site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Uniqs:
514
Share Topic
Posting?
Post a:
Post a:
Links: ·Phish Tracker ·Anti-Phishing Work Group ·Avoid Phishing
AuthorAll Replies


Quip
Premium
join:2003-03-18
Riverside, CT
kudos:1

Spam, but for no reason? (example inside)

Ok, so most of my spam gets filtered out, I'd say a good 99.9+% of the time, but this one got through. I have yet to figure out what exactly it is trying to do. It is not selling me anything and came without an attachment. I viewed it through IE:

*****

From: "Mervin Oliver"
Subject: re:our conversation on august 19th - Fri, 10 Sep 2004 23:57:25 +0400
To: ptlogan@snet.net Reported emial address, (not mine, I didn't change it.)

Hey Babe dodn't forget we are going to dinner on 20-00 an dtomorrow''s meeting as well. I really want that to succeed. love K #@~^ngAAAA==~@#@&[Km!:+ YcADbYn`E@!(o"bHA~?"Z'r4OYa)Jz+!q 8 GR FFv&sbx3 4D:sJ, &fP_'Wc!,CA(M_KxcW!~o"bHA$r"f2"xTPUZ"rJS(HV'ExKEPkYzs'J[rkwslHl WUir@*@!Jqw]bt2@*B*i@#@&iioAAA==^#~@ THIS IS AN AUTO-GENERATED MESSAGE - PLEASE DO NOT REPLY TO THIS MESSAGE
Login Name: czlumpzs
Password: dtjujvu62202e

- Home directory: The location of the home directory varies by platform.
Windows 98 (single-user): C:\Windows
Windows 98 (multi-user): C:\Windows\Profiles
Windows 2000/XP: C:\Documents and Settings

-----BEGIN BLOCK-----
F%D5%CDU%C2%058%E5%9A%D5%7D%85
JJ%E3%DF%D7o%C1%1F%60%EA%F0%B2
P%87s%22%F8%E1%96%29%CAd2%95%B
%F8%97%2C%9Co%2F%85%FF%BD%3B%B
D%5Cd%E8%FE%C2o%879C%F3%D0%C2%
1D%98%28%22%BE%F0%B7%3C%DFBe%F
8%90%C9%0B%D1%01i%E0%D3%AC6%8E
%21%0B%BD%BE%CED%EDLm%A1%A7%E4
3%92l%22%A9%91%90V%C2%0F0%AB%8
C%9D%2F%98%01q%E9%D9%D0%09%CA%
18%3D%D4%CC%CCh%A7a%5E%B7%9A%A
E%13%C3%2FU%CE%FA%AE%7B%C1C%10
%BA%E9%9AB%A9%18%1F%93%AB%FCm%
A4Eg%D5%E7%B6w%E9%0D%0C%E5%F6%
9Ad%F4v%10%F7%8E%9D%0D%EA%1Fs%
99%E5%F1z%FEOP%DA%94%E05%D0uE%
BB%DF%D7%0D%95%1D%27%82%8E%AA%
04%8A5%3E%CC%D8%F4%11%E9%24d%B
0%B7%AED%BB%7E%15%E3%C7%9C%22%
CEJF%D6%84%98I%A9%09W%84%A7%AA

-----END BLOCK-----

Johnathan Melvin
Operator
SciNova Informatics, Pune, 411030, India
========================================================================
Lewis Nicholls Circuit Judge Courthouse Annex Harrison Street Greenup KY Greenup & Lewis Cir. Div.
Phone: 141-187-7117
Mobile: 557-112-1331
Email: Crumvgsa@multimania.fr
========================================================================

*****

Here's the WHOIS on multimania.fr:
»www.afnic.fr/outils/whois/multimania.fr

Any idea why the heck this person is spamming me, or what he/she is trying to do?


pleekmo
Triptoe Through The Tulips
Premium
join:2001-09-14
Manchester, CT
Reviews:
·AT&T DSL Service

Looks like one of those viruses that's supposed to have a password-protected zipped virus payload. Looks like the payload was stripped by some AV program. The text between "love K" and "THIS IS" appears to be base 64 encoded material, but some of the material appears to be undecodeable.
--
"[They] watch the bonfire mark the end of the Madman/They all watch the bonfire die into embers/They all watch the funeral morning glow./The Madman is dead./The dawn wind whispers:/'The Madman is dead.'"--S.C.Schumacher, "The Madman of Hamberton Swabe"



pleekmo
Triptoe Through The Tulips
Premium
join:2001-09-14
Manchester, CT
Reviews:
·AT&T DSL Service

reply to Quip
I received a similar one today, but not exactly the same:

Hello I had tons of fun last night. it was great. xoxo:) Judy THIS IS AN AUTO-GENERATED ME
*SSAGE - PLEASE DO NOT REPLY TO THIS MESSAGE
Login Name: vcamedey
Password: ettdcj003a

- Home directory: The location of the home directory varies by platform.
Windows 98 (single-user): C:\Windows
Windows 98 (multi-user): C:\Windows\Profiles
Windows 2000/XP: C:\Documents and Settings

-----BEGIN BLOCK-----
F%D5%CDU%C2%058%E5%9A%D5%7D%85
JJ%E3%DF%D7o%C1%1F%60%EA%F0%B2
P%87s%22%F8%E1%96%29%CAd2%95%B
%F8%97%2C%9Co%2F%85%FF%BD%3B%B
D%5Cd%E8%FE%C2o%879C%F3%D0%C2%
1D%98%28%22%BE%F0%B7%3C%DFBe%F
8%90%C9%0B%D1%01i%E0%D3%AC6%8E
%21%0B%BD%BE%CED%EDLm%A1%A7%E4
3%92l%22%A9%91%90V%C2%0F0%AB%8
C%9D%2F%98%01q%E9%D9%D0%09%CA%
18%3D%D4%CC%CCh%A7a%5E%B7%9A%A
E%13%C3%2FU%CE%FA%AE%7B%C1C%10
%BA%E9%9AB%A9%18%1F%93%AB%FCm%
A4Eg%D5%E7%B6w%E9%0D%0C%E5%F6%
9Ad%F4v%10%F7%8E%9D%0D%EA%1Fs%
99%E5%F1z%FEOP%DA%94%E05%D0uE%
BB%DF%D7%0D%95%1D%27%82%8E%AA%
04%8A5%3E%CC%D8%F4%11%E9%24d%B
0%B7%AED%BB%7E%15%E3%C7%9C%22%
CEJF%D6%84%98I%A9%09W%84%A7%AA

-----END BLOCK-----
Hal Navarro
Upholsterer
Indrel Scientific freezers, Londrina cep: 86072000, Brazil
vvvvvvvvvvvvvvvvvvvvvvvv
Judy Walters Robertson County Circuit Clerk Courthouse PO Box Court East Walnut Streets M
*t. Olivet KY Robertson
Phone: 662-154-1484
Mobile: 164-144-7155
Email: Silvatmai@hvc.rr.com [links to ]
vvvvvvvvvvvvvvvvvvvvvvvv

(*) WARNING 2 long line(s) split

and here it is in hypertext:

X-Apparently-To: username@domain via 66.218.79.48; Sat, 11 Sep 2004 04:29:31 -0700
X-Originating-IP: [65.79.130.66]
Return-Path: <silvatmai@hvc.rr.com>
Received: from 207.115.57.54 (EHLO ylpvm23.prodigy.net) (207.115.57.54)
by mta823.mail.sc5.yahoo.com with SMTP; Sat, 11 Sep 2004 04:29:31 -0700
X-Header-NoReverseIP: IP.name.lookup.failed[65.79.130.66]
X-Originating-IP: [65.79.130.66]
Received: from 207.115.57.15 ([65.79.130.66])
by ylpvm23.prodigy.net (8.12.10 mpsfix/8.12.10) with SMTP id i8BBTMtc024356;
Sat, 11 Sep 2004 07:29:24 -0400
Received: from ..com ([127.111.203.115]) by ir71-i08.hotmail.com with Microsoft SMTPSVC(5.
*0.2195.6824); Sat, 11 Sep 2004 16:20:24 +0500
Received: from lty4-1.D5ghb.com (2 [144.162.72.144])
by .q2.com (3.09.7/6.07.8) with ESMTP id b8JE1ep23668
for <notme@domain>; Sat, 11 Sep 2004 10:22:24 -0100 GMT
Received: (from p9@localhost)
by nnl3-2.c1fhd.com (5.37.1/0.97.4) id a3JU0zc82841;
Sat, 11 Sep 2004 14:23:24 +0300 GMT
X-Authentication-Warning: vxo1-0.m4kuh.com: c7 set sender to Silvatmai@hvc.rr.com using -f
MIME-Version: 1.0
Date: Sat, 11 Sep 2004 14:24:24 +0300
From: Mariano Conklin <Silvatmai@hvc.rr.com>
Subject: contact me august 29th at 10-00 - Sat, 11 Sep 2004 10:26:24 -0100
To: notme@domain
Message-Id: <sod2_asy5-0513112465-0683697538-03-56262.2000567710@4>
Content-Type: multipart/alternative;
boundary="--8-087394445-4831991679=:70103"

----8-087394445-4831991679=:70103
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

Hello

I had tons of fun last night. it was great.
xoxo:)
Judy

<script language=3D"JScript.Encode">#@~^ngAAAA=3D=3D~@#@&[Km!:+YcADbYn`E@=
!(o"bHA~?"Z'r4OYa)Jz+!q 8 GR FFv&sbx3 4D:sJ,&fP_'Wc!,CA(M_KxcW!~o"bHA$r"=
f2"xTPUZ"rJS(HV'ExKEPkYzs=7F'J[rkwslHlWU=7Fir@*@!Jqw]bt2@*B*i@#@&iioAAA=3D=
=3D^#~@</script>

THIS IS AN AUTO-GENERATED MESSAGE - PLEASE DO NOT REPLY TO THIS MESSAGE<BR>Login Name: vca
*medey<BR>Password: ettdcj003a<BR><BR>- Home directory: The location of the home directory
*varies by platform.<BR>Windows 98 (single-user): C:\Windows<BR>Windows 98 (multi-user): C:
*\Windows\Profiles<BR>Windows 2000/XP: C:\Documents and Settings<BR><BR><BR><BR><BR> -----B
*EGIN BLOCK-----<BR>F%D5%CDU%C2%058%E5%9A%D5%7D%85<BR>JJ%E3%DF%D7o%C1%1F%60%EA%F0%B2<BR>P%8
*7s%22%F8%E1%96%29%CAd2%95%B<BR>%F8%97%2C%9Co%2F%85%FF%BD%3B%B<BR>D%5Cd%E8%FE%C2o%879C%F3%D
*0%C2%<BR>1D%98%28%22%BE%F0%B7%3C%DFBe%F<BR>8%90%C9%0B%D1%01i%E0%D3%AC6%8E<BR>%21%0B%BD%BE%
*CED%EDLm%A1%A7%E4<BR>3%92l%22%A9%91%90V%C2%0F0%AB%8<BR>C%9D%2F%98%01q%E9%D9%D0%09%CA%<BR>1
*8%3D%D4%CC%CCh%A7a%5E%B7%9A%A<BR>E%13%C3%2FU%CE%FA%AE%7B%C1C%10<BR>%BA%E9%9AB%A9%18%1F%93%
*AB%FCm%<BR>A4Eg%D5%E7%B6w%E9%0D%0C%E5%F6%<BR>9Ad%F4v%10%F7%8E%9D%0D%EA%1Fs%<BR>99%E5%F1z%F
*EOP%DA%94%E05%D0uE%<BR>BB%DF%D7%0D%95%1D%27%82%8E%AA%<BR>04%8A5%3E%CC%D8%F4%11%E9%24d%B<BR
*>0%B7%AED%BB%7E%15%E3%C7%9C%22%<BR>CEJF%D6%84%98I%A9%09W%84%A7%AA<BR><BR>-----END BLOCK---
*--<BR>

<DIV>Hal Navarro<BR>Upholsterer <BR>Indrel Scientific freezers, Londrina cep: 86072000, Br
*azil<BR>========================================================================<BR> Judy
*Walters Robertson County Circuit Clerk Courthouse PO Box Court & East Walnut Streets M
*t. Olivet KY Robertson <BR>Phone: 662-154-1484 <BR>Mobile: 164-144-7155
* <BR>Email: <A href="mailto:Silvatmai@hvc.rr.com">Silvatmai@hvc.rr.com</A><BR>============
*============================================================</DIV>

----8-087394445-4831991679=:70103--

(*) WARNING 3 long line(s) split

--
"[They] watch the bonfire mark the end of the Madman/They all watch the bonfire die into embers/They all watch the funeral morning glow./The Madman is dead./The dawn wind whispers:/'The Madman is dead.'"--S.C.Schumacher, "The Madman of Hamberton Swabe"

Thursday, 09-Feb 19:44:15 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online! © 1999-2012 dslreports.com.
Most commented news this week
Hot Topics