Hi All,

Over the last week I've received a number of identical Spam mails to two of my email accounts.

With some time on my hands today I took a closer look.

From what I can tell they are not from an affiliate but originating from the casino itself Crown Vegas.

Given that one of these emails is not readily shared & the fact that only a few casino's have it on file; Crown Vegas being one of them, it stands to reason given the casino being flogged that this is where the spam is originating from.

I did contact Crown Vegas, however support said if it had a un-subscibe link then it was not considered spam...BS...if it's unsolicited email then it is SPAM!

Here is the header of the email received. (I've added xxx to hide my email address).

<tt>Return-Path</tt><tt>: <desmondbrendon5580@hotmail.com>
Received: from compute2.internal (compute2.internal [10.202.2.42])
by store43m.internal (Cyrus v2.3.9-fmsvn12891) with LMTPA;
Mon, 24 Sep 2007 01:33:13 -0400
X-Sieve: CMU Sieve 2.3
X-Resolved-to: xxxxxxx@fastmail.com.au
X-Delivered-to: xxxxxxx@fastmail.com.au
X-Mail-from: desmondbrendon5580@hotmail.com
Received: from bay0-omc3-s25.bay0.hotmail.com (bay0-omc3-s25.bay0.hotmail.com [65.54.246.225])
by mx2.messagingengine.com (Postfix) with ESMTP id 958DB1E1249
for <xxxxxxx@fastmail.com.au>; Mon, 24 Sep 2007 01:33:13 -0400 (EDT)
Received: from BAY116-W40 ([64.4.38.140]) by bay0-omc3-s25.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 23 Sep 2007 22:33:11 -0700
Message-ID: <BAY116-W40B994EBE4E6BC63C15946C3B60@phx.gbl>
X-Originating-IP: [64.37.114.3]
From: DESMOND BRENDON <desmondbrendon5580@hotmail.com>
To: <xxxxxxxxxxxxxx@yahoo.com>, <xxxxxxx@fastmail.com.au>,
<xxxxxxxx@yahoo.com>, <xxxxxxxxxx@aol.com>, <xxxxxxxxxxxx@yahoo.com>,
<xxxxxxxxxx@yahoo.com>, <xx_xxxxx@earthlink.net>
Subject: New cashier
Date: Mon, 24 Sep 2007 01:33:12 -0400
Importance: Normal
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginalArrivalTime: 24 Sep 2007 05:33:11.0867 (UTC) FILETIME=[65A650B0:01C7FE6C]</tt>

The actual SPAM:

<tt> Greetings,

Have you played at this place yet? They have a cool signup bonus
for the first deposit.

xxxhttp://www.nesswo.com/

They are also accepting US players with fast payouts.

Best wishes!

DESMOND BRENDON

Stop getting these here:
xxxhttp://www.nesswo.com/rm.php
-----------------------------------------

Granted it has a un-subscribe link, but, I never use these. Especially from a Spammer. Anyone that sends unsolicited emails is not about to worry about the CAN SPAM Laws. 9 times out of 10 these links are used to confirm email addy's are still current.

Anyway...

From what I can tell after doing traces on the IP, the URL and tracing it back through servers and mx records everything points back to Crown Vegas...




Cheers



Dave
</tt>