There's a new spam going round that we started seeing last Friday. The subject line consists of a (seemingly) random string of characters composed of uppercase letters and numbers, and the body text contains two words: Hillo<number> followed by a string of numbers and lowercase letters (letters optional in the limited examples I've seen).
Example From: eldonxv4 [firstname.lastname@example.org]To: A name that's not mineSubject: G0XVB Hillo7 761
From: eldonxv4 [email@example.com]To: A name that's not mineSubject: G0XVB
Looks a little random but my bet is that it is either broken spamware or address harvesting. I think we can expect to see another spam run within the next couple of days. That's typically the way it worked in the past.
The following is the header information - pretends to be firstname.lastname@example.org. Has picture download now beta 2 Internet explorer 7. When clicked on upercase letters appear accross top of page.
Невозможно найти ресурс
Возможно, он был удален, переименован, или временно недоступен
Received: from localhost (localhost.localdomain [127.0.0.1])
by cm-ms6.globat.com (Postfix) with ESMTP id B02A01033F
for <email@example.com>; Sat, 5 May 2007 12:06:10 -0700 (PDT)
Received: from cm-ms6.globat.com ([127.0.0.1])
by localhost (cm-ms6.globat.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 25665-01-42 for <firstname.lastname@example.org>;
Sat, 5 May 2007 12:06:10 -0700 (PDT)
Received: from cpe-76-175-99-28.socal.res.rr.com (cpe-76-175-99-28.socal.res.rr.com [126.96.36.199])
by cm-ms6.globat.com (Postfix) with SMTP id 5461510347
Received: (qmail 29268 by uid 111); Sat, 5 May 2007 12:06:12 -0800
Subject: Internet Explorer 7.0 Beta
Date: Sat, 5 May 2007 12:06:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at globat.com