Sorta...
Here's the 'announcement':
Since I last visited/uploaded last May, I was not only thrilled but extremely surprised!
Raw source for the From:, Subject: and message ID:
From: Picasa Services <hedava@anaconda04.webcreatif.ch>
Subject: Xairbusdriver, Your photo takes first place
Message-id: <e8c613fadf4681895812241bfaff@anaconda04.webcreatif.ch>
Red flags:
strange names for email account supposedly from Picasa (anaconda = 'snake in the grass'?)
A Chinese website (.ch)
All links went to exactly the same page, even though they had different purposes
An offer to get more space at Picasa, these are usually nefarious/cheating methods
Lots of 'bait' and 'hooks' usually means someone is 'phishing!'
This part was interesting, also:
x-icloud-spam-score: 10022
f=anaconda04.webcreatif.ch;e=anaconda04.webcreatif.ch;pp=suspected;spf=?;dkim=?;wl=absent;pwl=absent
X-Proofpoint-Virus-Version: vendor=fsecure
engine=2.50.10432:5.11.87,1.0.14,0.0.0000
definitions=2014-01-10_07:2014-01-10,2014-01-10,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=probablespam policy=default score=95
spamscore=95 suspectscore=61 phishscore=0 adultscore=3 bulkscore=66
classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1308280000
definitions=main-1401100233
X-Suspected-Spam: true
Apparently Mail ignores all that?
Here’s the html for the link that claims my ‘photo takes first place.”
<a href="
http://www.uniontop.com.tw/cgi-bin/imprinting.pl" style="text-decoration:none;color:#1155cc">Your photo takes first place</a>. Basically a Perl script (‘imprinting’) to do something. Haven’t bothered to attempt downloading the script which probably requires a password to the server, anyway.
uniontop.com.tw looks to be a Chinese company, of course. And I think that’s where the email originated. The company site “requires Java to display some elements on this page” according to Chrome. One of those “elements” could very well be a ‘surprise package?’
Actually, the company may be legit, it seems to be a company selling or building audio speakers and components. There are several pictures of various types of speakers on the page. I suppose even Chinese sites can have their email address harvested or their mail servers abused.
OTOH, the images on the ‘speaker’ company's site seem to have very little to do with the text I see in the html on that page. Here’ are a couple of samples of what the text says (in English, it is displayed in Chinese, on the page):
CODE
<h1>Buy generic Xenical</h1>
<p>Atherosclerosis provokes heart attacks that may lead to horrible result. <strong>Loss weight</strong>. Are you ok with your weight. Do you know how far you are from obesity.</p>
<a href="http://ottawadstore.com/products/weight_loss/xenical/order/">Xenical generic
.
.
.
<h1>Orlistat lose weight<h1>
<p>American pharmacists take pride in presenting you their new anti-obesity treatment. <strong>Losing weight</strong>. How long have you been suffering from derogatory looks. Time to improve your figure.</p>
<a href="http://ottawadstore.com/products/weight_loss/orlistat/order/">Buy Orlistat no prescription</a>
.
.
.
The html was generated by FrontPage 6.0™. I’m sure MS is proud to know their software is being used in such a creative way (even if they probably don’t have this company as a registered user!).
Seems to me, I am being confused with a Chinese ‘consumer!’
Not sure how “SPAM” translates into Chinese… but that's how I told SpamSieve to treat this message. BTW, Picasa is owned, operated and 'works' for Google.
BTW,
Paddy, have you ever made a virtual trip to that "Ottawa" store?
Oh well... back to the digital darkroom...
