thewayne: (Default)
If a mailer is trying to send more than 5,000 emails a day to Outlook.com, Hotmail.com, or Live.com email addresses, and the server is not configured to standards, Microsoft is going to block the emails from going through their networks with an error message. Yahoo and Gmail have been doing this for some time.

Specifically, "... (the) SPF record must clearly identify which IPs can send on your domain’s behalf. DKIM must sign the message with a valid key. And DMARC needs to be published, with alignment to either SPF or DKIM. Preferably both. Without all three in place, Microsoft will silence you."

This will make it harder for fly-by-night spammers to get messages through as they often do not have top-shelf IT people supporting them. It will also cause problems for legitimate mass mailers who use third-party email providers who also do not have top-shelf IT people who may be a little soft on their mail server configuration.

But this is the price paid because scammers are determined to make sure that we cannot have nice things.

https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730

https://betanews.com/2025/05/05/microsoft-email-blocks-start-may-2025/

https://it.slashdot.org/story/25/05/05/1817247/microsoft-cracks-down-on-bulk-email-with-strict-new-outlook-rules
thewayne: (Default)
It looks like my McAfee subscription has been renewed about a dozen times now! So is that good for twelve years, or am I 12x protected?

Ignoring the fact that I do not and never would use that product.

(I just deleted two "invoices" from my spam folder. Why they think the sender having my name would make me think they are authentic is completely beyond my ken.)
thewayne: (Default)
No, that's not the word. What's the word?

Not. Guaranteed that I'll not open it.

The subject line is: Ꮯοոցrаtսⅼаtіоոѕ Υοս hаⅴе ѕսссеѕѕfսⅼⅼу Ԝοո аո ΝFΤ іtеⅿ !

You send me an email with shifted case and multiple fonts like that, you ain't gonna win me over, skippy! Not to mention trying to hook me into an NFT scam?

Nope.
thewayne: (Default)
AND COSMIC JUSTICE!

The robocalls targets black zip codes in cities with large black populations, with a black voice actress reading the following script:

Hi, this is Tamika Taylor from Project 1599, the civil rights organization founded by Jack Burkman and Jacob Wohl. Mail-in voting sounds great, but did you know that if you vote by mail, your personal information will be part of a public database that will be used by police departments to track down old warrants and be used by credit card companies to collect outstanding debts? The CDC is even pushing to use records for mail-in voting to track people for mandatory vaccines. Don't be finessed into giving your private information to the man, stay safe and beware of vote by mail.

The robocalls violated several calls because they targeted cell phones and went up against anti-KKK laws. And the people behind them got nailed bigly.

But here's the best part. As a part of their supervised community service - they "...were ordered to work 500 hours of community service." The ordered community service consisted of registering voters in minority and low-income communities, the FCC said."

Oh, the irony! And the glee!

https://arstechnica.com/tech-policy/2023/06/robocalls-claiming-voters-would-get-mandatory-vaccines-result-in-5m-fine/
thewayne: (Default)
The standard "your account is suspended" crap. But as I was scrolling down to the bottom to get to the button to forward it to spoof@paypal.com, I noticed the following bit of text:

𝖧𝗈𝗐 𝖽𝗈 𝖨 𝗄𝗇𝗈𝗐 𝗍𝗁𝗂𝗌 𝗂𝗌 𝗇𝗈𝗍 𝖺 𝗌𝗉𝗈𝗈𝖿 𝖾𝗆𝖺𝗂𝗅?
𝖲𝗉𝗈𝗈𝖿 𝗈𝗋 "𝗉𝗁𝗂𝗌𝗁𝗂𝗇𝗀" 𝖾𝗆𝖺𝗂𝗅𝗌 𝗍𝖾𝗇𝖽 𝗍𝗈 𝗁𝖺𝗏𝖾 𝗀𝖾𝗇𝖾𝗋𝗂𝖼 𝗀𝗋𝖾𝖾𝗍𝗂𝗇𝗀𝗌 𝗌𝗎𝖼𝗁 𝖺𝗌 "𝖣𝖾𝖺𝗋 𝖯𝖺𝗒𝖯𝖺𝗅 𝗆𝖾𝗆𝖻𝖾𝗋". 𝖤𝗆𝖺𝗂𝗅𝗌 𝖿𝗋𝗈𝗆 𝖯𝖺𝗒𝖯𝖺𝗅 𝗐𝗂𝗅𝗅 𝖺𝗅𝗐𝖺𝗒𝗌 𝖺𝖽𝖽𝗋𝖾𝗌𝗌 𝗒𝗈𝗎 𝖻𝗒 𝗒𝗈𝗎𝗋 𝗀𝗂𝗏𝖾𝗇 𝗌𝗎𝗋𝗇𝖺𝗆𝖾 𝖺𝗇𝖽 𝗀𝗂𝗏𝖾𝗇 𝗇𝖺𝗆𝖾.


Here's the amusing part: they didn't address me by my name, just my email address. That would have certainly woken me up if they had my name!
thewayne: (Default)
Dear Valued Customer,


During our usual security enhancement protocol, we observed multiple login attempt errors while login in to
your online banking account.

We have believe that someone other than you is trying to access your account for security reasons, we have temporarily suspend your account and your access to online banking and will be restricted if you fail to
update.


* * * * *


I didn't discard the email out of hand. While we don't do any checking/savings/credit card with Chase, Russet's Subaru from the elk crash last year is financed through them, so I had to open it.

Yep, spam.

Love the spacing! Unfortunately you can't see the multiple internal spaces between words, like you can't see that the Dear Valued Customer is not lined up with the rest of the verbiage. I particularly loved the "during our usual security enhancement protocol" and "errors while login in to" and "We have believe". And 'we believe someone is trying to access my account for security reasons'? They're going to improve your security, or my security, or what? The second paragraph is a complete mess.

Of course, the email address of (at)Frontier.com was a complete giveaway. They don't even make a decent attempt at hiding their domains anymore!

I don't think they completed their Financial Spam Email 201 course.
thewayne: (Default)
Classic spam:

"We have recently detected that different device user a attempted gaining access to your Online account linked with your email, and multiple password was attempted with your user ID.
It is now necessary to re-confirm your account information to us.

If this process is not completed within 24-48 hours. We will be forced to suspend your Account Online Access as it may have been used for fraudulent purposes.

Please Sign in to visit and update profile immediately www.bankofamerica.com.

Please remember to review your statement to see transactions, payments, and other important account information and disclosures.

Thank you for being a Bank of America customer.
You received thik email as part of your existing relatienship with us."


We've got classic bad spelling and English grammar usage, indicating country of origin being non-native English speakers.

And the big tell? The email domain it came from: Hotynews.com. They didn't even try to disguise the domain!

But there's something else hidden in this message that you can't see because I cut them out: at the end of paragraphs are the phrases "SHOP NOW", "SOLD 50% OFF" and "Buy now"! They set the text to white text on white background, so they're invisible, and presumably links to shopping sites somewhere, but I can't be bothered to activate the message or look at the HTML code behind it.

So not only are they trying to steal your account credentials, they're trying to get you to buy crappy merchandise!

My wife pointed out that even with these obvious tells, they're still going to net a few accounts from incautious people, which is kind of tragic.
thewayne: (Default)
One last night, one a week or two ago. Dangerous information that could lead to infectious payload obscured.

The older one:
From:
checkinfowellsrecurringdepositXXXXX[Bad username or site: fatalerrornerd @ com]

Message text:
(Suspicious Activity) http://bit.ly/2WeXXXXX CustomersWellsBank LimitedActivityAccountLocked82
-----
So we have horrible structure, no actual English language, just run-on words. And I'm supposed to take a text from an email domain of FatalErrorNerd.com seriously?!


Last night's message:
From:
investmentwellsauthXXXXX[Bad username or site: investingnews @ com]

Message Text:
(WellsFargo) Your account was Limited - http://bit.ly/2ETXXXXX
Please update your personal information to avoid account locked.
Thank you
-----
Well, at least we have English sentence structure, even if it is a bit stilted, indicating a probable non-native English speaker. Definitely not reviewed by a corporate communications executive.

The first one says CustomerWellsBank, which implies I'm the customer of something called Wells Bank. There is no Wells Bank. The second one at least is explicitly trying to trick me if I'm a Wells Fargo customer, which I would not be a customer of those bastards in a million years. If they gave me a million dollars up front to open an account I'd deposit a penny and leave it there.


So on to email!

This one is a little bit interesting. A couple of weeks ago I had a problem on my iMac: something went REALLY weird in Firefox, and attempting to do ANYTHING in FF totally blew the mind of my video card and made the display dangerously unviewable, as in anyone epileptic in viewing distance would be incapacitated. I made the decision to create a new user account on my computer and copy everything from A to B. I don't run from accounts that are admin-privileged, so I signed on to an admin account, opened two finder windows, pointed them to the respective user data trees, gave the admin account appropriate permission, and it was literally just drag and drop. I left iTunes alone until I did some research, and that was also easy to do: I was overcautious. As it turns out, my FF problems sort of followed me, and I ended up deleting it and reinstalling it. Fortunately I had made a backup of my bookmarks the previous week, so nothing was lost.

The interesting bit was that when I deleted the damaged user account, I recovered an additional 200 GIG of disk space! And this was after running cache-clearing utilities! I don't know what was hidden, but clearly something was.

ANYWAY, on 6/2 I received an email allegedly from Apple Support. Clearly it was not. Now, the story gets interesting right off the bat: I couldn't copy and paste the text of the email! The whole thing apparently is in unicode! It appears to be text, you can select and copy individual letters and words in the text message, but when you do you end up with a big block of hexadecimal code! The second interesting thing appears because I don't let email messages load graphics because of email trackers. An interesting phrase appeared: "Hasil gambar untuk apple". I assumed this probably represented a placeholder or image tag for the Apple logo, and plugged the phrase in to Google Translate. The result was Indonesian Malay!

So the only way I could copy the message would be to retype it from scratch, which is what I'm doing. At least the header was required to be in ASCII-128 and copied properly.

Email Message:
Apple Support <bg45ng-h7skdj37sjdh3nh4fz3.rigayunah42@0477-politikus53.bg45ngg.<b>XXXXX.inginselamyadiamdigoa.org> [wow! I didn't know Apple used .org email addresses!]
Today at 10:16 AM

To wwXXXXX[Bad username or site: yahoo @ com]

This message contains blocked images. [from my not allowing images to load]
Message body

Hasil gambar untuk apple [the forementioned Malay]


Dear wwXXXXX[Bad username or site: yahoo @ com]

For your protection, your Apple ID is automatically disabled.

We have prevented an unusual sign in attempt on your Apple account. This may have been because you're signing in from a new location or from a different device. Please review the sign in details below:

Your account access has been locked for the following reason(s):
-Juni 2 2019
: We check your account log in with other device.
-Juni 3 2019 : Your account has been locked until this issued has been resolved. We will wait for 1 week or your account has been disabled permanently.

What to do Next:

Please Click the login button below to your Apple account and provide the requested information before 1 week. Through the Account Review, if we don't receive the information before this deadline, your account access may be further locked permanently.

Sincerely,
Apple Support


This email was intended for ,.
Copyright (c) 2019 Apple Inc. All rights reserved.
case-id bG45nG

-----

Well! If you do a quick read, the English might pass muster, but it doesn't on a close read. The Juni months instead of June is a dead giveaway. But it's always the email addresses that they fail at. Another curious thing is the centered text at the bottom, associated with the Dear [my email address]. Apple would have my [first name/last name] and could/probably would include it if they actually contacted me. These scammers don't. I'm guessing the comma/period might be a missed mail merge that didn't fill properly.

Anyway, fun stuff to look over.
thewayne: (Default)
From: Yahoo Security <87503176.11BF7B5CFC9BBB4072468Asadewnaxdfanuw@fviggqnauynfwi.com>
To: ww...
Sent: Monday, January 22, 2018 6:55 AM
Subject: Something is Wrong With Your Email Account

You need to call now 1 855-XXX-XXXX

We Have Detected Unusual Activity With Your Yahoo Account on Your Computer

Login Has Occurred on 1/22/2018 @ 3:04 AM EST

From IP: 34.124.12.1 Geo Location Found: Eastern Russia

If This Was Not You Please Call the Yahoo Security Team
(Be at your computer)

1 855-XXX-XXXX


First off, take a look at that wonderful email address. Yeah, that's clearly Yahoo Security.

Next, Look At How Every Word (almost) Is Capitalized. Doesn't everyone Send Emails Like That?

One might assume that this originated in Russia. Maybe yes, maybe no. Wherever it came from, they used American date format and an American time zone. Now the IP address is interesting. If you do a lookup of an address, you can usually find out who the ISP is. In this case, it's HALLIBURTON IN HOUSTON, TEXAS! Remember Dick Cheney's old digs before he became Dubya's veeps? Yep, them. So somehow an IP address of 34.124.12.1, which terminates in Houston, TX, somehow generated a login to my Yahoo email in Eastern Russia?

You can look up the location of an IP address at sites such as https://www.melissadata.com/lookups/iplocation.asp.

You'd think these twits could at least have looked up a big city in eastern Russia and gotten their IP address to give it some verisimilitude.

I tried doing a traceroute on the address, but after it left my ISP after the third hop, it just sort of died. I suspect Halliburton.com has some sort of countermeasures that eats such requests and puts the incoming traceroute packets in to a loop: I killed the program after 50 steps without result. Houston shouldn't have taken more than 8 hops or so from southen NM to establish it was in SE Texas.

I blocked out the phone number: according to 800notes.com, some people have called it and it has something to do with Hillary and Russian collusion.
thewayne: (Default)
"HELLO MY DEAR
Hi,....

Greetings from my sincere heart, i gotten your contact via searching i made on the Internet.

I have been undergoing treatment for Cancer. My husband was murdered alongside our only son GREG by those who are envious of his position in the same office.

Before his death he made a vow to use his wealth for the down trodden, orphanages and the less privileged in the society.

Having known my critical condition I decided to donate this fund to an individual or better still a God fearing person like you who will utilize this money the way I am going to instruct here in. I am seriously down by the cancer.

I want an individual that will use this fund and provide succor to poor and indigent persons, orphanages, and widows and for the propagating peace. What is required of you is your honesty, trust and sincerity.

Any delay in your reply will give me room in sourcing for another individual for this same purpose. Please be sincere in your heart.

I will like TO SPEAK WITH ON PHONE, so I appeal to you to humbly provide your phone to enable me speak with you on phone.

Reply Me Via My Personal Email:...... (elizswy@yahoo.com).....

My Regards To You And Your Family.

Thanks With Deep Love & Gratitude

Elizabeth S. Wylie
(WIDOW "

Yes, the message ends with an open paren. The DW profile was created on the 29th and has no posts or information on the profile, though curiously it lists a full street address in Ohio. I blocked this person and hopefully DW will purge them.
thewayne: (Cyranose)
One recurrent spam that I receive at my former work account and regularly on one of my personal email accounts has the subject line "New F@ck buddy alert!"

The @ symbol is commonly read as "At", so how do you pronounce "fatck"?

In linux you have the fsck for file system check, so is this a Windows command for checking the file allocation table? And why would I need a buddy to check that?

I just don't understand this modern world.


Another amusing spam that I received was from someone named Asia who said they were from the Ukraine. Do they travel a lot and recently relocated? Do they change their name whenever they travel? If they were in Africa, would they say their name was North America?


Yes, I'm rambling. The last few days have been conducive to random acts of weirdness. But my wife arrived yesterday, and we went and saw The Secret Life of Pets last night, and I laughed my butt off. I should check with the theater and see if they found it, it's hard to keep your pants up when your butt is missing.
thewayne: (Cyranose)
I got two good ones recently posing as notification that I have to renew my web domain registrations. My domains cost $9ish to renew. Here's part of the text:

"Failure to complete your Domain name search engine registration by the expiration date may result in cancellation of this offer making it difficult for your customers to locate you on the web.

Privatization allows the consumer a choice when registering. Search engine subscription includes domain name search engine submission. You are under no obligation to pay the amounts stated below unless you accept this offer. Do not discard, this notice is not an invoice it is a courtesy reminder to register your domain name search engine listing so your customers can locate you on the web.

This Notice for: WWW.WAYNEWESTPHOTOGRAPHY.COM will expire on FEBRUARY 03,2015 Act today!

Select Term:
[ ] 1 year 02/03/2015 - 02/03/2016 $75.00
[ ] 2 year 02/03/2015 - 02/03/2017 $119.00
[ ] 5 year 02/03/2015 - 02/03/2020 $199.05
[ ] 10 year -Most Recommended- 02/03/2015 - 02/03/2025 $295.00
[ ] Lifetime (NEW!) Limited time offer - Best value! Lifetime $499.00


The interesting thing is the line about "Domain name search engine registration". They're not actually selling you domain name registration, they're trying to sell you search engine optimization. Then the last paragraph was great, I'll bet they wish they'd sent it in 4 point type:

By accepting this offer, you agree not to hold DS liable for any part. Note that THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amounts stated unless you accept this offer. The information in this letter contains confidential and/or legally privileged information from the notification processing department of the ...

I love the "THIS IS NOT A BILL" bit, and the 'contains confidential legally privileged information'. No it doesn't, sweetheart. If you sent it online, and you sent it unsolicited, it's fair game.

It's a scam trying to sell a service of dubious value under the thin veneer of looking a little like an invoice. But it did prompt me to review my three domain registrations and renew one of them a few months early.
thewayne: (Cyranose)
It's interesting. We're used to being presented with a Captcha box with squiggly letters that supposedly only humans can decifer (which software could in some circumstances), now Google will be presenting us with a checkbox that says 'I am not a robot.'

The little square that the text and box are in is monitored, and Google says that the characteristic of a person checking that box is unique and identifiable. I just wonder how long it will take spammers to figure out how to make the mouse pointer jiggle a little bit before checking the box. I also wonder how this will work with assistive devices for people who don't use conventional pointing devices.

http://www.wired.com/2014/12/google-one-click-recaptcha/
thewayne: (Default)
Just got two alleging to be from Verizon Wireless. I actually opened them, they had my "billing statement", which I did not open, one of which claimed I had a $900 balance owed.

I opened them because I just bought an iPhone 4S and thought it might actually be related. I had it shipped to my parent's in Phoenix in vain hopes that it would arrive while I was in town. It didn't, so they had to turn around and ship it to New Mexico.

Here's a couple of suggestions to would-be spammers. First, if I see something alleging to be from someone with whom I do business, if I see dozens of To: addresses in addition to mine, that's a clue. Next, if you want to send me a traffic ticket from New York, it might be helpful if I had been in New York state in the last almost 40 years.

Now if only that Nigerian prince would return my emails....
thewayne: (Default)
I keep spam email that I find mildly interesting, and I have five from: Madison, Madison Chan, Madison Hastings, Madison Call, and Madison Reece. The first and the last two are identical messages, all of them imply previous x-rated contact in a chat room. All five in the last month.

I've also been getting a lot of "problems with your IRS return" and one that was kind of cool: an email saying that I'd gotten a traffic ticket in some municipality that I've never heard of. That was new, but still just a variation on a theme.

The other thing amusing me is Live Journal spam replies. I've turned on filtering so that anonymous replies on my LJ are screened and have to be approved by me, so they never get through, but you'd think that a person leaving such would check to see if it's visible. There are two things that I find odd about the LJ spam is they're not always appearing on my latest posts, they sometimes go kind of deep into my blog and post replies to things that are a couple of years old. I know most of these are search engine link farming, but there are a number of these that are brief messages with no links, so I'm not sure what to make of those.
thewayne: (Default)
From: Free Sample Enlargement
Subject: The Greatest Shag of All

(I didn't open the message)

So, you get a sample from somewhere and for no cost, it gets really big. Cool! I get food samples from Trader Joe's whenever we go there, so this could feed both of us instead of just having a bite. Or could the sample keep growing and destroy the store? Next Godzilla flick!

And greatest shag of all? We do kinda need new carpeting....
thewayne: (Default)
Subject: tn car dealer license 565
Body of post: 443257

No link, no URL, no nothing. It was posted anonymously, and I automatically screen all anonymous posts to prevent link farmers from getting hits, so again I say, WTF? Don't bother Googling it, there are no significant hits that I saw. And it was on a post from 2006! De merde étrange.
thewayne: (Default)
Subject: I've already contacted you concerning the online job. Please respond.
Saturday, January 23, 2010 8:07 PM
From: "Brittney Gallagher"

searching for a business partner .
My name is Mary.

If you have an account of ebay with a big number of positive feedbacks or you have an ebay store, we can have a
good deal despite the financial crisis! You’ll get even more raiting

I work at the warehouse and I can buy goods at cost price
No investments are needed.
We sell gardening and household equipment, tools and electronics.

feel free for questions: todehomskikos@yahoo.com

waiting for your response

MW

OK. First, the email is from Brittney. You say your name is Mary, and the email address that you want me to send my questions to is of no nationality that I can identify, nor does it bear any relationship to your name or the name of the account the message came from, nor does the address of the account that sent the message anything like any of the names mentioned in the email. At least the initials at the end of the message could correspond to someone named Mary.

Keep waiting for my response, baby, 'cause it ain't coming.
thewayne: (Default)
And they want to give me money! How fortuitous!

Head Office
International Monetary Fund
700 19th Street,
N.W. , Washington , D.C 20431
E-Mail: RemittanceDept@IMF.com

Attn:

First of all IMF apologizes for passing this message through to you in this manner; we wanted to ensure that the identity of the recipient is properly scrutinized. This is not a hoax or scam as you might think it is. Your undivided attention is highly needed to execute a charity project before the end of the March 2010.

Natwest Bank will be in charge of initiating transfer/delivery of your fund ($10.000.000.00usd) for charity work when your file has been forwarded to their office. You are further advised to contact immediately the office of Bernise Charity Foundation requesting that they forward your payment file to Natwest Bank immediately with the below information's accordingly:

Name: Mr. Donald Miller (Co-founder)
Office Address: 11 El Shams Bldgs., 8th District Nasr City
E-mail: Bernisecharityfoundation_A4@hotmail.com
Tel: (+2) 0116618850

IMF is monitoring the services of Natwest Bank with due process of law and order as the paying bank of your inheritance; we assure you that this inheritance awarded to you is free from any irregularities and it is completely risk free. The above fund was allocated to you after a MATRIX RESEARCH TEAM (MRT) was hired by Bernise Charity Foundation after the passing away of Mr. Michael Harson the founder of Bernise Charity Foundation which he left for his wife Dr. Mrs. Bernise Harson. She is now diagnosed of having Cancer of the lungs and has limited time left to be with her husband in Heaven. Kindly contact the foundation immediately requesting that they give urgent attention to your payment file and proceed with transfer.

MATRIX RESEARCH TEAM (MRT) will be visiting you in your country with a bank representative attached to have further discussions with you after transfer/delivery of your fund. We believe your good heart can continue the project for the World to see and benefit from.

Thank you very much for anticipated Co-operation and God bless.

Best regards

Paul V. Letterman
Head of Operations
International Monetary Fund (IMF)

Why do I think that perhaps the IMF might not have a clue who I am? I must say though, this is somewhat more interesting than some of the Nigerian hoaxes. Though my fav, and I'm really ticked that I didn't preserve the email, was the FedEx Courier Service one that they have oodles of money to give me.
thewayne: (Default)
One of the best spam subject lines that I've seen in a long time. Heck, correct the spelling, it could make for a great short story!

It was, of course, an ad to "Double YYour Sexual Pleasure", complete with a Ni hao.

June 2025

S M T W T F S
123456 7
8910 11121314
15 1617 18 1920 21
22232425262728
2930     

Syndicate

RSS Atom

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags
Page generated Jun. 27th, 2025 07:17 pm
Powered by Dreamwidth Studios