[FFML] Heads up on a new spam out there

[hmelton at ameriwave.net]

WARNING not 404! 

The 404 message depends on your email client and how it treats the spam message 
which contains both a text version and a HTML version.

My email client defaults to reading the text version and generates a URL that 
is 404 because it is pointing to a non-existant file on the server the spam 
text claims it is a message from.
 
However a Browser and most email programs go to the HTML version of the message 
and the HTML provides a link that claims to point to one site, but actually 
generates a VALID URL that is a LOOK A LIKE URL pointing to something 
!!!BAD!!!!! 

Most of the time the HTML generated LOOK A LIKE URL differs by 5 to 7 
characters from a the valid server's URL, but I've had a couple of spam 
messages that differed only in 2 characters from the correct server.

The spam messages appear to be cycling through a list and changes either with 
every spaming cycle or on a daily basis

Sorry for posting another non-fanfic message, but the Spam attack isn't 
generating 404 errors for most people and if they have followed the URL and 
executed the file they have a compromised computer looking to pass out private 
info like credit card and banking info.

howard melton

God Bless


On 15 Oct 2009 at 11:40, Dennis Carr wrote:

> Been seeing a lot of this - there is a new email that seems to be
> pointing recipients at a URL for new email settings, or a notificatoin
> that the settings have changed for the email.  The URL, from what I've
> seen on my end, points to a URL on the receiving email server, and
> seems to be an OWA (Outlook Web Access) URL - which is used for
> Microsoft Exchange.  
> 
> Here's a few pointers on dealing with this:
> 
> * Submit it to your spam folder.  If you have an account through
> something like Spamcop, report it and be done with it. Even better,
> report it to the postmaster, if you know what to look for in the
> headers.
> * The link is probably what I call "404 compliant" - that is, the URL
> does not exist.  At least, it is for me.  For some reason, the URL
> is formed to work with the recipient's email server - in my case,
> chez-vrolet.net.  Here, I don't use Exchange, so the link goes
> nowhere as explained. (Local users, take note: you'll see a
> similar URL.) Either way, I don't recommend using this URL, just for
> safety reasons. 
> * Don't worry - at this time, it's mostly harmless.
> 
> That said, I can't stress it enough - USE YOUR ANTIVIRUS SOFTWARE. If
> you don't have it, get it. 
> 
> This has been a public service message from your friendly neighborhood
> hostslave.
>