[Big Mac]

I think it would be mildly entertaining to have a thread devoted to really poorly written phishing messages. Here's one that got through Apple's server side .Mac filtering and was not even flagged by Mail (the country of origin seems to be China):

From: security-account@amazom.com
Subject: You must reset your account and identify your information !
Date: September 7, 2007 1:25:27 AM PDT
To: Big Mac
Return Path: <root@erohiroba.com>

Dear Member,

We have detected some unusual activity in your Amazon.com account from another country.

For your security account we require to urgent identify your personal information.

Please click on the link bellow and go thriugh the whole process:


http://moodle.canalwin.k12.oh.us/.se...nt-amazon.com/




We apologize in advance for any inconvenience this may cause you and we would like to thank you for your
cooperation as we review this matter.




Respectfully,
Amazon.com, Inc.



Please note that product prices and availability are subject to change. Prices and availability were accurate at the
time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. . 2007 Amazon.com.
All rights reserved. Amazon.com is a registered trademark of Amazon.com, Inc. Amazon.com, 1200 12th Ave. S., Suite 1200,
Seattle, WA 98144-2734. Reference:6668250

[C.A.T.S. CEO]

security-account@amazoM.com

[Big Mac]

rofl, didn't even notice that typo.

[Sherman Homan]

Looky here:
Canal Winchester Local Schools - Home
is a public school system in Canal Winchester, Ohio. I wonder who "moodle" is?!

[irunat2am]

Write The School

[besson3c]

Originally Posted by Sherman Homan 

Looky here:
Canal Winchester Local Schools - Home
is a public school system in Canal Winchester, Ohio. I wonder who "moodle" is?!

Moodle is an open source course management system used in education:

Moodle - A Free, Open Source Course Management System for Online Learning

[Person Man]

Originally Posted by besson3c 

Moodle is an open source course management system used in education:

Moodle - A Free, Open Source Course Management System for Online Learning

Definitely write the school. They probably don't know that their "free, open source course management system for online learning" is also being used as a "free, open source fraud management system for online scamming."

[Big Mac]

Okay, I sent a message to the school and moodle.org.

[besson3c]

Moodle is not going to be able to do a single thing about this. Just because the subdomain says Moodle doesn't mean that Moodle has any authority over the top-level domain.

It was nice of you to bring this to their attention, just saying don't worry about it if they don't respond. It was Canal Winchester that was exploited.

[Person Man]

Originally Posted by besson3c 

Moodle is not going to be able to do a single thing about this. Just because the subdomain says Moodle doesn't mean that Moodle has any authority over the top-level domain.

No, but if there was some sort of security flaw in their program that allowed the scammers to exploit the school's installation, I'm sure they'd want to know about it so it could be fixed.

As an aside, Canal Winchester is just outside of Columbus. For the longest time, along U.S. route 33 there was a highway sign for Canal Winchester. During the day it said "Canal Winchester," but someone had painted something over the reflective paint on the C, so at night when headlights illuminated the sign it said "anal Winchester."

[besson3c]

Originally Posted by Person Man 

No, but if there was some sort of security flaw in their program that allowed the scammers to exploit the school's installation, I'm sure they'd want to know about it so it could be fixed.

Good point... Looks like somebody uploaded the spam website to a directory writable by the webserver. I'd guess that a Moodle account was hijacked, and the exploit put in place by a script that exploits a badly designed Moodle form.

[Sherman Homan]

Here is one fresh this morning, the electrons are still warm!
Among the interesting features, the email is from Isaac Newton who still lives and writes from an Italian web domain for an official prize site in the Netherlands in conjunction with Microsoft.

newton.isaac@virgilio.it
NEDERLAND DAYZERS AWARD!!!
PALEISSTRAAT 5, 2514 JA,
THE HAGUE,THE
NETHERLANDS.
Official Website: Welkom bij Dayzers

Dear Beneficiary,

This
is to inform you that your email ID has won one million US Dollars (US
$ 1,000,000.00) only Payable in cash credited to security file Numbers;
UAD/5698245/5004701/POL at the Payment Bank in the first category of
our computer ballot email lottery with the said winning Numbers giving
below;

SERIAL Number:UAD/412554784500/ TICKET Number:UAD/012454012/
LOTTERY REF Number:07-13-31/54-64 FL,Lottery Date:
6/09/2007.For more
information,Please contact the Vetting &
Verification Department of
the payment office:

Contact the claim dept office:
************************************************** **
AGENT: Mr.Raymond
Collins.
Netherlands Claims Processing Lottery Agent.
Email:
dayzers22@aim.com
Email: dayzers_bv@myway.com
TEL; +31-643-610-875,
************************************************** **

The email lottery
draws was conducted from an exclusive list of 600,000.000 e-mail
addresses of individual,companies,and corporate bodies picked by an
advanced automated random computer search ballot system from the
InternetNO TICKET WERE SOLD)

This compensational program was
sponsored by the Microsoft Corporation and organized by the Dayzers
Netherlands organization.

Congratulations once again from all the
members of our staff.

Yours Sincerely,

Dr. platonik Marcello, For
Mrs. Gammah Van Broook (Lottery Director)
De Nederlandse Dayzers
Promotion
Official Website: www.da

[ghporter]

The sad thing is that both of these phishes WILL get takers. Silly, now completely bankrupt people...

[KeyLimePi]

I got a phishing e-mail disguised as an eBay security request once. I thought it was funny because instead of the author's signature listing eBay's "Safe Harbor" office, it said (no kidding) it was Pearl harbor.

[Mastrap]

Just got this:

Good day dear client.


Our bank is glad to inform you that we have achieved high level of security and we are moving with the times.

You have to confirm your personal information in order to receive weekly updates and reports from our security service.

Pay attention to this message because if you don't realize all the instruction we can't guarantee the security of your account.

So as to register pass-through authentication and you will received all news weekly.

To pass-through authentication click the following link : BancorpSouth Online Services


Yours sincerely,
Bank Administration

[irunat2am]

Originally Posted by Mastrap 

Just got this:

That is one of the worst ones I've ever seen. Sounds like a high schooler wrote it right off the bat.

[KeyLimePi]

yea, it's pretty bad, but to be fair, his English is much better than my Nigerian.

[Mastrap]

And don't forget, they're moving with the times.

[cheruman]

This may be of interest*

Fonejacker - $86,000 UGD Monies

*contains NSFW language

[moonmonkey]

Originally Posted by irunat2am 

Write The School

Originally Posted by Person Man 

Definitely write the school

Yes, write to the school, it might be a good idea for someone to check your grammar before you send the email.
(ducks for cover)

[SpaceMonkey]

Just got this one:

Message-Id: <20070910144220.50DF4B51C03E@vs2.v846.vanager.de >
Date: Mon, 10 Sep 2007 16:42:20 +0200 (CEST)

CONGRATULATION!!!


THE SELECTION PROCESS WAS CARRIED OUT THROUGH RANDOM SELECTION IN OUR COMPUTERIZED EMAIL SELECTION MACHINE (TOPAZ) FROM A DATABASE OF 10,000 EMAIL ADDRESSES
DRAWN FROM ALL THE CONTINENTS OF THE WORLD.

YOU ARE THE 9999TH VISITOR: CONGRATULATION YOU WON!!!

YOUR EMAIL IS AMONG 10,000 EMAILS IN SHELL CENTENARY WORLDWIDE BONANZA PROMOTION

YOU WON $850,000.00



YOUR BATCH NO : 074/05/ZY369
TICKET NO : 56475600545188




CONTACT:
CASH OFFICE FOR YOUR CLAIMS
PETE BROWN
FIDUCIARY OFFICER

PLEASE FILL THIS FORM
NAME.................................
PHONE NUMBERS........................
FAX..................................
ADDRESS..............................
COUNTRY..............................




PAST WINNERS IN SHELL CENTENARY WORLDWIDE BONANZA PROMOTION!!!

--------------------------------------------------------------------------------------------------------------------------------
REPLY TO THIS EMAIL. IF YOU HAVE QUESTIONS PLEASE
shell_petroleum_development@yahoo.co.uk

Home | FAQ | Our Services | Contact Us
SHELL CENTENARY WORLDWIDE BONANZA PROMOTION/PRIZE AWARD 2007
All Rights Reserved

[Person Man]

Originally Posted by moonmonkey 

Yes, write to the school, it might be a good idea for someone to check your grammar before you send the email.
(ducks for cover)

While it is not exactly correct grammar, saying "write (someone)" is acceptable in informal speech. The "to" is implied in that instance.

[Big Mac]

This one was identical to the one I received previously, except for the link. Maybe this is a virus going around. . .

From: security-account@amazom.com
Subject: Your account was violated !
Date: September 10, 2007 1:05:10 PM PDT

Dear Member,

We have detected some unusual activity in your Amazon.com account from another country.

For your security account we require to urgent identify your personal information.

Please click on the link bellow and go thriugh the whole process:


http://itphd.cucea.udg.mx/~lsoto/.ww...nt-amazom.com/





We apologize in advance for any inconvenience this may cause you and we would like to thank you for your
cooperation as we review this matter.




Respectfully,
Amazon.com, Inc.



Please note that product prices and availability are subject to change. Prices and availability were accurate at the
time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. . 2007 Amazon.com.
All rights reserved. Amazon.com is a registered trademark of Amazon.com, Inc. Amazon.com 1200 12th Ave. S., Suite 1200,
Seattle, WA 98144-2734. Reference:6668250

[Person Man]

Originally Posted by Big Mac 

Please note that product prices and availability are subject to change. Prices and availability were accurate at the
time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. . 2007 Amazon.com.
All rights reserved. Amazon.com is a registered trademark of Amazon.com, Inc. Amazon.com 1200 12th Ave. S., Suite 1200,
Seattle, WA 98144-2734. Reference:6668250

Hmm... What prices? What products were they advertising? The service of "for your security account we require to urgent identify your personal information," apparently.

[JoshuaZ]

I once got a friendly phone call at 5 am to my cell phone. My Japanese cell phone. The call went something like this....

Ring Ring...

Me: Oh my god... what time is it... what the.... Hello?
Phone: Hell, Mr. Zimmerman?
Me: Yes...
Phone: I'm calling on behalf of (some random name). Is (some fun filled number) your social security number?
Me: No. Who is this and how do you have my phone number here in Japan?
Phone: Goodbye.

I was highly confused, until I realized that I had stuck my phone number up on my webpage and someone must have wanted my SS number. Bastards.

I also got fun Phishing email a while back that looked very much like my credit card company. Seeing as how I had just paid for a lot of stuff in the Philippines, and kind of figured they would be a problem, I called them up. Seems a lot of people got the same email. Only I was smart enough not to fill out the phishing info webpage.

Sighh...

[Chuckit]

It's not exactly phishing, but I just had to post the entirety of a scam message I just received:

From: infffffo@cox.net
Subject: Good Day To You,My name is Mr.Jang Ji Yoon, a citizen of North Korea and I would like you to guide me through the most viable investment opportunities in your Country. Alternatively, I can invest in your line of business perhaps if it’s viable. I am one of the defectors from the North and I am currently residing in South Korea(Refugee Camp). I have been in this country for sometime after defecting from the North. I was into currency exchange business and I was always traveling to other parts of Asia and Europe and during that period, I was able to move out my funds and deposit it in a financial institution in Europe. I want to invest this funds in your country with your help and advice because we are being treated as foreigners here and watched because the Korean government believe we are a security threat, A lot of defectors now go on to Canada or the United States and some parts of Europe to live. I want you to send me a complete breakdown of the investment opportunities in your country and also let me know what exactly I need to do to enable you invest the funds for me in your country. If interested,on my freedom, I will then come over to your country after you receive the funds and work out the investment plans with you. After I hear from you and find out the best investment opportunity you can introduce to me, I will them tell you how much is involved. kindly reply as soon as possible Regards and God Bless Mr.Jang Ji Yoon.
Date: September 13, 2007 8:47:25 PM PDT
Reply-To: jangoon444@hotmail.com

That's just lazy.

[turtle777]

Originally Posted by Chuckit 

That's just lazy idiotic.

If you really wanna ask someone for investment advice, I guess asking morons who take spam seriously is the way to go

-t

[Chuckit]

I meant how he just put the body of the message in the subject line.

[turtle777]

Originally Posted by Chuckit 

I meant how he just put the body of the message in the subject line.

I didn't even see that.

-t

[Person Man]

Let's dissect the message.

Originally Posted by Scammer

From: infffffo@cox.net
Subject: Good Day To You,My name is Mr.Jang Ji Yoon, a citizen of North Korea

And you have internet access? Wow, you must work for the government because most North Koreans probably don't know what a computer is, let alone the internet.

Originally Posted by Scammer

and I would like you to guide me through the most viable investment opportunities in your Country. Alternatively, I can invest in your line of business perhaps if it’s viable. I am one of the defectors from the North and I am currently residing in South Korea(Refugee Camp).

Well, you probably don't work for the NK government if you're in a refugee camp. But wait, if you're in a refugee camp, HOW DO YOU HAVE INTERNET ACCESS??

Originally Posted by Scammer

I have been in this country for sometime after defecting from the North. I was into currency exchange business and I was always traveling to other parts of Asia and Europe and during that period, I was able to move out my funds and deposit it in a financial institution in Europe.

Uh-huh. And you still live in a refugee camp? Or was this when you were still in North Korea? Wait, it couldn't have been when you were still living in North Korea because people there aren't allowed to travel outside the country.

Originally Posted by Scammer

I want to invest this funds in your country with your help and advice because we are being treated as foreigners here and watched because the Korean government believe we are a security threat,

So they put you into refugee camps and give you internet access. If they're watching you closely, wouldn't the fact that you're sending this message make them watch you even more?

Originally Posted by Scammer

A lot of defectors now go on to Canada or the United States and some parts of Europe to live.

So why haven't you gone to Canada or the United States?

Originally Posted by Scammer

I want you to send me a complete breakdown of the investment opportunities in your country and also let me know what exactly I need to do to enable you invest the funds for me in your country.

Wait. Didn't you say you were in the currency exchange business and traveled extensively? And suddenly you need me to do your grunt work for you? Lazy bum.

Originally Posted by Scammer

If interested,on my freedom, I will then come over to your country after you receive the funds and work out the investment plans with you.

Oh. You're in prison then. I thought you were in a refugee camp.

Originally Posted by Scammer

After I hear from you and find out the best investment opportunity you can introduce to me, I will them tell you how much is involved.

Hmm, can't you give me a hint to make me interested in helping you?

Originally Posted by Scammer

kindly reply as soon as possible Regards and God Bless Mr.Jang Ji Yoon.

Yes. Ok. The check's in the mail. I'll do it right away. Or something like that.

Originally Posted by Scammer

Date: September 13, 2007 8:47:25 PM PDT
Reply-To: jangoon444@hotmail.com

Hmm. The From address and the Reply-to address are different. Must be the refugee camp.

Oh yeah. How the heck did you fit your entire message into the Subject line??? That's impressive.

[Rumor]

Got this one in my spam account.

COMPLIMENT OF THE DAY TO YOU.

I am Mr Richard Gray, an Account Officer with the Halifax Bank Of
London, United Kingdom. I have a very sensitive and confidential
brief for you . I am requesting for your partnership in re-profiling
funds I will give the details, but in summary, the funds are coming
via Halifax Bank Of London, England.

This is a legitimate transaction,You will be paid 30% for your
Management Fees".If you are interested,please write back and provide
me with your confidential telephone number,fax number,and I will
provide further details and instructions. Please keep this
confidential, as we can't afford more political problems. Finally,
please note that this must be concluded within two weeks. Please
write back promptly via this confidential email address
{info_richardgray@yahoo.com.hk)

Regards
Richard Gray

[Mastrap]

Nice one. Halifax Bank of London indeed.
With a Hong Kong email address of course.

[turtle777]

How dumb do they think we are ?




Oh, wait, people fall for that ?




Nevermind then...

-t

[Person Man]

Originally Posted by Mastrap 

Nice one. Halifax Bank of London indeed.
With a Hong Kong email address of course.

Not only that, but a YAHOO address, too.

Oh, and "COMPLIMENT OF THE DAY????"

What the heck is a "compliment of the day?"

Sounds like "soup of the day."

What's the compliment of the day? Today it's "Very Good!" Tomorrow it will be "Nice Work," and the day after it will be "You look lovely today."

[Mastrap]

I always feel like writing back, pointing out their grammatical errors and including a new and improved phishing letter that contains something so ridiculous that should they use it they become the laughing stock on the intarnets.

[turtle777]

Originally Posted by Mastrap 

I always feel like writing back, pointing out their grammatical errors and including a new and improved phishing letter that contains something so ridiculous that should they use it they become the laughing stock on the intarnets.

Hey, that's not fair.

Some country's GDP rely heavily on those spammers

-t

[analogika]

Originally Posted by Person Man 

Oh, and "COMPLIMENT OF THE DAY????"

What the heck is a "compliment of the day?"

Surrealism Server: Surrealist Compliments For All

[Rumor]

Since I've started using my old Yahoo account to IM, I get notified about emails. My inbox gets about 3 to 5 spam a day, but my Bulk folder gets closer to 1000.

CENTRAL BANK OF NIGERIA
TINUBU SQUARE,VICTORIA
Telegram: CENBANK
From The Desk of: Prof. Charles C. Soludo

RE: CHANGE OF ACCOUNT PARTICULARS ON YOUR CONTRACT/INHERITANCE FILE
Attention Honourable Beneficiary,
This is to officially inform you that we have verified your
contract/inheritance file and discovered reasons why you are yet to receive
your Payment. It is because Of irregularities and complications
discovered on your Payment file by our Technical Experts in respect to your
contract /Inheritance Payment requirements which have just been duly
rectified.

On going through your files, we discovered that your file was dumped
untreated. Now, your new payment reference no. - 545000358, allocation
no. - 604728, password no. - 9955104, pin code no - 44779 and your
certificate of merit payment no. 202; cbn release code no. 0494
immediate telex confirmation no. 1144778401. Having received these vital
payment numbers therefore, you are qualified now to receive and confirm
your payment with the federal government of Nigeria through the new
mode of transfer.

Through Our ATM Swift Card Payment Center:The Swift card Center Will
Send You An ATM Card Which You Will Use To Withdrew your money from any
ATM Machine in any part Of the World, But the Maximum is Six Thousand
Dollars Per Day and through our telegraphic wire transfer:
Meanwhile, a woman came to our office few days ago with a
letter,claiming to be your true representative. Here is the information she
submitted
ACCOUNT NAME: MRS. JANET WHITE
BANK NAME: CITI BANK ARIZONA, USA.
ACCOUNT NUMBER: 6503809428.

Please, do re-confirm to this office, as a matter of urgency if you are
the one who send her so that this bank will not be held responsible
for paying into the wrong account information. However, we shall proceed
to issue all payments details to Mrs. White, if we do not hear from
you. Do re-confirm your informations as follows to enable us facilitate
your payment.
1) Your full name.
2) Phone, fax and mobile #.
3) Profession, age and marital status.
4) Copy of Drivers License I .D.
5) Home or Office Address
And for your information you Have To stop any further communication
with any Institution Or Office Until You receive your fund. Looking
forward to hear from you.
Yours Faithfully,
Professor Charles C. Soludo
Governor (CBN)

[Mastrap]

Nice. That's almost a novel in there.

[Rumor]

This isn't a phishing attempt, but it is bad spam.

Dear Friend,
My name is Mrs Judith Williams am 79yrs old of age,I stay at No 6618
Flower mound Dr, Sugar land TX 78479,USA.I am a good merchant, I have
several industrial companies and good share in various banks in the
world
I spend all my life on investment and corporate business. All the way
i lost my husband and two beautiful kids in fatal accident that occur
in November 5th 2003. I am a very greedy woman with all cost i don't
know much and care about people, since when I have an experience of my
it
difficult to sleep and give rest .Later in the year 2004 February i was
sent a letter of medical check up, as my personal Doctor testify that
i have a lung cancer, which can easily take off my life soon. I found
it uneasy to survive myself, because a lot of investment cannot be run
and manage by me again. I quickly call up a pastor prophet to give me
positive thinking on this solution, as my adviser.He ministered to me
to
share my properties ,wealth, to motherless baby orphanage homes peo
ple that need money for survivor both student that need money business
men for their investment and for future rising. So i am writing this
letter to people who really need help from me both student in college,
to contact me urgently.So that i can make available preparation on that
especially women of the day, who are divorced by their husband, why
they cannot survive the mist of feeding their self. Please contact me
and
stop weeping . Probably let me now what you really need the money for,
and if you can still help me to distribute money to nearest orphanages
homes near your town. Now am so much with God, I'm now born again.May
you be blessed as you reach me, I will give more information to you as
i await your response immediately.

Best Regards,

Mrs Judith Williams