Greeting Card Spam
PLEASE NOTE: The 'From:' e-mail address mentioned for each e-mail on this page, is often a spoofed e-mail address and not necessarily the true origin of the malicious e-mail. Any links displayed in the e-mail below are only used by the spammer as the anchor text for the dangerous link and is not necessarily the website responsible for the malicious software.
Date: 19 September 2007
From: Greetings.com <Greeting@Greetings.com>
Subject: Hey, you have a new Greeting !!!
Contains link to: postcard.exe
Hello friend!
You have just received a postcard Greeting from someone who cares about you...
Just click here to receive your Animated Greeting !
Thank you for using www.Greetings.com services !!!
Please take this opportunity to let your friends hear about us by sending them a postcard from our collection !
Cheesy e-mail, isn't it?
Date: 13 May 2007
From: egreetings.com <egreetings@egreetings.com>
Subject: You've received a greeting from a family member!
Contains link to: postcard.exe
You have just received a virtual postcard from a family member!
.
You can pick up your postcard at the following web address:
.
http://www2.postcards.org/?a91-valets-cloud-31337
.
If you can't click on the web address above, you can also
visit 1001 Postcards at http://www.postcards.org/postcards/
and enter your pickup code, which is: a91-valets-cloud-mad
.
(Your postcard will be available for 60 days.)
.
Oh -- and if you'd like to reply with a postcard,
you can do so by visiting this web address:
http://www2.postcards.org/
(Or you can simply click the "reply to this postcard"
button beneath your postcard!)
.
We hope you enjoy your postcard, and if you do, please take a moment to send a few yourself!
.
Regards,
1001 Postcards
http://www.postcards.org/postcards/
Spammers have strange habits. Notice the full stop between each paragraph? These full stops are invincible in the original e-mail because the spammer made them the same colour as the background. Another strange thing to note is that the e-mail is supposedly from egreetings.com, but the message body refer to postcards.org.
