Subject: You have been selected for a Canadian Visa!!!

 

Attn:
We are contacting you with information that you have been selected online for a Temporary Residency Visa to Canada. This is for people who need a temporary resident visa (TRV) to visit Canada for a temporary purpose such as tourism, visiting family or friends, or business trips. We will also be providing you with free flight tickets for you and your family.

You have the opportunity of inviting up to 3 family members or friends by forwarding this email to them and they complete the same verification procedure as below.

To confirm your eligibility, reply this email with your below details:

Full Name:

Mobile Phone Number:

Country of Residence:

Nationality:

Marital Status:

Immediately we get your details, you will be provided with a short code to confirm your eligibility via your Mobile Number. After confirmation you will receive a password we expect you to reply us with for further processing where we will provide you with relevant documents to take down to our Embassy in your country for your visa issue.

During your visit, we will be providing you with a temporary job to enable you meet up with your expenses until you are well settled in. You must use the above link to start processing immediately.

This offer will expires 4weeks prior to your receipt of this  notification. You are only permitted to forward this invitation to not  more than 5 individuals for this free visa offer as there is a limit to the number of free visas we are offering.

Congratulations on being one of the selected Immigrants to travel to our Country for free.

Regards,

Susanne Hillen

Immigration Department,

1-800 O Canada (1-800-633-6232)

Monday to Friday (excluding public holidays) 0900 – 1700

N.B:
If you feel you received this message as and error and you are not interested in our services, kindly reply this email with your subject field as “Remove”; so we can take your email address off our database.

 

Raw Source for You have been selected for a Canadian Visa!!! Text

something in russian goes here

google translation:

 STATE DENT IN THE CENTER OF MOSCOW
Would you like to be assured of a high
the skill of your dentist?
Come to us for free advice,
and experienced professionals to our offices, not only vylechat your teeth,
but make your smile bright and healthy gums.
We offer all kinds of dental care at reasonable prices:
• Therapy • Prosthetics • Orthodontics • paradontology • Surgery • Preventive maintenance
All kinds of diagnosis! Includes computerized tomography!
The unique method of «electronic determine malocclusion» 10 minutes an American instrument Tscan-III
Treatment of gum German "Vector"-the system!
We are waiting for you: from 9.00 to 20.00 (working without days off)
Art. China-town, village Petroverigsky Lane 10
Writing for a free consultation, call:
[495] 621-81-26, 627-0Z-2O

I have no idea what that means and I can’t be assed running it through google translate.

hello.

i work in a private detective agency. my name is not important now.

I’m warning you that i’m going to watch you and monitor your telephone line.

Do you want to know who paid for shadowing you? Expect my next e-mail.

P.S. I know, you don’t believe me. But i think that the record of your yesterday’s telephone conversation will assure you

that everything is real. The record is in archive. The password is 123qwe

here’s the raw mail including the most likely malware rarfile enclosure (DO NOT extract and open this file on a Windows PC unless you know what you are doing.)

FW: Is your skills about to expired?

Your new Diploma!
No examinations!No classes!No textbooks!
Call to register and receive your qualifications within days!
24 hours a day 7 days a week!
+1 206 309 033 6
Confidentiality assured!

Kind of ironic considering we’re a business school.

sotw#5 mad skillz raw file

This one easily caught by Apple Mail’s built in junk mail detection though I’ve had a couple that have got through undetected.

small wang raw source

iPhone spam raw source

The hapless user gets some mail, thinks “yay, free mac!”, and after clicking on anything in the mail their web browser is launched and is redirected all over the place. Presumably each of the redirects represents a false click on some advertising or something somewhere which brings in revenue for the spammer.

Click to enlarge the initial spam.

Click to enlarge the page seen after the initial couple of redirects.

Click to enlarge the final webpage that is displayed. Kinda ironic don’t you think?

As an exercise I traced all of the redirects and meta refreshes in order.

1. After clicking on the spam, the following URL is requested by the users browser:
   http://r.rockysoils.com/c/34458/18377/82890422.html?/
dummy@email.address
   Which results in the first 302 redirect:
   HTTP/1.1 302 Moved Temporarily
Location: http://publishers.clickbooth.com/ez/bkdgyfnggey/
&dp=1537637&/dummy@email.address
2. That redirect:
   http://publishers.clickbooth.com/ez/bkdgyfnggey/
&dp=1537637&/dummy@email.address
   Results in another:
   HTTP/1.1 301 Moved Permanently
Location: http://publishers.clickbooth.com/geo_tracking_redirect.html?e=dowymcrbxx
3. That redirect:
   http://publishers.clickbooth.com/geo_tracking_redirect.html?e=clqnspiekk
   Brings up the page shown in the second image above, and contains a meta refresh command:
4. The meta refresh request:
   http://publishers.clickbooth.com/sw/12072/CD8940/
   Brings up another web page which sets 2 cookie and then triggers another meta refresh:
5. This meta refresh request:
   http://www.freepay.com/intl.aspx?x=5284
   Results in a 302 redirect:
   HTTP/1.1 302 Found
Location: http://offers.gratisnetwork.com/rotator/CD114/18
6. That redirect:
   http://offers.gratisnetwork.com/rotator/CD114/18
   results in another 302 redirect, and sets four more cookies
7. http://offers.gratisnetwork.com/sw/1510/CD114/&p=18
   Sets 2 more cookies, and contains another meta refresh
8. http://ab.vcmedia.com/c/s=64718/c=107930/
   returns another 302 redirect
9. http://a.websponsors.com/c/s=64718/c=107930/
   returns another 302 redirect
10. Which finally gets us to the last page:
    http://ShoppersSavingCenter.biz/?config=2073&src=WC-64718aaa:107930
    which is shown in image number 3

Click to enlarge

Australian Government
Australian Taxation Office

After the last annual
calculations of your fiscal
activity we have determined
that you are eligible to
receive a tax refund of
$183.80

A refund can be delayed for a
variety of reasons. For
example submitting invalid
records or applying after the
deadline.

To access the form for your
tax refund, please click here

Regards, Australian Government
© Copyright 2006, Australian Taxation Office – All rights reserved.