Start winning big with our generous welcome bonus at Euro Dice Stars!
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
From - Tue Oct 2 21:26:40 2012
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 95.64.89.54
Received-SPF: pass (domain of speelbosjoure.nl designates 95.64.89.54 as permitted sender)
X-YMailISG: x
X-Originating-IP: [95.64.89.54]
Authentication-Results: mta1029.mail.ird.yahoo.com from=speelbosjoure.nl; domainkeys=neutral (no sig);
from=speelbosjoure.nl; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO speelbosjoure.nl) (95.64.89.54)
by mta1029.mail.ird.yahoo.com with SMTP; Tue, 02 Oct 2012 19:28:28 +0000
Message-ID: <x@speelbosjoure.nl>
Date: Tue, 02 Oct 2012 12:28:28 -0700
From: 300% Bonus <donotreply@speelbosjoure.nl>
To: x
Subject: Start winning big with our generous welcome bonus at Euro Dice Stars!
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 95.64.89.54
Received-SPF: pass (domain of speelbosjoure.nl designates 95.64.89.54 as permitted sender)
X-YMailISG: x
X-Originating-IP: [95.64.89.54]
Authentication-Results: mta1029.mail.ird.yahoo.com from=speelbosjoure.nl; domainkeys=neutral (no sig);
from=speelbosjoure.nl; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO speelbosjoure.nl) (95.64.89.54)
by mta1029.mail.ird.yahoo.com with SMTP; Tue, 02 Oct 2012 19:28:28 +0000
Message-ID: <x@speelbosjoure.nl>
Date: Tue, 02 Oct 2012 12:28:28 -0700
From: 300% Bonus <donotreply@speelbosjoure.nl>
To: x
Subject: Start winning big with our generous welcome bonus at Euro Dice Stars!
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Body:
Get in on the action at EuroDice Stars with an impressive welcome bonus of 300%.
Euro Dice Stars Casino has a whole range of excellent games.
Deposit 100 Euro and play with 400 Euro.
With loads of money to be won and an excellent operating system you just a click away from your first million!
Start playing today to win the big bucks. http://wwwt.igreattopeudice.pl
Euro Dice Stars Casino has a whole range of excellent games.
Deposit 100 Euro and play with 400 Euro.
With loads of money to be won and an excellent operating system you just a click away from your first million!
Start playing today to win the big bucks. http://wwwt.igreattopeudice.pl
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Seven Stars Online Casino - Spring gift, 1000 at registrationCasino Action Spam - You are among the winners
Online Gambling and Casino Spam - Congratulations, you have just won
World Casino Online Gambling Spam
Anonymous Online Casino Spam
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
The link in the e-mail points to a random site that loads the actual spamvertised site in an iframe. The actual spamvertised site is also not visible in plain sight but the URL is disguised in Unicode characters, for example starseurodice.com is displayed as:
starseurodice.com
Only two main websites are associated with this spam namely starseurodice.com and istarseurodice.com and both are hosted on Russian servers (which shouldn't come as a surprise). The link in the spam e-mail always points to a domain containing the phrase eudice or eurodice. Most of the sites are .pl but some are .net and .com. It is also noticeable that the spammers use different servers for the same domains (most probably to prevent one server from being overloaded, because they send out a lot of spam e-mails on a daily basis). For example you would get one spam e-mail pointing to wwwt.igreattopeudice.pl and another one pointing to wwwo.igreattopeudice.pl. At the same time the spammers are mixing up the text in the spam e-mail while pointing to the same site.
The following domain names, associated with this spam, have been recorded so far:
acashgreateurodice.pl
agoldencasheurodice.pl
agoldengreateurodice.pl
alinegreateudice.pl
astarsgreateudice.pl
awebcasheurodice.pl
beteudice.net
bingoscasheurodice.com
cashwebeurodice.com
ebestgrandneteurodice.com
ebingoscasheurodice.pl
ecashlineeudice.pl
ecashneteurodice.pl
ecashwebeurodice.pl
egrandcasheurodice.com
estarsgrandeurodice.com
eudicestarz.net
eurodicestar.net
eurodicestarsi.com
eurodicestarso.com
eurodicestarsq.com
eurodicestarz.net
ibestgrandneteurodice.pl
icashbingoeurodice.com
icashgrandeurodice.pl
icashgreateurodice.pl
igrandcasheurodice.pl
igrandtopeudice.pl
ilinegreateudice.pl
istarcasheurodice.com
istarsgreateudice.pl
itopcasheurodice.com
ocashbingoeurodice.com
ocasheurodice.com
ocashgreateurodice.com
oeudicecashstarstop.com
oeudicecashtop.com
oeurodicecashbonus.com
ogreatcasheurodice.com
ogreattopeudice.com
olineeudicecash.com
ostarcasheurodice.com
otopcasheurodice.com
qcashtopeudice.com
qnetcasheurodice.com
qstarscasheurodice.com
ubonuseurodicecash.com
ucasheurodicebest.com
ucashgoldeurodice.com
ueurodicebestcash.com
Below is a screenshot of the spamvertised website. You will immediately notice the similarities between this site and the two examples mentioned before: