spam? virus?

3 views
Skip to first unread message

Sergio Monteiro

unread,
Feb 27, 2011, 2:31:51 AM2/27/11
to li...@linux.ucla.edu
is this real or spam / virus ?

Thanks

Sergio

_o
_ \<,_
(_)/ (_)

Sergio Monteiro
montei...@yahoo.com

--- On Tue, 2/15/11, University of California <webma...@ucla.edu> wrote:

From: University of California <webma...@ucla.edu>
Subject: [uclalug-linux] Announcement
To:
Date: Tuesday, February 15, 2011, 1:18 PM

We have upgraded our server to new secured version.This is to enable your webmail account take a new look with new functions and help protect against spam e-mails. You are require to upgrade your account to new secure version by clicking here or on  the secure link below 

https:/secure.ucla.edu

 Copyright 2011 University of California - All Rights Reserved

--
You received this message because you are subscribed to the UCLA LUG "Linux" group.
To post to this group, send email to li...@linux.ucla.edu
To unsubscribe from this group, send email to
linux+un...@linux.ucla.edu
For more options, visit this group at
http://groups.google.com/a/linux.ucla.edu/group/linux?hl=en

Omar Sheikh

unread,
Feb 27, 2011, 4:10:39 AM2/27/11
to li...@linux.ucla.edu
Most likely yes.

-Omar
Omar Sheikh
Internal VP



Romy Maxwell

unread,
Feb 27, 2011, 2:51:13 AM2/27/11
to li...@linux.ucla.edu, Sergio Monteiro
On Sat, Feb 26, 2011 at 11:31 PM, Sergio Monteiro <montei...@yahoo.com> wrote:
is this real or spam / virus ?

Um, none of the above ?

Some would call this phishing.

spe...@ucla.edu

unread,
Feb 27, 2011, 5:31:14 AM2/27/11
to li...@linux.ucla.edu
Oh yeah, this e-mail is totally bogus. The website 123contactform
provides HTML forms, and they admit on their forums that they've had
problems with people using their service to scam people.

- Steven

spe...@ucla.edu

unread,
Feb 27, 2011, 5:23:44 AM2/27/11
to li...@linux.ucla.edu
Yes, it is bogus.

- Steven

mattpham

unread,
Feb 27, 2011, 4:35:57 AM2/27/11
to Linux
Let's see:

1.) "webmasterr", with 2 r's.
2.) Multiple grammatical errors.
3.) Mid-message font change for no reason.
4.) The link goes to "123contactform.com". Haaahahahahaha

This has to be some sort of joke. Maybe a psych student's research
project.

On Feb 27, 1:10 am, Omar Sheikh <phoenix...@linux.ucla.edu> wrote:
> Most likely yes.
>
> -Omar
>
> On Feb 26, 2011, at 11:31 PM, Sergio Monteiro wrote:
>
>
>
> > is this real or spam / virus ?
>
> > Thanks
>
> > Sergio
>
> > _o
> > _ \<,_
> > (_)/ (_)
>
> > Sergio Monteiro
> > monteirose...@yahoo.com
>
> > --- On Tue, 2/15/11, University of California <webmast...@ucla.edu> wrote:
>
> > From: University of California <webmast...@ucla.edu>
> > Subject: [uclalug-linux] Announcement
> > To:
> > Date: Tuesday, February 15, 2011, 1:18 PM
>
> > We have upgraded our server to new secured version.This is to enable your webmail account take a new look with new functions and help protect against spam e-mails. You are require to upgrade your account to new secure version by clicking here or on  the secure link below
> > https:/secure.ucla.edu
>
> >  Copyright 2011 University of California - All Rights Reserved
>
> > --
> > You received this message because you are subscribed to the UCLA LUG "Linux" group.
> > To post to this group, send email to li...@linux.ucla.edu
> > To unsubscribe from this group, send email to
> > linux+unsubscr...@linux.ucla.edu
> > For more options, visit this group at
> >http://groups.google.com/a/linux.ucla.edu/group/linux?hl=en
>
> > --
> > You received this message because you are subscribed to the UCLA LUG "Linux" group.
> > To post to this group, send email to li...@linux.ucla.edu
> > To unsubscribe from this group, send email to
> > linux+unsubscr...@linux.ucla.edu
> > For more options, visit this group at
> >http://groups.google.com/a/linux.ucla.edu/group/linux?hl=en
>
> Omar Sheikh
> Internal VP
> phoenix...@linux.ucla.edu

Tommy Stanton

unread,
Feb 27, 2011, 3:01:28 AM2/27/11
to li...@linux.ucla.edu

I didn't examine the mail headers, but considering the fact that it links to http://www.123contactform.com/contact-form-Stoneq-146519.html , I'd say both.

Their fake https URL is even missing a forward slash.  Amateurs.

-Tommy

A

unread,
Feb 27, 2011, 2:42:53 PM2/27/11
to li...@linux.ucla.edu
=============================================
The bad English is an almost certain give-away that it
is "phishy".  It might be fun to bait a trap for the phisher.
This would require setting up a phony account with ad-
equate firewall to prevent the rest of the sys from the
infection.  Then a honey-trap needs to be thunk up.  It
might be great sport !
Meanwhile,  do a careful job of investigating the header.
==============================================

P B Postovoit

unread,
Feb 27, 2011, 10:22:49 AM2/27/11
to li...@linux.ucla.edu
Yes and yes.

Link went to --  hxxp://www_123contactform_com/contact-form-Stoneq-146519_html

Jameel Al-Aziz

unread,
Feb 27, 2011, 4:42:50 PM2/27/11
to li...@linux.ucla.edu, Sergio Monteiro
It's spam (you can tell by the hyperlinks). I'm not sure how this got through though. Sorry guys, our bad! 

Best Regards,
Jameel Al-Aziz
LUG@UCLA President



On Sat, Feb 26, 2011 at 11:31 PM, Sergio Monteiro <montei...@yahoo.com> wrote:

spe...@ucla.edu

unread,
Feb 27, 2011, 5:40:53 AM2/27/11
to li...@linux.ucla.edu
Sorry, there's a bit of a non-sequitur in my last e-mail.

Although the average of two spelling and grammatical errors per
sentence, the misspelled (and suspiciously generic) e-mail address,
the glaringly obviously typo in the URL, and the fact that the e-mail
was sent over the LUG mailing list (but not to my mail account) was
pretty damning...

I also cracked open the e-mail source code (yay for UCLA's mail system
which lets you do that) which shows that the innocent-looking
hyperlink actually links to an address at 123contactform.

Also, if I'm reading the message path correctly, the e-mail appears to
have originated from Chile... O_o

"Pardon me my friend, but I am the UCLA webmaster. Please ignore the
fact that I can't spell 'webmaster'. Or link to the UCLA website."

(Joke paraphrased from "RvB Special - Real Life vs Internet" on YouTube)

- Steven

spe...@ucla.edu

unread,
Feb 27, 2011, 5:44:01 AM2/27/11
to li...@linux.ucla.edu
Sorry, there's a bit of a non-sequitur in my last e-mail.

Although the average of two spelling and grammatical errors per
sentence, the misspelled (and suspiciously generic) e-mail address,
the glaringly obviously typo in the URL, and the fact that the e-mail
was sent over the LUG mailing list (but not to my mail account) was
pretty damning...

I also cracked open the e-mail source code (yay for UCLA's mail system
which lets you do that) which shows that the innocent-looking
hyperlink actually links to an address at 123contactform.

Also, if I'm reading the message path correctly, the e-mail appears to
have originated from Chile... O_o

As Red vs Blue would have put it:

"Pardon me my friend, but I am the UCLA webmaster. And I need you to
follow this hyperlink. Please ignore the fact that I can't spell
'webmaster'. Or write a link to the UCLA website."

(From "RvB Special - Real Life vs Internet" on YouTube)

- Steven

spe...@ucla.edu

unread,
Feb 27, 2011, 5:41:05 AM2/27/11
to li...@linux.ucla.edu
Sorry, there's a bit of a non-sequitur in my last e-mail.

Although the average of two spelling and grammatical errors per
sentence, the misspelled (and suspiciously generic) e-mail address,
the glaringly obviously typo in the URL, and the fact that the e-mail
was sent over the LUG mailing list (but not to my mail account) was
pretty damning...

I also cracked open the e-mail source code (yay for UCLA's mail system
which lets you do that) which shows that the innocent-looking
hyperlink actually links to an address at 123contactform.

Also, if I'm reading the message path correctly, the e-mail appears to
have originated from Chile... O_o

"Pardon me my friend, but I am the UCLA webmaster. Please ignore the
fact that I can't spell 'webmaster'. Or link to the UCLA website."

(Joke paraphrased from "RvB Special - Real Life vs Internet" on YouTube)

- Steven

Smith, Edson

unread,
Feb 27, 2011, 9:57:12 PM2/27/11
to li...@linux.ucla.edu
This is password spearphishing E-mail. Most campus departments see a couple of these each week.

Best just to delete it and not bother to report it to the webmasterrrrrrrr.

-Edson

Let's see:

linux+un...@linux.ucla.edu

Glenn Glazer

unread,
Feb 28, 2011, 8:00:53 PM2/28/11
to li...@linux.ucla.edu
Hey, Edson!

Long time no speak, how are you doing?

Best,

Glenn

--
Westercon 64
The First 7-bit Westercon

July 1st to 4th, 2011
Pro GoH: Patricia McKillip
Artist GoH: Kaja& Phil Foglio
Fan GoH: Mike Willmoth
www.westercon64.org

Glenn Glazer

unread,
Feb 28, 2011, 8:01:44 PM2/28/11
to li...@linux.ucla.edu
Apologies, this was not meant to go to the list.

Best,

Glenn

Reply all
Reply to author
Forward
0 new messages