Une nouvelle race de phishing

Je reçois actuellement des tonnes de mails me confirmant mon inscription à des sites où je ne suis jamais allé. Ci-dessous une inscription à un site (que je ne suis d'ailleurs même pas allé voir depuis). Par exemple des sites pour animaux domestiques, pour poker…

Parmi les risques à envisager si l'on cherche à se connecter:

- Quelques virus ou troyens "sympathiques"…

- Donner des indications (nom, adresse ou autres) destinées à enrichir une base de spam (notamment si, machinalement, on change Le login et le mot de passe pour ses valeurs "habituelles"…

- Et en tout cas confirmer que l'adresse spammée est bonne… à spammer!

-----Message d'origine-----
De : User eyrsbfj [mailto:eyrsbfj@h70.101.141.67.ip.alltel.net] De la part de Joke-A-Day
Envoyé : mardi 21 août 2007 02:41
À : […]
Objet : Member Confirm

Greetings,

We are glad you joined Joke-A-Day.

Membership Number: 65[…]

Temorary [sic!] Login: user9xxx

Temorary Password: itxxx

For security purposes please login and change the temporary Login ID and Password.

This link will allow you to securely change your login info: -http:// 76.108.193. 115/

Enjoy,

Welcome Department

Joke-A-Day

Dix pour cent, c'est intéressant!

Transmis par Didier qui commente

Bien monté, la présentation diffère des mails racoleurs africains … mais le résultat est le même !!!

----- Original Message -----

From: Dr. Micjael Weare

Sent: Saturday, July 07, 2007 7:47 PM

Subject: Re: Investment from Grist-Mill PLC.

Dr. Micjael Weare.

Managing Director,

Grist-Mill PLC.

Maclaurin House, AV Dublin Street,

EDINBURGH. EH1 3PP.

Direct Tel/Voice: 00 44 709 288 3149.
Email: drmwslint@uku.co.uk

Ref: Investment with Grist-Mill PLC.

I send you greetings. I have found your contact email address listed on an Internet Business Directory and it is my wish to do business with you, hence your receipt of this letter.

The purpose of this letter is to introduce myself to you. I am Dr. Micjael Weare, Managing Director, Grist-Mill PLC. Grist-Mill PLC is a business consulting firm, offering business advisor services in Scotland. We are a big company but have limitations in terms of providing investment services outside Scotland.

We have recently been confronted with the task of investing funds outside Scotland and have decided to seek partners to cooperate with us in investing the available funds because we have never done business of this nature.

We are brokering an investment venture on behalf of a client of our firm. This venture will involve the investment of Fifty Eight Million United States Dollars, USD 58, 000, 000.

We are by this letter considering entering into a partnership with you so as to allow us invest the available funds in your country and to appoint you as representatives and co-managers of the investment funds. We are ready to give you a commission of 10% of the available capital as soon as the proposed partnership between us is started.

Since we cannot determine if this email is still functional or your willingness to cooperate with us, we have kept this proposal brief.

If you are interested in this offer of partnership, please respond to enable us give further information about the proposed partnership. If you have any questions please do not hesitate to contact us.

Your expedient response will be appreciated as we look forward to hearing from you soon. Please send all email correspondence to drmwslint@uku.co.uk

Thank you.

Dr. Micjael Weare.

---

Je suis devenu riche, sans rien faire...

... Du moins si j'en crois l'intéressante proposition ci-dessous.
Près d'un million de dollars! Dès que j'aurai reçu ce montant, je m'engage à donner 50% de ce que j'aurai reçu!

Chacun des liens ci-dessous, que j'ai ici soigneusement "désinfectés", pointe en fait vers le site maître en lui transmettant mon adresse mail et une ancienne adresse postale.

On m'aurait menti?


-----Message d'origine-----
De : Access America Financial Services [mailto:processing@productsto.com]
Envoyé : mercredi 27 juin 2007 06:50
Objet : Notice of unclaimed trasfers

http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com [initialement il y avait MES coordonnées, je préfère mettre celles du spammeur]
http -:// productsto. com/ dbm83/img.php?xxxxxx
http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com
http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com

Form E40A XXXXXX $945,675

http -:// productsto. com/ dbm83/img.php?xxxxxx
http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com

http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com

For: XXXXX http -:// productsto. com/ dbm83/img.php?xxxxxx
ACCESS AMERICA $945,675 ENTITLEMENT http -:// productsto. com/ dbm83/img.php?xxxxxx
No:548 Date: 06/21/07 http -:// productsto. com/ dbm83/img.php?xxxxxx
Market Value of Maximum Allotment $945,675

http -:// productsto. com/ dbm83/ l.php?xxxxxx&em= processing @productsto.com

XXXXX,
You are authorized as a verified recipient of this financial opportunities notice via email selection of being a worthy, cash candidate providing you respond before the end of the current payment period. AAFS is delighted to send you absolutely FREE, your check CASH award entry and opportunities totaling $945,675 guaranteed to be awarded by sponsoring companies complied and reported by AAFS for your full and immediate access. Each document of assessment must be disbursed by the independent sponsors.
http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@ productsto.com
To Activate Cash Check and Benefits Form E40A
This advertisement is being sent to you from:
Access America Financial Group 580 South Research Place Center Islip, NY 11722, USA
To unsubscribe from receiving further emails from us, please click here:
Unsubscribe http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com
Please read the privacy policy by clicking on Privacy Policy http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com
Click here to view the Terms & Conditions http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com
Click here to view the Frequently Asked Questions http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com
Click here to view the Hints & Tips http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com

http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com


________________________________

We hope you enjoyed receiving this email, but if you no longer wish to receive our emails please click here
http -:// productsto. com/ dbm83/l.php?xxxxxx&em=processing@productsto.com .

PO Box 9056, Hicksville, NY, 11802 USA http -:// productsto. com/ dbm83/ httpd/smotr.php?xxxxxx&em=processing@ productsto.com

Une carte postale de ma famille? You've received a postcard from a family member!

Les sites qui vous proposent d'envoyer une carte postale à un ami ou à un parent fleurissent sur le web, aussi aurais-je considéré sans aucune méfiance le mail ci-dessous... s'il ne m'était pas arrivé en une demi-douzaine de mails différents! Du coup, je suis allé voir prudemment pour vérifier si c'était un spam ou un cousin actif... c'est du spam me proposant du Viagra et autres.

Bref, à éviter.

Avant le mail, quelques extraits de l'en-tête caché correspondant:

---

Return-Path: <punef@tfb.com>
[...]Received: from 210.213.254.243.pldt.net (unknown [210.213.254.243])
by mwinf2004.orange.fr (SMTP Server) with SMTP id [...]
[...]Received: from ocb.sbwag ([225.129.148.150]) by 210.213.254.243.pldt.net with Microsoft SMTPSVC(6.0.3790.1830);[...]
From: "xisuper.hk" <punef@tfb.com>
Subject: You've received a postcard from a family member!
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="Windows-1252";
reply-type=original
Content-Transfer-Encoding: 7bit

---

-----Message d'origine-----
De : xisuper.hk [mailto:punef@tfb.com]
Envoyé : vendredi 22 juin 2007 14:08
À : [...]
Objet : You've received a postcard from a family member!

Good day.

Your family member has sent you an ecard from xisuper.hk.

Send free ecards from xisuper.hk with your choice of colors, words and music.

Your ecard will be available with us for the next 30 days. If you wish to keep
the ecard longer, you may save it on your computer or take a print.

To view your ecard, choose from any of the following options:

--------
OPTION 1
--------

Click on the following Internet address or
copy & paste it into your browser's address box.

http : -//- xisuper .hk/?d770[...]

--------
OPTION 2
--------

Copy & paste the ecard number in the "View Your Card" box at
http : -//- xisuper .hk/

Your ecard number is
d770[...]

Best wishes,
Postmaster,
xisuper.hk

*If you would like to send someone an ecard, you can do so at
http : -//- xisuper .hk/

En Allemand, les faux tuyaux sur actions

C'est déjà assez pénible de se faire spammer en français ou en anglais, notamment avec des tuyaux crevés sur des actions supposées être des gagnants encore inconnus: un système qui n'enrichit que les petits malins qui spéculent et en même temps lancent la rumeur.
Mais voilà que depuis quelques jours, c'est maintenant en allemand qu'arrivent ces informations "exceptionnelles"!

---

De : express taped [mailto:asifnzkfmr@tpnet.pl]
Envoyé : dimanche 29 avril 2007 12:29
Objet : FRANKF MARKT ALLE!

AN ALLE FINANZINVESTOREN!

DIESE AKTIE WIRD DURCHSTARTEN!

MONTAG 30. APRIL STARTET DIE HAUSSE!

Symbol: G7Q.F

Firma: COUNTY LINE ENERGY

Preis: 0.25

WKN: A0J3B0

ISIN: US2224791077

Markt: Frankfurt

LASSEN SIE SICH DIESE CHANCE NICHT ENTGEHEN!

DIE RALLYE IST GESTARTET!