Dowload your Intuit.com invoice.

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]

VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.

Header:

From - Tue Aug 21 23:30:13 2012
X-Account-Key: account6
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Delivered-To: x
Received: by 10.58.218.134 with SMTP id pg6csp386680vec;
Thu, 16 Aug 2012 08:14:56 -0700 (PDT)
Received: by 10.66.83.8 with SMTP id m8mr2725759pay.48.1345130095542;
Thu, 16 Aug 2012 08:14:55 -0700 (PDT)
Return-Path: <ZoeBogren@bit-map.it>
Received: from sagembox ([41.249.149.200])
by mx.google.com with ESMTP id px6si8234066pbc.304.2012.08.16.08.14.46;
Thu, 16 Aug 2012 08:14:55 -0700 (PDT)
Received-SPF: neutral (google.com: 41.249.149.200 is neither permitted nor denied by best guess record for domain of
ZoeBogren@bit-map.it) client-ip=41.249.149.200;
Authentication-Results: mx.google.com; spf=neutral (google.com: 41.249.149.200 is neither permitted nor denied by best
guess record for domain of ZoeBogren@bit-map.it) smtp.mail=ZoeBogren@bit-map.it
Received: from col2-omc9-s5.col5.hotmail.com (col2-omc9-s5.col5.hotmail.com [65.55.90.19]) by mx.bit-map.it;
Thu, 16 Aug 2012 04:14:53 +0000
Received: from COL007-W66 ([65.54.51.78]) by col2-omc9-s5.col5.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 16 Aug 2012 04:14:53 +0000
Message-ID: <x@phx.gbl>
Return-Path: ZoeBogren@hotmail.com
Content-Type: multipart/mixed;
boundary="_37237dcc-03af-e692-37dc-0372849dccc0_"
X-Originating-IP: [68.110.18.250]
From: ZoeBogren@hotmail.com
To: x
Subject: Dowload your Intuit.com invoice.
Date: Thu, 16 Aug 2012 04:14:53 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: Thu, 16 Aug 2012 04:14:53 +0000

Body:

Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-538-6133 ($2.09/min).

ORDER INFORMATION

Please download your complete order id #8859363 from the attachment.(Open with Internet Explorer)

Comments:

At first glance this e-mail may appear as a phishing scam, but it has the same M.O. as one of those wire transfer malware spam e-mails.

What's interesting about these e-mails, is that each one has a different telephone number, so it seems like the malware spammers are trying to make an extra buck from incoming phone calls and will most likely exploit the situation and try to scam you even further.

As we mentioned in the Beneficial phishing scam example, never dial any phone number mentioned in a spam e-mail!

Other telephone numbers used in similar spam e-mails:
1-900-759-0337 ($3.39/min)
1-900-403-2758 ($5.39/min)
1-900-171-5785 ($4.59/min)
1-900-273-4420 ($1.69/min)

Noticed the different rate per minute? Something tells us this may be a form of hash busting, making the e-mail a little bit different each time and making it harder for the spam filters to detect it. But the rest of each e-mail is exactly the same as this one, so we have our doubts about whether this will have any significant effect on the spam filters.

From: ZoeBogren@hotmail.com

Just ask yourself, why would Intuit send you an e-mail from poor Zoe Brogen's hotmail account? One of the other samples we analysed, was sent from a spoofed (fake) craiglist e-mail address, so it is not only the telephone numbers that they are changing, they are mixing up the From addresses as well.

Dear customer:

Big, bright, red flashing lights! The generic greeting, the very first sign of a scam.

we may sned them in more than one delivery

Sned? Do you really think Intuit will make typos like this? The answer is simple... no!

Related Cyber Criminal Profiles:

No related profiles found.

Similar Spam Examples:

Intuit Phishing Scam - Your Intuit QuickBooks Order Confirmation
INTUIT Phishing Scam - Employer contributions report
Malware Spam - United Postal Service Tracking Nr. H8582404360
Malware Spam - Adobe Order N07973
Amazon.com Malware Spam - Order report

Related Malware Samples:

No related malware samples found.

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]