Note right off that this virus/trojan email has a Subject line of:
You Received Online Greeting Card
not
You Received An Online Greeting Card
Right away you should be alerted that this is not likely a legitimate greeting. The image contained in the email appears to be one actually used by 123Greetings.com:
http://i.123g.us/c/efeb_cuddleday/card/104506.gif
Another day, another minor twist on the virus attachment emails. This week it’s back to the bogus “iTunes” certificate confirmations:
Subject: Thank you for buying iTunes Gift Certificate!
Emails come from spoofed sending addresses, such as From:
When in reality all of these (and many others, see the end of this post) come from already infected personal computers from across the globe.
The email message itself is pretty simple:
More and more spammers are tuning into the high unemployment rate with bogus emails that purport to be responding to online resumes.
The latest comes disguised a request for an updated resume, presumably as seen on CareerBuilder.com:
Subject: Re: Job Interview
From: <crist.and@novaaldeotahotel.com.br>
It’s back….. the email confirmation (really a Trojan/Virus) for the airline ticket you never purchased is again making the rounds.
The subject line is pretty straightforward:
Online order for airplane ticket N648365
Though the “order number” at the end is randomized in order to try and evade some of the simpler spam filtering systems.
Another online email marketing tool is now hosting images for email spammers. The current campaign being another stock fraud “pump and dump” for Bio-Solutions Corp. (BISU.OB).
Most all of the headers we’ve reviewed from this campaign so far come from hacked Hotmail accounts (Microsoft’s support and tolerance of spammers is simply endless), for example:
from snt0-omc1-s4.snt0.hotmail.com ([65.55.90.15]
But, while the zombified Hotmail accounts sent the solicitation, the actual image displayed is hosted by online services such as iConnect which claims on its site:
This weeks most popular virus campaign appears to be the Facebook Password Reset Confirmation emails.
These emails claim to come from a wide variety of Facebook email addresses, such as:
Well 2009 is history, we know, we can’t believe it’s almost March already either. While previous years have been marked by either large increases in spam traffic, or sometimes a decrease followed by an increase, 2009 was pretty bland.
After the jump we’ve got some graphs and commentary from 2009.
Anyone who has looked for an email anti-spam solution is probably familiar with spam capture rate statistics. You’ve no doubt seen claims such as “Blocks 99.9% of spam” but what the capture rate doesn’t tell you is going to prove even more important to your overall filtering satisfaction.
While some spam campaigns are innovative and can be difficult for various filtering systems to catch, stopping most spam email is not too difficult. The real challenge is NOT filtering the good mail that end users want to receive in the process.
A spam filter’s claimed capture rate means nothing if you do not know their false-positive rate. False positives are good emails caught by the filters and marked as spam. A great capture rate will not be acceptable to the end-user if it comes with a high false-positive rate. The cost of lost opportunities and delayed responses to legitimate mail will exceed the benefit provided by the blocking of spam.
A newer and very popular tactic with “Viagra and Cialis” spammers is to move part of their sales pitch out of the email “Subject” and into the “From” address instead.
This technique takes advantage of the fact that email standards allow for the
“From” address to include both an actual email address <user@domain.com> and also what’s commonly referred to as a “Pretty Address” where the sender can include any name or title they choose.
