The Spam Omelette #38

Welcome to this week

Spam Omelette 38

1. MESSAGE in a bottle

Coming right as number
one spam word in the Spam Omelette top, the word MESSAGE has been identified in
messages coming from notorious spammer Canadian Pharmacy. At a glance, the
message looks as a legitimate newsletter from a health e-zine, but it has been
tampered with in order to include a Canadian Pharmacy picture with the current
offering. The fact that the word MESSAGE appears in the spam map is a clue that
the Canadian Pharmacy spammers have replaced their old templates ripped off
from MSN News newsletters.


message spam


2. Nigerian scammers say PLEASE

Ranking second in this
week’s issue of the Spam Omelette, the word PLEASE has been identified
especially in Nigerian scam letters.  This
specific wave presented below is made of extremely short messages (unlike
“regular” Nigerian letters) and asks for a couple of personal details needed
for an alleged payment.

please spam

3. When there’s a will, there’s

 The word WAY has been detected by the
BitDefender antispam researchers in messages advertising sexual enhancements
such as Viagra and Levitra. What’s particularly interesting in this wave is the
fact that spammers rely on image advertising along with a couple of lines taken
from books. The extra text has nothing to do with the advertised product;
instead, it makes sure that the message gets past the Bayesian spam filters.
The text below is an excerpt from Armadale by Wilkie Collins.

way spam

4. Need an ACCOUNT number? Here
it is!

Ranking fourth in this
week’s issue of the Spam Omelette, the word ACCOUNT has been identified in yet
another Nigerian scam. This time, it comes as a long and extremely
lacrimogenous letter announcing the victim that a dormant account with $12
million is ready to become theirs. All they have to do is pay a small
processing fee. As soon as the payment has cleared out, you will never hear
from the scammer again.

account spam

5. CLICK here for extra
medicine spam

The word CLICK concludes
this week’s issue of the Spam Omelette and has been mostly identified in
messages coming from Canadian Pharmacy. The new template allegedly offers users
a way of unsubscribing, but clicking the links would only validate the address
as being in use by a human operator. Spammers are using this template with
multiple email subjects, including an alleged tutorial on how to use the new
Yahoo profiles.

click spam


About the author


Bogdan Botezatu is living his second childhood at Bitdefender as senior e-threat analyst. When he is not documenting sophisticated strains of malware or writing removal tools, he teaches extreme sports such as surfing the web without protection or rodeo with wild Trojan horses. He believes that most things in life can be beat with strong heuristics and that antimalware research is like working for a secret agency: you need to stay focused at all times, but you get all the glory when you catch the bad guys.