RSS

Hunter Marshell

25 Nov

Suspicious emails sent by Hunter Marshall using a IP/DOMAIN known for sending out scam mail

FIRST EMAIL SENT: http://edebiyatalemi.com/boybullet/70matthewbrown/ <– Believed to be a spoofed link. The actual URL doesn’t have an HTTP:// and this email was sent to dozens of people at once. The IP/DOMAIN has not only been blacklisted but is known for sending out spam/phishing. This leads me to think that these links are malicious and trying to steal information and the links are spoofed. This unknown emailer also sent the email to the following: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>

SECOND EMAIL SENT: http://kora2day.com/wp-content/disoiuer.php <– Believed to be a spoofed link. Actual URL doesn’t have an http:// .. This email was sent a few days after the first email by Hunter Marshell. This email was sent to my email address along with other email addresses including alot of Craigslist email-addresses. When I look up both the originating IP and the received IP/DOMAIN, both come up blacklisted on many websites. And both have been reported by other online users. Below is a list of other messages sent from the originating IP.

Other Email addresses sent along with my email address are: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>

HEADER:

Return-Path: <hunter.mashell@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) LnBocCABMAEBAQEDdGV4dC9wbGFpbgMDMAIDdGV4dC9odG1sAwMx
X-YMailISG: 8m6IHqkWLDs.3oU5LH5YbJUF05C_830qagvefFyFN1SsSq1M 21Lmjm01GmhuYWO2i8o3CVbHF1FZ4nzHBAF_Sorh_8k19P5PiinTzTwI8Jwa .38uYiFqKUWxTYoBhGB.M9NWh.yMtR1NMMScWc8hTHWhe9.FO8m.P1ltd22q 8kq.Sd7k1uy_gEDG3CQspWgSS5cBJGQwWtcsC0D702Cr9lJLVhrza34rKkly Wa5DT.Bw_yxavqdnrFQ70SUlNNyoym4Xh1AkhOT5vU4MwZ0BnPqcgnqxv3lM smlGhiyvrKzNBbZf0QykXpSO22upZAF7tHRtSp5ZYQZmB89OA3vrkWgtq5MQ _2CpKuqYEP2ouU5Gc4eSYgt0Y_NroAK0pxF1DZBx0aLGd5tbeX5fZwzijASG 2sopsxgVbfVA22mCgaV9dB0FhslwY61RrXA_AemIwiOzzjVJ5mPkCFxNlEpk kYYs_0ln3VSOOnCcishHsLG1WjfEuL1vmQFfGa54nAnX2QbhAfdywSPsB9sB aowK977zFX7yeFPVXgJxx2USA2FeUTCFbTtHdEkBJnYzPWVfg_eop_oHVDRT nPV6CXB_co8C7pQ8pT3DkPJLLvL6wqcXUkv5xbyaw8BJQpxwfsxmNAQ38Jwp OwE9Xe1KKHxZbdXoBVLgNxUAYlxjSe0hOJ0cH4DLBZBJ_W1EUoHRXw9siwhG 9j2.V7vXjB9PAhfz8ub2g3EnVowFBUDpSj4BMiRDeVdYxSVz6xDkahXnck3g u028OTvCrNHjs4Me6Ld0UW3loobNb5JjAN7AoRGzAFz752SgsMyx8b3NmQf6 IobQi11XuOVJRRkGg27fMz8HMwl8oEXenL9dcLXdNYhR.FZX32ZNzLWOfruA VPH_KhVJVJPEW6MiF2dhDSh5dxKMBMOegu6YrQZFZa0ZT4jihX4kse.Ulzha uQQXY2i.pBpLSA4Z1crDSoAahbgeicN5qFMeJNM8AJ9ChKRXRtYxWG8EIjqB xLilg.LOE1SllnWNRg1aM03sWyGaT85_ng_NuofHXhWxIrJVhisgrE.Ff6Jq 1xMCBmdSfhZhh6zArdJHdjy0l34o9nrg9Co5IIhPG.hCShKQ7uEhjvbsefi6 WhYPNuGYQv3BbuYSpbdPNgqo3jlsSv7y5GLZ9TWi8ptPF4u5wuOeYroED2DF 7kqSLVEogRImA_9RwBq9MvfYIMQvAQ–
X-Originating-IP: [98.139.212.191]
Authentication-Results: mta1061.mail.gq1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm23-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.191) by mta1061.mail.gq1.yahoo.com with SMTP; Sun, 18 Nov 2012 14:03:01 -0800
Received: from [98.139.215.142] by nm23.bullet.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
Received: from [98.139.212.235] by tm13.bullet.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
Received: from [127.0.0.1] by omp1044.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 399988.28509.bm@omp1044.mail.bf1.yahoo.com
Received: (qmail 84775 invoked by uid 60001); 18 Nov 2012 22:03:00 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353276180; bh=ndVyovJHFOuRXWx3yCkZvqgZsA9GZf4U0QYoOVZJsZU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:To:MIME-Version:Content-Type; b=a8rRCMbRh7EldKyUf6V6bZ0p1bYqxZ7NFvFKCbVxfln9wfI731eVCcVx6Sb78yXuPa3CvQt7ro9FxPQ3SajSWFIRhCVcsjUhVS1mAA+jTprV9Zu5LxRAu/mHhXemIH/kPjCuVL9g6CnRrRx0f1YqLtHblobigrotb0/cdh7O0D0=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:To:MIME-Version:Content-Type; b=nUlshYW6xFdoUC+oHAhQoWIB+PmtBA4znAEgOADxUUi4YYGFmjC/iTYJV4pMyoqXM24WajRNaj7fAolTR9MFtKZTJh6lv8Md8eHyPzBWGftWMYsieKJ+tvTT899nPXYReBHZ+xklL9yP4lLO55WYiI7t5e39OTcrteQm1/mIKjE=;
X-YMail-OSG: 24fUDJwVM1mu4oNOl0zidjOV9vVTiz1yuEspcMFsCgGiFH6 oh4x5mY3HO_aT8sMtACHSoQuxb9lLkxSZU1xRtd7E.QHYWCkSJ3Z5fnjPOnI .0aPfSZ79YTavaHJWitpW5.qYVeoOa0Bp1ydr_xQ1RJ6_UCAENbgPRUBk_kq lbF696i1UJYED0mMhpYMr4qj.EEw11aAUuHCS4h1lHG6W3yBMP0qCATdwTBh aC_jmMTX9LPpH0m6NCccBQTq0Ns9gffOwlc8C.r868pf4tcCjyTL26Wbkix3 6viQYLN_oMChZJbeDOANcQX46HW4fYQL.cjcKbdsu8wQuasVhv2W7_pLLCIm cizxM507M.6dFd01SowYcIy5XrFuTlqxZktgMSxNg18EAgBuwi.vWj3wObWu 6CYNetLVSl0NQUK7N8YU78LNo_.0lsqPH7M8a9LKweCNWYefDiGqKtUHsOb9 o6Gb7CZco_c4lyhz3oSD1y8rge8lo3A1iItH022en5Y.jiBUIzzKXJ8c.86L YH8HS
Received: from [88.240.46.22] by web160305.mail.bf1.yahoo.com via HTTP; Sun, 18 Nov 2012 14:03:00 PST
X-Mailer: YahooMailWebService/0.8.123.460
Message-ID: <1353276180.78726.YahooMailNeo@web160305.mail.bf1.yahoo.com>
Date: Sun, 18 Nov 2012 14:03:00 -0800 (PST)
From: Hunter Mashell <hunter.mashell@yahoo.com>
Reply-To: Hunter Mashell <hunter.mashell@yahoo.com>
To: x8s8k-3232016651@pers.craigslist.org, pers-rajgk-2707076820@craigslist.org, porkyexposed@yahoo.com, devildog4life.hr@gmail.com, fqss9-3208471845@sale.craigslist.org, jc9vx-3236113278@pers.craigslist.org, 3dfb7-3212331409@sale.craigslist.org, pxthp-3223707014@sale.craigslist.org, 4wdzt-3167460410@sale.craigslist.org
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-360795340-1627103512-1353276180=:78726″
Content-Length: 551

SECOND EMAIL – HEADER:

Return-Path: <hunter.mashell@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) dHRoZXdicm93bi8gATABAQEBA3RleHQvcGxhaW4DAzACA3RleHQvaHRtbAMD MQ–
X-YMailISG: DaSKeHMWLDtpjAojuuC005648iMl_O1cmJgTfAmDWTBgjTyj W0K5h6q3bjKe.RoFe3pqNEaqEUieV1BOk1sAYhn1oAfwzXD8Aj1IVBreqZdZ kbeNaYICml27j0mrk9rkFcXiD2fmoCK4a16imA.sBEly5.T0mqc7xSQrTR0R yqiCyGpnUpzo2eGTFTI8wECjOLtR20l.Va3npL0thkK52lJGhAfG.fxIQmKj drHq7cL_qaBu48frGKc5zbTLNlQyiHP8rtZjw2Ov8Ckx4gGvYjrfSRFklL2o mwyJcgV5xmsaJ33Pxo4cy2Q7F0s00H7zM6LEHH.FmMvZOhKceJz29cb2KlXw kQWh4hUUtAOIzNPoY6lpSSgvMxoSKkPYMeBXIda9P75JJ2KjvYbSpcPxybmX _dNfv7fsrx9O84n4aNYg.pE42l4mewdRio_3u8RbQEBrk57bF41cyIUE9EwM eenpQxypMWRjm8mvX2DG9iXhlB7yCojwdHbGshgbWs2QEklIUu9faBOnWWj2 FYy0SNBp2e950SLrYGKLcr35j3pPt.1i6Bm_2jFhoS8G6sv3UR1_JuFtAl8f Zi4y9GFnn6kMiPSTWpr6CNxjmg0W8C1OyEqQ3kqZ5.EPAxtXcjZMTmBWXkZ9 gCLvEWba9xj7DEX89meVWSvlnNDr27xBSv0ZJj4mlSxLbkIRoqcomaKdG88L LNFVwGpvu.Zd.vJ3Z0FS1RPMc8LuO.k1pBecOEtwTKV2G2nwzxpx8inpum7r EerfYvkUHB8E0nWTYKU9o5SGoVjA3ESNP6Zu9fcaoSp5X9Kp1KAMAGRHodVw gYbXMovbsH_lUgHDSJNJ44jR0J50RqkyeJ.pMCKgl2KqMpUlBfqzcxrolnF2 fhmtemJo5IdvTqX4m0xKaIYQs6_RT2KTXgM5pvts5z58yVpC5RQajU22L3tB A6YwXQ7zVSS35li0N5e7XjEsGR0ILR3BEP1QV0.YbE1.5Hq9CZ7zjxMyQ0Me JlX.xHsthSNd1TpnbYAT2WspG89jf.4fWVN83fm8Ijh2IniCV0Ay0FJxAbc. 7Uz0xxjlPLrO_CI70o0YTZ80rWjEs3toLGIsrnbtoFbabwnd09Jyjr0YWJLS NMW65qWLLdshRY1n30MUhwul5W0qCNt8rvrbkBBR2GmsZa4ubJy61g.adZTQ yp.SljIk75abbfYU64Vy2eDgCR2ZBuBWQ4aU50JfoH_UDtdfLUpN8kfs9ZKg mA7rmw–
X-Originating-IP: [98.139.212.160]
Authentication-Results: mta1399.mail.gq1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm1.bullet.mail.bf1.yahoo.com) (98.139.212.160) by mta1399.mail.gq1.yahoo.com with SMTP; Sat, 17 Nov 2012 17:30:24 +0000
Received: from [98.139.212.152] by nm1.bullet.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
Received: from [98.139.215.254] by tm9.bullet.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
Received: from [127.0.0.1] by omp1067.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 948524.69397.bm@omp1067.mail.bf1.yahoo.com
Received: (qmail 15374 invoked by uid 60001); 17 Nov 2012 17:30:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353173422; bh=73XBI+Vxyzj3LMifXM0eCpx4TW4CwH6qnUe6WBqbSJc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:To:MIME-Version:Content-Type; b=LM8j1z0V+Y08iN2zxbsIHeCodaPWG/tMhLUpjQkevJdaeq5L4P3D+8g18nSPlbOtHYpM/AZRV+EYfwg5x6FLu16LQ65oHcEZttEg2avXsrM/Wf95mstrccxwC3koscV6H+KK7Lf0khdLLaGykhsVQfglkvFzrdER4E0LWy1ZY+Y=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:To:MIME-Version:Content-Type; b=YlvI8Yi/hqeSDlvB1gah8NEUIIrslxhIwAbPt3r1Tj5BXd16/ujgmtYvUM1/emnV4iLwEpAJ7zdKQd/S0cmThVVlCo5nvHn3dkV+/vs4Qm4DTD4wyFtBxLURe0sRVVW1ZqzOFKUpfPQRhfT4luuzDazZjXbbQpNdfZAzsiPmXyg=;
X-YMail-OSG: J6yHAxgVM1nZ5gr0kmpokRnOqMrRsATyexzx.xCuBJ2fhKQ 3PdReUQCxt4aiCtcmkCVi1mLsG2QCoQ1TkZgCJgytTyExBTASAAgNWLN5Lil RnvPLg5z7BTRxplxzYDC4GHqjhM_f0hJRTTpTiJih_Qyo.zav1BgFhbaqv8v GrikLYpfuJyGGzaWzGyArpbL8qDvZXiXHnJQrGpjiYm5QU32eHePNrKbIg.2 AVzDAhlofpwbNux2jbvrbYgbTIrW3UaRXK47.ZBj.eWYSYa9D0AYCZEe5VFf Lwh7.7XDHQGNiw5vbXmW9WeqBsT_cqg.wEjmJ.EqW89DffUDnK20Hl3jslnY Gf7Nc8ZV2vrhGhS79C8jEIdBjUp7XpO5TnFFH2w.0Bk_1JYEvQxYAga.ayxY 7978Rcrgcy3zwZ1EuGiqa3vmWp7xbTXdjUU52kJEc77o0LX5YoNoLjQGxxoM 1B9iQ1jx5sMkonWuMi.SCPK8MchlawzhcZlJic6QtNOjqWqWonlHC2JPA.CH afeabN7w83gNuTNaL
Received: from [181.14.174.37] by web160301.mail.bf1.yahoo.com via HTTP; Sat, 17 Nov 2012 09:30:22 PST
X-Mailer: YahooMailWebService/0.8.123.460
Message-ID: <1353173422.14639.androidMobile@web160301.mail.bf1.yahoo.com>
Date: Sat, 17 Nov 2012 09:30:22 -0800 (PST)
From: Hunter Mashell <hunter.mashell@yahoo.com>
To: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”1332810471-999729533-1353173422=:14639″
Content-Length: 572

 

Hunter Mashell  hunter.mashell@yahoo.com <hunter.mashell@yahoo.com>

41.83.22.59 <> Associated IP <> 41.82.77.176

Example Messages Sent From 98.139.212.191
From: LOAN SERVICE <web.office23429924@att.net>
Subjectnone/blank
From: “Mr. Robin Paker” <web.offfice.19.127@att.net>
Subjectnone/blank
From: L Wells <jbwells3@yahoo.com>
Subjectnone/blank
From: MISS JENNY <missjennykipkalya@postafiok.hu>
Subject: Hello Dearest One,
From: Esther Chizizy <000333yyyzz@att.net>
Subject: hi
From: sosdf fghj <goone_55@yahoo.ca>
Subject: Hi
From: Mrs Rose Lambert <webxxvvcc@att.net>
Subject: My Dear Friend
From: Mrs Elizabeth Kamara <elizabethkamara90@hotmail.fr
Subject: Dear Beloved One
From:
Subject: CONGRATULATION: YOUR OVERDUE FUND HAS BE RELEASED
From: “Mrs. Evelyn McGregor” <officialnoticecaza1@gmail.
Subject: GOOD NEWS YOUR EMAIL HAS WON USD$1,000,000.00 !!!
From: “MR. SUNNY LUCAS” <sunluccas111222@rediffmail.com>
Subject: SOUTH AFRICAN NETWORK FOR WOMEN
From: SJPUB <kmoore1099@att.net>
Subject: PUBLISH RESEARCH STUDIES ARTIC
From: “Robert”<fbiusaorg2011@live.com>
Subject: Read attached message and respond
From: “Maria .B Raul”<incaseinhkilo@btconnect.com>
Subject: Re: Award Final Notification
From: “Mr Anthony D Loehnis”<www.offic223@hotmail.com>
Subject: Kindly check the attached message for full details
From: 張小姐
Subject: =?utf-8?B?6Lez5qiT5YO5LeWQjeeJjC3ljIUt6Yy2LS7p=?
From: Wilfred Wilson <wwilson_four@yahoo.co.th>
Subject: My mail.
From: “ROBERT S. MUELLER”<fbiinvestigatiion@live.com>
Subject: ANTI-TERRORIST AND MONEY LAUNDRY CRIMES DIVISION W
From: “nutzkicker@yahoo.com” <nutzkicker@yahoo.com>
Subject: FW: Tired of green tea? Try green COFFEE!
From: “sonofdxb@yahoo.com” <sonofdxb@yahoo.com>
Subject: FW: Forget those usual weightloss scams!
From: “From Mr. David Morris” <john.king350@yahoo.co.id>
Subject: From Mr. David Morris
From: ETISALAT COMMUNICATION <ukpess@yahoo.com>
Subject: Etisalat Award Promotion
From: Millennium Global loan Ltd <mgl1@live.co.za>
Subject: Loan at 2% reply with Name,Amount,Duration and Con
From: “Mai Leida” <shoshanasherlyn@kl.com>
Subject: Generic & Brand Cialis for $1.53/pill from TRUSTED
From: “Kiera Susanne” <hilmasachiko@wipro.com>
Subject: Buy Cheap Generic Cialis or Brand name Cialis, CIA
From: “Rolande” <georgettewilhelmina@yowzahost.com>
Subject: Buy HCG Drops Online for only $59/bottle ltqgyab
From: “Linnie” <nereidamayme@ps.ge.com>
Subject: SPECIAL OFFER : CIALIS on SALE at $1.53 !!! r6ckix
From: “Carmel Mui” <vivanelda@fusionstorm.com>
Subject: SPECIAL OFFER : CIALIS on SALE at $1.53 !!! fzesti
 
Leave a comment

Posted by on 11/25/2012 in Other

 

Tags: , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: