new scam email going around

easyhost

beware if you receive and email like this as it is a scam (i have removed all emails linking to me or my sites)

From: Andrew Webber - Arizonakey.com
Sent: Friday, May 27, 2011 6:22 PM
To: *************
Subject: [?? Probable Spam] Cease and desist copyright infrigement!

Dear Sir,

Attached is a list of the copyrighted material you are infriging on.
We are the proprietors of all copyrighted material that is being fringed upon on your companies webste.
We have reserved all rights regarding these trademarked files.
Permission was neither asked nor granted to reproduce our copyrighted material, therefore what your company is doing constitutes infringement of our rights. In terms of the Copyright Statutes, we are entitled to an injunction against your continued infringement, as well as to recover damages from you for the loss we have suffered as a result of your infringing conduct.

In the circumstances, we demand that you immediately:

1. remove all infringing content and notify us in writing that you have done so;

2. pay a licensing fee in the amount of 160,000 USD;

3. immediately cease the use and distribution of copyrighted material;

We await to hear from you by.

This is written without prejudice to our rights, all of which are hereby expressly reserved.

Yours faithfully,
CEO Andrew Webber
www.arizonakey.com

checked www.arizonakey.com and the list of contacts are

NAME
POSITION Tom Ruberto Owner / Publisher / Sales Sue Malthaner Owner / Editor / Distribution / Sales Brian Malthaner Owner / Marketing & Public Relations / Sales Patricia Ruberto Accounting Johnny Fenton Contributing Writer Danielle Ruberto Contributing Writer

no CEO Andrew Webber, so i checked the emails header details

Return-Path: <[EMAIL="roebben&#64;adv-roebbenvelkeneers.be"]roebben@adv-roebbenvelkeneers.be[/EMAIL]>
Envelope-to: ************
Delivery-date: Fri, 27 May 2011 18:22:52 +0100
Received: from s01.gt-networks.be ([94.103.146.92]:45568) by
Delta.************ with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69)
(envelope-from <[EMAIL="roebben&#64;adv-roebbenvelkeneers.be"]roebben@adv-roebbenvelkeneers.be[/EMAIL]>) id 1QQ0kM-0005EC-3L for
************; Fri, 27 May 2011 18:22:52 +0100
Received: from apache by s01.gt-networks.be with local (Exim 4.76)
(envelope-from <[EMAIL="roebben&#64;adv-roebbenvelkeneers.be"]roebben@adv-roebbenvelkeneers.be[/EMAIL]>) id 1QQ0kI-00052F-Nx for
************; Fri, 27 May 2011 19:22:46 +0200
To: <************>
Subject: [?? Probable Spam] Cease and desist copyright infrigement!
X-PHP-Script: adv-roebbenvelkeneers.be/ad/sendme.php for 82.195.232.218
From: "Andrew Webber - Arizonakey.com" <[EMAIL="andrew.webber&#64;arizonakey.com"]andrew.webber@arizonakey.com[/EMAIL]>
Reply-To:
X-SpamFlt-Status: Probable Spam
X-KASFlt-Status: Method: probable
X-KASFlt-Status: Rate: 60
X-KASFlt-Status: Status: probable_spam
X-KASFlt-Status: Envelope from:
X-KASFlt-Status: Version: 4.4.2 (May 26 2010 17:02:10)
X-KASFlt-Status: Profiles 22032 [May 27 2011]
X-KASFlt-Status: {REPLY-TO: empty}
X-KASFlt-Status: {HEADERS: Content-Type without charset with 8-bit header
Content-Transfer-Encoding}
X-SpamFlt-Phishing: Not Detected
MIME-Version: 1.0
X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7600.16776
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <[EMAIL="E1QQ0kI-00052F-Nx&#64;s01.gt-networks.be"]E1QQ0kI-00052F-Nx@s01.gt-networks.be[/EMAIL]>
Date: Fri, 27 May 2011 19:22:46 +0200
X-Spam-Status: No, score=2.8
X-Spam-Score: 28
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system
"Delta.niceday-hosting.com", hasidentified this incoming email as possible
spam. The original messagehas been attached to this so you can view it (if
it isn't spam) or labelsimilar future email. If you have any questions,
seethe administrator of that system for details.Content preview: Dear Sir,
Attached is a list of the copyrighted material youare infriging on. We are
the proprietors of all copyrighted material thatis being fringed upon on
your companies webste. We have reserved all rightsregarding these
trademarked files. Permission was neither asked nor grantedto reproduce our
copyrighted material, therefore what your company is doingconstitutes
infringement of our rights. In terms of the Copyright Statutes,we are
entitled to an injunction against your continued infringement, aswell as to
recover damages from you for the loss we have suffered as a resultof your
infringing conduct. [...] Content analysis details: (2.8 points, 3.0 re
quired)pts rule name
description----

---

---

2.0
DEAR_SOMETHING BODY: Contains 'Dear (something)'-0.0 SPF_HELO_PASS
SPF: HELO matches SPF record-0.0 SPF_PASS SPF: sender matches
SPF record0.8 BAYES_50 BODY: Bayes spam probability is 40 to
60%[score: 0.4898]0.0 LOTS_OF_MONEY Huge... sums of money
X-Spam-Flag: NO

which as you see the email originated from s01.gt-networks.be ([94.103.146.92] which on checking is from Netherlands Amsterdam Ageo Bvba which i s strange as arizonakey.com is run by IMT Inc.
18346 W. Sweet Acacia Drive,Goodyear, Arizona 85338, United States with IP Address:173.203.96.65

JJ_Egan

arizonakey.com is run by IMT Inc.
18346 W. Sweet Acacia Drive,Goodyear, Arizona 85338, United States with IP Address:173.203.96.65

and is a local area magazine .


Odd scam how do you send them the money .


jje

easyhost

JJ_Egan wrote: »

arizonakey.com is run by IMT Inc.
18346 W. Sweet Acacia Drive,Goodyear, Arizona 85338, United States with IP Address:173.203.96.65

and is a local area magazine .


Odd scam how do you send them the money .


jje

it is but read the first line

Attached is a list of the copyrighted material you are infriging on

hoping the recipient would open an attachment most likely a virus. but no attachment was included, most likely stopped by my system

easyhost

plusnet sent me this

Dear Plusnet Customer,

You are receiving this mail because you have an active virus-scanning
service, and either a banned file extension or an email containing
a virus has been sent to your address.

The mail was sent to you from:

* Andrew Webber - Arizonakey.com<[EMAIL="andrew.webber&#64;arizonakey.com"]andrew.webber@arizonakey.com[/EMAIL]>

The subject line of the mail received was:

* Cease and desist copyright infrigement!

In order to protect you, this email has been stored on our servers
and quarantined. If you wish to retrieve this, please send an
email to [EMAIL="unquarantine&#64;quarantine.plus.com"]unquarantine@quarantine.plus.com[/EMAIL] containing the following information;

---

SUPPORT INFORMATION

---

Quarantine-Id: 2a707ca0eec0007913171d177c71033a57432
Message-Id: <[EMAIL="E1QQ224-0004Mn-MX&#64;pih-inmx25.plus.net"]E1QQ224-0004Mn-MX@pih-inmx25.plus.net[/EMAIL]>
To: Recipients <[EMAIL="andrew.webber&#64;arizonakey.com"]andrew.webber@arizonakey.com[/EMAIL]>

---

SUPPORT INFORMATION

---

It should be possible to reply to this mail to retrieve your email,
as long as your email application includes this entire message in
the reply.

Kind Regards,
Customer Support.

Ximian

Do you know what virus it is/was? I'm guessing "Andrew" sent a malicious PDF containing an exploit.

easyhost

Ximian wrote: »

Do you know what virus it is/was? I'm guessing "Andrew" sent a malicious PDF containing an exploit.

No i have no idea as the attachment was not received and anyway i would not open it.