Terry Zink's Cyber Security Blog

Discussing Internet security in (mostly) plain English

Strange new spam

Strange new spam

  • Comments 1

There's a new spam going round that we started seeing last Friday.  The subject line consists of a (seemingly) random string of characters composed of uppercase letters and numbers, and the body text contains two words: Hillo<number> followed by a string of numbers and lowercase letters (letters optional in the limited examples I've seen).


Example

From: eldonxv4 [eldonxv4@hotmail.com]
To: A name that's not mine
Subject: G0XVB

Hillo7 761


Looks a little random but my bet is that it is either broken spamware or address harvesting.  I think we can expect to see another spam run within the next couple of days.  That's typically the way it worked in the past.

Leave a Comment
  • Please add 1 and 1 and type the answer here:
  • Post
  • The following is the header information - pretends to be admin@microsoft.com.  Has picture download now beta 2 Internet explorer 7.  When clicked on upercase letters appear accross top of page.

    Невозможно найти ресурс

    Возможно, он был удален, переименован, или временно недоступен

    Received: from localhost (localhost.localdomain [127.0.0.1])

    by cm-ms6.globat.com (Postfix) with ESMTP id B02A01033F

    for <vhooper@whiskers-and-tails.com>; Sat,  5 May 2007 12:06:10 -0700 (PDT)

    Received: from cm-ms6.globat.com ([127.0.0.1])

    by localhost (cm-ms6.globat.com [127.0.0.1]) (amavisd-new, port 10024)

    with LMTP id 25665-01-42 for <vhooper@whiskers-and-tails.com>;

    Sat,  5 May 2007 12:06:10 -0700 (PDT)

    Received: from cpe-76-175-99-28.socal.res.rr.com (cpe-76-175-99-28.socal.res.rr.com [76.175.99.28])

    by cm-ms6.globat.com (Postfix) with SMTP id 5461510347

    for <vhooper@whiskers-and-tails.com>; Sat,  5 May 2007 12:06:10 -0700 (PDT)

    MIME-Version: 1.0

    X-Originating-IP: [420.9.48.8]

    X-Originating-Email: [vhooper@whiskers-and-tails.com]

    X-Sender: vhooper@whiskers-and-tails.com

    Received: (qmail 29268 by uid 111); Sat, 5 May 2007 12:06:12 -0800

    Message-Id: <20070505040612.29270.qmail@cpe-76-175-99-28.socal.res.rr.com>

    To: <vhooper@whiskers-and-tails.com>

    Subject: Internet Explorer 7.0 Beta

    From: admin@microsoft.com

    Importance: High

    Content-Type: text/html

    Date: Sat,  5 May 2007 12:06:10 -0700 (PDT)

    X-Virus-Scanned: amavisd-new at globat.com

Page 1 of 1 (1 items)