• "Arkolaptops.com / Arco-laptops.com" [2004-11-23]
  
• "skytech-computers.com / skytech-inc.com" [2005-01-21]
  
• "pc-homebiz.com" [2004-12-19]
  

The following spam advertising "syktech-computers.com" was caught by our filter on 2005-01-21. Several things look suspicious, see comments below. The following day we received a very similar spam advertising "skytech-inc.com". These spams may originate from the same people who set up "arkolaptops.com" two months earlier. There are many similarites. We seriously doubt whether this is a genuine business.

The spam evidence:

From: "Luke Delgado" <edouard@absolutemotion.com>
To: <emailaddress>
Sent: Thursday, 20 January, 2005 23:40
Subject: Looking for cheap high-quality notebook?__1007


Hi Gladys :)
http://www.skytech-computers.com/index.htm
reqards,
Annalise Vega

Received: from dyn-83-157-176-192.ppp.tiscali.fr
 (dyn-83-157-176-192.ppp.tiscali.fr [83.157.176.192])
	by lime.pobox.com (Postfix) with SMTP id 5F5C4108E7A
	for <emailaddress>; Thu, 20 Jan 2005 13:17:00 -0500 (EST)
Message-ID: <651c01c4fefd$10580bae$d16ff744@absolutemotion.com>
From: Luke Delgado 
To: emailaddress
Subject:
 =?iso-8859-1?B?TG9va2luZyBmb3IgY2hlYXAgaGlnaC1xdWFsaXR5IG5vdGVib29rP19fMTAwNw==?=
Date: Thu, 20 Jan 2005 14:40:21 +0000
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----=_NextPart_000_0000_87392201.632D8701"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-SpamScore: 1.438
	tests= DATE_IN_PAST_03_06 EXTRA_MPART_TYPE

What's wrong with this picture?

• The business advertised via spam, a red flag as far as ethics are concerned. It was sent from a DSL account in France.
• The head office is supposed to be in Latvia (an EU member). However, the only phone or fax numbers listed on their website (http://www.skytech-computers.com/contacts.htm) are supposed to be for the Moscow office.
• The domain is registered to a bogus streed address in Germany
• Even though their website claims that Skytech Computers is a 10 year old company, the domain skytech-computers.com was only registered on 2005-01-13, just one week before the spam was sent.
• The company offers free shipping worldwide. This is not economically viable, if they actually ship anything and the goods are not stolen merchandise.
• The company offers a worldwide warranty with with onsite support. Excuse me? Are they going to send support engineers to Falluja? Sounds too good to be true.

Domain Name : skytech-computers.com

::Registrant::
	Name      : Skytech Computers
	Email     : reg@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Administrative Contact::
	Name      : Skytech Computers
	Email     : adm@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Technical Contact::
	Name      : Skytech Computers
	Email     : tech@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Name Servers::
	dns1.skytech-computers.com
	dns2.skytech-computers.com

::Dates & Status::
	Created Date   2005-01-13 06:52:09 EST
	Updated Date   2005-01-13 06:52:09 EST
	Valid Date     2006-01-13 06:52:09 EST
	Status         ACTIVE

Domain Name : skytech-inc.com

::Registrant::
	Name      : Skytech Inc.
	Email     : reg@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Administrative Contact::
	Name      : Skytech Inc.
	Email     : adm@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Technical Contact::
	Name      : Skytech Inc.
	Email     : tech@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Name Servers::
	dns1.skytech-inc.com
	dns2.skytech-inc.com

::Dates & Status::
	Created Date   2005-01-21 11:14:18 EST
	Updated Date   2005-01-21 11:14:18 EST
	Valid Date     2006-01-21 11:14:18 EST
	Status         ACTIVE

Anti-Spam Resources:
jwSpamSpy is spam filtering software (currently in beta test, expected release: May 2004)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
Dynamic IP addresses (700 KB!)
Free email providers

How to trace senders of spam
Link exchange offer spam
Getting creative with spam
Clueless virus filters spam innocent third parties
Smyrnagroup spammers (in German)

Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)
AOL dial-up address ranges and mail servers