21-05-2003 05:54									#1
	Them spammers is getting sneaky Tired of ads?

Just saved my mom from this one.

Subject: Regarding your AOL account information
From: CreditCardSecure@aol.com (more on the return path later in the post)

quote: Dear Aol member, We regret to inform you that there was a recent attack by a hacker on your billing or password information. We have made a contract with SYI - Secure Your Information to upgrade our account databases on to their web servers. Please Click Here (link) and fill out the information requested. Failure to do so could cause your AOL account to be suspended until further notice. If you comply to this email and upgrade your account information on this site, you will receive 100 hours of free AOL time. If this is a child or teenager reading this email please notify your parents or the account holder to update the account information. We are sorry for the inconvenience. If you have received this email before and have already submitted your information on our secure servers, you may have done so in error. Please re-submit your information so we can provide you with the best security the internet has to offer. Please do not reply back. Go directly to our site. Section Head 109 America Online Billing Department Main Office 7897 Hugher St. Dallas, Texas. 1-888-AOL-HELP

link was to http://www.aolsecurity10.com/
(don't worry, there's nothing PC threatening on the site, but then again I have popup blocking on.)


These are complicated details on the message in some sort of code. I don't know exactly what it all means, but I get the sense that they made the return path different from the actual address.

quote: Return-Path: Received: from rly-xj04.mx.aol.com (rly-xj04.mail.aol.com [172.20.116.41]) by air-xj01.mail.aol.com (v93.12) with ESMTP id MAILINXJ14-21a83ecaabd028a; Tue, 20 May 2003 18:27:28 -0400 Received: from mallard.mail.pas.earthlink.net (mallard.mail.pas.earthlink.net [207.217.120.48]) by rly-xj04.mx.aol.com (v93.12) with ESMTP id MAILRELAYINXJ42-5163ecaabb8268; Tue, 20 May 2003 18:27:04 -0400 Received: from ip6-114.vancbc01g01.dialup.ca.telus.com ([207.6.107.114] helo=t6885th7) by mallard.mail.pas.earthlink.net with smtp (Exim 3.33 #1) id 19IFS2-0001ZQ-00 for ac995@aol.com; Tue, 20 May 2003 15:19:19 -0700 To: From: CreditCardSecure@aol.com Subject: Regarding your AOL account information Date: Tue, 20 May 2003 15:18:53 -0800 Message-Id: <37761.638121921299900.2294@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit

It is pretty easy to identify as spam, but I actually was convinced enough to see where the hyperlink went (once I saw it went to a different site, I made up my mind that it was spam. I didn't actually visit the site, because there could be malignant junk.)

	21-05-2003 05:56									#2
	Support Apolyton buy from Amazon

You'd think they'd know enough to capitalize AOL.

The grammar is also poor.

And yeah, the headers tell you where it originated from.

	21-05-2003 06:01									#3
	Help yourself to an AD-FREE life

I'd report it to AOL pronto. Like NOW.

	21-05-2003 06:03									#4
	Support Apolyton, buy Alpha Centauri

And then get a new ISP.

	21-05-2003 06:12									#5
	Avatar Enlargement: We've got the solution

"Dear Aol member"

Says it all.

Don't worry about the end, just concentrate on the first few letters.

Perhaps one should rethink the thread title?

	21-05-2003 06:26									#6
	Lose 30 kilos (of popups)

I did my famous trick of contradicting myself again, and again nobody noticed. I do that in at least one thread a week, and nobody's noticed for the past 3 or 4. See if you can spot the contradiction in my first post.


Anyway, I know this isn't that sneaky, but for a spam message, this one is top notch.

	21-05-2003 07:25									#8
	Put an end to popups!

You mean you created a thread wholly open to spam-sharks ?

	21-05-2003 07:38									#9
	Inflate your Upload Space

"You didn't go to that particular site but at the same time you saw it went to a ..... different site??"


Does seem a bit odd to me

	21-05-2003 08:30									#10
	Re: Them spammers is getting sneaky Inflate your Upload Space

quote: Originally posted by Jaguar Warrior link was to http://www.aolsecurity10.com/ (don't worry, there's nothing PC threatening on the site, but then again I have popup blocking on.) ...I didn't actually visit the site, because there could be malignant junk.)

I always contradict myself in non-serious posts to see if anyone notices.

	21-05-2003 08:42									#11
	Support Apolyton

"We have made a contract with SYI - Secure Your Information to upgrade our account databases on to their web servers."

Yeah right.

	21-05-2003 08:47									#12
	Support Apolyton buy from Amazon

I like the part at the end where they basically admit that they don't know any information about you, despite working at AOL, and they don't know how many times they send it.