Today I've received a strange email :
From - Wed May 23 03:38:55 2007
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from localhost (localhost.localdomain [127.0.0.1])
by zimbra.mycompany.com (Postfix) with ESMTP id 6CCBB3268564
for
X-Virus-Scanned: amavisd-new at
X-Spam-Score: 2.605
X-Spam-Level: **
X-Spam-Status: No, score=2.605 tagged_above=-10 required=6.6
tests=[BAYES_00=-2.599, HTML_IMAGE_ONLY_16=0.497, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_2=1.582, HTML_TEXT_AFTER_BODY=0.115,
MIME_HTML_ONLY=0.001, URIBL_OB_SURBL=3.008]
Received: from zimbra.mycompany.com ([127.0.0.1])
by localhost (zimbra.mycompany.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 7rxxf9Y88GGD for
Wed, 23 May 2007 03:38:54 +0200 (CEST)
Received: from smtp.mycompany.com (xxx.mycompany.com [213.207.101.239])
by zimbra.mycompany.com (Postfix) with ESMTP id B5F543268439
for
Received: (qmail 11323 invoked by uid 89); 23 May 2007 01:38:53 -0000
Mailing-List: contact xyz@xxx.mycompany.com; run by ezmlm
Precedence: bulk
X-No-Archive: yes
Reply-To: xyz@xxx.mycompany.com
Received: (qmail 11308 invoked by uid 0); 23 May 2007 01:38:53 -0000
X-Qmail-Scanner-Mail-From: msant@alpha.connectserver.org via garbo.mycompany.com
X-Qmail-Scanner: 1.25 (Clear:RC:0(89.251.0.85):SA:0(?/?):. Processed in 4.349745 secs)
X-Virus-Scanned: amavisd-new at
X-Qmail-Scanner-MOVED-X-Spam-Status: No, score=5.428 tagged_above=-10 required=6.6
tests=[AWL=-2.283, BAYES_50=0.001, HTML_IMAGE_ONLY_16=0.497,
HTML_IMAGE_RATIO_02=0.463, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_2=1.582, MIME_HTML_ONLY=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.558, REPLY_TO_EMPTY=0.6,
URIBL_OB_SURBL=3.008]
To: 07015qa@cccc.mycompany.com
From: Firfox Product
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Wed, 23 May 2007 02:38:17 +0100
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - alpha.connectserver.org
X-AntiAbuse: Original Domain - jobs.mycompany.com
X-AntiAbuse: Originator/Caller UID/GID - [32331 32002] / [47 12]
X-AntiAbuse: Sender Address Domain - alpha.connectserver.org
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php index.php
X-Source-Dir: msant.net:/public_html
Subject: [QA] New FireFox 2008
Download The Firefox Now & Surf faster and smarter! The innovative Firefox browser Together, they'll change the way you use the Internet - for free. TRY IT NOW YOU WILL SEE THE DIFFERENCE |
Which links to http://pspcolls.co.uk/Firefox.htm , Where there is a simple page on which you have two download links : http://firfox.bravehost.com/ which is suspended. I wonder what was there.
Where is the money in this scheme ?
Google has a referral program that pays people for generating Firefox downloads:
https://www.google.com/adsense/support/bin/answer.py?answer=27526
Maybe they're getting devious with custom spam-friendly Firefox builds. Man, that'd be fun.