[Dshield] AMAZON.COM spoof

Doug White doug at clickdoug.com
Fri Jan 23 21:33:10 GMT 2004


It was truly fraudulent -  the source is from Italy, none of the body links were
Amazon IP numbers

======================================
Stop spam on your domain, Anti-spam solutions
http://www.clickdoug.com/mailfilter.cfm
For hosting solutions http://www.clickdoug.com
======================================
Aspire to Inspire before you Retire or Expire!


----- Original Message ----- 
From: "BarkerJr" <barkerjr at barkerjr.net>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Friday, January 23, 2004 11:50 AM
Subject: Re: [Dshield] AMAZON.COM spoof


: -----BEGIN PGP SIGNED MESSAGE-----
: Hash: SHA1
:
: True, the subject line says amazon.com, but the content and the pages
: linked
: to look nothing like amazon.  I wouldn't call it a spoof... more of a
: vain
: attempt to get through spam filters.
:
: I've recieved two of these spams over the past three days, also.
:
: - ----- Original Message -----
: From: "Robert Dodd" <bobdodd at sheperd.com>
: To: "'General DShield Discussion List'" <list at dshield.org>
: Sent: Friday, January 23, 2004 9:16 AM
: Subject: [Dshield] AMAZON.COM spoof
:
:
: > I just received what I think is another HTML exploit purporting to
: > be from amazon.com. The subject line contains a bogus order number.
: > I don't find
: an
: > abuse email address on the amazon site, so sent this to "Comments"
: > using their online form.
: >
: > Subject: Your amazon.com order #935-448-9241 has shipped
: >
: > Header:
: > Received: from 80.179.156.174.forward.012.net.il [80.179.156.174]
: > by <MY_SERVER>
: >   (SMTPD32-6.06) id ACC711400EA; Thu, 22 Jan 2004 22:18:47 -0800
: > Received: from [162.150.9.7] by 80.179.156.174.forward.012.net.il
: > id <0055653-85577>; Fri, 23 Jan 2004 17:23:49 -0300
: > Message-ID: <6-2s$416571jgg77$5x$m3tn-$58 at 6sq34v.jvm9828>
: > From: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
: > Reply-To: "ship-confirm at amazon.com" <ship-confirm at amazon.com>
: > To: <MY_ADDRESS>
: > Subject: Your amazon.com order #935-448-9241 has shipped
: > Date: Fri, 23 Jan 04 17:23:49 GMT
: > X-Mailer: drochkamail 2.3
: > MIME-Version: 1.0
: > Content-Type: multipart/alternative;
: > boundary="1..CBBA6_F0"
: > X-Priority: 3
: > X-MSMail-Priority: Normal
: > X-RCPT-TO: < <MY_ADDRESS> >
: > X-UIDL: 369387179
: > Status: U
:
: -----BEGIN PGP SIGNATURE-----
: Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
:
: iQA/AwUBQBFe3oLSHsoG8onwEQLtQwCgltLA3CEsXy/MPkHvG/7NGOcf4zcAn0Af
: 86L4moQy/NMpBXcE5OVjYFGz
: =UbnT
: -----END PGP SIGNATURE-----
:
:
: _______________________________________________
: list mailing list
: list at dshield.org
: To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
:
:




More information about the list mailing list