There's a new spam going round that we started seeing last Friday. The subject line consists of a (seemingly) random string of characters composed of uppercase letters and numbers, and the body text contains two words: Hillo<number> followed by a string of numbers and lowercase letters (letters optional in the limited examples I've seen).
Example From: eldonxv4 [eldonxv4@hotmail.com]To: A name that's not mineSubject: G0XVB Hillo7 761
Example
From: eldonxv4 [eldonxv4@hotmail.com]To: A name that's not mineSubject: G0XVB
Hillo7 761
Looks a little random but my bet is that it is either broken spamware or address harvesting. I think we can expect to see another spam run within the next couple of days. That's typically the way it worked in the past.
The following is the header information - pretends to be admin@microsoft.com. Has picture download now beta 2 Internet explorer 7. When clicked on upercase letters appear accross top of page.
Невозможно найти ресурс
Возможно, он был удален, переименован, или временно недоступен
Received: from localhost (localhost.localdomain [127.0.0.1])
by cm-ms6.globat.com (Postfix) with ESMTP id B02A01033F
for <vhooper@whiskers-and-tails.com>; Sat, 5 May 2007 12:06:10 -0700 (PDT)
Received: from cm-ms6.globat.com ([127.0.0.1])
by localhost (cm-ms6.globat.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 25665-01-42 for <vhooper@whiskers-and-tails.com>;
Sat, 5 May 2007 12:06:10 -0700 (PDT)
Received: from cpe-76-175-99-28.socal.res.rr.com (cpe-76-175-99-28.socal.res.rr.com [76.175.99.28])
by cm-ms6.globat.com (Postfix) with SMTP id 5461510347
MIME-Version: 1.0
X-Originating-IP: [420.9.48.8]
X-Originating-Email: [vhooper@whiskers-and-tails.com]
X-Sender: vhooper@whiskers-and-tails.com
Received: (qmail 29268 by uid 111); Sat, 5 May 2007 12:06:12 -0800
Message-Id: <20070505040612.29270.qmail@cpe-76-175-99-28.socal.res.rr.com>
To: <vhooper@whiskers-and-tails.com>
Subject: Internet Explorer 7.0 Beta
From: admin@microsoft.com
Importance: High
Content-Type: text/html
Date: Sat, 5 May 2007 12:06:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at globat.com