LOVESPAM

2013-12-01

We all receive them, and we all ignore them, but sometimes they can reveal interesting things. e.g.

Don’t you love spams that come from a n00bie spammer who just paid for access to a “one-click spam everyone” tool, but didn’t read the documentation? What follows below is a true spam that I received today with no alterations whatsoever (excepting the headers which I’ve removed from the top of the message to try to reduce it’s size a bit – they have no bearing other than to detail how Google delivered it. The subject is an interesting one, because I didn’t know “Lucas” was in a “Star Wars legal fight”. However, the important bit to note about the email is the address they try to send me to.

Subject: Lucas loses Star Wars legal fight
Date: Sat, 30 Nov 2013 21:58:47 +0400
From: "::Pharmacy Exspress::"<gundar@bankvrn.ru>
Message-ID: <AA7F23F84E5C563AAD12B3ABC5FE9415@bankvrn.ru>
X-Priority: 3
X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------09040400202040105050206"

This is a multi-part message in MIME format.
--------------09040400202040105050206
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-2"

 The new joy of ssex life!!!Solutions for providing a volcano power to you in bed. Your girl will be amused with how steady and wooden your bone-on is! This is a super pilule for every man!http://ssseexkxual.{dom}/?vdvbvivgvfvedj

--------------09040400202040105050206
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="windows-1250"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    <CENTER><DIV style="margin: 0 auto;text-align:center;width:350px;"> 
<DIV>The new joy of ssex life!!!</DIV>
<hr width="200">
<FONT face="Tahoma" size="2">Solutions for providing a volcano power to you in bed. <br>Your girl will be amused with how steady and wooden your bone-on is! <br>This is a super pilule for every man!</FONT>
<hr width="200">
<A href="http://ssseexkxual.{dom}/?vdvbvivgvfvedj"><B>http://ssseexkxual.{dom}/?vdvbvivgvfvedj</B></A>
</DIV></CENTER>
  </body>
</html>

--------------09040400202040105050206--

Yes, folks, it really is the age-old “I’m too stupid to fill out all the replacements properly when mail-merging” problem. Only in this instance it successfully prevents me from looking a fool by clicking the link and signing up to whatever they’re advertising and not receiving anything other than a hefty bill from fraudsters. Wait, stop looking at me like that; it only happened that one time!