[Dshield] AMAZON.COM spoof

BarkerJr barkerjr at barkerjr.net
Fri Jan 23 17:50:23 GMT 2004


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

True, the subject line says amazon.com, but the content and the pages
linked
to look nothing like amazon.  I wouldn't call it a spoof... more of a
vain
attempt to get through spam filters.

I've recieved two of these spams over the past three days, also.

- ----- Original Message -----
From: "Robert Dodd" <bobdodd at sheperd.com>
To: "'General DShield Discussion List'" <list at dshield.org>
Sent: Friday, January 23, 2004 9:16 AM
Subject: [Dshield] AMAZON.COM spoof


> I just received what I think is another HTML exploit purporting to
> be from amazon.com. The subject line contains a bogus order number.
> I don't find 
an
> abuse email address on the amazon site, so sent this to "Comments"
> using their online form.
>
> Subject: Your amazon.com order #935-448-9241 has shipped
>
> Header:
> Received: from 80.179.156.174.forward.012.net.il [80.179.156.174]
> by <MY_SERVER>
>   (SMTPD32-6.06) id ACC711400EA; Thu, 22 Jan 2004 22:18:47 -0800
> Received: from [162.150.9.7] by 80.179.156.174.forward.012.net.il
> id <0055653-85577>; Fri, 23 Jan 2004 17:23:49 -0300
> Message-ID: <6-2s$416571jgg77$5x$m3tn-$58 at 6sq34v.jvm9828>
> From: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
> Reply-To: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
> To: <MY_ADDRESS>
> Subject: Your amazon.com order #935-448-9241 has shipped
> Date: Fri, 23 Jan 04 17:23:49 GMT
> X-Mailer: drochkamail 2.3
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="1..CBBA6_F0"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-RCPT-TO: < <MY_ADDRESS> >
> X-UIDL: 369387179
> Status: U

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBQBFe3oLSHsoG8onwEQLtQwCgltLA3CEsXy/MPkHvG/7NGOcf4zcAn0Af
86L4moQy/NMpBXcE5OVjYFGz
=UbnT
-----END PGP SIGNATURE-----





More information about the list mailing list