sda2.jpg

January 15, 2006

Fake Email Circulating

Via Peter Warren, it's a phoney email suggesting that the sinister puppetmaster of the Conservative Hidden Agenda[tm] has spoken...

(Email's content in the extended entry)

A computer expert on the show says he's run a traced the email to St.Petersburg, Russia, which is a sign that it's created by someone intent on hiding their tracks who has a little more knowledge of the internet than the average spoofer. The account was opened Dec.18, 2005.

Furthermore, as a member of the VRWC, I can also assure folks that it didn't come from us.

Update - More on this case of the spy who spammed me....

Upperdate - Skimming the comments, at the rate the resident SDA "geeks" are going, expect disclosure of the culprit's shoe size by mid-afternoon. Heh.


*****

From: National Council
To: standupf@standupforcanada.net
SUBJECT: JUST A FEW DAYS LEFT...NOTHING TO WORRY ABOUT
Date: Sun., 15 Jan. 2006 06:28:44 +0300
Dear Fellow Conservatives:

These are exciting times. Here we are in the home stretch on our way to victory in Election 2006!
In just a few more days, our leader Stephen Harper will become the next Prime Minister of Canada!
As your Chair, I want to thank each and everyone of you for your work in bring us so close to the victory. During a campaign like this one, it is not always possible or wise to speak about every details of our plans. Don't be confused or upset by Stephen saying that he has "evolved." After all, winning is the name of the game.

When we form Government on Jan. 23rd., be rest assured that we will not let you and your families down. As promised, all the issues that are precious to you will be dealt with. We will have the power to get on with repairing the social fabric of this country and restoring the Christian values we all hold dear.

Keep the faith, keep up the pressure, and God bless Canada.

Don
PS: This is a post-only mailing -- please do not reply to this message


*****

Posted by Kate at January 15, 2006 5:41 PM
TrackBacks

TrackBack URL for this entry:
http://www.smalldeadanimals.com/mt/mt-tb.cgi/3310

Comments

Where is the content on the Dan Cook site?

Posted by: Colin at January 15, 2006 3:06 PM

Funny that the article from Dan Cook does exist on Globe and Mail server, and yet it doesn't appear accessible from either the Home Page, or the National Page....

Posted by: Matthew at January 15, 2006 3:07 PM

This week will see dirty ads, emails, rumours etc. like North America has never seen or wanted to see before.
The Libs will stop at nothing to hold onto power to keep hidden all of the scandals of the past that can and will be investigated if they loose power.

Posted by: capt_bob at January 15, 2006 3:12 PM

Because Dan's blog doesn't have permalinks, I've updated the entry, and the content is now in the extended portion of the post.

Posted by: Kate at January 15, 2006 3:17 PM

I find this letter insulting on a variety of grounds. First, it's very upsetting that political operatives would be pulling this kind of stunt. Second, what bothers me the most -- as a Christian Conservative with strong anti-SSM views and pro-US attitudes -- is that we, as Conservatives, are not allowed to be, well, conservative. I am, and I'm proud of it. It's why I'm voting for the CPC. But is the controversy about this email supposed to say to voters like me, "sorry, you won't be rewarded for your vote." I thought that a vote for the CPC was a vote for social conservativism, at least in relation to the other parties. Is this no longer true? Has the CPC sold out its core consitutency in the interests of political correctness? If so, then maybe we should have kept the old ALliance. At least you knew where they stood.

Posted by: Christ4Canada at January 15, 2006 3:17 PM

I hope it's real

Posted by: Knight of Good Mr. Iron Man at January 15, 2006 3:24 PM


Well we know what Scott Reid has been up to . . .

Posted by: Fred at January 15, 2006 3:34 PM

It looks like they went through some lengths to make it look real, right down to registering the domain name standupforcanada.net.

The domain name is registered to:

Alice A Tokareff
Alice A Tokareff (standupforcanada@replay.ru)
7 Moscoyskiy Av
St.Petersburg
Leningradskaya oblast,190031
RU
Tel. +007.8125794869

www.standupforcanada.net gives a template page from a Russian server, IP address 85.142.35.104 which is also a network block assigned to the same Russian ISP.

What might prove really useful though would be the original email with headers intact showing the full path that the mail traveled from it's source. Do you happen to have the original email, headers and all?

Posted by: S. Clarke at January 15, 2006 3:44 PM

Listening to Peter Warren on radio. One of the false names on the Russian e-mail account was Alice B Tokarov(Alice B Toklas was a pot smoking character from the 60's. Tokarov is/was a standard Soviet era pistol: ie:"smoking gun").
This is getting to good for words.

Posted by: RW at January 15, 2006 3:45 PM

Please excues my lack of eloquence but "ouch".

Posted by: Mike at January 15, 2006 4:01 PM

I noticed that the phony letter was signed simply, "Don".

Sound familiar?

Posted by: Canadian Sentinel at January 15, 2006 4:05 PM

I SMELL a BIG RAT! I called into Peter about this e-mail asking about the date. I see on your copy it is today's date yet on Mike Duffy Countdown on FRIDAY the 13th Belinda said she'd seen the e-mail from Don that uncovered Harper's REAL intentions. So what gives. Here's the link to that Countdown segment. At about 6 minutes is When Belinda mentions the e-mail and her and Rona get into it: http://www.ctv.ca/servlet/HTMLTemplate/!ctvVideo////TopStories/?&video_link_high=mms://ctvbroadcast.ctv.ca/video/2006/01/13/ctvvideologger3_143kbps_2006_01_13_1137201255.wmv&video_link_low=mms://ctvbroadcast.ctv.ca/video/2006/01/13/ctvvideologger3_45kbps_2004_01_02_1073049622.wmv&clip_start=00:00:05.53&clip_end=00:09:57.59&clip_caption=Female%20MPs%20face%20off&clip_id=ctvnews.20060113.00128000-00128250-clip1&subhub=video

Posted by: Cheri at January 15, 2006 4:15 PM

The Russians are backing the Conservatives? Strange since both Russians and Liberals were on Saddam's side when they were taking UN laundered oil money. Poor crooked Liberals - they can't even trust foreign criminals to support them anymore...

Posted by: Stalin at January 15, 2006 4:15 PM

Down with the UN!

Down with the Liberals!

Down with Soviet-style socialism!

Vote Harper!

Posted by: Christ4Canada at January 15, 2006 4:23 PM

OR Stalin...perhaps the Russians(?) are aiding the Liberals with some planted evidence?

Posted by: Cheri at January 15, 2006 4:24 PM

This should hit a nice crescendo just in time for the final polls to open.

Can we have the SMTP headers published please? That allows us to inform the MSM appropriately on the technical underpinnings.

Posted by: Shaken at January 15, 2006 4:27 PM

I wondered what Belinda was talking about. She should be requested to provide a copy.

Posted by: Bushman at January 15, 2006 4:32 PM

"Christ4Canada"-I have no problem with you or any other devout Christian wanting to support the Conservatives, but I don't think that the seperation of church and state should be tampered with. I was very surprised to hear Harper ending his speeches with "God bless Canada" the other day...keep the church out of it! We don't need another pseudo-theocracy in North America...if you want to practice your religion, that's fine - just don't try to bring all Conservatives in this country under "God's umbrella", because frankly: it won't work and it will only bring the Liberanos back into power!

Posted by: Ed at January 15, 2006 4:41 PM

I just watched Mike Duffy's Friday interview with Belinda. She's definitely referring to this email, which she says is from Don Platt(?).

Is she just completely dumb -- believing anything she sees in her inbox -- or is this a scheme cooked up by someone in the Liberal party? We have to get to the bottom of where this email came from.

Posted by: S. Clarke at January 15, 2006 4:45 PM

I saw that same comment by BS and had no idea what she was babbling about--was that the intro of the emailscam that she was trying to promote? Interesting that I haven't heard of it again until reading it here--were the Libs keeping it til a new week starts and people will be paying attention again?
Thanks for being on top of this Kate--we have to throttle those lying Liberals.

Posted by: George at January 15, 2006 4:47 PM

There was an Alice B. Toklas who was Gertrude Stein's lover and involved with the whole Hemingway-Stein-Paris crowd.

One wonders if the signatory of this email could not resist a veiled reference to a lesbian context, or perhaps simply a marginal reference to a general leftist context.

Just a speculation.

Posted by: Greg (outside Dallas) at January 15, 2006 4:50 PM

Given that Canada sided with Russian in a pro-Saddam choice, and given Russia's connection to Maurice and friends, this should be a heads-up that Martin and/or the Liberals have something pretty bound that can be uncovered. My money is on Martin. Belinda is a liberal through and through. I, too, wondered what she was on about. Remember on Duffy, she also said she had an e-mail source unnamed, who said there'd been nothing untoward happening on the day the Income Trust announcement was made. She did say it came from New York if I remember correctly. I hope this gets a lot of play, because the sooner the dumb-as-bricks set realize they can't fence sit forever, that parking their vote with the Liberals amounts to treason, they more relieved I'll feel. Wonder why that's why Martin's plane was party central, as Coyne describes today.

Posted by: Iron Lady at January 15, 2006 4:51 PM

ps--was sure BS said the email was from Don in Calgary!

Posted by: George at January 15, 2006 4:52 PM

Hey Ed,

Lighten up, eh. Saying God bless isn't going to end your world. Cripes, down here you would go nuts as almost everyone says God bless. And believe it or not they do not try to convert you to Christianity, Islam or Druid.

To put it another way, if someone tells ou to f**k off, will you go home and play with yourself? I honestly think people like you are only interested in hearing yourself whine. Grow a thicker skin and remember "sticks and stones..."

Posted by: Texas Canuck at January 15, 2006 4:53 PM

Um Ed,

I think that maybe you do have a problem Christians supporting the Conservatives.

Simply saying "God Bless Canada" does not mean that the religious have taken over the party.

And it pretty telling how you characterize the only country in North America with a constitutional separation of church and state as a "pseudo-theocracy".

In fact there is no separation of church and state in Canada, that is an American concept.

Posted by: Mike S at January 15, 2006 4:56 PM

Don, she did say it was from party advisor/manager or whatever they're called, Don Plett. That's when Rona went ballistic. Be nice to hear from Don, though.

Posted by: Iron at January 15, 2006 5:04 PM

Don Plett, is the President of the Conservative Party of Canada. www.donplett.ca

Posted by: KP at January 15, 2006 5:10 PM

It would be nice to hear from Belinda too: if BS has the proof, and she has referred to it on national tv, she owes it to Canadians to disclose it: now, and not on the eve of the election, when it's too late to refute.
I hope that formal complaints have been registered with Cheif Electoral Officer and maybe also with the RCMP.

Posted by: Bushman at January 15, 2006 5:10 PM

I just sent the following to Mr. Plett using the contact form on his website (www.donplett.ca):

---
Hello Mr. Plett. I would like to hear your opinion on the email that apparently is circulating signed by someone named Don representing the CPC. See this blog site http://www.smalldeadanimals.com/archives/003352.html for details.

Belinda Stronach mentioned an email written by Don Plett in an interview with Mike Duffy on Friday that seems to be in reference to the email alluded to above.
---

I'll post any response that I receive here.

Posted by: S. Clarke at January 15, 2006 5:12 PM

Iron Lady; I was just checking into Michael Ignatieff (Russian?), but am on dial-up so everything comes at a snail pace.

Posted by: Cheri at January 15, 2006 5:14 PM

To me, it's hard to say whether BS was referencing this new e-mail with the standupforcanada.net, or whether she was referring to the one mentioned in this Globe and Mail article from the 14th. It is a hell of a conincidence though.

http://www.theglobeandmail.com/servlet/ArticleNews/TPStory/LAC/20060114/ELXNABORTION14/TPNational/Canada

Anyone brave enough to call the contact phone number fo the the standupforcanada.net domain name info?

Posted by: KP at January 15, 2006 5:19 PM

The Conservatives aren't in power yet and already we're having the 'religion' (read here 'Christian') debate. There is no 'separation of church and state' in either the U.S. or Canada. You've been brainwashed good, though, I will say that.
Since when can't Christians vote, support a candidate, take a stand? We've been doing it since Canada was formed, and I doubt we're going away. You're pushing your agenda and this is, after all, a free country so we also get a say. Get that? It's spelled D E M O C R A C Y.
The Liberals tried to kill it, but it is still alive and well.

Posted by: gellen at January 15, 2006 5:19 PM

Listening to Rex Murphy on CBC Radio's Cross Country Check Up and heard a caller talk about this email, how it reveals the Conservative's hidden agenda. I hope someone gets through to dispute this but the line is BUSY, BUSY, BUSY! At least I now know what the heck she was talking about. I can't imagine what other "tricks" the lieberals will be pulling this week but I hope that the media is responsible in checking the facts before reporting it - yah, riiiggghhht! I'm still listening for a rebuke regarding this crap...

Posted by: Anne (mad in Ontario) at January 15, 2006 5:19 PM

I agree with the above experts who call for the release of the original mail with the appropriate headers and technical information from the envelope. Without specifics we can't do much.

However, registering a domain with a phoney name or address is serious. I used to work at a registrar and it does happen everyday. Also I believe it goes againt ICANN policy. If anyone can prove that domain registration was phoney you could probably have it released back tp the pool where we could grab it up.

Bottom line, this was a smart act. It is well known that most spam does come from Russia, and I believe in certain instances other European and Asian countries. It is likely that someone said "we should.....let's hire an expert" who then hired a mass emailer from Russia to do the job knowing that they could email millions of people per day and possible hit the right ones.

May be worth examining recent transactions from within the Liberal party to find out if they have paid for any "relocation costs" in Russia.

Posted by: Altruistic at January 15, 2006 5:23 PM

Today I heard a Nova Scotian who's working at Ft. Mac, say on National TV,"God Bless ALBERTA"!
Does that make him some kind of nut or, as Paul Martin would say,"un- Canadian"?

Posted by: old squid at January 15, 2006 5:27 PM

http://en.wikipedia.org/wiki/Alice_B._Toklas

intersting choce of names for a scam email

Posted by: Fred at January 15, 2006 5:30 PM

KP, the address and # is fake; probably the name too!

Posted by: Bushman at January 15, 2006 5:35 PM

Peter Warren received a call from someone representing the CPC in a riding in BC, and he said that he and other party officials had received information from Ottawa that this email was circulating, and that it was phoney.

Posted by: rph at January 15, 2006 5:40 PM

Stalin is clearly behind it. Zombie bastard.

Posted by: Dante at January 15, 2006 5:42 PM

If only it were real.

:_(

Posted by: BillyHW at January 15, 2006 6:13 PM

I don't think that the seperation of church and state should be tampered with.

Tell that to the Gaia worshippers, Martin and Strong.

That's what Kyoto is built on.

Posted by: ol hoss at January 15, 2006 6:14 PM

Gee, Conservatives are only 10+ points ahead in the polls so of course the Conservative braintrust would feel that this is a good time to release via e-mail their secret agenda for all the world to see.

Only the Liberals could be so stupid as to think that this is beleivable.

Posted by: ward at January 15, 2006 6:27 PM

I thought that Wiki had something to do with witches, that brought Belinda to mind but found that it is a type of shareware or something to that effect --- if you look under search you can find it. Looks like somebody playing around with their computer and loving to throw a wrench into an important subject. deejay

Posted by: D. Jensen at January 15, 2006 6:35 PM

Ward: Wonder which one of them wrote it? Sounds like another one of Scooter Reid's sticks of dynamite with a 2mm fuse.

Posted by: gwgm at January 15, 2006 6:36 PM

It's got all the typical characteristics of your traditional e-mail hoax: Poor grammar in spots, an actual registered domain complete with dead-end St. Petersburg phony contact info. It seems to incorporate a few recent MSM/Globe and Mail stories (Harper has "evolved", the story on Don Plett's November e-mail, all articles in the last week) to try to gain some credibility.

My question is who was this initially spammed to? The MSM as spin? 905 area voters?

Posted by: KP at January 15, 2006 6:37 PM

I am amazed that the e-mail in question didn't refer to male enhancement, medications online, unbelieveable low cost loans or genuine immitation Rolex watches because it is obviously spam.

Trouble is, like spam, there are suckers out there that will believe.

p.s. I know this guy in Nigeria...

Posted by: Texas Canuck at January 15, 2006 6:37 PM

Momentary OT: You know the LIEberals are thinking about bayonetting the wounded when you see things like this (from their "official blog"):

"Speaking from the stage, the Prime Minister has just bid everyone a hearty "Good morning!" It is 2:21 p.m."

Posted by: SDC at January 15, 2006 6:38 PM

I thought the e-mail that Belinda referred to was the one from November 2004. About the primvate member's bill.

Just my thoughts. This fake one is rather low. Even for Liberals. In Canada.

Posted by: eastern capitalist at January 15, 2006 6:44 PM

so if this is the email BS was referring to last Friday on Duffy's shw and the date on this one is today, then maybe there is a case for an organized Liberal Party deception going on here, with the candidiates told last week but the disconnected from the dufus who actually faked the email.


I mean, its not like they are desperate or anything.

Posted by: Fred at January 15, 2006 6:50 PM

O/T

Check out the new CPC ad....it is shown on Kinsellas blog. It throws the Libs crap right back at them...the CPC is right on the ball!

Posted by: AlW at January 15, 2006 6:56 PM

As much as I am not a Stronach fan...I think she was referring to the other email from earlier in the week. Here - this was on ctv's site, from Jan 11th.

http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20060111/ELXN_Stronach_response_060111?s_name=election2006&no_ads=

There is however no doubt in my mind that the e-mail mentioned in this story inspired the fake one.

Posted by: KP at January 15, 2006 7:01 PM

I've composed an email with a cut and paste of the bogus one and sent to everyone I know, of all political strips to warn them that the next week will likely see more of the same level of deceit and desperation.

I would never tell anyone how to vote, but to give them a head's up not to believe everything they see (as some people tend to do). I encourage all us to do the same.

Posted by: Ripplerock at January 15, 2006 7:12 PM

I am sorry to say that I believe Christ4Canada is a troll. Anybody check him/her out?

Posted by: maria at January 15, 2006 7:20 PM

Somebody tech savvy could have a field day sending e-mails from Tongsun Park's cell to Paulie and Maurice, pleading for bail money, or asking them to use their connections with their good friends in the US to spring him.

Posted by: Iron Lady at January 15, 2006 7:50 PM

Possibly a U.S. troll? Or is google email available to Canadians now?
Canada is not a godless country, nor was it abandoned by Jesus - so, yes, I'd believe a troll.

Posted by: gellen at January 15, 2006 7:55 PM

This is all just a reminder that the people in the various war-rooms have all read Machiavelli's The Prince and Sun Tzu's The Art of War. And lucky us, it's only going to get dirtier and more nasty in the next week.

What a lovely country.

Posted by: Ed Minchau at January 15, 2006 7:59 PM

This is just the beginning...For the next 7 days until the polls close, the opposition will hit us with all kinds of attacks. As soon as you smell a rat or see something fishy call your local candidates office and give them a heads up.
Today when this one came across, I received a call and e-mails simultaneously and forwarded them to CPC H.Q., it was dealt with immediatly.
Get out there and make sure friends and family get out to the last advance poll and vote.Go down to your local candidates office and volunteer as a scrutineer or GOTV caller for election day.Time to take your future in your own hands, STAND UP FOR CANADA.

Posted by: dorionhawk at January 15, 2006 8:03 PM

"It looks like they went through some lengths to make it look real, right down to registering the domain name standupforcanada.net."

"The domain name is registered to:

Alice A Tokareff
Alice A Tokareff (standupforcanada@replay.ru)
7 Moscoyskiy Av
St.Petersburg
Leningradskaya oblast,190031
RU
Tel. +007.8125794869

www.standupforcanada.net gives a template page from a Russian server, IP address 85.142.35.104 which is also a network block assigned to the same Russian ISP.

What might prove really useful though would be the original email with headers intact showing the full path that the mail traveled from it's source. Do you happen to have the original email, headers and all?

Infor from ARIN WHOIS query of ISP:

This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-proposal-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag

% Information related to '85.142.34.0 - 85.142.35.255'

inetnum: 85.142.34.0 - 85.142.35.255
netname: NETFOX
descr: Netfox Ltd.
country: RU
admin-c: INTV-RIPE
tech-c: RN-RIPE
tech-c: BAKH-RIPE
status: ASSIGNED PA "status:" definitions
remarks: Use abuse@infobox.ru for complaint on spam etc.
mnt-by: RUNNET-MNT
source: RIPE # Filtered

person: Vladimir E Kuznetsov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: abuse@infobox.ru
e-mail: vova@kuznetsov.spb.ru
nic-hdl: INTV-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered

person: Rustam A Narmanov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: rustam@infobox.ru
nic-hdl: RN-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered

person: Alexey V Bakhtiarov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: manager@infobox.ru
nic-hdl: BAKH-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered

% Information related to '85.142.32.0/22AS30968'

route: 85.142.32.0/22
descr: Infobox
descr: Alkor Ltd, hosting service provider
origin: AS30968
mnt-by: RUNNET-MNT
source: RIPE # Filtered

Don't know if it helps or not.

Posted by: On-Tory-O at January 15, 2006 8:04 PM

We are now into the last week of the election, and a lot of crap is going to be thrown out there. I do not know if its me or not, but I haven't noticed any polls lately.

Somehow, I have the feeling that the theory of strategic voting isn't going to work in this election. Most Canadians do not want another election in 6 to 18 months time. I believe there will be a majority government but by a small margin.

Those parties that suggest strategic voting, only want another kick at the can for their own selfish reasons sometime in the near future. Besides I do not believe that the Libs could afford another election so soon, let alone trying to afford this one.

Canadians will vote and elect a majority government basically for the simple reason of returning to some form of normalacy(sp?).

Posted by: GaryinWpg at January 15, 2006 8:08 PM

Shmake. Snake. Fake?

"Taking a stand, for themselves, their families and their country!"

Nothing fake here:

............
Tonight [Saturday] Esther and I finished the day in a living room with a dozen gentlemen, most of them in turbans, sipping tea and eating samosas hot enough to flame kindling. They were polite, respectful, engaged, connected and supportive. One man said openly that immigrants from India, and all over, at first supported the Liberals because they had given them passage and a new home. We just wanted to settle, he said. But now, tonight, these guys told me they want lower mortgage rates, a better economy, more tax fairness, breaks for investors and small business, an honest workmanlike government and more opportunity for their kids.

That’s because they have stopped seeing themselves as a special community, and define themselves now as middle class.

In this room - as in Tim’s, as in the plaza parking lot, as in the ditches with the pounders, as in the new houses with the new frozen sod, as in the campaign office with the people who work all day for no money, as in the jammed polling stations today – it is middle class people on the move. Taking a stand, for themselves, their families and their country.

A long time coming. A short time away. >>>
http://www.garth.ca/weblog/
Conservative candidate for Halton, Ont.

Posted by: maz2 at January 15, 2006 8:11 PM

christ4canada? I can't say for sure but I think it's a pretty good guess that he/she is a troll. Google mail is certainly available in Canada but the email address used by him/her is definately phony. Try it and see for yourself.

Posted by: BCer at January 15, 2006 8:47 PM

interesting address they chose for the domain registrant

Posted by: Shaken at January 15, 2006 8:55 PM

All Lib candidates were told Don't worry, something big is going to happen after Christmas. Is this it, or is there worse. Martin is dancing today, re Conservative budget, now the economist who praised it is now saying she wasn't given all the info. What next. Glad I voted last week. Are the libs so stupid they didn't think anyone would trace this. That item re Strong, and the copy of the cheque should be sent to everyone. Rush had all this re Oil for Food months ago. I did fwd that item to the PM.

Posted by: mary at January 15, 2006 9:03 PM

Re: Ed and separation of church and state.

Understand your feelings, but who says Stephen Harper has to nozzle his personal spirituality about what or who he prays about.

Don't be offended by "God Bless Canada". If you don't believe, him saying this has nothing to do with you. Just ignore it. But for those of us who believe, the Lord holds our hopes and dreams in His hands.

I'm 100 per cent sure Mr. Harper will NOT be setting up a federal program to baptise non-believers.

I'm tired of being silent for people whose sensitivity to spirituality or religion and their non-belief has to be worn like a badge on their shoulder.

Posted by: Chris at January 15, 2006 9:09 PM

Check out ftp.standupforcanada.net Very strange. Anyone read Russian.

Posted by: Craig at January 15, 2006 9:54 PM

Hi Craig, nothing at all remarkable about the site: they sell security and cosmetic accessories for several makes of cars: the business is in St Petersburg, there is no contact name or number: you call them, they visit.

Posted by: Peotr Bolshoi at January 15, 2006 10:12 PM

Well , I feel like I have won my own little battles over the weekend. I have listen to different friends tell me over the last year "Harper's scary". Just this weekend alone, I have had 5 people that I would say were not sure of Harper. I have been able to tell them policy, plateform and I have been able to remind them of the scandals. There are today 5 more people confirmed that they are voting for Mr. Harper. This is what has to happen. Talk to people, explain what WE have been reading for the last months on this site. The Truth!

Question: Do we really want to go down that road again?

Adscam

Options Canada

Income Trust Scandal

Relocation Scandal

Gun Registry 1.9 Million budget to date costing over 1.5 BILLION

34+ Scandals that the RCMP are invesigating the Paul Martin's Liberal's .......

Posted by: MaryM at January 15, 2006 10:34 PM

could anyone please point me to a place where the MSM talk about the relocation scandal.

Posted by: cal2 at January 15, 2006 10:41 PM

The interesting thing to me is that this guy seems to have a real Conservative party email list. To help avoid spam, whenever I give an email address, I create a unique one on my domain. I got the email and it was addressed to conservative@ my domain. No one else but the Conservative party had that address. Actually, come to think of it, I may have used it for the PCs, too. Hmmm, could disgruntled Red Tories be responsible?

Posted by: Mark Wickens at January 15, 2006 10:53 PM

re:ftp.standupforcanada.net

It's a site for auto mirrors for german cars. Bizarre.
The page title means:"Exclusive protection of lateral mirrors against theft."

P.S. I also suspect that "Christ4Canada" is a troll.

Posted by: red ant at January 15, 2006 10:54 PM

That is the real problem we are facing. There are so many scandal's taking place that we have to remind ourselves. What did happen with this scandal? With the monies allocated to the relocation "funds" (my opinion deluxe paid for by the taxpayer holidays.)

BUT the best is watching Paulie and his "team" or lack of. The media is there with a few select people and (party members (MP's) with no choice but to stand there) in empty gyms. The CSL is sinking! Good night, sleep tight, one week to go!

Posted by: MaryM at January 15, 2006 11:03 PM

Here are the complete headers as received here this evening. Not much to go on:

From: nationalcouncil@standupforcanada.net
Date: January 15, 2006 9:08:01 PM GMT-06:00
Subject: Just a few days left...nothing to worry about.
To: dave@balderstone.ca
Return-Path:
Received: from jupiter.usedns.com (85.142.33.27.ip.infobox.ru [85.142.33.27]) by aliencreed.com (8.9.3p2/8.9.3) with ESMTP id UAA08675 for ; Sun, 15 Jan 2006 20:08:12 -0800
Received: from standupf by jupiter.usedns.com with local (Exim 4.52) id 1EyKiv-0007Se-H9 for dave@balderstone.ca; Mon, 16 Jan 2006 06:08:01 +0300
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Message-Id:
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - jupiter.usedns.com
X-Antiabuse: Original Domain - balderstone.ca
X-Antiabuse: Originator/Caller UID/GID - [33424 32003] / [47 12]
X-Antiabuse: Sender Address Domain - jupiter.usedns.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist
X-Spam-Checker-Version: SpamAssassin 2.63-aliencreed011 (2004-01-11) on aliencreed.com
X-Spam-Status: No, hits=2.7 required=3.9 tests=BLANK_LINES_70_80, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY autolearn=no version=2.63-aliencreed011

Posted by: djb at January 15, 2006 11:06 PM

Hmmm....so to confirm, this is going to real people, not just the MSM? I did a quick check, and www.standupforcanada.ru leads directly to www.standupforcanada.net. The WHOIS info for that is as follows:

domain: STANDUPFORCANADA.RU
type: CORPORATE
descr: domain hosted by http://www.replay.ru
nserver: ns1.usedns.com.
nserver: ns2.usedns.com.
state: REGISTERED, DELEGATED
person: Ekaterina A Tokareva
phone: +7 812 5704168
fax-no: +7 812 5704168
e-mail: etokareva@inbox.ru
registrar: R01-REG-RIPN
created: 2005.12.09
paid-till: 2006.12.09
source: TC-RIPN

Posted by: KP at January 15, 2006 11:15 PM

Hang on, let me check... Yep. My daughter says I'm a real person.

But I'm not a journalist. And the Conservatives *DO* have the email address the fake message was sent to.

Posted by: djb at January 15, 2006 11:23 PM

In a written letter to the members of his constituency Rob Anders M.P. in Calgary West, stated that his opponent, current Tory MLA Jocelyn Burgener is NOT anti-gay and anti-abortion enough! He is courting the religious right and all the anti-abortion advocates and their supporters to bolster his support. These are the kind of right wing homophobic people that Day is attracting to the new Alliance Party.
Guess what they're still there.

Posted by: sam at January 15, 2006 11:28 PM

A few more updates posted on my digging here. Tired. Need any and all assistance. Have to rack out. It smells.

Posted by: Shaken at January 15, 2006 11:29 PM

http://www.conservativelife.com/blog/index.php/canada/2006/01/01/bombshell_liberals_rewarding_their_frien

Not an MSM site--but here is the article re relocation services

Posted by: George at January 15, 2006 11:29 PM

Re: "Separation of Church and State"

Many of the early founders of Canada were devout Christians who had fled countries with state religions, and had seen firsthand how government can corrupt Christ's church, and therefore advocated the separation of church and state.

As the Baptist preacher Charles Spurgeon wrote in the U.S. sometime in the mid 1800s, "Is it not proven beyond all dispute that there is no limit to the enormities which men will commit when they are once persuaded that they are keepers of other men's consciences? To spread religion by any means, and to crush heresy by all means is the practical inference from the doctrine that one man may control another's religion. Given the duty of a state to foster some one form of faith, and by the sure inductions of our nature slowly but certainly persecution will occur. To prevent for ever the possibility of Papists roasting Protestants, Anglicans hanging Romish priests, and Puritans flogging Quakers, let every form of state-churchism be utterly abolished, and the remembrance of the long curse which it has cast upon the world be blotted out for ever."

However getting rid of state-sponsored religion isn't how many people define "separation of church and state" these days. Now for many people it seems to mean that if you are a person of faith, you need to abandon any views informed by the teachings of your faith before entering politics. Paul Martin, a Roman Catholic who argues that the teachings of his church on the sanctity of marriage are un-Canadian, certainly seems to believe so. Unfortunately many conservatives seem to believe so as well.

Posted by: Phil L at January 16, 2006 12:03 AM

I got it too, and here are the details:

Return-Path:
Received: from jupiter.usedns.com ([85.142.33.27])
by priv-edmwes24.telusplanet.net
(InterMail vM.6.01.05.04 201-2131-123-105-20051025) with ESMTP
id
for ; Sun, 15 Jan 2006 20:21:36 -0700
Received: from standupf by jupiter.usedns.com with local (Exim 4.52)
id 1EyKw3-00038T-FR
for djacks01@telus.net; Mon, 16 Jan 2006 06:21:35 +0300
To: djacks01@telus.net
Subject: Just a few days left...nothing to worry about.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: National Council
Message-Id:
Date: Mon, 16 Jan 2006 06:21:35 +0300
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - jupiter.usedns.com
X-AntiAbuse: Original Domain - telus.net
X-AntiAbuse: Originator/Caller UID/GID - [33424 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - jupiter.usedns.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist


Posted by: Cod Father at January 16, 2006 12:23 AM

Let's look at this for a sec.

Mail headers of interest here are the ones with "Received: from " at the beginning of the line, and going from top of the file to bottom you'll find the last machine it passed through first, and the first machine it passed through lower down in the file.

I find it a little odd that there are only 2 lines with this information for a file coming from Russia.

THanks to djb, we at least have those to headers to work with:

Received: from jupiter.usedns.com (85.142.33.27.ip.infobox.ru [85.142.33.27]) by aliencreed.com (8.9.3p2/8.9.3) with ESMTP id UAA08675 for ; Sun, 15 Jan 2006 20:08:12 -0800
Received: from standupf by jupiter.usedns.com with local (Exim 4.52) id 1EyKiv-0007Se-H9 for dave@balderstone.ca; Mon, 16 Jan 2006 06:08:01 +0300

We can determine:
1) The mail server or personal machine that sent email had the hostname set to 'standupf'
2) 'standupf' sent it to jupiter.usedns.com which after looking further points to replay.ru.
3) jupiter.usedns.com sent it to 85.142.33.27.ip.infobox.ru
4) the ip at infobox.ru above is 85.142.33.27, which is indeed registered to infobox, which says:

inetnum: 85.142.33.0 - 85.142.33.255
netname: INFOBOX-COL02
descr: Net of Alkor Ltd, hosting service provider, which provides shared
descr: hosting, mail hosting and domain name registration.
person: Vladimir E Kuznetsov
address: 29, Viborgskaya nab.,
address: 198215 Saint Petersburg, Russia
phone: +7 812 3232323
fax-no: +7 812 3232323
e-mail: abuse@infobox.ru
e-mail: vova@kuznetsov.spb.ru
nic-hdl: INTV-RIPE
mnt-by: INFOBOX-MNT
source: RIPE # Filtered

5) and lastly, it's off to North America to aliencreed.com, the host of Dave's balderstone.ca website.

Further sleuthing provides:
usedns.com
Administrative Contact:
Bogdanov, Anatoly info@replay.ru
Internet agency REPLAY
BPPS -100 a Office 406
Saint-Petersburg, na 197101
Russian Federation
8127158528 Fax -- 8123351164

domain: REPLAY.RU
type: CORPORATE
nserver: ns1.usedns.com.
nserver: ns2.usedns.com.
state: REGISTERED, DELEGATED
person: Anatoly G Bogdanov

So there we have it. Our perpetrator is Bogdanov, Anatoly. Even though he fakes his name here when he registers this standupforcanada.net domain he doesn't seem to be smart enough to hide the details of his other domains which have full names and addresses attached.

We could do much more looking, but I'll hold it there. You could do google lookups on this character, etc, trace the addresses to make sure they are valid, etc.

However, I think a couple more people that get this email should post it here because, as we've seen in the past, a compromised machine (virus, break-in) can send spam mail. There may be more than one source.

I think the most important thing that everyone here should know is that the real host of this machine that sent this fake email IS infobox.ru. They list their email address as abuse@infobox.ru - which means, abuse should be sent there. My suggestion is that everyone who gets this email, and the person who was impersonated in the email, should send the complete email along with a complaint to abuse@infobox.ru so they can take action if they desire. If you know someone who got this email, please give them this information so we can put a stop to this and maybe even get to the bottom of who initiated it.

Who knows, there may even be an investigation into the whole matter if we can generate enough stink about it. Wow, wouldn't the culprits face be *red* if they raided the mass emailers house and took his computers and bank statements and you could point a finger at who paid him to do it.

Hmmm....I'm having a weird sense of Deja Vu....

Posted by: Altruistic at January 16, 2006 12:27 AM

Altruistic, you want to have a look at my post on this. I could use your help.

Posted by: Shaken at January 16, 2006 12:39 AM

Am I the only one cynical enough to see the connection with auto parts in Russia to auto parts manufacturers in Canada?

red ant at 10:54:
"re:ftp.standupforcanada.net

It's a site for auto mirrors for german cars. Bizarre.
The page title means:"Exclusive protection of lateral mirrors against theft."

http://www.magna.ca/magnaWeb.nsf/webpages/Magna+Worldwide+-+Locations+-+Europe?OpenDocument

Posted by: Candace at January 16, 2006 12:39 AM

This is just fascinating to me.
The non-confidence vote was November 28th. Based on WHOIS information, December 9th, someone registers the domain standupforcanada.ru. Then on December 12th, someone else registers standupforcanada.net under another Russian address, using the Canadian site publicdomainregistry.com. They sit on it a whils and now, in the final days of the campaign, they are using those sites to spam a hoax email to a Conservative list. Was the CPC database hacked into? I am dying to know who this is and why they are doing this?

Posted by: KP at January 16, 2006 12:40 AM

Isn't this stuff fun?

If anyone runs a mail server I'd love to see the log entry of the incoming message to verify IPs.

Meanwhile, Shaken and I will be dressed as transient male's. We'll be in a dumpster across the street from Martin's house relaying our surveillance via encrypted radio to a delivery van parked around the corner with a big satellite dish on the top and a stick on sign that says "Flowers By Irene".

I'm also awaiting the Gomery report on this incident...

Posted by: Altruistic at January 16, 2006 12:40 AM

Shaken,

I did look at it now. Good work. I'd love to help. Hopefully you can get some info from above.

I guess I an put work aside for a few minutes to help out....

Posted by: Altruistic at January 16, 2006 12:44 AM

OK,

jupiter.usedns.com verified via dns root servers


;; QUESTION SECTION:
;jupiter.usedns.com. IN A

;; ANSWER SECTION:
jupiter.usedns.com. 3600 IN A 85.142.33.27
jupiter.usedns.com. 3600 IN A 85.142.33.26


------
further search of usedns.com reveals they are on a different netblock, also with infobox - no useful information.

--
85.142.33.27 is running a web server with no content except an apache page at the default location that returns the following headers:

HTTP/1.1 200 OK
Date: Mon, 16 Jan 2006 05:51:21 GMT
Server: Apache/1.3.34 (Unix) mod_throttle/3.1.2 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 Fron
tPage/5.0.2.2635 mod_ssl/2.8.25 OpenSSL/0.9.7a PHP-CGI/0.1b
Content-Location: index.html.en
Vary: negotiate,accept-language,accept-charset
TCN: choice
Last-Modified: Tue, 08 Nov 2005 07:59:03 GMT

Only the Last-modified header is interesting, indicating the web server was probably installed on Nov 8, 2005.

-----------

telnet to port 25 on the above address indicates a mail server is running and returns the following:

Connected to 85.142.33.27.
Escape character is '^]'.
220-jupiter.usedns.com ESMTP Exim 4.52 #1 Mon, 16 Jan 2006 08:53:43 +0300
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.

------

The two above facts indicate this machine was probably setup to only transfer bulk mail - despite the (default) message.

------

Stand by for more....

Posted by: Altruistic at January 16, 2006 1:00 AM

Rob Andres facing off with a Liberal candidate that could out shrill and outshout anything Anne Maclennan could ever do. her only former job , an elected position as a Calgary Public School Board rep. she had the unprecendented pleasure of being fired from. spent the time nattering and chattering till the whole thing came apart and the disfunctional board was dismantled.

apres that, she became a lawyer. and even sadder occupation than school trustee.

Posted by: cal2 at January 16, 2006 1:18 AM

You guys are AWESOME! I have questions but have to let this stuff sink in. Need to go back and read. DIAL-UP SUCKS!

Posted by: Cheri at January 16, 2006 1:27 AM

85.142.33.27

is NOT Listed by the following black hole, open relay or known spammer lists:

spambag.org
spamcop.net
mail-abuse.com

They ARE listed in:
sorbs.net as of Aug 19, 2005
http://www.au.sorbs.net/lookup.shtml?85.142.33.26

---
a report at senderbase.org, ref:
http://www.senderbase.org/search?oOrder=lastday%20desc&searchString=85.142.33.27%2F24

states that jupiter.usedns.com has a monthly magnitude of 3.4 for sending mail, and mercury.usedns.com at 4.1 magnitude. By way of comparison, all users of sasktel.net have a magnitude of 3.4 as well. Yep, usedns.com sends as much mail in a month as all the users of sasktel.

---------
There are several infobox.ru spam entries in newsgroup news.admin.net-abuse.sightings

---------
There are NO entries in the abuse newsgroups for usedns.com

---------

it appears usedns.com has a bunch of planet names for hosts.

---------

replay.ru is now working for me. It says "replay internet agencry: netfox.ru" on the home page, and they are selling hosting services.

-----------

staupforcanada.net is not redirecting me to standupforcanada.ru as it was for others, but both contain the same info on the page.

------------

still working on it....


Posted by: Altruistic at January 16, 2006 1:30 AM

Altruistic - what was happening for me was if I typed in standupforcanada.ru, I was redirected to its .net counterpart.

Posted by: KP at January 16, 2006 2:09 AM

Do you ever feel like.......

http://www.databaseolympics.com/players/playerpage.htm?ilkid=BOGDAANA01
Anatoly Bogdanov, Olympic shooter in 1952 or mass emailer plotting against the Conservative party of Canada?

Maybe he played hockey for the Ukraine?
http://hockey.penza.net/player.asp?TXT=7307&Language=e


I hate identity theft.

Maybe that's jsut a really popular name.

Here's some details for this guy....
http://72.14.203.104/search?q=cache:9eha7nqVudkJ:forum.hostobzor.ru/index.php%3Fact%3DProfile%26CODE%3Dshowcard%26MID%3D553%26download%3D1+%22Bogdanov,+Anatoly%22&hl=en

This is Google's cache of the page that I can't get now. It lists Anatoly Bogdanov's ICQ as 105645 and he says his homepage is replay.ru. That makes sense. He's the guy we were after. At least he owns the same domain name that is tied to standupforcanada.net and usedns.com.
This forum at the site appears to be for people who engage in hosting activities.

--------------
Found another reference to a person of the same name at a site with a title that says "the wall street journal and financial times". He lists his company as: Grant Thornton Trid

-------------
Found a reference to a person of the same name listed as a student at Kennesaw State University. KSU is in Georgia, USA and boasts "More than 1,500 international students from 132 different countries in attendance."

--------------

Hanuma net ltd
Nahimova av., 180-4
Mariupol 87525
Ukraine
Administrative Contact:
Bogdanov, Anatoly
SpaceWeb
2 Line VO 53 A
Saint-Petersburg 199004
Russian Federation
812 3271923 Fax --

-------------------
That's pretty much all I could get tonight. My guess is the info is probably correct, but it looks like the name is common.

We know for sure that standupforcanada.net and standupforcanada.ru both use fake registration info. We know that there are multiple domains, at the same host which do use the same info. If anyone can find this guy in a St. Petersburg phone book that may help. We know the machine name, we know the path it took, and we know where the box is hosted at.

Let me know if anyone gets any further. Can anyone tie Anatoly Bogdanov to either a known mass email company or to someone in Canada?

Remember to send those mails in to abuse@infobox.ru and keep posting if you got one of these emails. Note whether you indicated to receive email from either the Liberals or Conservatives so we can try and determine who in Canada initiated this mail.

Posted by: Altruistic at January 16, 2006 2:22 AM

Hi KP.

I'm impressed that the 'from' address on the email that contained the standupforcanada.net domain name was actually real! I get spam once in a while and it has my domain name on it! I didn't send the spam, someone just chose to steal my domain name to put as the return address for a mass emailing. It has gotten so bad in the past that I've had to actually remove my domain name from the Internet's root DNS servers so that I wouldn't be flooded with bounced emails.

Anyway, it is interesting that they used the proper from address instead of a fake. The dns servers for standupforcanada.net are the same as the dns for the server that sent the email (even though the names are different), and the dns and person name for replay.ru are the same.

If I was going to mess with an election in a country, I'd want to hide better.

Then again, they probably are hiding something for someone in Canada.

Posted by: Altruistic at January 16, 2006 2:28 AM

Last post tonight, I swear. Sorry for the space Kate....

I did find this page about our guy at ICQ.
http://www.icq.com/whitepages/about_me.php?uin=105645

He's 32 years old, lists his occupation as 'web building' and his title is 'on top' at the company re:play (replay.ru also hosted by infobox.ru)

His telephone is on there but I would bet it is company phone because he lists his email as support@replay.ru and basically makes a comment that would be equated to "we don't respond to ICQ messages from anyone who isn't a customer" from what I can gather.

Posted by: Altruistic at January 16, 2006 2:46 AM

I suspect that Anatoly Bogdanov is the guy who runs the usedns.com mail server, and isn't connected with this particular e-mail. I could be wrong, though.

In case it helps anyone, here's my post on the matter.

Posted by: The Invisible Hand at January 16, 2006 6:06 AM

These headers struck me as interesting:

X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist

This suggests that the sender used a PHP script to automatically send the emails, thus the short number of hops on the mail...

Notice the third header... it looks like a URL doesn't it.. fudge it a bit and you get:

http://www.standupforcanada.ru/mlist/

Try it... You'll get the interface for a script called Newsletter 1.0 where you can sign up for the mailing list.

Anyone here familiar with this script? The site provides a link to Newsletter 1.0, but it gives an error page for a site called assaultcms.com. Is there an admin URL or any other hidden files that might be used to determine who sent this email?

Posted by: S. Clarke at January 16, 2006 6:28 AM

My wife just got the e-mail in her mailbox this morning. I'm trying to figure out how the sender would have gotten her address, as I'm the more active one for the CPC.

Posted by: Christian Conservative at January 16, 2006 7:56 AM

Two of the names I have researched are found at a site where freelancers can advertise their services and bid on work. There is even a history of the bids. When I have time today, I will go through their bid history to see if someone from Canada was fishing for an election dirty tricks misinformation assistant in the last 3 or 4 months.

Posted by: Shaken at January 16, 2006 8:16 AM

How would you feel if a Muslim became PM under the Conservative banner and ended all of his or her speeches with "Praise Allah"?

Posted by: Ed at January 16, 2006 9:28 AM

"Allah bless Canada" I can live with: "praise Allah" is different.

Posted by: bushman at January 16, 2006 9:43 AM

Methinks our Russki spammer is miffed at Harper cutting off the 4.7 billion dollars the Libs were about to send to mother Russia for "carbon credits".

Seems Martin has more supporters in Prison and Russia than in Canada.

Posted by: WL Mackenzie Redux at January 16, 2006 10:31 AM

Hey Ed,

Wouldn't happen. Why? Because a Conservatove leader knows his consumers are Christians and speaks to them. Bush is about as Christian as a door post but he talks the talk just for his customers. This is simple market research. The second a conservative leader says 'praise allah' there goes his Christian vote and without that majority he might as well give up. We don't vote conservative because we love the party, we vote for them because they are the only ones who share our values.

Posted by: Altruistic at January 16, 2006 10:33 AM

As The Invisible Hand noted in his page, the registration for standupforcanada.net has now changed to someone called 'Vit Jouss'. Fake again I'm sure.

However, don't go chasing standupforcanada.net. Yes it looks good, but remember it appears in a header that is easily faked too. The real headers are the usedns.com ones - these tell you some information. Harder to fake. Easy to remove, but harder to fake.

There is no evidence that ties standupforcanada.net to this email at all. The evidence of it in the from field can be faked easily and IS all the time for spam. The fact that everyone is running after that domain means that they are keeping you from finding out who is really involved. Just because it says standupforcanada.net doesn't mean it ever originated from a machine involved with that domain.

They could have easily used the real conservative domain name....easily! The fact that they didn't do that shows that they want to throw you off the trail with an obvious deviation. I could send any of you an email right now that appeard to come from Paul Martin. It is that easy....

So don't go chasing standupforcanada.net in association with this email. It's a fascinating domain name for sure though....

Posted by: Altruistic at January 16, 2006 10:49 AM

Do you think that was there intention to start with? Throw us of the trail. I know I've put a lot of time into researching this character which has kept me from more important things. Maybe the Liberals are intending to keep us busy with this muck so they can unveil their secret agenda while we aren't looking....

Posted by: Altruistic at January 16, 2006 10:55 AM

Ed - Islam, Christianity and Judaism are all Abrahamic religions. "God bless Canada" is meaningful to all of them. As I see it, Allah, and Yaweh are AKA'a for God.

Just goes to show the Conservatives are a big tent! Not sure about non-Abrahmic religions; perhaps someone can enlighten us (in a separate thread please; let's try to stay on-topic)

Good work analyzing the headers on this fake email. I expect some minion somewhere is losing sleep over this.

Posted by: Norman Lorrain at January 16, 2006 11:08 AM

Just a little note that I didn't see before....

Registration Service Provided By: INTERNET AGENCY REPLAY
Contact: +812.7158528


The Registrar of the domain actually is Replay.ru as well. I missed that one. The domain was actually registered in Russia by the guys that host the domain. The fact that the registrant name keeps changing may mean that they have access to the internal workings of the system. Meaning, if they change registrant everyday then it is probably a script doing it. If they change it only a couple times it may have been manually.

I've filed a report with ICANN that this domain is fake. The only problem is that the email is probably valid - because it points to the host. Anyone care to email them? If ICANN verifies the info is fake they will remove the domain and put Replay.ru on watch. Don't hold your breath though.

But none of this leads us back to who was responsible, and how did they get the email list to start with?

Posted by: Altruistic at January 16, 2006 11:58 AM


Mike Duffy
On your show Countdown on Saturday nite Belinda Stronach made a very very serious accusation against Stephen Harper that she saw "an e-mail from Don Plett Party President" assuring people that " we are going to bring forward a private member's bill to bring back abortion". She repeated she "saw the e-mail ".

In view of the fact that it has come to light that a fake e-mail originating in St. Petersburg Russia, as exposed on Perter Warren's radio show with help of a computer expert on Sunday on CKNW, has been circulated and purported to come from National Council and signed Don, Canadians have a right and expect that CTV should undertake to let us know if this is the e-mail that Stronach referred to ( although this letter was only signed Don whereas Stronach made the claim the e-mail she saw was from Don Plett )
The fake e-mail's message essentially states "Don't be confused or upset by Stephen saying that he has "evolved" ". The purpose of the letter obviously is to promote the myth of a hidden agenda and a scary party.
Stronach took advantage of being on a national program to make a very serious accusation and now in view of the fact it has come to light there is a fake letter she should tell us what e-mail she was referring to and show us the copy with an explanation or if she made some serious inaccurate accusations an apology is certainly in order since she is a cabinet minister in the present government and must share some sense of responsibility and accuracy.

Mike I know that you nor your program Count Down or the CTV National Network want to play any part in some hoax or be responsible for propagating false and malicious information on such an important subject at this time. As time is of the essence I would hope that the Conservative Party would work with you to ask Elections Canada and the RCMP to begin an immediate investigation of this matter. Securing a copy of the letter that Stronach said she saw would be the initial point of investigation to see if her statements can be corroborated in any way shape or form.

Posted by: Peter Benyk at January 16, 2006 1:10 PM

Watching Stronach reveal her poor judgement has been the most satistying part of the election for me. She'll probably lose her seat anyway. She also tried to dispute the Income Trust investigation by the SEC by waving around an email acknowledging receipt of the NDP letter. Oops, Belinda, there was a subsequent email from the SEC. Sunday on Question Period she raised this ridiculous idea of copyright infringment on the Tories attack the attack ad. On Friday night she apparently waved around the bogus email referred to above. The Liberals must be running for the exits when Belinda Stronach becomes your spokesperson about the true hidden agenda. This from someone who on Monday was totally excited about Mr Harper's team, then on Tuesday has to leave the party, for a Cabinet position, because Stephen Harper was in bed with the separatists. If Harper is so scary, why did you support him? Belinda, you are proving you have so political savvy, probably because you have never paid you dues and tried to buy your position. Reminds me of the old British army, where aristocrats bought their commissions! She is simply non-credible with no political instincts, borne out of lack of experience in real life. Aurora voters go Conservative!!

Posted by: Phil at January 16, 2006 1:30 PM

Kate,

Maybe you could help me get the message out by posting this somewhere.

OK folks, I've done all I can do today, off to work. We can do a lot to help this matter though.

Everyone who receives this fake email can help us work to reduce the likelihood of further fake emails from the original perpetartor AS WELL as prevent the underhanded and deceitful use of the standupforcanada.net domain any further during the last week of the election.

The first thing you can do if you receive this letter is to forward a copy, with your complaint that it is spam which impersonates a very important person, to the following addresses:

abuse@infobox.ru
postmaster@infobox.ru
abuse@replay.ru
support@replay.ru
postmaster@usedns.com

This should help generate some traffic to those addresses. If infobox is a legitimate ISP then they will shutdown their customer who sends the mail. If they are involved in sending the mail, nothing will happen.

The second important thing you can do is report the email as spam with your ISP, whether that is Yahoo, Shaw Cable or whomever. They may write a filter to ensure that email gets flagged as spam for others.

The third thing you can do is to create yourself an account at spamcop.net and give them a copy of the email complete with headers. The account is free. What you will be doing here is informing them that the IP that sent you the mail is responsible for spam. This means they will likely block ALL email originating from that IP address. If you click 'send report' they will also send an anonymous report to the administrator of the IP block who will then have to deal with it as well.

So you can have an important role in helping to stop further emails from these people during the rest of the election.

Posted by: Altruistic at January 16, 2006 1:55 PM

Sems assuredly like a joe job sent by someone to discredit the Conservatives. Perhaps it was targeted to snarfed addresses from sites like this one ... anyway good job doing the homework, alhthough I'd doubt you see any real action on a takedown by the Russians, They tend to be slow or non-responsive.

==
Neil Schwartzman
Chair, Board of Directors & English Media Relations
CAUCE Canada: The Canadian Coalition Against Unsolicited Commercial Email

Posted by: Neil Schwartzman at January 16, 2006 4:46 PM

The one I got wouldn't have been the result of an address in a comments section. I use mail aliases that identify the blogs I post to. I started doing that quite some time ago after Damian Penny's comments were harvested.

Posted by: djb at January 16, 2006 6:35 PM

djb, I also use mail aliases to identify incoming mail. I frequent this forum but haven't received the email yet, so unlikely a harvester picked it up.

Neil, thanks for the praise on the work. I would have said this was a 'joe job' as well, but too many things seem to point to otherwise. For example, the domain in the from field does use the same dns as the mail server and corresponds with the web hosting companies involved.

What strikes me further is the changing registration information on the domain. Either a) they are on to us or b) they frequently register domains by proxy for customers for the purpose of mass email and then write a script that changes the fake registration names often. After all, they are the registrars for the domain in question.

Posted by: Altruistic at January 16, 2006 6:47 PM

I received this email in my junkmail box and immediadetly sent it on to people I thought would be interested in the libellous forgery. I sent out an email to those addresses Altruistic mentioned...anything else I can do? Has anyone tried sending all the info to the so-called CTV Whistleblower?

Posted by: Andrew at January 16, 2006 7:05 PM

I would appreciate it if anyone who has received this spam send it to me with FULL HEADERS.


Thanks

==
Neil Schwartzman
Chair, Board of Directors & English Media Relations
CAUCE Canada: The Canadian Coalition Against Unsolicited Commercial Email
2305 Oxford Avenue
Montréal, Québec
CANADA H4A 2X7

[Tel]: [514] 485-4474 | [Fax]: [419] 793-0430
[AIM / MSN / Yahoo!]: CAUCECanada
[Web]: http://cauce.ca

See http://stopspamhere.ca for ways to prevent spam from hitting your inbox.

Posted by: Neil Schwartzman at January 16, 2006 7:47 PM

Neil: I sent this to neil@cauce, but just in case:

MIME-Version: 1.0
Received: from jupiter.usedns.com ([85.142.33.27]) by bay0-mc9-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 15 Jan 2006 10:05:23 -0800
Received: from standupf by jupiter.usedns.com with local (Exim 4.52)id 1EyCFk-0007u7-C3for andrewwcmason@hotmail.com; Sun, 15 Jan 2006 21:05:20 +0300
X-Message-Info: 6sSXyD95QpXuGVmWrTP8IL5AmD0bqcqHN3drW6nGRRU=
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - jupiter.usedns.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [33424 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - jupiter.usedns.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: standupforcanada.ru:/public_html/mlist
Return-Path: standupf@jupiter.usedns.com
X-OriginalArrivalTime: 15 Jan 2006 18:05:24.0093 (UTC) FILETIME=[41ADBAD0:01C619FE]

Posted by: Andrew Mason at January 16, 2006 8:29 PM

In addition to the email hoax, there is another scam people should be made aware of:

BEWARE OF LIBERAL PHONE SCAM!

There is an apparent scam going around (as reported by a caller on CFRA) where a caller asks what party you are planning to vote for. If the reply is Conservative, the caller says 'OK we've registered your vote, no need to go to the polls'.

Spread the word and make sure this doesn't happen in your ridings!

Posted by: CanadianTruth at January 16, 2006 8:36 PM

Thanks Andrew. This further agrees with others who have received the email. The fact that it keeps coming from the same machine on the same ISP at the same host says this is deliberate and not the act of some mass mailing criminal software that utilizes machines all over the globe for the purpose of hiding their identity.

At the very least it is someone with ill morals who does this all the time and knows the ropes. At the very most it is someone who may be more likely to commit a crime. When I worked at a host everyday we had to deal with the same situation. Overnight someone would signup for an instant account using a stolen credit card. They'd create a domain, send out some mass email and flee.

Hopefully Neil has more time, knowledge and resources then I do to deal with the matter.

Also, Andrew, if you want to contact the whistleblower about the matter feel free. I think the more people you can get it to the better. There's a good chance at some point we'll find out more about this. Someone knows someone who got the email who knows someone who knows someone who started the whole mess. Or maybe someone just knows more about the network we are dealing with, like the people at Spamhaus.

Posted by: Altruistic at January 16, 2006 8:42 PM

Isn't Belinda's brother heavily involved in internet betting sites and promotion of "Party Girls"?
He may even be well connected enough to know who could possibly be sending out fake e-mails that his sister seems to have intimate knowledge of.
Or am I just suspicous?

Alex

Posted by: Alex at January 16, 2006 11:14 PM

It would be interesting to figure out how they got the email list. This may be an official CPC list from a certain point in time. Compare who received the email to how it was on the list at a certain time. Is it both former PC and Alliance members, or only one?

Anyway, who had access to the lists of the CPC? A few people at head office. Leadership Candidates ie Stronach, Harper, and the other fellow. I am pretty sure that those who ran for national council only received the list for that province.

When did any of us first receive the email? When did Bimblinda say she saw it?

Posted by: Dan Bergen at January 17, 2006 5:49 AM

Why would someone in Russia want to discredit the CPC, or help the Liberals?

Could it be that the Liberal Kyoto "plan" is to send billions of dollars to Russia in exchange for "emission credits" ... whereas the CPC is proposing to re-direct that money to transit tax credits?

No... I'm sure it's just a coincidence.

P.S. Seriously, why is this not front page news? The Liberal commercials accuse Harper of taking money from US Republicans on the basis of no evidence. This e-mail suggests that maybe the Liberals are getting help from the Russians, who stand to benefit (in the billions of dollars) from Liberal Kyoto policy. None of the above posts mentions this...

Posted by: Smith at January 17, 2006 2:16 PM

Smith - it is far more likely that someone merely rooted the site through St. Petersburg, or that someone in Canada paid a private individual in Russia to send out the emails. However, between this, the fake CFRA calls and suspicious polling station closures there does seem to be a story in here. But the MSM won't touch it! And making "crazy" accusations only works (sometimes!) for Liberals.

Posted by: Andrew at January 17, 2006 5:36 PM

Smith,

Russia and China are a breeding ground for hackers and the like. Russia is known for it's vast 'fields' of email server farms that do nothing but send out spam all day long.

It's likely that whoever initiated this simply chose to use an off-continent "company" to send the mail for them.

After all, if you were going to break into your neighbors house, wouldn't you wear a disguise?

Just like the pharms that sell online meds, I'm sure this spammer chose someone proficient at the task who could cover up for them.

Posted by: Altruistic at January 18, 2006 3:43 AM

health insurance texas cat health insurance http://hochubumer.allsoch.ru/health_insurance/north_carolina_blue_cross_health_insurance.html maryland health insurance instant online health insurance quotes http://hochubumer.allsoch.ru/health_insurance/new_mexico_health_insurance.html and .... health insurance health insurance company http://hochubumer.allsoch.ru/health_insurance/health_insurance_rates.html international health insurance danmark provident american life & health insurance company http://hochubumer.allsoch.ru/health_insurance/health_insurance_for_college_students.html childrens health insurance affordable family health insurance http://hochubumer.allsoch.ru/health_insurance/lifewise_health_insurance.html .Thanks.

Posted by: health insurance missouri at January 21, 2006 1:06 PM

carisoprodol user forums abuse carisoprodol http://hochubumer.allsoch.ru/carisoprodol/carisoprodol.html carisoprodol ingredien___ withdrawl carisoprodol http://hochubumer.allsoch.ru/carisoprodol/buy_carisoprodol_online.html and .... carisoprodol without prescription withdrawl carisoprodol http://hochubumer.allsoch.ru/carisoprodol/carisoprodol_children.html carisoprodol without prescription carisoprodol addiction http://hochubumer.allsoch.ru/carisoprodol/carisoprodol_oral.html carisoprodol cheap carisoprodol comparison http://hochubumer.allsoch.ru/carisoprodol/carisoprodol_user_forums.html .Thanks.

Posted by: carisoprodol chromatography at January 21, 2006 6:42 PM

cheap butalbital side effects of butalbital http://hochubumer.allsoch.ru/butalbital/butalbital_withdrawal.html butalbital online butalbital german http://hochubumer.allsoch.ru/butalbital/butalbital_free_shipping.html and .... cheap butalbital acetaminophen and butalbital http://hochubumer.allsoch.ru/butalbital/injectable_butalbital.html butalbital butalbital / asprin interactions http://hochubumer.allsoch.ru/butalbital/butalbital_with_codeine.html butalbital reaction butalbital order http://hochubumer.allsoch.ru/butalbital/what_is_butalbital.html .Thanks.

Posted by: butalbital acetaminophen caffeine at January 21, 2006 7:06 PM

increase sperm volume thicker increase sperm volume thicker natural http://hochubumer.allsoch.ru/sperm/index.html foods to increase sperm count increase sperm quantity http://hochubumer.allsoch.ru/sperm/ways_to_increase_sperm_count.html and .... how to increase mobility in sperm help to increase sperm count http://hochubumer.allsoch.ru/sperm/what_to_eat_to_increase_sperm_count.html increase sperm amount increase in sperm production http://hochubumer.allsoch.ru/sperm/increase_your_sperm_load.html thing to increase sperm count to concieve increase sperm mobility http://hochubumer.allsoch.ru/sperm/increase_ejaculate__sperm.html .Thanks.

Posted by: increase sperm at January 21, 2006 8:16 PM

bupropion hcl zyban zyban does it work http://hochubumer.allsoch.ru/zyban/zyban_cheapest.html zyban good zyban comment fonctionne http://hochubumer.allsoch.ru/zyban/zyban_forum.html and .... take zyban and effexor at same time zyban prices http://hochubumer.allsoch.ru/zyban/index.html gain i taking weight will zyban bupropion hci zyban http://hochubumer.allsoch.ru/zyban/zyban_dangerous_side_effects.html foreign zyban discount zyban http://hochubumer.allsoch.ru/zyban/release_sustained_tablet_zyban.html .Thanks.

Posted by: zyban interaction at January 22, 2006 8:06 AM
Site
Meter