Spams and Scams

I have collected a few of the scam e-mails I've received that I found especially interesting. These are both attempts to get people to divulge financial info by posing as trusted parties.

Citibank Scam

This message used an interesting scheme for obfuscating the URL and making it appear to point to citibank.com, when it actually points to a Russian server. First time I saw this method, so I was intrigued.

Date: Sat, 15 Nov 2003 22:44:38 -0500
From: "Citibank" <Citibank66@citicards.com>
To: "*********" <*********@yahoo.com>
Subject: Citibank E-mail Verification: ********@yahoo.com

Dear Citibank Member,

This email was sent by the Citibank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Citibank ATM/Debit Card number and PIN that you use on ATM. This is done for your protection -- because some of our members no longer have access to their email addresses and we must verify it.

To verify your e-mail address and access your bank account, click on the link below. If nothing happens when you click on the link (or if you use AOL), copy and paste the link into the address bar of your web browser.

http://www.citibank.com:ac-WhXNAFxOXAuwcu4z9gci@pfdm5w7s3.Da.rU/?7U1gPvU8kBthTf6

---------------------------------------------
Thank you for using Citibank!
---------------------------------------------

This automatic email sent to: *********@yahoo.com
Do not reply to this email.

R_CODE: tVEiReMoptu0qJcJQ7L8

eBay Scam

The nonstandard grammar and spelling errors of this attempt are a dead giveaway of its bogosity. Still an interesting effort

Date: 12 Nov 2003 09:50:33 -0000
To: ********@stanford.edu
Subject: eBay Account Security Measures
From: "Security@ebay.com" <Security@ebay.com>

Hello,
Dear member,
eBay Security Department have investigated logins from ip 212.156.4.69 and 62.156.4.69 with your account. The Department reported that they are worried that your account might have been stolen and some one may be access your eBay ID and password. It might have been captured by spy software that some one put in your machine,So... We put your account under security mode (not restricted) , and you should follow some steps to secure your account.

1- You should update your account in our SSL server to prevent it from to be remotely accesed by anyone(Secure Accounts Server) click the link to update http://cgi.ebay.com/ws/eBayISAPI.dll?Verify&your?account

2- Wait 24 hours to detecting and routing of remote logins machine and you will be e-maild from support@ebay.com to continue using our service.

3-Try to re-setup your operating system and delete all files you suspect in.

With Best Wishes,
eBay Security Department Assistant,
Richard Michael.

Spammer Names

I've noticed that many of the spams I receive on my Yahoo accounts lately appear to have From: names generated according to a dictionary-based procedure. Just for good measure, I've scoured my mailbox for a sampling of spammer From: entries that attempt to resemble people's names:

Emma Hale
Dorian Gibson
Jacqueline Hall
Adulterants L. Pitchblende
Cammy Toes
Referendum H. Joey
Nancy Kurgain
Dr. Ponce de Leon
Josue Sharpe
Sissy Ramjob
Vivian Kumontop
Lottie Ewing
Misstate U. Reconstructs
Debra Lane
Jon Delman
Jean Wilcox
Janice Bidana
Scintillating J. Readmits
Kellie Fenton
marina deltoro
Matt McMillan
Jennifer Dripping
Catalepsy O. Councillors    
Sakhalin K. Cleaning
Insulin F. Dogfight
Jessica Dipsy
lois torrese
Sondra Hinson
Wild Virginia
Jasmine Duright
Lou Golden
lucille perrez
Gimmick M. Hits
Inflammations H. Humanoids
Jessica Jodam
Elena Pike
Don Nicholas
Cynthia Jizlove
Janice Yeahbabe
Nathaniel Robbins
Barbara Busty
Gretchen Blue
Trisha Tushpack
Wanda Dickens
Cornelius Dominguez
Jasmine Underfinger
Sherry Devnuts 
Sarah Smith
Cynthia Holysmokes
Rebecca Johnston
Linda Blowhard
Juana Gibson
Ricardo Witt
Megan Ayers