8PY5A706Bxk5weljFqvqTgYx5Qpew7tHO8GTvCb1PDlbDeHoALnYcqT1bjPk7G8syJhkt7n6el6WCWq3NIMxiYaB.SYL9zkrGtjiH_MtiO.wiJeXPdtegDo_XkD4DLkPlWCgn9ZcxHjJ_xvoHbtA4SvrgPFbMAnOBIAFGswacn_bZIpIs6cRnbQqZKudUNGqSokY1TqOUScZHJoG8qIfRztTRGgxDRqI5m9cxz2_6N_bvzpSmw.PdPe7lmmAAfduoAwM_jqX.uk8zUYnnpK5kKLShTsTU0mK905zvZhz3S1jvFiPfrYjlZQj.ZZAKIrdTIJ_wo-
X-Originating-IP: [66.150.10.138]
Authentication-Results: mta1023.mail.mud.yahoo.com from=nuepod.com; domainkeys=pass (ok)
Received: from 127.0.0.1 (EHLO mx-10.nuepod.com) (66.150.10.138)
by mta1023.mail.mud.yahoo.com with SMTP; Tue, 09 Feb 2010 07:04:36 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=nuepod.com;
h=Message-ID:Date:From:Reply-To:To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:list-unsubscribe; i=support@nuepod.com;
bh=tFao2OKgUCBVxvCbByfUC0R86dw=;
b=v2IkiIzG2jE9MJeruh9FN/KGi2KjVwjqgXizOUSSiQBIHGc7MdeLB5HBgUjj/pcd6XCv1DSuQPDu
Ae1u2R4pRZCWcIUVjGq3tT5vZiqIYMHf0vwehxWMTBr9MGUveSiH
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=nuepod.com;
b=j5aVolVdj/72LzpWhVh9SIeh1fahLdnQnUKjYEp7PzmvUz0HmzxBSJh/OzeQEc00nTAUZyfsU67k
oshP65P+Hs1XgfrgLUKoLW5jbOKJ4kAvFwrIXbGy4j//GV+F+nlT;
Received: by mx-10.nuepod.com id he5so20moas4 for ; Tue, 9 Feb 2010 09:58:49 -0500 (envelope-from )
Message-ID:
Date: Tue, 9 Feb 2010 09:58:49 -0500 (EST)
From: Free Money
Reply-To:
To: “pc_in_tampa@yahoo.com”
Subject: Pres Obama is giving away from $1000′s to $10,000′s -Get yours
before it’s gone! See how
Mime-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-tsk: qaolenlilotolotmazolneeo otolozpmrzetonape omremmmapl
list-unsubscribe:
Content-Length: 4174

By: Ausonius

Ausonius — Tue, 09 Feb 2010 23:37:09 +0000

There are various websites showing how, assuming that nefarious forces are not originating things through a computer in an empty office in Armenia:

See e.g.

http://www.johnru.com/active-whois/trace-email.html

If you have a Macintosh, you can hit the “Show Long Headers” button for all the routing.

It would be interesting to see if the NEA is involved, especially with all those misspelled words!