Tweet
I love spam, it is hilarious to see what "arrangements" they make to try and make a living, or whatever...
Of course you have the fun headers to deal with, but this particular e-mail has some content that one would misunderstand at first glance if not familar with http.
Return-Path: <gramos1999@juno.com>
Received: from ip68-0-47-140.hr.hr.cox.net (ip68-0-47-140.hr.hr.cox.net [68.0.47.140])
Received: from cgp.sovintel.ru (cgp.sovintel.ru [212.44.130.39])
by lexx.eunet.lv (8.12.5/8.12.5) with ESMTP id gAM8NThG013844;
Received: from gtms01.netone.com.tr (mail.netone.com.tr [193.192.100.127])
by mail.steinweg.nl (8.11.6/8.11.6) with SMTP id gAFDBfI14480
Received: from relay.wplus.net (relay.wplus.net [195.131.52.142])
by mail2.seaport.spb.ru (8.12.3/8.12.3) with SMTP id g935QjUQ036484
From: "Jennifer Hawkings" <gramos1999@juno.com>
Subject:
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: iPlanet Messenger Express 5.2 HotFix 0.9 (built Jul 29 2002)
Date: Sun, 8 Dec 2002 04:19:38 +0000
Message-ID: <01c29795$82ed3460$5c0fa8c0@cpunselie.lan>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Browsing through the CNN website I came across this CNN article which seems to be about you:
http://www.cnn.com:USArticle1840@www.nondisclosedwebsite. com/
Yours,
Jennifer Hawkings
... what "Jennifer Hawkings" fails to mention is that the link is not to CNN (http://www.cnn.com/) as "she" implies and hopes to fool you with but rather the link refers you to (www.nondisclosedwebsite.com).
the linklogs you into www.nondisclosedwebsite.com via username:password.
... next usually you get the old signed active x control that injects spyware into your box, snares your logon info, or credits the spammer, or gets you to look at something... whatever.
fuck you spammers... fuck you all.
Of course you have the fun headers to deal with, but this particular e-mail has some content that one would misunderstand at first glance if not familar with http.
Return-Path: <gramos1999@juno.com>
Received: from ip68-0-47-140.hr.hr.cox.net (ip68-0-47-140.hr.hr.cox.net [68.0.47.140])
Received: from cgp.sovintel.ru (cgp.sovintel.ru [212.44.130.39])
by lexx.eunet.lv (8.12.5/8.12.5) with ESMTP id gAM8NThG013844;
Received: from gtms01.netone.com.tr (mail.netone.com.tr [193.192.100.127])
by mail.steinweg.nl (8.11.6/8.11.6) with SMTP id gAFDBfI14480
Received: from relay.wplus.net (relay.wplus.net [195.131.52.142])
by mail2.seaport.spb.ru (8.12.3/8.12.3) with SMTP id g935QjUQ036484
From: "Jennifer Hawkings" <gramos1999@juno.com>
Subject:
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: iPlanet Messenger Express 5.2 HotFix 0.9 (built Jul 29 2002)
Date: Sun, 8 Dec 2002 04:19:38 +0000
Message-ID: <01c29795$82ed3460$5c0fa8c0@cpunselie.lan>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Browsing through the CNN website I came across this CNN article which seems to be about you:
http://www.cnn.com:USArticle1840@www.nondisclosedwebsite. com/
Yours,
Jennifer Hawkings
... what "Jennifer Hawkings" fails to mention is that the link is not to CNN (http://www.cnn.com/) as "she" implies and hopes to fool you with but rather the link refers you to (www.nondisclosedwebsite.com).
the linklogs you into www.nondisclosedwebsite.com via username:password.
- www.cnn.com is the username
USArticle1840 is the password
... next usually you get the old signed active x control that injects spyware into your box, snares your logon info, or credits the spammer, or gets you to look at something... whatever.
fuck you spammers... fuck you all.
Comment