Author Topic: Today's SPAM  (Read 30238 times)

tiermat

  • According to Jane, I'm a Unisex SpaceAdmin
Today's SPAM
« on: May 20, 2015, 01:12:24 pm »
Today's is from Sage, the address is wrong, apart from the Newcastle Upon Tyne bit.

The lazy b****** haven't even added an attachment, just sent a link to a zip file!

It can be quite fun reading them, especially if your email doesn't do HTML (by choice)
I feel like Captain Kirk, on a brand new planet every day, a little like King Kong on top of the Empire State

Mr Larrington

  • A bit ov a lyv wyr by slof standirds
  • Custard Wallah
    • Mr Larrington's Automatic Diary
Re: Today's SPAM
« Reply #1 on: May 20, 2015, 02:48:38 pm »
Had a similar one purporting to come from sky.com.

Yeah, right.
External Transparent Wall Inspection Operative & Mayor of Mortagne-au-Perche
Satisfying the Bloodlust of the Masses in Peacetime

tiermat

  • According to Jane, I'm a Unisex SpaceAdmin
Re: Today's SPAM
« Reply #2 on: July 23, 2015, 08:29:45 am »
Over the last two days I have received a load from dart-charge (yeah right!) and, apparently, my domain has a Xerox MFU in Turkey!  I know this to be so as I am receiving documents scanned on it!!! :)
I feel like Captain Kirk, on a brand new planet every day, a little like King Kong on top of the Empire State

Pingu

  • Put away those fiery biscuits!
  • Mrs Pingu's domestique
    • the Igloo
Re: Today's SPAM
« Reply #3 on: July 23, 2015, 09:33:53 am »
I've received a few of them at work. Ignored, of course.

Re: Today's SPAM
« Reply #4 on: July 26, 2015, 01:11:35 pm »
Got a different one the other day...

Quote
Hello,

I am Samuel Williams. I want to seek for admission in your hospital for my pregnant wife. She is 20 weeks pregnant now and will be due to deliver on November 2015. This is her second issue as she had already had one child through normal delivery. She is 26 years old. I hope that your hospital will accept her for child delivery. What is the requirement for admission for child delivery in your establishment. Give me the grand total cost of delivery (Normal/surgery) in your hospital.  Admission date will probably be on the 11th November,2015. Your positive response will be appreciated.


Regards,
Samuel Williams.

Any ideas? It went to the very old account I used to use for one of the morris teams I used to be in.
"No matter how slow you go, you're still lapping everybody on the couch."

Re: Today's SPAM
« Reply #5 on: July 28, 2015, 04:48:34 pm »
Scam email - not dissimilar to one someone received asking for cost of staying in their B&B.
<i>Marmite slave</i>

hellymedic

  • Just do it!
Re: Today's SPAM
« Reply #6 on: July 31, 2015, 11:33:37 am »
I sorted some of Aged Father's emails a couple of weeks ago.
I was amazed by the number of penis enlargements he was offered.
Neither I nor Male Partner have received these for AGES!

tiermat

  • According to Jane, I'm a Unisex SpaceAdmin
Re: Today's SPAM
« Reply #7 on: January 12, 2016, 02:18:40 pm »
An amusing 419, due to the cause of death....

Greetings:

HAPPY CHRISTMAS & PROSPEROUS NEW YEAR!

My name is Mr. Rufus Raymond, a Registered Broker of Cooper Sec (Pty) Limited. One
of my clients bearing the same name as yours died after a brief illness, in
Manchester United Kingdom in March 2008 leaving US$8,360 000.00 under my care as the
personal broker. I did managed to reached the wife telephonically only to find out
of her death in 2012 with the only daughter; both killed by arm rubbers in their new
home in Madrid - Spain.

Recently, Government is threatening to confiscate the funds if fails to provide the
next of kin in 30 days. I cannot watch the Government confiscates the money so I
decide to seek for someone sharing the same name/surname to claim the funds as the
relative. That is why I contact you; I will share it with you in 50/50 ratio. Kindly
respond with your full address and cell phone number for professional
dialog/commencement. I have the power to present to the corresponding bank for
immediate release of the funds to your care. Note our transfer processes are legal
and must be done through online bank transfer method. Looking forward to hearing
from you as soon as possible.

Until then have a great day!
Best Regards

Mr. Rufus Raymond
(The Chief Broker)
Importantly: If you are not interested, please ignore the message
I feel like Captain Kirk, on a brand new planet every day, a little like King Kong on top of the Empire State

Re: Today's SPAM
« Reply #8 on: January 12, 2016, 02:53:49 pm »
Blimey.  Death by arm rubbing!!!    :o

Re: Today's SPAM
« Reply #9 on: January 12, 2016, 09:18:15 pm »
It can be quite fun reading them, especially if your email doesn't do HTML (by choice)

Just got one from PayPal. This one was quite convincing but, as above, I like a plain-text client because I can just read through and check whether it's fake.

Re: Today's SPAM
« Reply #10 on: January 13, 2016, 06:39:00 am »
Asking the idiot's question, what can you see in plain text that gets hidden in HTML?   

Re: Today's SPAM
« Reply #11 on: January 13, 2016, 07:55:37 am »
Where the hyperlink really points to.

In HTML, obviously, a link has two components. For example, YACF forum has the text "YACF forum", and the link "http://yacf.co.uk". So, if you replace the text with a link, there are still two parts, but they are the same, for example: http://yacf.co.uk/

Now leave the text part as the YACF URL, but change the actual link part to a dodgey site (for this demonstration, an unimpeccably safe site where some of us spend time, but not in fact the one where the link appears to go): http://yacf.co.uk/

So, in HTML, although some Internet security software puts checks in (and some of you may even get alerts on that last link), it's easy to have a link that seems to go to the real bank site, but actually goes to something that the spammers built to look real, but to defraud you.

Plain text is plain text in the sense that SMS is plain text. You can't have a two-part link. You can type http://yacf.co.uk/ but you can't hide it behind text of any kind. So we can always see, very easily, where the link really goes, and check whether it matches the bank's actual URL. (Note - some email software spots links in plain text and makes them clickable for convenience, but there's still only one part, so you're still seeing the real thing. In fact, as I review this message, my browser is making that last link clickable, even though I didn't use the limited HTML in the forum message editor to make it into a link.)

You still need to check, of course, that the link really is going to what you know to be the bank's URL.

It's really important though to understand that plain text does not mean "text without any italics and font changes". It means, like SMS, text written in a system that simply does not allow the transmission of formatting. It's not just that I am sending a text message without italics or fonts; it's that I couldn't, even if I wanted to, because SMS doesn't understand such things.

Re: Today's SPAM
« Reply #12 on: January 13, 2016, 07:56:31 am »
For example, you can see what a link is actually pointing to. In HTML it might say "click here: www.paypal.com" but actually clicking on the link takes you to somebody's hacked server or PC with a completely different domain.

That's not fail-safe though: there were some clever spams over Christmas where the spammers had bought domains like sainsbury-customer.com and had very legit looking offers. Only by a whois search could you see the the domain was registered the day before in Panama or some such.

EDIT: x-post with drossall
Quote from: tiermat
that's not science, it's semantics.

Re: Today's SPAM
« Reply #13 on: January 13, 2016, 08:02:31 am »
Hence my comment that you still need to check URLs. I believe my PayPal one used paypal-customer

It helps to know that domains work backwards. uk is under the control of one authority. co.uk is similarly controlled by one authority. yacf.co.uk is similarly controlled by one authority (our benevolent forum team). So newsite.yacf.co.uk would be a safe site because we trust yacf.co.uk. yacf-new.co.uk would not be, because yacf-new isn't part of yacf, it's a separate part of .co.uk

Hope this makes sense.

T42

  • Gaulois réfractaire
Re: Today's SPAM
« Reply #14 on: January 13, 2016, 08:42:50 am »
I'm still using the 2007 version of Eudora. "View message source" reveals all.
Tout à gauche sur le plat

Re: Today's SPAM
« Reply #15 on: January 13, 2016, 08:47:20 am »
I use Thunderbird as my email client. If you hover over a link it displays the target URL in the bottom/left of the window. Most other clients (AFAIK) do the same.

If I'm in doubt it's easy enough to click View\Message Body As\Plain Text or view the message source.
My default mode is DISTRUST so, in general I don't click links in emails. I go to the site in a browser window and navigate from there. I think the only links in emails I do click are YACF and other fora, some news feeds, and in emails from people I know and which I know will not lead to anything damaging.

I view most, if not all, email in HTML. I don't, however, display remote content (e.g. images) by default. It's common practice (or was) for scammers to reference a small image (often just a single pixel) with a name unique to your email. This allowed them to check if the email had been read thus proving the email address was live. Your email address then had added value and would become more targetted by spammers, phishers etc.   

I also use Vfemail as an email provider. They do a lot of filtering of emails passing through their servers, including viruses and known scammers. Vfemail = Virus Free Email. Their spam filters aren't perfect (it's a moving target) but I rarely receive spam and equally rarely lose 'good' messages into the spam folder (accessible via their web interface). Other similar email providers are available.

The biggest problem I've had in the last few months has been about my iCloud/iTunes accounts being frozen because I haven't entered my details and, therefore, fall foul of some new US security legislation or other. The iTunes account has been frozen since September, apparently, but still works perfectly. I have never had an iCloud account.
We have two ears and one mouth for a reason. We should do twice as much listening as talking.

Feanor

  • It's mostly downhill from here.
Re: Today's SPAM
« Reply #16 on: January 13, 2016, 09:18:08 am »
I use Thunderbird as my email client. If you hover over a link it displays the target URL in the bottom/left of the window. Most other clients (AFAIK) do the same.

I use-hover-over all the time to check where urls point, and it's a great irritation to me that you can't easily do this on mobile devices.

T42

  • Gaulois réfractaire
Re: Today's SPAM
« Reply #17 on: January 13, 2016, 09:28:24 am »
On the phone just now, a recorded message saying "Your new SIM card is ready. Please call 0899..... to confirm your address and the times during which it can be delivered".

Pull the other one, duckie. 0899 numbers are usually high-tariff phoneys.
Tout à gauche sur le plat

Woofage

  • Ain't no hooves on my bike.
Re: Today's SPAM
« Reply #18 on: January 13, 2016, 10:18:15 am »
I had one of those "help I'm stranded abroad with no money" e-mails recently. Since this was (allegedly) from someone I actually knew I bothered to read it. I noticed that the reply-to address is ever-so-slightly different to the person's actual e-mail address. A sneaky way of getting the gullible to communicate with the scammer.
Pen Pusher

Re: Today's SPAM
« Reply #19 on: January 13, 2016, 10:38:04 am »
MrsC had a Facebook message conversation with someone who'd hacked into a friend's account trying to pull that scam. She was convinced for quite a long time. The biggest clue that it was a fake was the likelihood of a single mother working in a call centre being able to take the whole family to Thailand for a holiday in the first place.
"No matter how slow you go, you're still lapping everybody on the couch."

Re: Today's SPAM
« Reply #20 on: January 13, 2016, 10:41:23 am »
Hello,

  I am Captain. Kevin James commanding 3rd Battalion army with the United States and Britain Coalition Force in Afghanistan. Due the decision by our Government to withdraw our troops from Afghanistan. I have decided to quit the army.

    I am considering a possibility of doing business with you, which is why I'm reaching out to you. On the other hand I want to inform you that I have in my possession the sum of 7.2million Euros (Seven million two hundred thousand Euros) which I recovered during one of our raids on terrorists here in Afghanistan, possibly funds left by the terrorists group. I do not intend handing this money over to the Government, and i have been able to move the money out of war zone with the help of Red Cross organization to a security company somewhere safe and secured.

  Please if you are interested in this transaction I will give to you the complete details you need for us to carry out this transaction successfully. I decided to find someone that is real and not imaginary. I believe I can trust you. Where we are now we can only communicate through our military communication facilities which are secured so nobody can monitor our discussions, then I can explain in details to you. I will only reach you through emails, because our calls might be monitored, I just have to be sure whom I am dealing with.

  Also I want you to know that am revealing this deal to you with belief that you will never let me down in this business, you are the first and the only person that I am contacting for this deal, so please reply urgently so that I will inform you on the next step to take.

If you are interested please reply me immediately so I can contact you for further details. I am doing this on trust, you should understand and you should know that as a trained military expert I will always play safe in case you are the bad type, but I pray you are not. 7.2 million Euros, is a lot of money, i couldn't hesitate but reveal to you the details due to the limited time frame.

   I'm patiently waiting for your contact details so we would proceed as soon as possible. In less than 7 days the money should have been noted on your care. You will be rewarded with 40% of the total sum and 60% would be mine. I hope I am being fair on this deal?

I wish you all the best of luck. waiting to hear from you urgently.

Thank You.
Captain Kevin James.
captainjames number gmail

(Sent from a completely different Mexican address, with a reply-to address of captainjames different number gmail. Even if it wasn't obviously fraudulent from the contents that should set every alarm in the street ringing)
"A woman on a bicycle has all the world before her where to choose; she can go where she will, no man hindering." The Type-Writer Girl, 1897

Re: Today's SPAM
« Reply #21 on: January 13, 2016, 01:33:14 pm »
Thanks very much for the detailed explanations. I was aware never to click on any of these link but it is good to understand the science behind it....

Re: Today's SPAM
« Reply #22 on: January 13, 2016, 02:17:23 pm »
Quote
Hi Friend,
Paris from Yongkang Simple Outdoor Products Co.,Ltd.
Glad to know that you are in the outdoor heating and barbecue products.
We specialized in providing Patio Heater, BBQ and Fire Pit for several years.
We have developed 10types of 2015 NEW MODEL for your refference.
All products approve the ISO/CE/ETL certificates etc.
Please contact me for any enquiries and questions.
Thanks and have a pleasant day!
Best Regards!
Paris Shentu
To my @audax.uk functional address
I can usually smell these a mile away - and only opened this because of the word Paris in the header.
Doh!

Steph

  • Fast. Fast and bulbous. But fluffy.
Re: Today's SPAM
« Reply #23 on: January 13, 2016, 03:02:28 pm »
I am at present receiving a number of Skype and Whatsapp messages, purporting to inform me that I have new voice messages, etc, etc, as well as one telling me I won't be able to send messages because I have exceeded my storage limit.

Bollocks to the latter, and I have never used either What'sapp or Skype.
Mae angen arnaf i byw, a fe fydda'i

Steph

  • Fast. Fast and bulbous. But fluffy.
Re: Today's SPAM
« Reply #24 on: January 14, 2016, 07:46:00 pm »
Attention Beneficiary:

This is to officially informed you that we have concluded arrangements to effect your payment of $850,000 USD through MONEY GRAME Swift Money transfer services today, but the maximum amount you will be receiving every day starting from tomorrow is $2,000.00 as reflected in our transfer system daily until the funds is completely transferred.

This special arrangement is being used to avoid all scrupulous demands by both the states and federal authorities that have previously delayed your payment till date; we shall need your maximum co-operation to ensure that strictness and confidence is maintained to avoid any further delays.

The above arrangement has been signed and endorsed by UNITED NATION (UN),INTERNATIONAL MONETARY FUND (IMF) given credence that this transaction is devoid of any form of illegality.

Please contact the Accredited MONEY GRAME Agent for the details of your first payment of $2,000 USD and reconfirm your correct details that you will like the first transfer to be program with such as Receivers Name, destination where you will like the transfer to be send to and your cell phone number for urgent communication if the need arise.

Fill your details below for reference purposes:

Your Full Name
Country
Address
City
Age
Sex
Phone Number

Upon your acceptance we will give you the contact information of Mr Samuel Tata the Electronic Transfer officer of MONEY GRAME MONEY TRANSFER for immediate programming of your first transfer:

Name: Mr Samuel Tata.
Mobile:+29962536386

Thanks and God Bless
Mr FRANK SMITH
Mae angen arnaf i byw, a fe fydda'i