Spam is one of those things that’s often so bad, it’s good. Today, I received one of those messages. It was sent to the hello@crashedpips.co.uk e-mail address (obviously harvested, from here) and I present the text below:
Dear customers,
Thank you for using our new service “Buy airplane ticket Online” on our website.
Your account has been created:
Your login: hello@crashedpips.co.uk
Your password: passRHK6
Your credit card has been charged for $669.57.
We would like to remind you that whenever you order tickets on our website you get a discount of 10%!
Attached to this message is the purchase Invoice and the flight ticket.
To use your ticket, simply print it on a color printed, and you are set to take off for the journey!
Kind regards,
Spirit Airlines
There are multiple reasons why this is dubious.
- I never booked a flight, and the idea I would do so with Spirit Airlines is ludicrous. Because they operate in the Americas as an ultracheap airline (a bit like EasyJet in the UK, but without as much orange.)
- As Spirit is an ultracheap airline, $669 (even with the current state of the dollar) is excessive.
- Printer is mis-spelled printed. It seems unlikely that a medium-size airline (still quite a large operation) would make such a mistake – can they not afford a dictionary?
- The ‘invoice’ and ‘flight ticket’ are attached in a ZIP file, apparently. Examination of the zip file reveals – yes, you guessed it – Ticket_N141-SK.exe, which looks suspiciously like a virus. I’ll be sending this off to some antivirus companies for analysis.
- They’ve obviously put in no effort with header spoofing whatsoever: the ‘from’ address is kvtgady (at] bradshawplace (full stop) com (address obfuscated to prevent spam to the (possibly) innocent owner of this address).
- Yep, the usual “Dear Customers” opening line (surprise, surprise).
- This is perhaps the most important point of all. It demolishes the e-mail’s premise in one swipe: I don’t even have a damn credit card. Even if I did, I’d have paid in pounds or euros, rather than dollars. If I did have to pay in dollars, I would have sent the money using a money transfer service or simply by popping a cheque in the post.
For the record, I’ve tried to contact Spirit about this, but the only phone numbers I can find are for their reservations centre, and the only e-mail addresses I can find are for comments on the Web site. If anyone can source a number or address direct to Spirit’s HQ, I’d be very grateful – it’s best the airline knows about this so it can post an advisory in its website.
EDIT: I’ve sent the file to McAfee and its online scanner says it’s spy-agent.bw. An extra .dat file is being issued for this – I’ll see what McAfee’s rules on redistribution are, and if it’s OK with them I might mirror it here for if you’re using a McAfee scanner. Meanwhile, Symantec won’t let me show them the virus unless I pay them money, and Sophos’s process is long and irritating.
The file will now be shredded to protect other machines on my network.
Remember MS’s ill-fated get the facts campaign? Well… they’re at it again.