Sometimes, a spam message can look very tempting to the reader. I recently received the following message that’s just too good to be true. Fortunately, my spam filter did move it to spam already…

Dear Friend,

This is a personal email directed to you.

I and my wife won a EuroMillions Jackpot Lottery of Ј148m EuroMillions in August.
We have decided to donate the sum of Ј2,000,000.00 Pounds to you as part of our own
charity project to improve the life of 5 lucky other individuals all over the world.

All you have to do is get back with us so that we can send you details to the payout bank.

You can verify this via the two link below.

http://www.dailymail.co.uk/news/article-2187999/
http://www.national-lottery.co.uk/player/p/goodcausesandwinners/winnersgallery.ftl

Adrian And Gillian Bayford
Email: adriangillian-bayfords@maildx.com

Strangely enough, the sender happens to be adrian.gillian.bayforddonationdesk@hotmail.co.uk but the email in the message claims otherwise. A check of that MailDX address shows that it’s just another free email provider, like Hotmail, Yahoo or GMail. Since the sender is also a free mail account, I just consider these throw-away accounts. They use it to get your attention and they hope to collect enough information before the free providers will close the account again. And, the trick here is that they use two providers, so one account is closed for sending spam reasonable fast, but the other will continue to work a bit longer. A simple trick, but reasonable effective.

Also interesting is that they did not include any fake URL’s or made up a fake story. The real Adrian And Gillian Bayford did win a nice amount in the national lottery. A nice 148 million in British pounds. Not bad! And sure, they could decide to give away a small part of that amount to a few lucky others, but how would they chose those people? Ask yourself: if you would give away a large sum of money, how would you decide the person who should receive it?

Right! You would not pick a random person from a mailing list. Especially not when that mailing list happens to be used by spammers to spam people. I know it’s on a spam list since I tend to receive several other spam messages on the specific mail alias that has received this message. Anything I receive on that list is most likely spam anyways. Doesn’t bother me, though. My mailbox has a powerful spam filter and the account is just an alias that I can close and discard. It’s just fun to see the kind of tricks spammers will use. And some of their tricks are very sophisticated! Besides, it helps me to recognize those spammers.

So, except for the fact that it was already marked as spam, what other things told me it was spam? And most likely a phishing mail? Well, first of all it sounded too good to be true. Also, a quick Google-search revealed an article on SpamFighter warning people about this message! It never hurts to just search on Google to check if some message is spam or not! The two different email accounts also warned me, especially since both are free accounts. Registering a domain name is not expensive. And by using Google Apps you can also add a mailbox with unlimited aliases to your domain, again for a low price. So this couple could have easily created a real domain with extra information for those people with whom they would share their price.

Also, the lack of the British Pound symbol in the email was a clear clue, since it’s supposed to be British. It tells me that it was sent by someone with a non-British keyboard! That’s very common outside the UK but people inside the UK prefer to type the proper symbol for their currency.

Sending the spam to my honey pot mail account was also a dumb move.

I’ve recently posted a rant about spam and today, I’m going to add another one. This one about a spammers trick that might fool a lot of people. Especially those people who don’t use a good spam filter. And I’m doing this because it might have fooled me, if there weren’t two flaws with it. First of all, it ended up in my spam folder, which suggests that something is wrong. Second of all, it was sent to the wrong email address.

First, let’s take a look at the spam itself:

What the spam looks like

Well, it looks good enough. LinkedIn does send these kinds of emails on a regular basis. I get plenty of those on my real LinkedIn account. But as I said, I received this one in my spam filter and on the wrong account. So, let’s look at the email a bit more, starting with the headers…

Delivered-To: address@example.com
Received: by 10.14.174.6 with SMTP id w6csp66709eel;
        Wed, 29 Aug 2012 08:00:37 -0700 (PDT)
Received: by 10.60.11.34 with SMTP id n2mr645244oeb.18.1346252436700;
        Wed, 29 Aug 2012 08:00:36 -0700 (PDT)
Return-Path: <heemali@snmz227.leaseweb.com>
Received: from SNMZ227.leaseweb.com ([82.192.78.107])
        by mx.google.com with SMTP id zm6si23150147obb.199.2012.08.29.08.00.35;
        Wed, 29 Aug 2012 08:00:36 -0700 (PDT)
Received-SPF: neutral (google.com: 82.192.78.107 is neither permitted nor denied by best guess record for domain of heemali@snmz227.leaseweb.com) client-ip=82.192.78.107;
Authentication-Results: mx.google.com; spf=neutral (google.com: 82.192.78.107 is neither permitted nor denied by best guess record for domain of heemali@snmz227.leaseweb.com) smtp.mail=heemali@snmz227.leaseweb.com
Date: Wed, 29 Aug 2012 11:00:36 +0000 (UTC)
From: LinkedIn Reminders <reminders-noreply@noreply-linkedin.com>
To: address@example.com
Message-ID: <52203955.7448783.1913884201422.JavaMail.app@ela4-app2581.prod> Subject: There are a total of 1 messages awaiting your response MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I’ve replaced my address with address@example.com, a dummy address. But if I look at these headers I noticed that it’s sent from a leaseweb.com mail account, and not from LinkedIn itself. Leaseweb is a hosting provider with a bad reputation as being one of the worst hosts since they seem to host a lot of malware on their sites. So was the Bredolab botnet hosted on Leaseweb servers. Leaseweb also hosted part of MegaUpload. But Leaseweb is just one of the biggest hosts in Europe so it’s no surprise that you can find lots of malware there. Such sites are always a small percentage of sites for any host.

But why would LinkedIn use Leaseweb? Well, they would not! This is just another sign that this is a real spammer. But let’s look a bit further, which is the HTML code behind this email:

The source code behind the spam.

This shows the true intentions of this spam. The spammer wants to fool to visit some specific site. The site itself has nothing to do with the spam, except for the site has been hacked without the site owner knowing this. But it’s not a malware URL but a redirection to a Canadian pharmacy website. They want to sell Viagra and Cialis to the unsuspecting visitor. (Oh, dear! Those two words will most likely put this post in each and every spam filter!)

Well, not all spammers will send their victims to malware sites. In this case, they just want to get more visitors to buy little blue pills. They prefer to target American visitors since the sale of these pills are more limited in the USA than in Canada. In Europe, unknown to most, you can just buy similar products at the local pharmacy. That is, if you need them.

Anyways, the URL has the word “stupid” which tells us how the spammer thinks about those who are fooled by this. Well, I wasn’t fooled but instead I investigated it a bit and contacted the site where the redirect was hosted. I’ve warned them about this URL on their domain and I expect it to be gone within a few days. If not, they might be held responsible for this spam, and for the (illegal?) sale of these types of drugs. Since they are a clinic of some sorts, it could cost them their license if they don’t take additional steps against this.

But for now, let’s wait on their response on this post, and on my warning…

For some time now, I am receiving about 5 spam messages per day for some weird job offerings that could earn me 22 to 65 Euro’s per day. And all I have to do for this “job” is to answer questions from some health clinic and answer some easy questions. They’d like me to do this about 2 to 12 hours per day and all I have to do to join is send them the following information: name, phone number, age and the city where I live.

Of course, this is spam and most people would just ignore such things but I started to investigate a bit. The sender always seem to be a different person but the domain it originates from is careersholland.com. However, the DNS information for this site is gone which means that you cannot reply anymore. The domain is gone, but the spammer just continues to send these messages.

There is another site, however, that happens to be legitimate and whose domain name looks closely to this spammer. They’ve posted this article to their site to warn people about these spammers. That’s because this is a phishing attack, where the spammer is trying to collect as much information about you for their own criminal intentions. These criminals are looking for “Money mules” and for this they need as much personal information as they can collect from you. Be aware that if you respond to such an email then you can become part of some criminal activities and it will be hard to prove your innocence. And yes, these spammers might even actually pay you for your “services” but in the end, it will cost you a lot more than you’ll earn from this. Worse, if it can be proven that you’re willingly participated to this scheme, you could even end up doing time in jail in the Netherlands, although that would still be very unlikely. It’s more likely that you’ll end up with a huge debt which you’ll have to pay for a very long time.

One of the original spam messages looks like this, and I’ve removed my personal information from it. It’s in Dutch, though. It is targetting Dutch people, mostly.

Delivered-To: helpdesk@example.com
Received: by 10.50.42.196 with SMTP id q4csp8656igl;
        Mon, 27 Aug 2012 23:10:28 -0700 (PDT)
Received: by 10.14.223.9 with SMTP id u9mr5532200eep.10.1346134228048;
        Mon, 27 Aug 2012 23:10:28 -0700 (PDT)
Return-Path: <neuralgiag5@realliving.com>
Received: from [190.43.101.99] ([190.43.101.99])
        by mx.google.com with ESMTP id e9si13429791eep.46.2012.08.27.23.10.23;
        Mon, 27 Aug 2012 23:10:27 -0700 (PDT)
Received-SPF: pass (google.com: domain of neuralgiag5@realliving.com designates 190.43.101.99 as permitted sender) client-ip=190.43.101.99;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of neuralgiag5@realliving.com designates 190.43.101.99 as permitted sender) smtp.mail=neuralgiag5@realliving.com
Received: from apache by qbqgghfhehsvvbsvwi.deltamar.net with local (Exim 4.67)
	(envelope-from <<helpdesk@example.com>>)
	id OWG4MX-L13X05-EZ
	for <helpdesk@example.com>; Tue, 28 Aug 2012 01:10:24 -0500
To: <helpdesk@example.com>
Subject: We nodigen u uit in uw vrije tijd te verdienen
X-PHP-Script: qbqgghfhehsvvbsvwi.deltamar.net/sendmail.php for 190.43.101.99
From: <helpdesk@example.com>
X-Sender: <helpdesk@example.com>
X-Mailer: PHP
X-Priority: 1
Content-Type: text/plain; charset="Windows-1252"
Message-Id: <ANP530-V0ONDJ-VW@qbqgghfhehsvvbsvwi.realliving.com>
Date: Tue, 28 Aug 2012 01:10:24 -0500

Beste dames en heren,

We beiden goedbetaalde baan aan: de website LEZER.

Uw functie:
Bezoeken van de website van een Gezondheidskliniek en daarna eenvoudige vragen te beantwoorden.

Bijvoorbeeld: was het gemakkelijk om een aanvraag te doet, is er niet te veel van de rode kleur,
is de tekst duidelijk op de aanvraagpagina.

We vragen dat om te bepalen of de website gemakkelijk is voor onze klanten.
Dit is zeer belangrijk want een eenvoudige website kan wist ervan 3-5 keer vermeerderen.
U kan dit doen in uw vrije tijd, ongeveer  van 2 tot 12 uur per week.

De prijs is van 25 tot 67 euro per uur, de vaste prijs wordt bepaald naar het interview.
De tewerkstellingperiode is van 3 tot 6 maanden, tijdens de Nederlandstalige website portaal ontwikkeling van de kliniek.
Indien u het goed doet zullen we u uitnodigen voor de andere gelijkaardige projecten.

De betaling gebeurt dagelijks of maandelijks per overschrijving op uw bankrekening van onze vennootschapsrekening.
U kan in uw vrije tijd verdien van 1512 tot 3612 euro per maand.
Als u het verschil kan zien tussen eenvoudige en ingewikkelde website, dan gaat u erin slagen.

Voor de aanvraag, stuur de volgende gegevens op:
1. Uw naam
2. Telefoon nummer
3. Leeftijd
4. Verblijfsstad

Aandacht! De gegevens moeten verstuurd worden op de volgende email:  Jaime@careersholland.com.

Aanvragen die op het andere email worden verstuurd kunnen niet behandeld worden
Zodra ik uw gegevens heb ontvangen neem ik contact met u op.

Met vriendelijke groeten,
Afdeling Personeelsaangelegenheden van “Geincorporeerde Gezondheidsinstellingen”