[Dshield] AMAZON.COM spoof

Robert Dodd bobdodd at sheperd.com
Fri Jan 23 14:16:02 GMT 2004


I just received what I think is another HTML exploit purporting to be from
amazon.com. The subject line contains a bogus order number. I don't find an
abuse email address on the amazon site, so sent this to "Comments" using
their online form.

Subject: Your amazon.com order #935-448-9241 has shipped

Header:
Received: from 80.179.156.174.forward.012.net.il [80.179.156.174] by
<MY_SERVER>
  (SMTPD32-6.06) id ACC711400EA; Thu, 22 Jan 2004 22:18:47 -0800
Received: from [162.150.9.7] by 80.179.156.174.forward.012.net.il id
<0055653-85577>; Fri, 23 Jan 2004 17:23:49 -0300
Message-ID: <6-2s$416571jgg77$5x$m3tn-$58 at 6sq34v.jvm9828>
From: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
Reply-To: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
To: <MY_ADDRESS>
Subject: Your amazon.com order #935-448-9241 has shipped
Date: Fri, 23 Jan 04 17:23:49 GMT
X-Mailer: drochkamail 2.3
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="1..CBBA6_F0"
X-Priority: 3
X-MSMail-Priority: Normal
X-RCPT-TO: < <MY_ADDRESS> >
X-UIDL: 369387179
Status: U




Body:

<html><head><title>lorraine mien lability</title></head><body
bgcolor=#FFFFFF text=#000000><table border=0 cellspacing=4
cellpadding=10><tr><td width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/reciprocal/*http://www.oem-expert.biz/?id=substanti
ve&at=astigmatic&href=http://www.monitory.com><img
src=http://www.oem-expert.biz/files/01.jpg align=left hspace=0 vspace=0
border=0 width=100 height=140></a><p><font size=2 color=gray><b><font
face="Verdana, Arial, Helvetica, sans-serif">Micr<ceylon>osoft
Win<parolee>dows XP Profes<bathe>sional 2002</font></b></font><div
align=right><p><font color=red size=5 face="Verdana, Arial, Helvetica,
sans-serif"><b>$39.95</b></font><br> <font face="Verdana, Arial, Helvetica,
sans-serif" size=1>Re<poisson>tail pr<pacify>ice: <font
color=#0080C0><b><s>$270.95</s></b></font><br> Our Pr<pharmacist>ice: <font
color=red><b>$39.95</b></font><br> You Sa<cahill>ve: <font
color=#0080C0><b>$236</b></font></font><a
href=http://rd.yahoo.com/chambers/*http://www.oem-expert.biz/?id=buddy&at=be
dbug&href=http://www.immaterial.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td><td width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/biddable/*http://www.oem-expert.biz/?id=negroes&at=
bingham&href=http://www.deviant.com><img
src=http://www.oem-expert.biz/files/02.jpg align=left hspace=0 vspace=0
border=0 width=100 height=140></a><p><font size=2 color=gray><b><font
face="Verdana, Arial, Helvetica, sans-serif">Ad<indolent>obe
Pho<seethe>tos<mathews>hop 7.0</font></b></font><div align=right><p><font
color=red size=5 face="Verdana, Arial, Helvetica,
sans-serif"><b>$59.95</b></font><br> <font face="Verdana, Arial, Helvetica,
sans-serif" size=1>Re<inescapable>tail pri<nestle>ce: <font
color=#0080C0><b><s>$609.95</s></b></font><br> Our Pri<briny>ce: <font
color=red><b>$59.95</b></font><br> You Sav<cupric>e: <font
color=#0080C0><b>$550</b></font></font><a
href=http://rd.yahoo.com/drain/*http://www.oem-expert.biz/?id=diction&at=cal
cify&href=http://www.basalt.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td></tr><tr><td
width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/convalescent/*http://www.oem-expert.biz/?id=convers
e&at=car&href=http://www.pull.com><img
src=http://www.oem-expert.biz/files/03.jpg
align=left hspace=0 vspace=0 border=0 width=100 height=140></a><p><font
size=2 color=gray><b><font face="Verdana, Arial, Helvetica,
sans-serif">Mic<squatting>rosoft Of<coffey>fice XP Profess<donnelly>ional
2002</font></b></font><div align=right><p><font color=red size=5
face="Verdana, Arial, Helvetica, sans-serif"><b>$59.95</b></font><br> <font
face="Verdana, Arial, Helvetica, sans-serif" size=1>Ret<northrop>ail
pri<stow>ce: <font color=#0080C0><b><s>$579.95</s></b></font><br> Our
Pri<donate>ce: <font color=red><b>$5995</b></font><br> You S<media>ave:
<font color=#0080C0><b>$520</b></font></font><a
href=http://rd.yahoo.com/devon/*http://www.oem-expert.biz/?id=diocese&at=cos
sack&href=http://www.fortin.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td><td width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/blomquist/*http://www.oem-expert.biz/?id=delegate&a
t=eidetic&href=http://www.fan.com><img
src=http://www.oem-expert.biz/files/04.jpg align=left hspace=0 vspace=0
border=0 width=100 height=140></a><p><font size=2 color=gray><b><font
face="Verdana, Arial, Helvetica, sans-serif">Micr<hosiery>osoft
Wind<lunacy>ows 2000 Profe<cringe>ssional</font></b></font><div
align=right><p><font color=red size=5 face="Verdana, Arial, Helvetica,
sans-serif"><b>$34.95</b></font><br> <font
face="Verdana, Arial, Helvetica, sans-serif" size=1>Ret<warrant>ail
pr<diagrammatic>ice: <font color=#0080C0><b><s>$266.95</s></b></font><br>
Our Pr<clink>ice: <font color=red><b>$34.95</b></font><br> You
Sa<campfire>ve: <font color=#0080C0><b>$232</b></font></font><a
href=http://rd.yahoo.com/logo/*http://www.oem-expert.biz/?id=belgrade&at=roc
kwell&href=http://www.brownish.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td></tr><tr><td width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/fauna/*http://www.oem-expert.biz/?id=mildew&at=brow
se&href=http://www.herewith.com><img
src=http://www.oem-expert.biz/files/05.jpg align=left hspace=0
vspace=0 border=0 width=100 height=140></a><p><font size=2
color=gray><b><font face="Verdana, Arial, Helvetica,
sans-serif">Ad<chuckle>obe Page<godfather>maker 7.0</font></b></font><div
align=right><p><font color=red size=5 face="Verdana, Arial, Helvetica,
sans-serif"><b>$5995</b></font><br> <font face="Verdana, Arial, Helvetica,
sans-serif" size=1>Ret<citrus>ail pri<instinctual>ce: <font
color=#0080C0><b><s>$404.95</s></b></font><br> Our Price: <font
color=red><b>$59.95</b></font><br> You Sa<decolletage>ve: <font
color=#0080C0><b>$345</b></font></font><a
href=http://rd.yahoo.com/borneo/*http://www.oem-expert.biz/?id=son&at=cascad
e&href=http://www.barnett.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td><td width=255 bgcolor=#E7F0F9><a
href=http://rd.yahoo.com/protract/*http://www.oem-expert.biz/?id=aspheric&at
=denominate&href=http://www.creekside.com><img
src=http://www.oem-expert.biz/files/06.jpg align=left hspace=0
vspace=0 border=0 width=100 height=140></a><p><font size=2
color=gray><b><font face="Verdana, Arial, Helvetica,
sans-serif">Ado<dwell>be Illus<crestfallen>trator 10</font></b></font><div
align=right><p><font color=red size=5 face="Verdana, Arial, Helvetica,
sans-serif"><b>$59.95</b></font><br> <font face="Verdana, Arial, Helvetica,
sans-serif" size=1>Re<assemblage>tail pric<continuo>e: <font
color=#0080C0><b><s>$270.95</s></b></font><br> Our Pri<combinate>ce: <font
color=red><b>$59.95</b></font><br> You Sa<burg>ve: <font
color=#0080C0><b>$211</b></font></font><a
href=http://rd.yahoo.com/tipple/*http://www.oem-expert.biz/?id=walpole&at=do
ckside&href=http://www.carnation.com><img
src=http://www.oem-expert.biz/files/buy.gif border=0 width=102
height=27></a></p></div></td></tr></table></body></html>




More information about the list mailing list