Zone38 Presents...
Letters to the World


Epic phisher phail

Filed under: General — codeman38 @ 11:06 am

I just got what may be the most inept phishing e-mail I’ve ever seen. And I’m going to quote it below just to show how absolutely mind-bogglingly bad it is.

Subject: WebNews Email Account Update
Date: April 25, 2008 10:41:02 AM EDT
To: “undisclosed-recipients:”

Dear Webmail Subscriber,

This message is from messaging center to all email account owners. On Fri, April 25th, 2008, from 3:00 PM until 9:00 PM, all Mailhub systems will undergo regularly scheduled maintenance. Access to your e-mail via the mail client will be unavailable for some time during this maintenance window. We are currently upgrading our data base and e-mail account center – see homepage. We are deleting all email account to create more space for new accounts.

To complete your Webmail account, you must reply to this email immediately and enter your password here (********) Failure to do this will immediately render your emailaddresshere(**********)deactivated from our database.

You can also confirm your email address by logging into your account at

Thank you for using THE uga.eduu TEAM”

—- Msg sent via KSU Webmail –

Let’s see… what all is wrong here?

  • Yeah, I think UGA’s administrators would send official correspondence from a Gmail account. Riiiight.
  • And they’d send it via KSU Webmail, no less.
  • And judging from the “To” line, the KSU in question is King Saud University in Saudi Arabia.
  • And last, but definitely not least, the only thing on UGA’s homepage (“see homepage”, right?) about this is… a scam warning.

Seriously, scammers? Don’t quit your day job.

1 Comment »


    From: “UK ONLIN LOTTERY COUNCIL” Save Address Block Sender This Is Spam
    To: “undisclosed-recipients:”
    Subject: Result Grid!!!
    Date: Sun, 14 Dec 2008 12:50:25 +0300
    Received: (qmail 25719 invoked by uid 0); 14 Dec 2008 09:52:07 -0000
    X-Ob-Received: from unknown ( by; 14 Dec 2008 09:52:07 -0000
    Received: from localhost ( []) by (Postfix) with ESMTP id 24B5E33679B for ; Sun, 14 Dec 2008 09:52:07 +0000 (GMT)
    X-Ob-Received: from unknown ( by; 14 Dec 2008 09:52:07 -0000
    Received: from relay1.localdomain ( []) by (Postfix) with ESMTP id B1ACF889C for ; Sun, 14 Dec 2008 09:52:06 +0000 (GMT)
    Received: from relay1.localdomain (localhost []) by (Postfix) with ESMTP id 029E6EC30; Sun, 14 Dec 2008 12:50:29 +0300 (AST)
    Received: from (smtp [])by relay1.localdomain (Postfix) with ESMTP id 462E95CA3;Sun, 14 Dec 2008 12:50:27 +0300 (AST)
    Received: from (localhost [])by (Postfix) with ESMTP id 42465D6008;Sun, 14 Dec 2008 12:48:27 +0300 (AST)
    Received: from ( [])by (Postfix) with ESMTP id C7DE7D6007;Sun, 14 Dec 2008 12:48:26 +0300 (AST)
    Content-Disposition: inline
    Content-Transfer-Encoding: quoted-printable
    Content-Type: text/plain; charset=iso-8859-1
    Mime-Version: 1.0
    X-Uidl: 1229248225155308179
    X-Mailer: AtMail 4.1
    X-Imss-Version: 2.051
    X-Imss-Result: Default_Triggered
    X-Imss-Scaninfo: M:P L:E SM:0
    X-Imss-Tmaseresult: TT:0 TS:0.0000 TC:00 TRN:0 TV:5.5.1026(16338.000)
    X-Imss-Scores: Clean:0.00000 C:2 M:3 S:5 R:5
    X-Imss-Settings: Baseline:1 C:1 M:1 S:1 R:1 (0.0000 0.0000)
    X-Spam-Status: No, hits=1.035 required=6 tests=[PLING_PLING=1.034, UNPARSEABLE_RELAY=0.001]
    X-Spam-Level: *

    Show Basic Headers Back To [INBOX]

    Your email address emerged a winner of £3,000,000.00 on U.K. Online Lottery.
    Name:Mr.Mark Walter

    Heneri K. Lloyd
    (Online Promo Co-ordinator

    —- Msg sent via KSU Webmail –

    Comment by mary — 14-Dec-2008 @ 7:49 am

RSS feed for comments on this post. TrackBack URL

Leave a comment

You can use these HTML tags:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

© 2001-2018 codeman38. Powered by WordPress.