Spammer
Jamie Baille
History: Canadian. Claimed to be antispammer. Known
for long humorous rants and bogus complaints over his ignorance of copyright
laws.
Since becoming a spammer he has gone through more than a few various
companies, and had many pages shut
down for abuse.
He has also been shown to be involved in attacks
on those who have exposed his abuse, and posts blatant threats and
lies
about his abuse and those who expose it to usenet newsgroups. For
example, see here.
Baillie has a history which includes crossing
legal lines and has been described in police reports as "a person who can
be described as a very slow learner or as border-line mentally challenged.
He seems like the type of person who is very easily led and who would do
almost anything to be popular or to be liked by others."
MO: Spams for infamous DHS-Club
spammers. Uses foreign open relays to send initial spam.
Collects replies via free web page reply forms for adding to the company's
spam list of suckers.
Most recent exchange:
Initial spam:
Spam sent from mta1.real.mail.entelchile.net
ISAPRE BANMEDICA BANMEDIC (NET-164-77-0-0-1)
164.77.0.0 - 164.77.255.255
ENTEL CHILE S.A. ENTELCHILE-164-77 (NET-164-77-32-0-1)
164.77.32.0 - 164.77.255.255
More
examples of the same spam here
Received: from mta1.real.mail.entelchile.net ([164.77.62.90]
helo=mta1.entelchile.net)
by ares.liveshere.com with esmtp (Exim
3.36 #1)
id 18ufdQ-0003py-00
for removed; Sun, 16 Mar 2003 13:25:36
-0800
Received: from pc1 ([164.77.56.221]) by mta1.entelchile.net
with SMTP
id <20030316212221.YRCU25552.mta1@pc1>;
Sun, 16 Mar 2003 17:22:21 -0400
From: personalfreedom499@hotmail.com
To:
Subject: Financial Freedom For YOU - Work SMARTER,
not HARDER!
Date: Sun, 16 Mar 2003 15:29:15 -0500
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <20030316212221.YRCU25552.mta1@pc1>
Hello there,
You get emails every day, offering to show you
how to make money.
Most of these emails are from people who are
NOT making any money.
And they expect you to listen to them?
Enough.
If you want to make money with your computer,
then you should
hook up with a group that is actually DOING it.
We are making
a large, continuing income every month.
What's more - we will
show YOU how to do the same thing.
This business is done completely by internet and
email, and you
can even join for free to check it out first.
If you can send
an email, you can do this. No special "skills"
are required.
How much are we earning? Anything from $500 to
$9000 per month.
We are real people, and most of us work at this
business part-time.
But keep in mind, we do WORK at it - I am not
going to
insult your intelligence by saying you can sign
up, do no work,
and rake in the cash. That kind of job
does not exist. But if
you are willing to put in 10-12 hours per week,
this might be
just the thing you are looking for.
This is not income that is determined by luck,
or work that is
done FOR you - it is all based on your effort.
But, as I said,
there are no special skills required. And
this income is RESIDUAL -
meaning that it continues each month (and it
tends to increase
each month also).
Interested? I invite you to find out more.
You can get in as a
free member, at no cost, and no obligation to
continue if you
decide it is not for you. We are just looking
for people who still
have that "burning desire" to find an opportunity
that will reward
them incredibly well, if they work at it.
To grab a FREE ID#, simply go to one of the mirror
sites below and enter your
details:
http://www.geocities.com/wealth900004/
http://www.geocities.com/wealth900005/
http://www.geocities.com/wealth900003/
http://www.geocities.com/wealth900002/
http://www.geocities.com/freedom90001/
http://www.geocities.com/alwaysfree9000/
http://www.geocities.com/freedom900000/
http://www.geocities.com/freedom900006/
http://www.geocities.com/freedom900007/
http://www.geocities.com/freedom900008/
If you can not reach one of the mirror sites please
try
back again later the mirror sites are extremely
busy
and recieve a lot of hits. It just goes to prove
how exciting this business really is!
We will confirm your position and send you a special
report as
soon as possible, and also your Free Member ID.
That is all there
is to it!
You can then make up your own mind and decide
whether you want to
make some money too...or not.
Looking forward to hearing from you!
P.S. After having several negative experiences
with network
marketing companies, I had pretty much given
up on them. This is
different - there is value, integrity and a REAL
opportunity to have
your own home-based business...and finally make
real money on the
internet.
Don't pass this up...you can sign up and test
drive the program for
FREE. All you need to do is get your Free Membership.
=============================================================
This email has been screened and filtered by our
in-house "Opt-Out"
system in compliance with State Law. If you wish
to have your email
address deleted from this mailing as well as
future mailings, please
go to our "Opt-Out" Website"
http://www.geocities.com/removal_request2000/
OR at http://www.geocities.com/removal_request20022000/
You only have to go to one of the sites above
to be removed
either one will have you removed from the list.
This message is not intended for residents of
the state of Washington, and
screening of addresses has been done to the best
of our technical ability.
If you are a Washington resident or otherwise
wish to be removed from this
list, just follow the removal instructions above.
====================================================================
By submitting this request for a Free Membership,
I agree to accept email
from the Club about their Consumer and Business
Opportunities.
I also understand that I am under no obligation
and that no commitment is
expected from me and that I can be removed from
receiving any more
information. I also understand that a record
will be kept of my
Membership Request as proof of my consent,
containing my IP address, Email
address, Name, Surname, Date and Time.
(END OF SPAM)
Baille's pages are all the same. Apparently
he doesn't quite grasp the concept of mirroring.
Most spammers, even as absolutely stupid as
they tend to be, understand that the reason for
mirroring the site is so that when one get's
terminated for abuse, at least one of the others may
stay up a while. But Jamie is apparently
lower on the IQ scale than your typical chickenboner.
He puts them all on the same free host and
lists them all in the same spam.
Let's look at his source code:
From http://www.geocities.com/alwaysfree9000/
:
<html>
<head>
<meta http-equiv="Content-Language"
content="en-us">
<meta name="GENERATOR" content="Microsoft
FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type"
content="text/html; charset=windows-1252">
<title>Upgrade your Future Today</title>
</head>
<body>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p><b><i><font size="7">Upgrade
your Future Today!</font></i></b></p>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<blockquote>
<blockquote>
<blockquote>
<blockquote>
<blockquote>
<p><b><font face="Arial" color="#00FFFF" size="+2">
<span style="font-size: 24px">Congratulations!!</span></font></b></p>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p> </p>
<p><u><b><font face="Arial"
size="+1"><span style="font-size: 18px">You have
taken your first step towards financial
independence!</span></font></b></u><font face="Arial" size="-1"><span
style="font-size: 12px"><br>
<br>
I would like to extend a warm welcome
to you from a team of people that are
ready to help you reach your goals
and I know that we will have a bright and
prosperous future together. </span></font></p>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p><b><font face="Arial"
size="+1"><span style="font-size: 18px">What We Offer:</span></font></b></p>
<p><font face="Arial" size="-1"><span
style="font-size: 12px">We offer all of
our members </span></font><b><font
face="Arial" color="#006600" size="-1">
<span style="font-size: 12px">FREE</span></font></b><font
face="Arial" size="-1"><span style="font-size: 12px">
membership. This means that you
can become a member, totally </span></font><b>
<font face="Arial" color="#006600"
size="-1"><span style="font-size: 12px">FREE
</span></font></b><font
face="Arial" size="-1"><span style="font-size: 12px">of
charge, and enjoy the benefits
of rebates on all your online purchases, from
stores affiliated with us, and
half price purchases from our Online Mall Outlet.
You will also earn commisions on
all purchases of Free Members that sign up
after you. Once you join as a VIP
(</span></font><b><font face="Arial" color="#006600" size="-1"><span
style="font-size: 12px">V</span></font></b><font face="Arial"
size="-1"><span style="font-size: 12px">ested
</span></font><b><font
face="Arial" color="#006600" size="-1">
<span style="font-size: 12px">I</span></font></b><font
face="Arial" size="-1"><span style="font-size: 12px">ncome
</span></font><b><font
face="Arial" color="#006600" size="-1">
<span style="font-size: 12px">P</span></font></b><font
face="Arial" size="-1"><span style="font-size: 12px">artner)
member you will become part of
a unique team, whose members work together
towards financial success and independence.
All new VIP members that join after
you, are placed in your down line.
This will give you the fastest growing down
line on the net and the best potential
of increasing your earnings. </span>
</font><b><font face="Arial"
color="#990000" size="-1">
<span style="font-size: 12px">This
is a very unique program that allows you to
earn even as a FREE Member!!</span></font></b></p>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p><b><font face="Arial"
size="+1"><span style="font-size: 18px">Why are we
different?</span></font></b></p>
<p><b><font face="Arial"
color="#cc0000" size="-1">
<span style="font-size: 12px">Before
I joined this program, I had a lot of
doubts:</span></font></b></p>
<p><b><font face="Arial"
size="-1"><span style="font-size: 12px">Why should I
join this program?<br>
What makes it successful and<br>
How do I know that it will work
for me?</span></font></b></p>
<p><u><b><font face="Arial"
color="#006666" size="-1">
<span style="font-size: 12px">I
found five distinguishing features about this
program that satisfied me:</span></font></b></u><font
face="Arial" color="#000099" size="-1"><span style="font-size: 12px"><br>
<br>
I was not mislead by what I read
- </span></font><u>
<font face="Arial" color="#000099"
size="-1"><span style="font-size: 12px">The
information I received was truthful.</span></font></u><font
face="Arial" color="#000099" size="-1"><span style="font-size: 12px"><br>
<br>
The program operates in such a
way that all members interact. This means that if
a new member does not know how
to market the product, he/she is coached by
his/her sponsors which really made
me feel part of a team. <br>
<br>
The resources available to VIP
Members to promote their business are endless.<br>
<br>
The fact that I became excited
by what I was presented with and the prospect of
earning an extra income with other
teammates helping me.<br>
</span></font></p>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p><b><font face="Arial"
size="+1"><span style="font-size: 18px">What should you
do if you are interested?</span></font></b></p>
<p><font face="Arial" size="-1"><span
style="font-size: 12px">Because I would
like you to feel welcome and since
I would like you to be part of my team, I am
going to offer you all of my assistance
in getting your business up and running,
should you choose to join as a
VIP member. All I ask of you now, is to fill in
the form below. Remember that your
membership is totally free and you can cancel
your membership at anytime. Have
a look around and see what you think. I will
contact you with the necessary
information. Thank you for your time and
attention! </span></font></p>
<p> </p>
<p>
<form method=post action="http://geocities.yahoo.com/forms">
<font face="arial" size= "-1">
<b>First Name:</b> <input
type="text" name="FirstName" size="27">
</FONT><p><font face="arial"
size= "-1"><b>Last Name:</b> <input type="text" name="LastName"
size="27">
</FONT><p><font face="arial"
size= "-1"><b>Your Email:</b> <input type="text" name="Email"
size="27">
</FONT><p><font face="arial"
size= "-1"><input type="submit" value="Send Info">
<input type="reset" value="Clear
the form">
<input type="hidden" name="login"
value="alwaysfree9000">
<input type="hidden" name="subject"
value="---Membership Request!---">
<input type="hidden" name="I
submit the above information freely and agree to receive information from
the Club about both their Consumer and Business Opportunities." value="I
agree with this Submitted Posting of my information">
<input type="hidden" name="required_fields"
value="FirstName,LastName,Email">
<input type="hidden" name="next_url"
value="http://www.geocities.com/alwaysfree9000/thankyou2.htm">
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p><font face="Helvetica"
color="#00FFFF" size="1">By submitting this request
for a Free Membership, I agree
to accept email from the Club about their
Consumer and Business Opportunities.
I also understand that I am under no
obligation and that no commitment
is expected from me and that I can be removed
from receiving any more information.
I also understand that a Record will be
kept of my Membership Request as
proof of my consent, containing my IP address,
Email address, Name, Surname, Date
and Time.</font></p>
<p><img border="0" src="images/light_blue.gif"
width="594" height="5"></p>
<p>To be removed click </font>
<a href="http://www.geocities.com/removal_request20022000">HERE</a>
OR
<a href="http://www.geocities.com/removal_request2000">HERE</a>
<font face="arial" size= "-1">
<blockquote>
<blockquote>
<blockquote>
<blockquote>
<p><font face="Arial" size="-2"><span style="font-size: 10px">Author:
Jamie JB3082892<br>
Copyright © 2003. All rights reserved .Revised: March 8, 2003</span></font></p>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<table border=0 cellpadding=1
cellspacing=0 width="1%" bgcolor=660066><tr><td><table border=0
cellpadding=3 cellspacing=0 width="1%" bgcolor=eeeeee><tr><td nowrap><a
href="http://geocities.yahoo.com/pstats/alwaysfree9000"><img src="http://us.geo1.yimg.com/pic.geocities.com/us/i/geo/ao/pstat.gif"
width="14" height="14" alt="See who's visiting this page." border="0" align="left"></a><font
face=arial size=-1> <a href="http://geocities.yahoo.com/pstats/alwaysfree9000"><b>View
Page Stats</b></a></font><br><font face=arial size=-2>See
who's visiting this page.</font></td></tr>
</table></td></tr>
</table>
</body>
</html><!-- text below generated
by server. PLEASE REMOVE --></object></layer></div></span></style></noscript></table></script></applet>
<script language="JavaScript">
var PUpage="76001065"; var PUprop="geocities";
</script><script language="JavaScript"
src="http://www.geocities.com/js_source/pu5geo.js">
</script><script language="JavaScript"
src="http://www.geocities.com/js_source/ygNSLib9.js?v3">
</script><script language="JavaScript">
var yvnContents='http://us.toto.geo.yahoo.com/toto?s=76001065&l=NE&b=0&t=1047871509';yvnR='us';yfnEA(0);
</script><script language="JavaScript"
src="http://us.i1.yimg.com/us.yimg.com/i/mc/mc.js">
</script><script language="JavaScript"
src="http://geocities.com/js_source/geov2.js">
</script><script language="javascript">
geovisit();
</script><noscript><img
src="http://visit.webhosting.yahoo.com/visit.gif?us1047871509" alt="setstats"
border="0" width="1" height="1"></noscript>
<IMG SRC="http://geo.yahoo.com/serv?s=76001065&t=1047871509"
ALT=1 WIDTH=1 HEIGHT=1>
Tracing the spammer is pretty easy here. He admits that it's
his garbage right there on the page where is says:
<p><font face="Arial" size="-2"><span style="font-size: 10px">Author:
Jamie JB3082892<br>
Copyright © 2003. All rights reserved .Revised: March 8, 2003</span></font></p>
But that doesn't tell us who he's spamming
for. For more details, I opened a few temporary accounts and pretended
to
fall for spammer Jamie Baillie's scam.
I replied to the spam by entering the new addresses into his form.
I got two replies. The first directly
from Jamie Baillie the spammer. It's an autoresponser reply, but
it shows his real connection.
The spam was relayed through an open relay
in spain. This reply came directly from Spammer Jamie through his
ISP via his hotmail drop box:
Message-ID: <20030317080849.3e758291291ffffffc2@hotmail.com>
X-Originating-IP: [24.192.183.149]
From: "Jamie" <surfer800@hotmail.com>
To: <removed>
Subject: Please Activate Your Free
Membership Today, Rob!
Date: Mon, 17 Mar 2003 03:08:49
-0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express
6.00.2800.1106
Disposition-Notification-To: "Jamie"
<surfer800@hotmail.com>
X-MimeOLE: Produced By Microsoft
MimeOLE V6.00.2800.1106
Dear removed,
Thank you for submitting your Free
Membership request!
I am glad that you are joining us
to work together in achieving a better future!
Best of all is that this opportunity
is presented to you FREE OF CHARGE!
You should by now have received
a letter through which you can activate your
Free Membership.
Please activate your membership
as soon as possible, since it will expire in a 5
days' time. Remember that you can
cancel your membership at anytime if you are
not totally satisfied with what
the Club has to offer you, but since it is FREE
to join, come and see for yourself.
Some people in my Team have generated an
income of over $7000 per month
in less that 10 months! This is definitely an
opportunity not to be missed!
So don't waste any time activating
your membership. The earlier you do, the
quicker you can save and even earn!
Once again, I would like to extend
a warm welcome to you and I am looking
forward to a better future in our
Team!!
Kindest Regards,
Jamie Baillie
Your DHS Club Sponsor
X-Originating-IP: [24.192.183.149] is his connection.
He connects to the internet via
OrgName: Rogers
Cable Inc.
NetRange: 24.192.0.0
- 24.192.255.255
CIDR:
24.192.0.0/16
OK, now we have proof that Jamie Baillie is
a spammer, that Jamie Baillie is the spammer in this case,
and that Jamie Baillie is spamming for the
long
term spamhaus DHS-Club.
The second response is more proof of the connection.
It came directly from the DHS-Club
spammers themselves.
X-Message-Info: JGTYoYF78jEHjJx36Oi8+Q1OJDRSDidP
Received: from www.clubshop.com
([63.124.98.254]) by mc7-f19.law1.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Mon, 17 Mar 2003 00:08:19 -0800
Received: (from nobody@localhost)
by www.clubshop.com (8.11.6/8.11.6) id h2H88H128202;
Mon, 17 Mar 2003 00:08:17 -0800
Date: Mon, 17 Mar 2003 00:08:17
-0800
Message-Id: <200303170808.h2H88H128202@www.clubshop.com>
To: removed
From: Jamie Baillie
<surfer800@hotmail.com>
Subject: Rob, How To Confirm
Your DHS ClubBucks Membership
Return-Path: nobody@www.clubshop.com
X-OriginalArrivalTime: 17 Mar 2003
08:08:20.0218 (UTC) FILETIME=[5F70F5A0:01C2EC5C]
Dear removed :
Congratulations on requesting Membership
in the DHS Club.
As a DHS Club Member, you are joining
together with millions of other Members to save money and make money by
using our exciting ClubBucks Rewards Program.
Confirm your request to become a
Free Member and receive your ID Number, click on this link:
http://www.clubshop.com/cgi-bin/confirm/75896066
AOL users click <a href="http://www.clubshop.com/cgi-bin/confirm/75896066">here</a>.
If you do not confirm your request
within 5 days, your request will expire, so be sure to click on the link
above now!
Welcome to the Club!
Jamie Baillie
Note that although it was sent from www.clubshop.com
([63.124.98.254]), one of the DHS-Club spam
domains, they added Spammer Jamie Baillie's
name to it. The link between the spam and the perps is thus
confirmed by the replies, and by them claiming
Spammer Jamie and by Spammer Jamie claiming them.
Spammer's domains:
dhs-club.com
63.124.98.250
clubshop.com
63.124.98.254
dhscsvcs.com
63.124.98.253
All hosted by uu.net:
NetRange: 63.64.0.0 - 63.127.255.255
CIDR:
63.64.0.0/10
And also:
clubdepot.com
65.120.169.130
hosted by usexpress under qwest
Qwest Communications NET-QWEST-BLKS-4 (NET-65-112-0-0-1)
65.112.0.0 - 65.127.255.255
US EXPRESS.NET Q1126-65-120-168-0 (NET-65-120-168-0-1)
65.120.168.0 - 65.120.171.255
More information on these long term criminals
can be found at The
club built on spam.com and here
and here.
More information on Spammer Jamie Ballie can
be found here
and here
.
William R. James
|