[WEB1901] Exemple de SpyBug dans un Spam
Robert Goedertier
agpym at skynet.be
Mer 30 Avr 10:48:06 CEST 2003
J'ai déjà envoyé à certains d'entre vous des courriers sur les précautions anti-spam, et l'utilité qu'il y avait à ne pas ouvrir son courrier en ligne.
Ci-dessous un exemple de spam comprenant des "images" dont le lien http me semble contenir clairement des codes d'identification que l'administrateur du serveur click1.rapiddealsbyemail.com pourra retrouver dans ses log-files signalant que le courrier envoyé à l'adresse XXXXX at swing.be a été reçu et ouvert.
(Pour ne pas polluer davantage l'adresse visée j'ai remplacé l'adresse ainsi que les codes numériques par des XXXXX; pour retrouver rapidement le spybug il vous suffira de chercher "id=X" dans le message ci-dessous).
Le problème est que je ne sais quel conseil donner à ceux qui voyagent en se servant d'une boîte de webmail...
>Return-Path: <bounce-123559595-8894 at mail84.rapiddealsbyemail.com>
>Received: from jay.skynet.be (jay.skynet.be [195.238.3.234])
> by coldbert.skynet.be (8.12.9/8.12.9/Skynet-MAILSTORE-2.12) with ESMTP id h3U2UYIL020526
> for <rgoeder at swing.be>; Wed, 30 Apr 2003 04:30:34 +0200 (MET DST)
> (envelope-from <bounce-123559595-8894 at mail84.rapiddealsbyemail.com>)
>Received: from mail84.rapiddealsbyemail.com (mail84.rapiddealsbyemail.com [66.216.119.125])
> by jay.skynet.be (8.12.9/8.12.9/Skynet-IN-2.32) with SMTP id h3U2UNS5031397
> for <XXXXX at swing.be>; Wed, 30 Apr 2003 04:30:23 +0200
> (envelope-from <bounce-123559595-8894 at mail84.rapiddealsbyemail.com>)
>Message-Id: <200304300230.h3U2UNS5031397 at jay.skynet.be>
>Content-Transfer-Encoding: 7bit
>Content-Type: multipart/alternative; boundary="_----------=_1593818743147014865815"
>MIME-Version: 1.0
>X-Mailer: MIME::Lite 2.117 (F2.6; B2.12; Q2.03)
>Date: Tue, 29 Apr 2003 21:21:47 UT
>Subject: Friend, Do this for your family
>X-List-Unsubscribe: <unsub-XXXXXXXXX-XXXX at rapiddealsbyemail.com>
>From: "ALERT" <returns-fvfgxxjxjxyddja at rapiddealsbyemail.com>
>Reply-To: "Rapid Deals By Email" <returns-fvfgxxjxjxyddja at rapiddealsbyemail.com>
>X-Rapid: H4F%N9&]M25;;%*O2MF:[JLUBRF77=6N)<*J?Z*EF[[)-7?'8!:5[80``
>To: "Friend" <XXXXX at swing.be>
>X-MDA: Freemail-1.3
>X-UIDL: 21b30794c107219a0da9f3481628a5c7
>
><x-html><!x-stuff-for-pete base="" src="" id="0"><table border="0" width="320" height="30">
>
> <tr>
>
> <td width="320" height="30">
>
> <p align="center"><img src="http://power-sup.com/rapiddealbyemailrtarget.gif" width="300" height="30"></td>
>
> </tr>
>
> </table>
>
>
>Friend, <br><p>Are you as sick of all the "money making", "get rich
>
>quick" schemes as I am?</p>
>
><p>Tired of people wanting you to give them your personal details without having
>
>any clue what they are offering?</p>
>
><p>Me too!</p>
>
><p>That is why I have put together one of the hottest, most successful business
>
>packages of the new millennium, and I will show it to you right now! <u>And, yes
>
>that means details!</u></p>
>
><p>Give me 2 minutes of your time and I will show you EXACTLY what it wil take
>
>to change your financial life today. No Hype, NO False promises, just the
>
>facts!</p>
>
></FONT><FONT COLOR="#0000ff" BACK="#ffffff" style="BACKGROUND-COLOR: #ffffff" SIZE=6 PTSIZE=20 FAMILY="SANSSERIF" FACE="Arial" LANG="0"><A HREF="http://click1.rapiddealsbyemail.com/sp/t.pl?id=XXXXXX:XXXXXXXXX">CLICK HERE NOW FOR FREE DETAILS!
>
><p>Sincerely, <br>
>
>Neil Patrick<br>Senior Business Coordinator</p>
>
><br>
>
><IMG SRC="http://click1.rapiddealsbyemail.com/sp/t.pl?id=XXXXXX:XXXXXXXXX&o=1" BORDER=0 WIDTH=0 HEIGHT=0>
><A name='unsub'><BR><P><BR><!-- Email-Address: XXXXX at swing.be -->
>
><A name='unsub'><TABLE align="center" border="0" cellpadding="5" cellspacing="0" bgcolor=white><TD><TABLE width="600" align="center" cellpadding="0" cellspacing="0" border="0"><tr><td height=1><hr noshade></td></tr><TR><TD align="center"><FONT color="black" size="2" face="arial,sans-serif">We respect your privacy. You have opted in to receive updates <BR>on the web's best discount offers while visiting one of our partner sites.</FONT></TD></TR>
>
><TR><TD align="center"><FONT color="black" size="2" face="arial,sans-serif"><BR>If you would no longer like to receive these offers via email, <BR>you can unsubscribe by sending a blank email to <A href="mailto:unsub-123559595-8894 at rapiddealsbyemail.com">unsub-123559595-8894 at rapiddealsbyemail.com</A></FONT>
>
></TD></TR><TR><TD align="center"><FONT size="2" face="arial,sans-serif"><I>OR</I></FONT></TD></TR><TR>
>
><TD align="center"><FONT face="arial,sans-serif" color="black" size="2">Sending a postal mail to: <br><br> Customer Service <br> 3236 Grand Avenue, Ste. I - #669 <br> Laramie, WY 82070</FONT>
>
></TD></TR><TR><TD align="CENTER"><BR><FONT face="arial,sans-serif" size="2" color="black"><I>This message was sent to address XXXXX at swing.be</I></FONT>
>
></TD></TR><tr><td height=1><hr noshade></td></tr></TABLE></TD></TABLE>
>
>
></x-html>