We all receive them, and we all ignore them, but sometimes they can reveal interesting things. e.g.
Don’t you love spams that come from a n00bie spammer who just paid for access to a “one-click spam everyone” tool, but didn’t read the documentation? What follows below is a true spam that I received today with no alterations whatsoever (excepting the headers which I’ve removed from the top of the message to try to reduce its size a bit – they have no bearing other than to detail how Google delivered it. The subject is an interesting one, because I didn’t know “Lucas” was in a “Star Wars legal fight”. However, the important bit to note about the email is the address they try to send me to.
Subject: Lucas loses Star Wars legal fight Date: Sat, 30 Nov 2013 21:58:47 +0400 From: "::Pharmacy Exspress::"<[email protected]> Message-ID: <[email protected]> X-Priority: 3 X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------09040400202040105050206" This is a multi-part message in MIME format. --------------09040400202040105050206 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="iso-8859-2" The new joy of ssex life!!!Solutions for providing a volcano power to you in bed. Your girl will be amused with how steady and wooden your bone-on is! This is a super pilule for every man!http://ssseexkxual.{dom}/?vdvbvivgvfvedj --------------09040400202040105050206 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset="windows-1250" <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body bgcolor="#ffffff" text="#000000"> <CENTER><DIV style="margin: 0 auto;text-align:center;width:350px;"> <DIV>The new joy of ssex life!!!</DIV> <hr width="200"> <FONT face="Tahoma" size="2">Solutions for providing a volcano power to you in bed. <br>Your girl will be amused with how steady and wooden your bone-on is! <br>This is a super pilule for every man!</FONT> <hr width="200"> <A href="http://ssseexkxual.{dom}/?vdvbvivgvfvedj"><B>http://ssseexkxual.{dom}/?vdvbvivgvfvedj</B></A> </DIV></CENTER> </body> </html> --------------09040400202040105050206--
Yes, folks, it really is the age-old “I’m too stupid to fill out all the replacements properly when mail-merging” problem. Only in this instance it successfully prevents me from looking a fool by clicking the link and signing up to whatever they’re advertising and not receiving anything other than a hefty bill from fraudsters. Wait, stop looking at me like that; it only happened that one time!