[unisog] Sneaky spamming or something more sinister????

Gary Flynn flynngn at jmu.edu
Fri Apr 15 18:58:57 GMT 2005


An e-mail was received by myself and four other individuals
here purportedly from USA Today because we posted a resume
online (which I did not).

The email appears to have originated from a computer in
Hungary on a Cable TV ISP - www.broadband.hu.

It lists an e-mail address as the contact for job
information. Messages to that address bounce.

The following links appear in the message for unsubscribing
and other purposes:

http://click.e.usatoday.com/accountinfo.asp?13893d-5d9eaf6e9ed3fd
http://reg.e.usatoday.com/edit.aspx?8047644456
http://click.e.usatoday.com/open.aspx?baad3c-baad3c-baad3c

Ergo, it would seem to be in the address space operated
by USA Today.

I did a wget on those links and links found in the fetched
files but didn't see anything extraordinary.

An nslookup on those names result in canonical names in
the exacttarget.com domain. Exacttarget appears to be
a, ahem (cough), direct email marketing company.

So, is USA Today hiring or hosting firms that send their
spam through overseas computers?

Does such an indirect route bypass laws like CAN-SPAM?

Is there, perhaps, something more sinister going on
here or is this just e-mail address harvesting? The
DNS poisoning incidents advertised by SANS
has made me a bit jumpy.




Email source with other recipients deleted:

**************************************************************

Return-Path: 
<reply-jQjCUpfWvSx=-156585_HTML-5605304151 at reply.e.usatoday.com>
Received: from mpdir5.jmu.edu (mpdir5.jmu.edu [134.126.12.44])
	by mpmail1.jmu.edu (MOS 3.5.8-GR)
	with ESMTP id BEP39882 (AUTH via LOGINBEFORESMTP);
	Fri, 15 Apr 2005 11:53:28 -0400 (EDT)
Received: from reply.e.usatoday.com (catv-50628b3c.catv.broadband.hu 
[80.98.139.60])
	by mpdir5.jmu.edu (MOS 3.5.8-GR)
	with ESMTP id BVT04627;
	Fri, 15 Apr 2005 12:02:30 -0400 (EDT)
Message-ID: <002b01c541d4$8fcb1350$fea47944 at cvlte>
From: "USATODAY.com" 
<reply-jQjCUpfWvSx=-156585_HTML-5605304151 at reply.e.usatoday.com>
To:
Cc: <flynngn at jmu.edu>,
Subject: USATODAY.com's Exclusive Agent
Date: Fri, 15 Apr 2005 09:39:52 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----==_NextPart_000_0028_01C54199.E36C3B50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2479.0006
X-ELNK-AV: 0
X-Junkmail: UCE(93)
X-Junkmail-Status: score=93/50, host=mpdir5.jmu.edu

This is a multi-part message in MIME format.

------==_NextPart_000_0028_01C54199.E36C3B50
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Our ability to search resumes online has allowed us to grow at a pace 
second to none in our industry. Because of this, we are touching base 
with individuals who have posted their resumes that meet our 
requirements for the positions we have available.

Based on the career profile you provided us, you might be interested in 
the following job(s). Please review the job description(s) and if you 
would like to continue the process, send blank e-mail with the word 
"USASPECIAL" in the subject line to trwjobs at cox.net

2873 -- Sr. Financial Representative

As a front line financial agent, you will be responsible for connecting 
different countries' financial markets by acting on behalf of our 
customers. All you need is an active bank account, good communication, 
internet access and desire to work as a big team. Get from 5 to 10% from 
each transaction!

This message contains information which is privileged and confidential 
and is solely for the use of the intended recipient. If you are not the 
intended recipient, be aware that any review, disclosure, copying, 
distribution, or use of the contents of this message is strictly 
prohibited. If this confirmation notice was sent to you in error or to 
unsubscribe at any time, please click:

http://reg.e.usatoday.com/edit.aspx?8047644456


Thank you for using USATODAY.com.

Regards,
The USATODAY.com Team

For the latest news, please visit http://www.usatoday.com/

************************************************************

This email was sent by: USATODAY, a division of Gannett Co. Inc.

7950 Jones Branch Drive
McLean, VA, 22108,


Go <a 
href="http://click.e.usatoday.com/accountinfo.asp?13893d-5d9eaf6e9ed3fd">here</a> 
to leave this mailing list or <a
href="http://click.e.usatoday.com/accountinfo.asp?13893d-5d9eaf6e9ed3fd">modify</a> 
your email profile.


------==_NextPart_000_0028_01C54199.E36C3B50
Content-Type: text/html;;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Our ability to search resumes online has allowed us to grow at a pace =
second to none in our industry. Because of this, we are touching base with =
individuals who have posted their resumes that meet our requirements for =
the positions we have available.
<br>
<br>
Based on the career profile you provided us, you might be interested in =
the following job(s). Please review the job description(s) and if you =
would like to continue the process, send blank e-mail with the word =
"USASPECIAL" in the subject line to trwjobs at cox.net
<br>
<br>
2873 -- Sr. Financial Representative

<br>
<br>
As a front line financial agent, you will be responsible for connecting =
different countries' financial markets by acting on behalf of our <br>
customers. All you need is an active bank account, good communication, =
internet access and desire to work as a big team. Get from 5 to 10% from =
each transaction!
<br>
<br>
This message contains information which is privileged and confidential and =
is solely for the use of the intended recipient. If you are not the =
intended recipient, be aware that any review, disclosure, copying, =
distribution, or use of the contents of this message is strictly <br>
prohibited. If this confirmation notice was sent to you in error or to =
unsubscribe at any time, please click:<br>
<a =
href=3D"http://click.e.usatoday.com/?13893d-d35fdf50d8-5d9eaf6e9ed3fd">http=
://reg.e.usatoday.com/edit.aspx?8047644456</a>
<br>
<br>
Thank you for using USATODAY.com.
<br>
<br>
Regards,<br>
   The USATODAY.com Team
<br>
<br>
For the latest news, please visit http://www.usatoday.com/<br>

<br>

************************************************************
<br>
<br>

<img src=3D"http://click.e.usatoday.com/open.aspx?baad3c-baad3c-baad3c" =
width=3D"1" height=3D"1">

------==_NextPart_000_0028_01C54199.E36C3B50--



-- 
Gary Flynn
Security Engineer
James Madison University


More information about the unisog mailing list