Spam Reaper

Spam Reaper

Spammer Jamie Baille

History: Canadian. Claimed to be antispammer. Known for long humorous rants and bogus complaints over his ignorance of copyright laws.
Since becoming a spammer he has gone through more than a few various companies, and had many pages shut down for abuse.
He has also been shown to be involved in attacks on those who have exposed his abuse, and posts blatant threats and lies
about his abuse and those who expose it to usenet newsgroups. For example, see here.
Baillie has a history which includes crossing legal lines and has been described in police reports as "a person who can be described as a very slow learner or as border-line mentally challenged. He seems like the type of person who is very easily led and who would do almost anything to be popular or to be liked by others."

MO: Spams for infamous DHS-Club spammers. Uses foreign open relays to send initial spam. Collects replies via free web page reply forms for adding to the company's spam list of suckers.

Most recent exchange:
Initial spam:
Spam sent from mta1.real.mail.entelchile.net
ISAPRE BANMEDICA BANMEDIC (NET-164-77-0-0-1)
164.77.0.0 - 164.77.255.255
ENTEL CHILE S.A. ENTELCHILE-164-77 (NET-164-77-32-0-1)
164.77.32.0 - 164.77.255.255
More examples of the same spam here

Received: from mta1.real.mail.entelchile.net ([164.77.62.90] helo=mta1.entelchile.net)
by ares.liveshere.com with esmtp (Exim 3.36 #1)
id 18ufdQ-0003py-00
for removed; Sun, 16 Mar 2003 13:25:36 -0800
Received: from pc1 ([164.77.56.221]) by mta1.entelchile.net with SMTP
id <20030316212221.YRCU25552.mta1@pc1>;
Sun, 16 Mar 2003 17:22:21 -0400
From: personalfreedom499@hotmail.com
To:
Subject: Financial Freedom For YOU - Work SMARTER, not HARDER!
Date: Sun, 16 Mar 2003 15:29:15 -0500
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <20030316212221.YRCU25552.mta1@pc1>

Hello there,

You get emails every day, offering to show you how to make money.
Most of these emails are from people who are NOT making any money.
And they expect you to listen to them?

Enough.

If you want to make money with your computer, then you should
hook up with a group that is actually DOING it. We are making
a large, continuing income every month. What's more - we will
show YOU how to do the same thing.

This business is done completely by internet and email, and you
can even join for free to check it out first. If you can send
an email, you can do this. No special "skills" are required.

How much are we earning? Anything from $500 to $9000 per month.
We are real people, and most of us work at this business part-time.
But keep in mind, we do WORK at it - I am not going to
insult your intelligence by saying you can sign up, do no work,
and rake in the cash. That kind of job does not exist. But if
you are willing to put in 10-12 hours per week, this might be
just the thing you are looking for.

This is not income that is determined by luck, or work that is
done FOR you - it is all based on your effort. But, as I said,
there are no special skills required. And this income is RESIDUAL -
meaning that it continues each month (and it tends to increase
each month also).

Interested? I invite you to find out more. You can get in as a
free member, at no cost, and no obligation to continue if you
decide it is not for you. We are just looking for people who still
have that "burning desire" to find an opportunity that will reward
them incredibly well, if they work at it.

To grab a FREE ID#, simply go to one of the mirror sites below and enter your
details:

http://www.geocities.com/wealth900004/

http://www.geocities.com/wealth900005/

http://www.geocities.com/wealth900003/

http://www.geocities.com/wealth900002/

http://www.geocities.com/freedom90001/

http://www.geocities.com/alwaysfree9000/

http://www.geocities.com/freedom900000/

http://www.geocities.com/freedom900006/

http://www.geocities.com/freedom900007/

http://www.geocities.com/freedom900008/

If you can not reach one of the mirror sites please try
back again later the mirror sites are extremely busy
and recieve a lot of hits. It just goes to prove
how exciting this business really is!

We will confirm your position and send you a special report as
soon as possible, and also your Free Member ID. That is all there
is to it!

You can then make up your own mind and decide whether you want to
make some money too...or not.

Looking forward to hearing from you!

P.S. After having several negative experiences with network
marketing companies, I had pretty much given up on them. This is
different - there is value, integrity and a REAL opportunity to have
your own home-based business...and finally make real money on the
internet.

Don't pass this up...you can sign up and test drive the program for
FREE. All you need to do is get your Free Membership.

=============================================================

This email has been screened and filtered by our in-house "Opt-Out"
system in compliance with State Law. If you wish to have your email
address deleted from this mailing as well as future mailings, please
go to our "Opt-Out" Website"

http://www.geocities.com/removal_request2000/

OR at http://www.geocities.com/removal_request20022000/

You only have to go to one of the sites above to be removed
either one will have you removed from the list.

This message is not intended for residents of the state of Washington, and
screening of addresses has been done to the best of our technical ability.
If you are a Washington resident or otherwise wish to be removed from this
list, just follow the removal instructions above.

====================================================================

By submitting this request for a Free Membership, I agree to accept email
from the Club about their Consumer and Business Opportunities.

I also understand that I am under no obligation and that no commitment is
expected from me and that I can be removed from receiving any more
information. I also understand that a record will be kept of my
Membership Request as proof of my consent, containing my IP address, Email
address, Name, Surname, Date and Time.

(END OF SPAM)

Baille's pages are all the same. Apparently he doesn't quite grasp the concept of mirroring.
Most spammers, even as absolutely stupid as they tend to be, understand that the reason for
mirroring the site is so that when one get's terminated for abuse, at least one of the others may
stay up a while. But Jamie is apparently lower on the IQ scale than your typical chickenboner.
He puts them all on the same free host and lists them all in the same spam.

Let's look at his source code:
From http://www.geocities.com/alwaysfree9000/ :

<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Upgrade your Future Today</title>
</head>

<body>

<img border="0" src="images/light_blue.gif" width="594" height="5">
Upgrade your Future Today!
<img border="0" src="images/light_blue.gif" width="594" height="5">
<blockquote>
<blockquote>
 <blockquote>
 <blockquote>
 <blockquote>
 
 Congratulations!!
 </blockquote>
 </blockquote>
 </blockquote>
</blockquote>
</blockquote>
<img border="0" src="images/light_blue.gif" width="594" height="5">
 
You have
taken your first step towards financial independence! 
 
I would like to extend a warm welcome to you from a team of people that are
ready to help you reach your goals and I know that we will have a bright and
prosperous future together. 
<img border="0" src="images/light_blue.gif" width="594" height="5">
What We Offer:
We offer all of
our members 
FREE
membership. This means that you can become a member, totally 
FREE
of
charge, and enjoy the benefits of rebates on all your online purchases, from
stores affiliated with us, and half price purchases from our Online Mall Outlet.
You will also earn commisions on all purchases of Free Members that sign up
after you. Once you join as a VIP (Vested

Income

Partner)
member you will become part of a unique team, whose members work together
towards financial success and independence. All new VIP members that join after
you, are placed in your down line. This will give you the fastest growing down
line on the net and the best potential of increasing your earnings. 

This is a very unique program that allows you to
earn even as a FREE Member!!
<img border="0" src="images/light_blue.gif" width="594" height="5">
Why are we
different?

Before I joined this program, I had a lot of
doubts:
Why should I
join this program? 
What makes it successful and 
How do I know that it will work for me?

I found five distinguishing features about this
program that satisfied me: 
 
I was not mislead by what I read - 
The
information I received was truthful. 
 
The program operates in such a way that all members interact. This means that if
a new member does not know how to market the product, he/she is coached by
his/her sponsors which really made me feel part of a team.   
 
The resources available to VIP Members to promote their business are endless. 
 
The fact that I became excited by what I was presented with and the prospect of
earning an extra income with other teammates helping me. 
 
<img border="0" src="images/light_blue.gif" width="594" height="5">
What should you
do if you are interested?
Because I would
like you to feel welcome and since I would like you to be part of my team, I am
going to offer you all of my assistance in getting your business up and running,
should you choose to join as a VIP member. All I ask of you now, is to fill in
the form below. Remember that your membership is totally free and you can cancel
your membership at anytime. Have a look around and see what you think. I will
contact you with the necessary information. Thank you for your time and
attention! 
 

<form method=post action="http://geocities.yahoo.com/forms">

First Name: <input type="text" name="FirstName" size="27">
Last Name: <input type="text" name="LastName" size="27">
Your Email: <input type="text" name="Email" size="27">
<input type="submit" value="Send Info">
<input type="reset" value="Clear the form">
<input type="hidden" name="login" value="alwaysfree9000">
<input type="hidden" name="subject" value="---Membership Request!---">
<input type="hidden" name="I submit the above information freely and agree to receive information from the Club about both their Consumer and Business Opportunities." value="I agree with this Submitted Posting of my information">
<input type="hidden" name="required_fields" value="FirstName,LastName,Email">
<input type="hidden" name="next_url" value="http://www.geocities.com/alwaysfree9000/thankyou2.htm">
<img border="0" src="images/light_blue.gif" width="594" height="5">
By submitting this request
for a Free Membership, I agree to accept email from the Club about their
Consumer and Business Opportunities. I also understand that I am under no
obligation and that no commitment is expected from me and that I can be removed
from receiving any more information. I also understand that a Record will be
kept of my Membership Request as proof of my consent, containing my IP address,
Email address, Name, Surname, Date and Time.
<img border="0" src="images/light_blue.gif" width="594" height="5">
To be removed click 
<a href="http://www.geocities.com/removal_request20022000">HERE</a> OR
<a href="http://www.geocities.com/removal_request2000">HERE</a>

<blockquote>
<blockquote>
 <blockquote>
 <blockquote>
 Author: 
 Jamie JB3082892 
 Copyright © 2003. All rights reserved .Revised: March 8, 2003
 </blockquote>
 </blockquote>
</blockquote>
</blockquote>
<table border=0 cellpadding=1 cellspacing=0 width="1%" bgcolor=660066><tr><td><table border=0 cellpadding=3 cellspacing=0 width="1%" bgcolor=eeeeee><tr><td nowrap><a href="http://geocities.yahoo.com/pstats/alwaysfree9000"><img src="http://us.geo1.yimg.com/pic.geocities.com/us/i/geo/ao/pstat.gif" width="14" height="14" alt="See who's visiting this page." border="0" align="left"></a> <a href="http://geocities.yahoo.com/pstats/alwaysfree9000">View Page Stats</a> See who's visiting this page.</td></tr>
</table></td></tr>
</table>
</body>
</html></object></layer></div></style></noscript></table></script></applet>
<script language="JavaScript">

var PUpage="76001065"; var PUprop="geocities";

</script><script language="JavaScript" src="http://www.geocities.com/js_source/pu5geo.js">

</script><script language="JavaScript" src="http://www.geocities.com/js_source/ygNSLib9.js?v3">

</script><script language="JavaScript">

var yvnContents='http://us.toto.geo.yahoo.com/toto?s=76001065&l=NE&b=0&t=1047871509';yvnR='us';yfnEA(0);

</script><script language="JavaScript" src="http://us.i1.yimg.com/us.yimg.com/i/mc/mc.js">

</script><script language="JavaScript" src="http://geocities.com/js_source/geov2.js">

</script><script language="javascript">

geovisit();

</script><noscript><img src="http://visit.webhosting.yahoo.com/visit.gif?us1047871509" alt="setstats" border="0" width="1" height="1"></noscript>
<IMG SRC="http://geo.yahoo.com/serv?s=76001065&t=1047871509" ALT=1 WIDTH=1 HEIGHT=1>

Tracing the spammer is pretty easy here. He admits that it's his garbage right there on the page where is says:
 Author: 
 Jamie JB3082892 
 Copyright © 2003. All rights reserved .Revised: March 8, 2003

But that doesn't tell us who he's spamming for. For more details, I opened a few temporary accounts and pretended to
fall for spammer Jamie Baillie's scam. I replied to the spam by entering the new addresses into his form.

I got two replies. The first directly from Jamie Baillie the spammer. It's an autoresponser reply, but it shows his real connection.
The spam was relayed through an open relay in spain. This reply came directly from Spammer Jamie through his ISP via his hotmail drop box:

Message-ID: <20030317080849.3e758291291ffffffc2@hotmail.com>
X-Originating-IP: [24.192.183.149]
From: "Jamie" <surfer800@hotmail.com>
To: <removed>
Subject: Please Activate Your Free Membership Today, Rob!
Date: Mon, 17 Mar 2003 03:08:49 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
Disposition-Notification-To: "Jamie" <surfer800@hotmail.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Dear removed,

Thank you for submitting your Free Membership request!

I am glad that you are joining us to work together in achieving a better future!
Best of all is that this opportunity is presented to you FREE OF CHARGE!

You should by now have received a letter through which you can activate your
Free Membership.

Please activate your membership as soon as possible, since it will expire in a 5
days' time. Remember that you can cancel your membership at anytime if you are
not totally satisfied with what the Club has to offer you, but since it is FREE
to join, come and see for yourself. Some people in my Team have generated an
income of over $7000 per month in less that 10 months! This is definitely an
opportunity not to be missed!

So don't waste any time activating your membership. The earlier you do, the
quicker you can save and even earn!

Once again, I would like to extend a warm welcome to you and I am looking
forward to a better future in our Team!!

Kindest Regards,

Jamie Baillie

Your DHS Club Sponsor

X-Originating-IP: [24.192.183.149] is his connection. He connects to the internet via
OrgName:    Rogers Cable Inc.
NetRange:   24.192.0.0 - 24.192.255.255
CIDR:       24.192.0.0/16

OK, now we have proof that Jamie Baillie is a spammer, that Jamie Baillie is the spammer in this case,
and that Jamie Baillie is spamming for the long term spamhaus DHS-Club.

The second response is more proof of the connection. It came directly from the DHS-Club spammers themselves.

X-Message-Info: JGTYoYF78jEHjJx36Oi8+Q1OJDRSDidP
Received: from www.clubshop.com ([63.124.98.254]) by mc7-f19.law1.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
 Mon, 17 Mar 2003 00:08:19 -0800
Received: (from nobody@localhost)
 by www.clubshop.com (8.11.6/8.11.6) id h2H88H128202;
 Mon, 17 Mar 2003 00:08:17 -0800
Date: Mon, 17 Mar 2003 00:08:17 -0800
Message-Id: <200303170808.h2H88H128202@www.clubshop.com>
To: removed
From: Jamie Baillie <surfer800@hotmail.com>
Subject: Rob, How To Confirm Your DHS ClubBucks Membership
Return-Path: nobody@www.clubshop.com
X-OriginalArrivalTime: 17 Mar 2003 08:08:20.0218 (UTC) FILETIME=[5F70F5A0:01C2EC5C]

Dear removed :

Congratulations on requesting Membership in the DHS Club.
As a DHS Club Member, you are joining together with millions of other Members to save money and make money by using our exciting ClubBucks Rewards Program.

Confirm your request to become a Free Member and receive your ID Number, click on this link:

http://www.clubshop.com/cgi-bin/confirm/75896066
AOL users click <a href="http://www.clubshop.com/cgi-bin/confirm/75896066">here</a>.

If you do not confirm your request within 5 days, your request will expire, so be sure to click on the link above now!

Welcome to the Club!
Jamie Baillie

Note that although it was sent from www.clubshop.com ([63.124.98.254]), one of the DHS-Club spam
domains, they added Spammer Jamie Baillie's name to it. The link between the spam and the perps is thus
confirmed by the replies, and by them claiming Spammer Jamie and by Spammer Jamie claiming them.

Spammer's domains:
dhs-club.com         63.124.98.250
clubshop.com         63.124.98.254
dhscsvcs.com             63.124.98.253
All hosted by uu.net:
NetRange:   63.64.0.0 - 63.127.255.255
CIDR:       63.64.0.0/10

And also:
clubdepot.com 65.120.169.130
hosted by usexpress under qwest

Qwest Communications NET-QWEST-BLKS-4 (NET-65-112-0-0-1)
65.112.0.0 - 65.127.255.255
US EXPRESS.NET Q1126-65-120-168-0 (NET-65-120-168-0-1)
65.120.168.0 - 65.120.171.255

More information on these long term criminals can be found at The club built on spam.com and here and here.

More information on Spammer Jamie Ballie can be found here and here .

William R. James

Back to Spamreaper.org Contact Spamreaper