Classic Spam: Onward Christian Spammers

I'm not a particularly religious man, but I'd like to think that there's an especially warm and uncomfy spot reserved in hell for scammers who prey on church people.

Received: from exanpcn7.arinc.com ([144.243.3.7])
    by exanpcn1.arinc.com with SMTP (Microsoft
    Exchange Internet Mail Service
    Version 5.5.2653.13) id LTZD9R33;
    Mon, 26 May 2003 08:17:36 -0400
Received: from 61.42.255.17 (unverified)
    by EXANPCN7.arinc.com
    (Content Technologies SMTPRS 4.3.6)
    with SMTP id <T626ff36e4c90f30307550@EXANPCN7.arinc.com>
    for <<my-address>>;
    Mon, 26 May 2003 08:16:59 -0400
Message-ID: <T626ff36e4c90f30307550@EXANPCN7.arinc.com>
Received: from smtp-server1.cfl.rr.com
    ([5.151.138.187]) by rly-xl04.mx.aol.com
    with esmtp; May, 26 2003 6:48:43 AM -0200
Received: from anther.webhostingtalk.com ([88.58.121.118])
    by da001d2020.lax-ca.osd.concentric.net
    with QMQP; May, 26 2003 5:52:06 AM +1100
Received: from 157.139.128.128 ([157.139.128.128])
    by mta6.snfc21.pbi.net
    with asmtp; May, 26 2003 4:49:07 AM +1100
Received: from [138.156.251.163]
    by da001d2020.lax-ca.osd.concentric.net
    with local; May, 26 2003 3:49:47 AM -0300
From: CHURCH WEBSITES <yaenuytreklklkkl@yahoo.com>
To: Haraldo
Cc:
Subject: FREE WEBSITE FOR YOUR CHURCH
from Kingdom Ventures.......... rjm
Sender: CHURCH WEBSITES <yaenuytreklklkkl@yahoo.com>
Mime-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Date: Mon, 26 May 2003 07:17:11 -0500
X-Mailer: Microsoft Outlook Express 5.50.4522.1200


<html>
<head>
Pastors and Church-goers<br>
<br>
50% of our country's churches do not have a website!
IF YOUR CHURCH IS ONE OF THEM AND DOES NOT HAVE A
WEBSITE, then let Kingdom Ventures build yours
for FREE.
<br>
<br>
The 1st 5000 churches will get their websites for
FREE<br>
<br>
To find out more go to <a
href="http://www.transworldwebsites.com/default.htm">
Kingdom ventures</a><br>
<br>
<br>
Unsubscribe me: <a href="mailto:tallrhe@cs.com">
tallrhe@cs.com</a><br>
&nbsp;</p>
</body>
<script language="JavaScript">
var popunder=new Array();
popunder[0]='http://www.transworldwebsites.com';
function get_cookie(Name){
  var search=Name+'=';
  var returnvalue='';
  if(document.cookie.length>0){
    offset=document.cookie.indexOf(search);
    if(offset!=-1){
      offset+=search.length;
      end=document.cookie.indexOf(';',offset);
      if(end==-1)end=document.cookie.length;
      returnvalue
        =unescape(document.cookie.substring(offset,end))
    }
  }
  return returnvalue;
}
function openWindowRemote(){
  win2=window.open(popunder[Math.floor(Math.random()
    *(popunder.length))],'popunder',"scrollbars=yes,
    resizable=yes,toolbar=yes,menubar=yes,status=yes,
    location=yes,width=800,height=600,left=0,top=0");
  win2.blur();
  window.focus();
}
window.onload = openWindowRemote;
</script>

</html>

uweawspiesarfieiolbkveqaximjmgyvck

There's so much that's so wrong here that it's hard to know where to cast the first stone.

The ambitiously-named www.transworldwebsites.com operation was apparently shut down DEAD (I couldn't even do an nslookup) by its hosting provider, www.atfreeweb.com, within mere hours of my receiving this mail (good job, folks!). A Yahoo search on the domain name reveals that the transworldwebsites folks were also apparently involved in pennystock scams as well.

I have to be careful here, since we may very possibly be looking at a Joe-job (a malicious attempt by a spammer to direct blame to specific third parties), but there is an organization known as Kingdom Ventures (http://www.kdmvcorp.com/cwi/cwi.html [link is dead, see note above]) that offers the same free-website pitch (albeit without the same "first 5,000" limitation). The idea appears to be to turn churches into ISPs by enabling them to resell bandwidth to the congregants (a not unreasonable venture, I suppose). I can't find anything that points to a connection between these folks and the transworldwebsites people, although I did find other spams online that mentioned KDMV and used the same removal/info e-mail address at cs.com. On the other hand, the spammers may simply have been trying to get KDMV in trouble by making the spam appear to have come from them. In either case, this bears watching.

In the meantime, here's some free advice for pastors and other church leaders: if you need a free website done, get some of your teenaged parishoners on the job. They learn this stuff in school now, and you'll get a pretty good job plus you'll keep 'em off the street.


(c) 2003-2006, Richard C. Conner ( )

03183 hits since March 28 2009

Updated: Sat, 06 May 2006