This spam is preying on people in the UK who have had a accident, but it is actually based in India. It starts off with a pitch similar to this one:
From: UL05 UL05@app12.sarvdns.org
Reply-To: UL05@app12.sarvdns.org
Date: 3 August 2012 17:26
Subject: Accident Injuries
Auto Axident
Claim Comfort
Home
Injury / Claim types
Contact Us
Welcome
Header Image
We are the accident claim specialists, offering free advice, downloads and access to top no win no fee personal injury solicitors.There are many types of Personal Injury like
Road Traffic Accident
Work Accident
Accident at Sea
Aircraft Accident
Faulty Product Accident
Hairdressing Accident
Holiday Accident
Medical Negligency Accident
Public Place Accident
Did you have an injury in the last two years?
If yes, Apply for Compensation below.
Apply for Claim here
Step 1
RTA ( SELF MEDICATING CLAIMANT )
[snipped]
© Copyright 2012 autoaxident.com. All Rights Reserved.
Powered by SARV Mail
Click here to unsubscribe
The spam leads you to a side called
autoaxident.com on 174.122.93.250 which appears to belong to Confluence Networks in the
UAE. The WHOIS details are privacy protected (never a good sign for this type of site). Nameservers show an Indian connection, they are dns1.bigrock.in and dns2.bigrock.in. The spam is sent through a relay service at 74.117.60.126 (lbsmtp.org, India).
The website has no contact details or privacy policy, it is basically just a collector. However, sending a query does generate a response..
from: AnnieThomas alaska05@rediffmail.com
date: 6 August 2012 08:15
subject: Re: RTA - Injuries
Awaiting your reply.
Annie Thomas
From: "Swati"[alaska05@rediffmail.com]
Sent: Sat, 04 Aug 2012 14:11:40
Subject: RTA - Injuries
Dear Mr. Xxxx Xxxx
Thanks for sending us your message.
Please send your contact phone number and address.
Also if you have time please fill up form available at www.autoaxident.com and press continue button instead of submit to get the full claim form to be filled.
Upon receipt of your phone number solicitor Mr. Lamb Brook will contact you for compensation for your injury
---
Annie Thomas
Customer Care Executive
Auto Accident Claim Company
London
Phone No. +44 20 3286 4645
Website - www.autoaxident.com
The originating IP was 14.98.247.162 (TATA Indicom, India), so there's the Indian connection again.
Several things don't stand up with this pitch. One of them is the solicitor's name of "Mr. Lamb Brook". That's quite an unusual name, and it probably comes as no surprise to find that there is no such solicitor listed by the
Law Society in the UK. Oddly, the telephone number quoted seems potentially valid and is a London number.
Update: the name of the law firm is
Lamb Brooks and not an individual solicitor, note however that Lamb Brooks are not sending out this unsolicited mail, I suspect that they are not even aware of it.
The email address of "Annie Thomas" alaska05@rediffmail.com also gives some clues. rediffmail.com is almost exclusively used in India, thus confirming that this is an Indian-based scam again,
Googling this email address shows several clues with a background of buying and selling leads.
This thread ties the email address up with a user called
lalchand38 and this is linked to a Twitter account at https://twitter.com/LCS38 (Lalchand / @LCS38) who appears to be
Lalchand Sobhani who also uses an email address of
lalchand38@yahoo.com. You can see his
dating profile here and there are
several other matches on Google for the same email address which show an interesting variety of enterprises
including shipping prescription medications from India to the US.
So Annie Thomas is either Lalchand Sobhani or someone working for him. The solicitor in the UK does not exist. Mr Sobhani has gone to some efforts to hide his involvement here too.
What is probably going on here is lead generation through spam. Lalchand Sobhani is probably trying to generate personal injury leads to resell on to others. In any case, dealing with spammers is unlikely to be beneficial and it could lead to you being seriously out of pocket.
This is an updated list of evil domains on 194.28.115.150 (Specialist ISP in Transnistria). Blocking all of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is the best idea, and blocking traffic to .rr.nu ain't a bad one either. But if you can only block by domains names then this is the latest list of malware-laden sites to avoid:
