It may be hard to believe, but I have not altered one bit of this unsolicited e-mail I’m quoting here:

Subject: lacie
From: “earle oxford” <wesansgar@emailaccount.com>

sol

http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^%}={%ROT
F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}

later,

kenya

And to think that companies are actually paying for this— nice way to recoup your investments when the recipients can’t even get to the page…

Y’know, after I got one too many spams advertising a Canadian pharmacy “verified by BBB”, I just had to go check it out and see how truthful they were.

So, after removing all tracking information from the URL to prevent any sort of click-through revenue, I entered the address of the site. It looked fairly legitimate, and even had a number of seals at the bottom identifying affiliation with various big names in online business.

Except… well, let’s just say that something was rotten in the province of Ontario.

Upon closer inspection, every one of the links pointed to a page on the pharmacy’s own domain. Sure, they tried to hide it by hiding the address bar via JavaScript, but it wasn’t too hard to unhide it and reveal their duplicity.

And why were they hosting the BBB report on their own site, rather than linking to the BBB? A quick search at the BBB’s web site turned up the real report (compare the mailing address in that first screen shot if you have any doubt!), which points out that they’re not even a member— membership, of course, being a requirement to display the seal featured on the front page. Oops.

Oh, and also, those links in the fake report don’t work at all. So much for getting the much-needed background information.

Even worse: They claimed to be a secure site using a Verisign encryption certificate. Of course, that was also a fake certificate hosted on their site. Indeed, there was no security at all— no padlock in the corner, no HTTPS URL, nothing.

So yeah. Avoid these guys like the plague— no pun intended!

This one… well, I’m not even going to touch the URL, because it doesn’t work anyway. :-p

Subject: Application approval #06864597I Sun, 24 Jul 2005 09:33:19 -0800
From: “Rodney” <Rafael.Braun@charter.net>

(more…)

Subject: UK NATIONAL LOTTERY CONGRATULATE’S YOU
To: codystw@sinamail.com.tw

Never mind that errant apostrophe— why should I be concerned that some random guy in Taiwan won the lottery?

I also have a spam for prescription drugs here from one Sanatorium D. Tinglier. Honestly, I’m not sure I’d be willing to buy drugs hawked by someone with a name like that!

I swear, I just don’t get spammers sometimes. “Fill your wife’s hospital”?!

As is usually the policy around here, all the text below, save for the URLs, is verbatim.

Subject: Rep0rt : f|LL yOur w1fe’s hospita| nOw
From: From: “Dena Horton” <fvgpvpz@webtv.net>

(more…)

I’d be far more inclined believe your e-mail is a notification from a major online bookseller if it didn’t contain sentences like this one, quoted verbatim:

“Complete the form below , with all your corect information wroted by you las time you changed / updated or maked ! your acount.”

Wroted? Maked? Come on…

LOL. Someone’s trackback-spamming my blog with a link to “http://thebest-pills/weight-loss-pills.html”. I’m not leaving anything out of that URL– that’s exactly what they posted.

Yes, that’s right. No top-level domain whatsoever. Talk about pointless spam.

Again, other than the URLs, this is verbatim. Why do these people not go through a test run to verify that their configuration is correct before spamming the world?

Subject: Re: bestQuotesToday
From: “Philips” <Philips>
To: “Philips” <lifephilip@cagefactor.com>

Hi

We tried to contact you earlier about %CUSTOM_3 your home at a %CUSTOM_4 %CUSTOM_5
%CUSTOM_6 would like to let you know that we have gone ahead and started the %CUSTOM_8 process.

Here are the results:

Amount: $203,200 - $879,000
%CUSTOM_5: 3.77 - 6.94

%CUSTOM_7
appreciatrust.###/mg/1

Goodbye
Philips

......................
%CUSTOM_OPTOUT
querysearchis.###/r

Both of these were actually spotted in my spam trap this morning. The actual body of the message was a ridiculously HTML-obfuscated ad for a mail-order pharmacy (not surprising, really).

Subject: Re: spatangoid about it
From: “Gunfights C. Constructions” <kash@adacomputer.com>

Apparently a spatangoid is a type of starfish. Given these absurd headers, I wouldn’t be surprised if the spammers responsible for this had the relative intelligence of starfish.

Subject: re: unjointed info
From: “Packed D. Swamped” <smobley@adcomfg.com>

Mr. Swamped, the name is probably appropriate given how many gullible people must order from you, but I prefer my information to be jointed, thank you very much.

Edited to add: How did I miss this one while scanning through my spambox?

Subject: re: milked info
From: “Gesundheit M. Subheading” <don@1acredit.net>

I suppose you ought to milk the info for all it’s worth. And Gesundheit is a wonderful name for someone selling medications!

I always knew the stock spammers and medication spammers had to be in cahoots…

As usual, I’ve obfuscated the domain names to avoid drawing any undue attention to the spammers’ sites. Everything else, of course, is verbatim as usual.

Subject: HOt penny st0ck pick fue|ed by high demand
From: “Harlan Beach” <harlanbeachre@neo.rr.com>

SAVE-BiG 0nl|NE Ph4rm4cy
We sell Brand Name FDA Approved Meds At Aff0rdable Prices.
S$ve up to 80% compared to normal rates.

(more…)