Planet Antispam
May 16, 2012
96673 patterns in 34304 domains, 12241 right anchor strings, 376304 test IPs
New patterns and updates from the various contributing feeds. There
were two minor releases since 20120515.
PLEASE NOTE that this release contains a NEW CLASS: 'dedhost'. It
replaces 'static/colo' and allows for distinction between shared and
dedicated web hosting and colocated servers. It is now reflected in
the rbldnsd files and returns 127.0.2.3.
May 16, 2012 03:22 PM
To help you better safeguard your Android phone and tablet, Sophos just published Sophos Mobile Security for Android in Google Play. Oh, and it's free! 

May 16, 2012 02:45 PM
A new spam campaign is exploiting the OpenID security protocol. The messages look like legit emails from local real estate companies and invite the recipient to view properties for sale in their area using the logo of well-known realtors like Remax, and some of them arrive looking like UPS delivery notifications. UPS is one of the most commonly brandjacked companies along with the IRS and Paypal. If the link in the message is clicked, the user is brought to a malicious webpage that displays the logos of AOL, Gmail, Yahoo, and other popular websites that use the OpenID protocol. Clicking on any of them prompts the user to log into that service, but the login screen is fake and designed to steal the all information typed into it.
This campaign has several layers of brandjacking in it, making it a little more complex than most. Since it seems designed simply to allow the phishers behind it to steal email accounts and doesn’t attempt to install malware on the victim’s computer, it’s not that harmful as far as malicious spam goes.
Why the attempt to steal so many email addresses? Obviously to allow spammers to send out more spam, but it may also be an attempt to gather resources for another attack. Have you ever received an email from a friend or colleague telling you they are overseas, got robbed, and need your help to get home? Chances are they fell for a phishing email like the ones being sent out in this new attack, which allowed the scammers to access their email accounts and spam their contacts.
Liked this post? Get more anti-spam related news from AllSpammedUp.com!
OpenID Exploited by New Spam Campaign
May 16, 2012 02:00 PM
In the third part of this on-going series, Neil Schwartzman explores the current landscape of the email delivery world.
As regular readers may recall, in my early posting “You Get the Deliverability You Deserve” I made mention of a 2010 international consumer survey conducted by industry group MAAWG. It had some distressing results for senders of commercial email. Basically, end-users don’t 
May 16, 2012 09:00 AM
Yesterday, I started digging through statistics of users who use our network to send out spam. Most of them are not doing it intentionally, but some are hostile. What sorts of behavior characteristics do these senders conform to? There are are a couple.
- Spammers are very likely to send a lot of mail.
People who send outbound spam – mostly compromised accounts from an edu – are more likely to send a lot of mail. You might be saying “Well, no kidding.” But before you scoff, consider this:
I went through all of our outbound mail stats this past week. I did a quick visual inspection of the types of senders. There are a few senders who send a lot of messages, and lots and lots (and lots and lots) of senders who send a few messages. The overwhelming majority of spammers send lots of mail. They are heavily concentrated in the senders who have high volumes of mail.
This doesn’t mean that everyone who sends lots of outbound mail is a spammer. Rather, if you are trying to find someone who is sending outbound spam, the first place you ought to look is for accounts sending a lot of mail.
- Spammers are not likely to send out small amounts of spam.
This is the corollary to point (1). Spammers are not found very often in small mailers. Now before you scoff yet again, my big worry was that spammers came in two kinds – the type that sent floods of spam and the type that send only small amounts of spam. The types that send small amounts of spam would be harder to detect due to the tiny volumes.
But because of my research, spammers just don’t send tiny bits of mail from a lot of compromised accounts; at least in our network, they compromise an account and send tons of spam. They don’t waste it by sending only little bits.
Thus, to summarize: on our network, spammers are overwhelmingly represented in the accounts that send tons and tons of mail, and almost no where to be found in the smaller senders and thus trying to stay under the radar. However, the majority of accounts that send lots of mail are not spammers; sorting between these two is art of outbound spam filtering and is what makes outbound spam control so challenging.
- The exception to the rule is freebie spammers
The exception to the rule above are what I call freebie spammers. We have a service called Office 365 that spammers sign up for and abuse (we know what you’re doing, you ass of a spammer). These types of accounts have much lower sending limits and spammers will hit those limits (and have experimented, trying to find those limits) and then get banned, discard the account, and move on.
Freebie spammers do not send in high volumes from a single account. They sign up, spam, get banned, and repeat. This contrasts from our paid-service which conforms to rules (1) and (2) above.
So to summarize: if spammers compromise paid accounts, they will spam in large volumes. If they acquire free accounts with low throttles, they will send in small amounts.
That’s what I have discovered about spammers who utilize reputation hijacking.
May 16, 2012 04:26 AM
Did you ever wonder what China is doing with all of those Advanced Persistent Threats that they are tossing at US companies, trying to steal their secrets (allegedly)? The answer is they give them to their own home-grown companies. Here’s a story from yesterday’s Financial Times entitled Baidu to launch low-cost smartphone:
Baidu is making its boldest foray yet into mobile search by launching a low-cost smartphone that runs on the Chinese search company’s own operating system.
Baidu will hold a press conference in Beijing on Tuesday to launch the smartphone, which will be priced under Rmb1,000 (£98) and will run Baidu Cloud, a mobile-phone operating system developed by modifying Google’s Android platform. The phone will have a separate brand, the company said.
Let me get this straight:
- The US government has accused China of stealing secrets from US companies and giving them to Chinese companies.
- US search engine Google competes directly with Chinese search engine Baidu.
- Google makes a low(ish) cost smartphone, Google Android.
- Baidu is making a low cost smartphone based on Google Android.
Geez, they’re not even hiding what they are doing. I wonder how much of the code and design is based upon what other US companies have previously done?
May 16, 2012 04:12 AM
May 15, 2012
96482 patterns in 34244 domains, 12234 right anchor strings, 375756 test IPs
New patterns and updates from the various contributing feeds. There
was one minor release since 20120511.
PLEASE NOTE that this release contains a NEW CLASS: 'dedhost'. It
replaces 'static/colo' and allows for distinction between shared and
dedicated web hosting and colocated servers. It is now reflected in
the rbldnsd files and returns 127.0.2.3.
May 15, 2012 03:38 PM
Welcome back to another in our series of articles on talking about spam. I have to apologize for this one, since in the title I broke one of the cardinal rules I set for this series; I used a technical term. I used a term that most in IT are familiar with, and almost no one outside of IT is, but it is a term, or rather an acronym, that distinctly and succinctly sums up one of the most insidious weapons spammers and phishers use against their targets. Knowing what the term means might not win you Final Jeopardy, but it will help you to understand and recognize attacks for what they are. FUD is pronounced exactly as it looks, and stands for the big three emotions that make most people believe things they should not; Fear, Uncertainty and Doubt.
Why they work
FUD is used to prey upon a victim’s ignorance, self-doubt, paranoia, and general willingness to believe anything that is negative. Spammers, phishers, and their like use FUD like a blunt object, because it works. This works for any number of reasons. More people tend to be trusting than not, and many more are willing to believe that they did something wrong, or that anyone with the semblance of authority is to be believed. Far too many non-technical users still think that because they don’t work for a big company or have their own website, no one could find them so anyone who does must be legitimate. Our own banks, credit card companies, mortgage holders, large companies, and governments, contribute to the problem by either sending out confusing communications themselves, or worse still, not making absolutely clear what they will and will not send to customers in email. This leads to a situation where a user cannot be sure what is and is not legitimate email, and they tend to err on the side of belief, where they should instead be skeptical by default.
How to recognize them
First things first – If you get an email from a company that you have not done business with, then you should automatically be suspect of the message. That is not to say that you should always trust any message that purports to be from a company you have done business with; only that you should know who you deal with and suspect anything that comes to you from someone you don’t.
Look for some of the hallmarks we’ve discussed in earlier articles in this series, especially links. Mouse over them without clicking on them, and see if what appears in your status bar, or in pop-up text, matches what is in the email, and that is seems to go to the business website.
Requests for personal information are almost universally a sign that the message is bogus, and if it is legitimate, the company should know better. Anytime you are directed to log onto a site and update your information, consider it a scam.
The more urgent a message seems, or the more emphatically it directs you to action, the more likely it is to be a scam.
What you should never do
- Never click on a link in any message like this.
- Do not reply to any message that you suspect may be bogus.
- Do not forward any message that you suspect is bogus.
What you should do if you still aren’t sure
If you want to make absolutely certain that a message is fake, you can do one of two things. You can either call the company directly, or visit their website. DO NOT trust any phone number or URL that is contained in the suspicious email. If you really do have a relationship with the company that the email is allegedly from, go get your invoice or monthly statement and find the phone number or URL printed on that. If you don’t have that, use your favourite search engine to find their phone number or website. If you do have an account with the company and they really did need you to do something, either the customer service representative you speak to will have that information on the screen in front of them, or you will get a warning about what is required as soon as you log on.
You might also use your search engine to check to see if anyone else has reported a scam. Search for the name of the business and the word scam or fraud to see what results come up. You can also visit sites like http://www.hotscams.com to search for the name of the company to see if there are any reported scams that look like the message you have received.
A healthy degree of skepticism is critical in this day and age when anyone in the world can send anyone else an email that purports to be from anyone else. Reputable companies know the dangers of FUD, and will never send you an email requesting personal information, or that contain links to websites other than their own. Keeping always in mind that scams abound, you should be ready to recognize and to handle (that means delete) any scam message that gets past the filters and into your inbox.
Liked this post? Get more anti-spam related news from AllSpammedUp.com!
Let’s Talk About Spam – FUD
May 15, 2012 02:00 PM
Twitter users 15% of UK, but will it help Big Brother?
Twitter today announced that the number of active Twitter users in the UK has exceeded 10 million. But it also says it 'wants to work closer with UK government and policymakers,' which sounds ominous to +Richi Jennings.
#HPIO UK Editor's blog for +HPUK...
http://h30565.www3.hp.com/t5/UK-Edition-start-here/Twitter-users-15-of-UK-but-will-it-help-Big-Brother/ba-p/3687
Twitter users 15% of UK, but will it help Big Brot... - Input Output

May 15, 2012 12:34 PM
May 14, 2012
If you are an AT&T wireless customer (like me), you probably receive legitimate email notices each month when your wireless bill is ready to be viewed online. I don't keep track of when in the month the notice is sent, so when a notice arrived in my inbox this morning claiming to be from AT&T Customer Care with a Subject: line of "Your AT&T wireless bill is ready to view", I took a peek:
I have a low-end plan (I don't talk much), so my bills are regularly well under $100 per month. Imagine my surprise at the claimed balance of over $1500. The sender hoped I'd be outraged enough to click immediately on the live links to log in to see where all the big charges came from. Unfortunately for the sender, when I see an outrageous email from one of my suppliers, I immediately smell a rat. Before clicking anything, I check the URL of the link (a mouse hover atop the link typically displays a tooltip revealing the actual URL of the link). The links in this email were not going to any AT&T web site, but rather to a hijacked site, which, upon further safe inspection of the content, loads the old obfuscated JavaScript stuff reported many times on this blog as malware loaders.
Other readily visible clues that this message is phony baloney include failure to address the recipient by name and to specify the account number in the first paragraph. It's not easy, however, to remember how each of your vendors addresses you in their regular emails. Most include your name somewhere, but not always.
Further inspecting the innards of the message, I see that the crooks tried to forge the headers to look like the message originated from an AT&T mail server. At the final stage of the header trail, however, the reverse IP address lookup performed by my mail server failed to resolve to a domain name. Legitimate AT&T emails to customers also employ a domain key signature.
You have to keep telling yourself (and your friends and neighbors) that when you receive an email message (even from someone you know) that contains anything outrageous, route your adrenalin to your rat-sniffing faculties, not your clicking finger. Clicking a link or opening an attachment in such emails may be the last thing you do with your computer before it — and all your valuable data and login credentials — fall into the hands of Bad Guys.
May 14, 2012 05:53 PM
Newt 2012, the organization behind the now defunct presidential campaign of former House Speaker Newt Gingrich, is showing a truly ugly side of itself. It’s no secret that presidential campaigns require a lot of money, and Gingrich’s was no exception. Even before he pulled out there were claims that it was struggling for money and seriously in debt. Those claims have been confirmed – they owe over $4 million.
Now that the campaign is over, guess how they’ve decided to make some fast cash?
By selling their email list to spammers. The list, which contains the names and email addresses of people who donated or otherwise supported the campaign, is being offered to any spammer will to fork over some dough. By doing this, they have made it clear their privacy policy is full of lies:
“We are committed to protecting your privacy online.”
“We may also use your email address to provide you news and information about Newt 2012. We may also…send you email messages about upcoming events or activities in your area.”
They are also engaging in a shady practice known as email appending:
““Email appending”…refers to taking known demographic information and using various methods to determine an email address for the purpose of adding people to a list or otherwise sending them email messages.”
In other words, even if you did not give the campaign your email address when you made a donation, they can find it and add it to their list anyway.
Let this be lesson to you about how NOT to do business. It doesn’t appear that what they are doing is in violation of the CAN-SPAM Act (although it should be), doing either of these things is a really great way to anger customers, damage your reputation/brand, and get you on spam blacklists, among other things.
Liked this post? Get more anti-spam related news from AllSpammedUp.com!
Spammers Love Newt Gingrich
May 14, 2012 02:00 PM
My wife and I enjoy eating out for dinner fairly often, and it can get kind of spendy. On a whim, I started searching for ways to save money while dining out, and stumbled across this service called Savored. Looks like a neat way to save some money-- I've just registered, but I have yet to try it.
I was reading through their blog and found this wonderful post, "What does your email address say 
May 14, 2012 09:13 AM
May 13, 2012
I had a great idea at work.
We’re looking at a future feature wherein we allow users to block email by language. If you’re an English speaker and never receive mail in Chinese, you can set an option to block all Chinese mail. Want no Spanish? Set the option to block Spanish. Voila, you’ve just achieved foreign language spam filtering at no extra cost.
Most filters do this by doing charset analysis – certain charsets correspond to certain languages. This is true of Russian, Japanese, Chinese, Korean and Turkish. Unfortunately, other languages like French, Spanish, German and Portuguese all use the same charset so you can’t use those charsets to block those languages without incurring a lot of false positives. English also overlaps with a lot of other charsets, and every language uses UTF-8 sometimes to encode it. In other words, you could block the Russian charset but you wouldn’t block all Russian spam because some Russian spam is encoded in UTF-8; but if you blocked UTF-8, you would block a lot of legitimate English language mail.
I’m not going to give away the feature we’re looking at just yet, but it will be much more accurate than simple charset analysis.
In terms of how to expose this to the user, I had a great idea. The current blocked encodings dialog box in Outlook 2010 looks like this:

You can see that all the languages are in alphabetical order. That’s not too bad because if you look at the slider bar, there doesn’t look like there’s that many languages and you can navigate through it pretty easily if you had to.
Our new feature will let you select more languages – something like 90 (I didn’t even know that there were that many detectable languages). If you want to pick and choose the ones you don’t want to receive anymore, you have to navigate a long list of checkboxes. And navigating a long list of checkboxes is difficult and non-intuitive, especially if the languages start with letters that aren’t close to each other. It’s easy for your eye to miss, and if you ever want to check your settings, you have to scroll through and mentally keep track of what you picked because everything won’t fit in one window.
I had an idea to make this better.
Instead of putting all 90 languages (or more) in alphabetical order, why not put the top ten most commonly complained about languages at the top of the list? The bulk of our user base (for now) speaks English and most of them want ways to block spam in languages other than English. Instead of putting everything in alphabetical order, why not put the top 10 most requested-to-be-blocked languages at the top of the list followed by a dotted line, followed by the rest of the languages?
This way, a user could block a language and the ones that they are most likely to pick (19 times out of 20) are right there in front of them with no navigating through a list of choices. They don’t have to scroll through the list, we’ve thought ahead to put their choices right there in front of them. It’s like this:
I want to block all mail in Chinese, Russian and Japanese. I get all this spam in those languages and don’t want it anymore. Let’s see, how do I do this?
Oh, okay, there’s the Languages button. Let’s click that… Hey! The languages I want to block are right there! <click> <click> <click> Hmm, I get a lot of Spanish spam and I don’t ever speak to anyone in Spanish, let’s click that one, too. <click>
Done. <click OK>
The whole process takes 10 seconds or so. Easy. But if you have to hunt through and find the languages in alphabetical order, it takes you a second or two (or most likely, 8-10 seconds) to find the languages, and then the helpful suggestions aren’t there either. Instead of being easy-peasey, it’s just a basic interface. And how do you check to see what you’ve picked? You have to memorize the list as you scroll through it, remembering what you clicked.
Thus, my idea is to make it simple for the user by giving the options that almost everyone picks.
I ran this idea past a couple of folks in Marketing and Legal. Their opinion was no dice. Why? Because if you were a user in a particular language that we singled out, this could be offensive or upsetting to them. A Chinese user might say “Hey, why is my language on the top of this list? Why am I being singled out?”
I have no defense for that. Yes, if you’re in a particular country and speak a particular language, the language you speak might just be on the list of top languages that people want to block. That’s the reality. And you might find that offensive, it’s true.
But it’s not your fault. It’s spammers’ fault. They’re the ones abusing your language. And lots of English speakers want to block Chinese spam, or Spanish spam, or Russian spam. But lots of Spanish speakers might want to block English spam. Lots of German users might want to block Turkish spam, and so forth. And many other languages won’t make the cut because spammers don’t abuse them, and people never complain about them. For example, I would not put Swedish on that top 10 list. I have seen Swedish spam, but it is very rare. The same goes for Finnish and Catalonian.
Spammers pick the languages that people use more often and there is a long tail of languages that people use, but not all languages are used equally. That’s a fact.
But it’s a battle I’m not going to win. Maaaaaah.
May 13, 2012 05:44 AM
May 12, 2012
MillerSmiles provides its weekly phishing analysis for the week of 5th May 2012 to 12th May 2012
May 12, 2012 12:00 PM
May 11, 2012
A couple of days ago, Ed Bott posted an article on ZDNet entitled What Microsoft can teach Apple about security response. This is in response to how Microsoft deals with security vulnerabilities and applies updates, vs how Apple does it (did it) with the Flashback malware. Some highlights:
- Microsoft updates its OS with critical security updates on the second Tuesday of each month, called “Patch Tuesday” (soon to be renamed Update Tuesday). Microsoft also delivers out-of-band security updates when it feels it necessary.
- Each update contains announcements about the vulnerability and its security risks, which products they affect. This level of transparency is stunning.
- Each vulnerability is rated on a scale of 1 to 5 about how it is to be exploited.
- Microsoft has also published blog posts from time to time about the vulnerability as well as deployment guides on how to patch your computer.
You may be an “I hate Microsoft” type but there’s no denying that this is a good process and absolutely benefits consumers and IT pros alike.
Contrast with Apple:
- In February, Oracle issued a security path to fix a Java vulnerability. Apple didn’t release their version of the patch for another 6 weeks.
- During that time, several hundred thousand (?) Mac users fell victim to the vulnerability through the Flashback malware. Apple did not explain how the malware works (do they know?) nor how to remove it if one is running MacOS X 10.5.
- A second issue occurred on Feb 1 when Apple released update 10.7.3 to OS X but a flaw in the update code would result in a clear-text record of login usernames and passwords in a file (see article for more details).
- Apple kept silent on this vulnerability (did they know?) and has not (yet?) acknowledged the issue, nor offered advice on how to tell if they are a victim of this bug.
The contrast is striking. Of course, Apple is still trying to maintain its polish and image as a system that is resistant to malware (and many users will happily endorse that fact). Still, we live in a world where malware writers don’t care what OS you are using; if they can break into it, and it’s popular, that’s what they will do.
You may be an “I hate Microsoft” type, but Microsoft definitely gets the edge year by a wide margin. Their processes are far more mature than Apple’s.
May 11, 2012 11:48 PM
Last week, Sophos released a blog post on the top 12 countries that relay spam during the first three months of 2012. Their summary:
- The country with the highest amount of spam sent is India.
- Spam has decreased over time because of better efforts to combat spam worldwide, but also because of a shift in tactics by spammers to mobile spam and social network abuse.
I decided to compare Sophos’s list with our list during the 1Q 2012. I don’t know how Sophos compiled their list, but here’s how I did mine:
- I only count spam that makes it past our IP blocks. Prior to be blocked at the network edge, I don’t have the data and therefore cannot get a geographical distribution. However, my assumption is that it would look roughly the same as it does after IP blocks.
- I perform country/IP analysis and assume that the originating country of the spam is the same as the IP that relayed it. This isn’t strictly true because a bot in Russia can control a bot in China and cause the Chinese bot to send the spam. Which country originated the spam? Russia? Or China? In my statistics, I count it as China even though you could make a case for Russia. However, I cannot get accurate statistics on bots that originate the mail instead of relaying it.
So without further ado, here’s a comparison of the two lists by the total amount of spam that we saw from each country. The numbers in parentheses in Sophos’s list are where that country ranked in our list:

You can see that countries like India, the USA, Indonesia, Brazil and Pakistan are roughly the same between Forefront and Sophos. But Sophos’s numbers vary wildly for South Korea, Taiwan and Peru.
But is total number of spam the best way to denote that a country is spammy or not? After all, skewing the US simply represents our customer base. What percentage of mail does that country send that is marked as spam? The proportion of mail that a country sends that is spam is a better indicator of its spamminess. Here’s our top 12 list again by total spam messages, but now showing the percentage of spam:

Going by this, developing countries like India, Indonesia and Pakistan blow right by the US, the UK, France and Germany. If we order by spam % and adjust for minimum amounts of spam, how does the list look?

This switches things. While countries like the US, Canada and the UK all make the list for the most spam sent, it’s because the total Internet population is so large and they account for so much Internet traffic and email in general.
However, in terms of the rate of spam, none of the developed world makes the list. Instead, countries like Belarus, Indonesia and Vietnam are sending way more than their fair share of spam. If you look through the list, every single one of these countries is in the developing world. It’s clear that spammers have greater success compromising computers in nations where the infrastructure is not as developed.
What about the cleanest countries? What do they look like? Here’s the list:

This list is populated by northern Europe as usual. Northern Europe, for as long as I have been investigating these statistics (for spam and malware) has always been a model citizen. Japan and Singapore are similarly good (they are the only two far east Asian countries that are). But what surprises me about this list is Oman and the United Arab Emirates. These are not countries that you typically associate with the developed world.
In the case of the UAE, they have a very high rate of immigration (one of the highest in the world according to the CIA World Fact Book and depending on the source you consult, are classified as having a high human development index) and my theory is that all of the skilled workers are the ones with Internet connectivity. Since they are skilled workers and have a lot of IT experience, they are very good about keeping their computers patched and up-to-date. Their places of work will probably have policies around computer security.
Regarding Oman… I admit I am pretty clueless about Oman although the country is made up of 1/6 non-nationals so maybe their situation is similar to the UAE regarding skilled workers. The fact that they made this list was very surprising to me. I have to go back and look at my script that does IP/country assignment and see if maybe I have to update my tables.
Anyhow, that’s my list of the top countries that are sending spam and how it compares to Sophos’s list.
May 11, 2012 06:29 PM
96332 patterns in 34212 domains, 12236 right anchor strings, 375120 test IPs
New patterns and updates from the various contributing feeds. There
were several minor releases since 20120510.
PLEASE NOTE that this release contains a NEW CLASS: 'dedhost'. It
replaces 'static/colo' and allows for distinction between shared and
dedicated web hosting and colocated servers. It is now reflected in
the rbldnsd files and returns 127.0.2.3.
May 11, 2012 04:37 PM
In today’s post, we’re going to take a look at some actual spam messages to help you get a feel for what spam looks like. We’ll point out some of the obvious characteristics, as well as some of the more subtle traits that tend to be common amongst spam, to help you get more familiar with identifying it yourself. Once you know what to look for, spotting spam becomes less like “Where’s Waldo” and more like spotting the wolf amongst the sheep. Once you know what to look for, it’s hard to believe you ever missed it.
Who is that?
Unless you make it a habit of giving out your email to every stranger you meet, treat any email that comes from someone you don’t know as suspect. This doesn’t hold true if you are the contact person at your work, but for your personal account, don’t assume you have to open every message sent to you. If you don’t recognize the sender, it’s probably going to be junk.
Open attachment
Any email that contains nothing more than an attachment, and maybe a short one liner telling you to open the attachment to read the important message is not only spam, it may well be malware. Delete these without opening the attachment, and if you did open the attachment even though I warned you not to, make sure to run a full anti-virus scan immediately.
Dearest friend
Not too many people speak like that, except for those scammers who are trying to get you to help them smuggle unclaimed funds out of their country, or are appealing to you to donate to their worthy cause.
藥品全.面瘋狂贈
Unless you actually read the language, it’s a safe bet that any messages that arrive in your inbox with subjects or senders that look like this are probably spam.
me
Odds are, if you email yourself something, you’ll remember it. Anything else that looks like it came from you to you is from someone spoofing your email address.
RE:
If you see a message with the subject line starting with RE: you will probably think it is a reply to an email you sent. Think about it though. Do you recognize the sender and do you remember sending an email with that subject? If both of those answers are no, hit the delete key.
Big Government Entity
Spammers often pretend to be a governmental agency to get you to open their messages. Law enforcement and tax authorities are often spoofed. If someone from the FBI was going to email you, it would probably come from some username @ fbi .gov, not FEDERAL BUREAU OF INVEST. and would likely be in response to an email you sent. Look at the sender and the subject line, and ask yourself if it even feels a little bit legit. Odds are you’ll be hitting the delete key and you’ll be right to do that.
Big Corporate Entity
Same thing here. You just aren’t going to see legitimate emails from COCA COLA COMPANY or WALT DISNEY WORLD as the sender.
You may already be a winner
And you may already know what to do with any message that promises winnings from some contest you never entered.
Blessings to you
Should be immediately followed by deleting by you. Many of the phishing scams out there start with some benediction because hey, anyone nice enough to start an email that way must be honest, right?
ANYTHING IN ALL CAPS
This is almost universally equated on the Internet with shouting at the top of your lungs, and it’s just not going to be something legitimate email is likely to have.
no subject
Most mail clients will warn the user before they send a message with no subject, but no spammer program will. If the message has no subject at all, it is almost certainly spam.
While none of these are 100% absolutely and without exception guaranteed to be the hallmarks of spam, each and every one of them is something you want to watch for, and be suspicious of any email you receive that falls into one of these categories. The best thing you can do is approach your inbox with a healthy bit of skepticism, and err on the side of caution.
I’m sure some of you are wondering why I left off your favorite spam warning sign. Please, share the best with the rest of us by leaving a comment below!
Liked this post? Get more anti-spam related news from AllSpammedUp.com!
Let’s Talk About Spam – The Worst Offenders
May 11, 2012 02:00 PM
Reminder to Dublin-based readers — next week, Amazon (my employers) will be putting on Under the Hood at Amazon, billed as ‘A night of Beer, Pizza and Cloud Computing for Software Developers’. I’ll be speaking at it.
It’s partially a recruiting event, but even if you’re not looking for a new job, please come along. It’s also useful for us to talk about some details of what we’ve been doing in Dublin, since we’ve been operating to date with a pretty low profile, and in reality there’s some very interesting stuff going on here… particularly the product I’ll be talking about, naturally.
Also, there’ll be free beer and some Kindles to be won ;)
It’s next Thursday night, in our offices in Kilmainham. More info on this Facebook page.
May 11, 2012 01:46 PM
Geddit?
Steve Davies originally shared this post:
After his sudden death my father's solicitors called the family together to read out the details of his estate.
It was a 2 litre Ford Mondeo with 120 thousand miles on the clock
May 11, 2012 10:17 AM