[Dshield] Strange emails

Paul Marsh pmarsh at nmefdn.org
Sun Oct 3 14:27:20 GMT 2004

Anyone else seeing these at their gateways?  They're coming in to random nonexistant user names.  If opened in a browser the page displayes a blank AD.png and a hiden iframe.  That page inturn calls www_dot_enews_dot_com_dot_tw/range_dot_asp that pulls 122 hiden blank png images from a db.

Date: Sun, 3 Oct 2004 03:23:06 +0800
From: 儂融國際股份有限公司 <longno_at_yahoo_dot_com> 
To: lorin_at_domainname_dot_com
Subject: 對不起你寄錯了 
<IMG SRC="adp_dot_iso_dot_com_dot_tw/AD.png?eid=lorin_at_domainname_dot_com&pid=other" HEIGHT="0" WEIGHT="0" BORDER="0"> 
<iframe src="www_dot_enews_dot_com_dot_tw/counter_dot_asp" width=0 height=0></iframe> 

More information about the list mailing list