Please be sure to read my Malware Home Page

Notes for All Four Examples

I want you to know that the first email I received, I clicked the link, even though it was the generic "Hi. Neighbor has sent you a greeting card", rather than a name I recognize, figuring my virus scanner would catch any bad things it tried to send my way. The page it went to was a white blank with a line at the top that said that my download would begin in 15 seconds or to "click here". This bothered me... No recognizable name and a DOWNLOAD instead of an online card? So I clicked the "X" to close the window. NOTHING! I clicked ALT-4, which closes the last window opened (note: If the window is explorer, it may close all instances). NOTHING. I did CONTROL-ALT-DELETE to open the Windows Task Manager. I found the application and clicked "End Task"... It didn't stop, and seemed to replicate itself (meaning another opened as the prior was closing.) OH BOY! What did I do now? I finally clicked START, Turn Off Computer, and RESTART. Slowly (and I will admit my system is slow, but this was like molasses in Winter!) my system began to shut-down. During the shut-down, my virus scanner kicked up a blank window. This window normally shows the virus being protected against. There was nothing there. After the reboot, I ran the full virus scan, and found... NOTHING. (I, personally, think I was lucky.) I ran a Spyware-Search & Destroy to clean off all the programs it found (and, yes... I DO get programs SSD looks for... Most are "tracking cookies" and some are "MRU Lists" (like the last set of pages you opened in your browser, etc.), and some I know about (SSD warns me when my home page is not "normal" as far as it's concerned, and some of those "tracking cookies" it finds are those that keep my username for that site online). SSD didn't find anything I could attribute to the email. So, I set the email aside to research for this page later.

I got the second email, later the same day, and recognized the wording immediately. While it was a "greeting card" from "school mate", the rest of the text was close enough that I didn't want to click the link. So, I did a little research On this one, the ISP listed as the base site was from Turkey (see below). Hmm... Carefully, I put the ISP only in my browser window, and clicked enter. The same 15 seconds to download screen appeared. I did the same things I did on the first one (above), and the same things happened. This time, though, I think I tried to close the window a little longer, and suddenly URL changed to a yahoo email setup. I didn't wait around to see what happened, but shut down windows again. Afterward, SSD showed nothing new (just my home page "problem"), and nothing was found in the virus scan, again.

When I got the third one, I didn't even try the site or the link, and decided I needed to get this page out ASAP. AND, I got the fourth one today (08/04/2007). Now, I may just be a little paranoid, and nothing bad may happen. But:

1. when there's no recognizable name who sent me the email;
2. when there's only an ISP, rather than a DNS name translation (ie: www.orangefrogproductions.com);
3. when it goes to a page that will do a download rather than display a card;
4. when it appears to either eat up all my processing, or even simply stops me from closing the window;
5. when my virus scanner auto-protect kicks in even though blank;

I think I have the right to be.

Ok... Again, these MAY be legit, though I doubt it.

And I have been proven right. http://www.greetingcard.org/ has a warning about these email scam/phishing expeditions, and what to look for from legitimate card sites.

So, for senders of real online cards:

• Don't EVER NOT use your name when sending online cards - They may never be read!
• If you are the Neighbor or School Chum who sent me something, and it IS legit, please send me an email to let me know who you are.
• Be careful about who you send cards THROUGH.

For receivers of emails like this:

• There are many legitimate online card companies, some requiring money, and others free. Most will ask you to click a link in the email, and take you to their site. The link will probably look like "gobbledy-good" to you, but there should be a translated website NAME at the beginning, rather than an ISP. If so, make sure the name in the link and any other site names in the email match. (Most will only advertise themselves.)
• Make sure you recognize the name from whom the email is received. It will most-likely be sent from the card company, but the sender's name is usually requested and sent in the email. Don't respond or click the link in emails where you do NOT recognize the name.
• If you are in the habit of receiving online cards when there's no celebration (birthday, anniversary, holiday), watch for the signs that it's NOT legit, and don't open those.

For the purveyors of real online cards:

• Make sure the site from which you send cards, and to which you send readers of sent cards have a translated DNS name. Do NOT just use the ISP.
• Get the senders' names and make sure THAT is sent in emails to receivers.
• Do NOT call showing a page a "download". Downloads imply moving a program or something from your servers to the readers. Basically, first let them read it, and, if it's downloadable, give them the option to download it.
• There should be NO pause from a redirect page to where the viewer can read the card. If you change the names of cards or links, use the HTACCESS on your system to forward to the new ones.

Now, on to the Examples:

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Examples

Malware Email Example 009
Received 08/02/2007

Example Email 009 Headers
08/02/2007

Notes for the above

Most of my notes are above, in the opening statement of this page. I did try to find out where this email was from:

• Kerzner.com appears to be a resort company based out of New York. I doubt this is where this email came from. I know no one at Kerzner, nor do I believe I know anyone out of New York.
• 152.179.83.125, (think link in the email) could not be located by GeoBytes' IP Address Locater
• 67.52.168.34 is in Palm Desert, California
• The rest are tied to Insightbb, my home provider.

So, we have an email, that came from somewhere unknown, using the email address of a company based out of New York, through a California email server, thence to my provider. If I'd have looked here, first, I might have been even MORE suspicious.

BTW: It appears that www.funnypostcard.com is a legitimate card company.

NOTE: If someone sent you directly to this example, please be sure to read about my experience with this (and the like) email.

---

Malware Email Example 010
Received 08/02/2007

Example Email 010 Headers
08/02/2007

Notes for the above

Most of my notes are above, in the opening statement of this page. I did try to find out where this email was from:

• interlog.com forwards immediately to http://www.ca.inter.net/, and appears to be a Canadian internet services company. I doubt this is where this email came from. I know no one at interlog, and only know a couple of people from Canada, and they were not school mates!
• 89.212.163.86 (the link in the email) is from Ljubljana, Slovenia. Duh... What?
• 27.97.136.53 could not be located by GeoBytes' IP Address Locater
• 76.184.144.222 is from Dallas, Texas
• 216.117.230.55 is from Evanston, Wyoming
• The rest are tied to Insightbb, my home provider.

So, we have an email, that came from Slovenia, using the email from a Canadian internet service provider through a (appears to be) faked email header, through Texas and Wyoming email servers, thence to my provider. If I'd have looked here, first, I might have been even MORE suspicious.

BTW: It appears that http://www.greeting-cards.com/ is a legitimate card company.

NOTE: If someone sent you directly to this example, please be sure to read about my experience with this (and the like) email.

---

Malware Email Example 011
Received 08/02/2007

Example Email 011 Headers
08/02/2007

Notes for the above

Most of my notes are above, in the opening statement of this page. I did try to find out where this email was from:

• bhimnathwala.com doesn't even appear to be registered at this time, so there's no indication of whence it came.
• 71.238.193.38 (the link in the email) is from Keego Harbor, Michigan
• 137.163.75.124 could not be located by GeoBytes' IP Address Locater
• 208.180.242.9 is from Bella Vista, Arkansas
• lothianoil.us appears to be a New York energy company
• The rest are tied to Insightbb, my home provider.

So, we have an email, that came from a fictional email address through a (appears to be) faked email header, through Arkansas email servers, thence to my provider. If I'd have looked here, first, I might have been even MORE suspicious.

BTW: It appears that http://www.greetingcard.org/ is a legitimate card company. In fact, they have a warning about these emails on their site.

NOTE: If someone sent you directly to this example, please be sure to read about my experience with this (and the like) email.

---

Malware Email Example 012
Received 08/04/2007

Example Email 012 Headers
08/04/2007

Notes for the above

Most of my notes are above, in the opening statement of this page. I did try to find out where this email was from:

• jaka.cz appears to be a kid camp in the Czech Republic. I doubt this is where this email came from. I only know one person who MIGHT be in the Czech Republic , he/she was related, not a school mate! And, he/she would not be using an email address I wouldn't recognize.
• 75.61.82.5 (the link in the email) is from Chicago, Illinois. (GeoBytes' IP Address Locater)
• 137.156.67.207 could not be located, so was probably faked.
• 205.179.82.202 is from Westfield, New Jersey
• 75.126.254.163 could not be located
• houseboatingworld.com appears to be based out of Herndon, VA, and not responsible for the original email.
• The rest are tied to Insightbb, my home provider.

So, we have an email, that came from the Chicago, using a Czech Republic kid's camp email through a (appears to be) faked ISP, through New Jersey, then another faked ISP, then through email servers owned by houseboatworld.com, thence to my provider. If I'd have looked here, first, I might have been even MORE suspicious.

BTW: AND, I KNOW that www.americangreetings.com is a legitimate card company.

NOTE: If someone sent you directly to this example, please be sure to read about my experience with this (and the like) email.

 

---

Send comments/questions about this page to Bill Sanders at:

Go to More Email Examples (Greeting Card or Postcard)
Go to Malware (Viruses, Adware, Spyware) Home page
Go to Malware Examples Home Page

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.