📧 The Official Spam Emails Thread™

HardwareGeek

@djls45 said in 📧 The Official Spam Emails Thread™:

self-

I knew I'd seen it before, but to look for where.

Tsaukpaetra

Before I fully parsed the voicemail I was like, "Sweet, some chick wants to give me pizza!"

Then I was like, "Wait, Elementary? Fuck!"

I'm not falling for that trap!

dcon

<ringring>
: Hello?
: Hi , I was just browsing ZipRecruiter and saw your name...
: <interrupts> I'm not looking for a job right now. <click><block>

BernieTheBernie

Eventually someone came up with a long-needed compensation scheme for scam victims. What a relief:

Reply-To: unitednationsc03@gmail.com
From: "UN Compensation" remax@remax.net
To: Bernie@BernieTheBernie.con
Subject: Compensation payment notification*

Hello
I write to let you know that the sum of $1,000,000.00 USD has been approved in your favor by
United Nations Secretary General in conjunction with the World Bank as a compensation payment
on scammed victims from Asia,America and Europe so your name emerged as one of the lucky
beneficiaries. Reply back to us for more details.
Mr.Aubrey Box
United Nations Co-coordinator Texas USA

BernieTheBernie

Next level phishing. Do not yet fully understand how it is expected to work.
Anyway, having been to Thailand, I had to apply for the "Thailand Pass". And within Thailand, several hotels required my email address. Also for hotel booking, or booking the Covid test, I had to use some email address.
Now I received following request:

From: Thailand Pass <support@team-thpass.online>
Subject: There are a New updates regarding your submitted information tha
Date: Tue, 22 Feb 2022 06:13:49 +0000 (UTC)
Envelope-To: <Bernie@Bernie.con>

Aha. There is no To header, but an Envelope-To. Interesting to learn something new about email again from spammers / phishers.
The message is again base64 encoded.

Hello ,  Bernie@Bernie.con

Th system noticed some problems in the documents you submitted to the embassy
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
You should correct some information so that you are not held responsible by the government
คุณควรแก้ไขข้อมูลบางอย่างเพื่อที่คุณจะได้ไม่ต้องรับผิดชอบต่อรัฐบาล

Please reply to this message and write the following information

โปรดตอบกลับข้อความนี้และเขียนข้อมูลต่อไปนี้

    Your full name.

    Date of birth.

    Last 4 digits of the passport.






ขออภัยในความไม่สะดวกที่เกิดขึ้น 
We apologize for any inconvenience caused
ขอแสดงความนับถือ Thailand Pass
Best regards Thailand Pass,

Strange again: they do not know my name: they greet me with my email address instead.

The Thai text in the email is not for all fields - why?
Let me guess...
You remember my message in "Translated by Google"?
Well, take a look at their first statement:
Th system noticed - an eis missing in The. And the translation in the next line contains an odd Th.
So let me try it.
First line: their text, second line Google Translate:
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
Perfect.

HardwareGeek

(One of) today's recruiter spam:

Gribnit

Atazhaia

Today I got a portugese Messenger spam. Ran it through Google Translate. (Emphasis mine.)

Hello friends We have created a new WhatsApp, Snapchat and adult messaging group. There are a lot of single girls here with no money while you're in there. You can watch the latest videos and date them

So, if I join this "adult messaging group" I will cause a lot of single girls to lose access to their money for as long as I am in the group? That's interesting...

Zecc

@Atazhaia I am slightly interested in seeing the original, but you've probably deleted it already, and meh I'm not that interested.

Gribnit

@Zecc I have sister, mister - no money, very clean, many lead, never break.

BernieTheBernie

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

Next level phishing. Do not yet fully understand how it is expected to work.
Anyway, having been to Thailand, I had to apply for the "Thailand Pass". And within Thailand, several hotels required my email address. Also for hotel booking, or booking the Covid test, I had to use some email address.
Now I received following request:
From: Thailand Pass <support@team-thpass.online>
Subject: There are a New updates regarding your submitted information tha
Date: Tue, 22 Feb 2022 06:13:49 +0000 (UTC)
Envelope-To: <Bernie@Bernie.con>
Aha. There is no To header, but an Envelope-To. Interesting to learn something new about email again from spammers / phishers.
The message is again base64 encoded.
Hello ,  Bernie@Bernie.con

Th system noticed some problems in the documents you submitted to the embassy
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
You should correct some information so that you are not held responsible by the government
คุณควรแก้ไขข้อมูลบางอย่างเพื่อที่คุณจะได้ไม่ต้องรับผิดชอบต่อรัฐบาล

Please reply to this message and write the following information

โปรดตอบกลับข้อความนี้และเขียนข้อมูลต่อไปนี้

    Your full name.

    Date of birth.

    Last 4 digits of the passport.






ขออภัยในความไม่สะดวกที่เกิดขึ้น 
We apologize for any inconvenience caused
ขอแสดงความนับถือ Thailand Pass
Best regards Thailand Pass,
Strange again: they do not know my name: they greet me with my email address instead.

The Thai text in the email is not for all fields - why?
Let me guess...
You remember my message in "Translated by Google"?
Well, take a look at their first statement:
Th system noticed - an eis missing in The. And the translation in the next line contains an odd Th.
So let me try it.
First line: their text, second line Google Translate:
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
ระบบ Th สังเกตเห็นปัญหาบางอย่างในเอกสารที่คุณส่งไปยังสถานทูต
Perfect.

The scam continues. Next email does not contain Thai text anymore. And it has a new Fromheader:

From: Thailand Pass <support@passinformationthailand.com>

Let me check with whois:

Whois passinformationthailand.com

Whois Lookup for passinformationthailand.com

"Looks like this domain has not been registered yet"

BernieTheBernie

In my spam folder, I found another message from them.
Screenshot_20220227_144138_de.gmx.mobile.android.mail.jpg
"Download Document
important note. You must open the document from a PC and not from the phone"

remi

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

"Download Document
important note. You must open the document from a PC running a version of Windows ~~compatible with~~vulnerable to our rootkit and not from the phone"

(Fake ETA: NodeBB ins/del nested formatting ruining the joke)

djls45

@Gribnit said in 📧 The Official Spam Emails Thread™:

@Zecc I have sister, mister - no money, very clean, many lead, never break.

She frowned and called him Mr.
Because in sport he kr.
And so in spite
That very night
This mr. kr. sr.

BernieTheBernie

@remi said in 📧 The Official Spam Emails Thread™:

a version of Windows compatible withvulnerable to our rootkit

I.e. any version of Windows?

PleegWat

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

@remi said in 📧 The Official Spam Emails Thread™:

a version of Windows compatible withvulnerable to our rootkit

I.e. any version of Windows?

They probably haven't gotten round to ~~writing~~buying an android rootkit yet.

Gąska

Oh God, the spammers have learned they can put emoji in subjects.

They still haven't learned what means, though. FWIW, neither have I, but I'm still pretty sure they're using it wrong.

Tsaukpaetra

@Gąska said in 📧 The Official Spam Emails Thread™:

Oh God, the spammers have learned they can put emoji in subjects.

.... Just now? Bruh, they've been in my spam for years....

kazitor

@remi said in 📧 The Official Spam Emails Thread™:

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

"Download Document
important note. You must open the document from a PC running a version of Windows ~~compatible with~~vulnerable to our rootkit and not from the phone"

(Fake ETA: NodeBB ins/del nested formatting ruining the joke)

E_NO_REPRO

Filed under: Have I mentioned I have better del/ins styling today

Gąska

@kazitor said in 📧 The Official Spam Emails Thread™:

Have I mentioned I have better del/ins styling today

You don't have it on other days?

Tsaukpaetra

@Gąska said in 📧 The Official Spam Emails Thread™:

@kazitor said in 📧 The Official Spam Emails Thread™:

Have I mentioned I have better del/ins styling today

You don't have it on other days?

For today only! It may be gone tomorrow, hurry and buy buy buy!

Applied Mediocrity

@Tsaukpaetra said in 📧 The Official Spam Emails Thread™:

@Gąska said in 📧 The Official Spam Emails Thread™:

@kazitor said in 📧 The Official Spam Emails Thread™:

Have I mentioned I have better del/ins styling today

You don't have it on other days?

For today only! ~~It may be gone~~ There may be no tomorrow, hurry and buy buy buy!

topspin

@remi said in 📧 The Official Spam Emails Thread™:

(Fake ETA: NodeBB ins/del nested formatting ruining the joke)

Nest the other way:

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

"Download Document
important note. You must open the document from a PC running a version of Windows ~~compatible withvulnerable to~~ our rootkit and not from the phone"

dcon

Someone's spam generator is a little behind... (The SPAM portion was added my my email provider)

Gribnit

@dcon dude to end doublesecret continuing presidencies requires doublesecret continuing congress to impeach. folks need to read their doublesecret constitutions.

topspin

dcon

(phone spam)
"Amazon" is busy today. I've had 4 phone calls in the last couple hours. All from different "numbers", of course.

HardwareGeek

First stupid-recruiter spam of the day:

I have ~35 years of experience. I'm not looking for an entry level job. (I'm not looking for any job, but definitely not an entry level job.)
I'm not a physical designer.
Based on the wording of the subject line, I'd bet "Janet Gibson" is not the recruiter's real name. "... is shared with you" is characteristic of South Asian recruiters.

Just out of curiosity, I opened the email. Having done so, I can add the following:

Not entry level. They want experience. They don't specify a minimum, but they want some.
On site, half a continent away. No.

topspin

I normally don't click the "unsubscribe" button on real spam, since that's usually just another way they fuck with you. However, I've grown to accept that you sometimes have to do that for UBE from legitimate mailing lists, because the concept that I don't need to opt out of anything I didn't opt in to is apparently not universally accepted.

So today on another stupid conference spam mail ("Join ROBOTMEET2022 as a Speaker") I was about to click the unsubscribe link when I saw another link that says "why did I get this?". It takes you to this page:

Bildschirmfoto 2022-04-06 um 14.25.14.png

I most certainly did not!

BernieTheBernie

@topspin "mailchimp" - that tells you all about their capabilities

dcon

@topspin said in 📧 The Official Spam Emails Thread™:

However, I've grown to accept that you sometimes have to do that for UBE from legitimate mailing lists

I've been fighting with USC (and Linkedin) about that. Because evidently when you mark "I attended" on USC in LinkedIn, they auto-subscribe you to all sorts of shit. 23 unsubscribes later (including a USPS letter basically saying "fuck you, knock it off") and I haven't gotten anything since 6Dec2021.

HardwareGeek

@dcon said in 📧 The Official Spam Emails Thread™:

I've been fighting with USC

I somehow got on their alumni mailing list despite never having attended at all. I don't remember whether I did anything to get myself off, but I haven't gotten anything from them in a long time.

"I attended" on USC

You're a Spoiled Child?

dcon

@HardwareGeek said in 📧 The Official Spam Emails Thread™:

"I attended" on USC

You're a Spoiled Child?

That was for my Masters. AT&T paid for it. So I guess so...

HardwareGeek

I'm not sure why they want a software engineer with blood clots in his/her/whatever legs, but IIRC a few of you might qualify.

dcon

@HardwareGeek said in 📧 The Official Spam Emails Thread™:

a few of you might qualify.

Not anymore! I pay big bucks to keep them away.

DogsB

I quite like his gumption.

HardwareGeek

Relevant, but ...

... the fact that she's now married to someone else is a very strong sign that she does not want me back.

topspin

@HardwareGeek said in 📧 The Official Spam Emails Thread™:

Relevant, but ...

... the fact that she's now married to someone else is a very strong sign that she does not want me back.

I'm going with:

∅

Benjamin Hall

@topspin If I'd gotten that, the only possible result would be EMPTY_SET. Because my ex can't want me back if I never had an ex (or even a current significant other) in the first place.

Gribnit

@Benjamin-Hall huh. This reminds me of another question lately to which the answer was the empty set. Although, the concept of vacuous satisfaction applies less directly here.

Or maybe more.

Tsaukpaetra

@Benjamin-Hall said in 📧 The Official Spam Emails Thread™:

@topspin If I'd gotten that, the only possible result would be EMPTY_SET. Because my ex can't want me back if I never had an ex (or even a current significant other) in the first place.

"How to know your ex doesn't know she's not yet to be your future ex, but will be in the future!"

HardwareGeek

Well, this is different:

No, neither my ISP nor my client adds "*****SPAM*****" to email subject lines; the ISP just moves them to a suspected-spam folder, and Thunderbird (rather unreliably) sets that indicator. No, it appears the spammer self-identified their own email.

BernieTheBernie

@DogsB said in 📧 The Official Spam Emails Thread™:

I quite like his gumption.

You're late. I received that email already on 21 Feb. And consumed all the money.
See:

@BernieTheBernie said in 📧 The Official Spam Emails Thread™:

Reply-To: unitednationsc03@gmail.com
From: "UN Compensation" remax@remax.net
To: Bernie@BernieTheBernie.con
Subject: Compensation payment notification*

Hello
I write to let you know that the sum of $1,000,000.00 USD has been approved in your favor by
United Nations Secretary General in conjunction with the World Bank as a compensation payment
on scammed victims from Asia,America and Europe so your name emerged as one of the lucky
beneficiaries. Reply back to us for more details.
Mr.Aubrey Box
United Nations Co-coordinator Texas USA

hungrier

For the past few weeks, I've been getting weird spam in my work email. All different messages, addressed to different people, with tens of paragraphs talking about Middle Eastern geopolitics or some shit. There aren't any links or calls to action, so I have no idea what the purpose is or how my work email got on this list

(note: I am not President Joe Biden)

HardwareGeek

@hungrier Maybe you're one of the "individuals that you are keeping closer to your encounter."

Gribnit

@Tsaukpaetra said in 📧 The Official Spam Emails Thread™:

@Benjamin-Hall said in 📧 The Official Spam Emails Thread™:

@topspin If I'd gotten that, the only possible result would be EMPTY_SET. Because my ex can't want me back if I never had an ex (or even a current significant other) in the first place.

"How to know your ex doesn't know she's not yet to be your future ex, but will be in the future and will want you back!"

, yeesh.

HardwareGeek

Today's episode of "Recruiters who can't read resumes":

A financial data analyst is probably one of the jobs that I'm least qualified for.

Gribnit

@HardwareGeek said in 📧 The Official Spam Emails Thread™:

A financial data analyst is probably one of the jobs that I'm least qualified for.

You seem boring enough, what's the problem?

BernieTheBernie

@hungrier Any images loaded from external sources? They might cause the infection iwth some digital

On the other hand, some political campaign of unspecified origin, to change your opinion on some political topics. E.g. thinking bad of US "investments" in Arab countries. There's Iran which is not a friend of Arabs. There's Russia which is a competitor in oil and gas business. There's China which does not like US strength. There's ...

hungrier

@BernieTheBernie No external images, but Outlook did block "potentially unsafe attachments" (images), one or two in every message, so that could be something