ArchangelWebDesign.info

ArchangelWebDesign.info is being used for sending out email messages for the Cheri Craigslist dating scam. The spam is coming from the subdomain arc.archangelwebdesign.info, as you can see from the headers of a sample fraudulent email message below.

Delivered-To: ***@***.***
Received: by 10.151.15.8 with SMTP id s8cs74788ybi;
Thu, 11 Nov 2010 19:43:18 -0800 (PST)
Received: by 10.150.189.2 with SMTP id m2mr3084169ybf.48.1289533397732;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Return-Path:
Received: from arc.archangelwebdesign.info ([174.122.133.9])
by mx.google.com with ESMTP id l55si6539186yhd.141.2010.11.11.19.43.16;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received-SPF: fail (google.com: domain of pers-p5gm3-2052632382@craigslist.org does not designate 174.122.133.9 as permitted sender) client-ip=174.122.133.9;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of pers-p5gm3-2052632382@craigslist.org does not designate 174.122.133.9 as permitted sender) smtp.mail=pers-p5gm3-2052632382@craigslist.org
Received: from [69.25.188.179] (helo=3e414603b1a244c)
by arc.archangelwebdesign.info with esmtpa (Exim 4.69)
(envelope-from )
id 1PGkXi-0004kH-VS
for ***@***.***; Thu, 11 Nov 2010 21:43:15 -0600
MIME-Version: 1.0
Date: Thu, 11 Nov 2010 19:43:15 -0800
Message-ID:
X-Priority: 3 (Normal)
Subject: RE: criagslist
Reply-To: pers-p5gm3-2052632382@craigslist.org
From: "meee ;)"
To: "***" <***@***.***>
Content-Type: multipart/alternative;
boundary="-----_chilkat_cf1_4bd0_4a664414.d03cbf62_.ALT"
In-Reply-To: AANLkTi=osGdv+pi325ZdDM7SVJopt1gzODnVHATgRPVQ@mail.gmail.com
X-Mailer: Microsoft Outlook, Build 10.0.6822
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - arc.archangelwebdesign.info
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - craigslist.org


Hey Babe, hehe you seem to be my kind of guy.

thanks for the reply. Totally honestly, i just want some no strings action today or tomorrow. You into that?

You ever do this? I've a couple times b4. Everytime I think about hooking up with no strings I get really horny but a little worried. I don't want to meet some underage kid or something.

I'm a pretty upfront person so let me just lay this out before we go any further. This is a NSA thing with nothing else. I just got out of a relationship and am not looking for a guy to hold me back.

If you are good with that then there is one more thing I have for you. I am getting a lot of emails from HS kids and creepy guys out there so i am requiring everyone to register for my peace of mind. Its no cost but I promise if you do this, Ill make it worth your while and will be more open to whatever you want to do. If you dont want to do this then i am afraid we can't go any further because it wont be any fun for me being stressed and afraid of you the whole time.


If you want to meet me still then just go here [Here there was a link to mysafenet.net. Do not visit that site!]. You can find my profile and contact information there.

I'm looking forward to seeing you

Call me at the number on there.

Bye for now

Cheri

The reason that this is a scam is because the person that is supposedly sending the messages doesn't exist. The messages are actually being sent by someone who makes money from directing you to the dating sites that you are being asked to join. These scammers like to call this "affiliate marketing", but it is fraud.

Other servers that have been used for sending these scam messages are:

mail4time.org
mail4now.net
safe4mail.org
b8mail.com