[Coco] spoof e-mail "from coco3.com"

[Aaron Wolfe]

This is a generic template, I have seen them come into a few different
domains.  Just replace "coco3.com" with domain of the recipient (and
set sender = recipient).

It's trivial to spoof a message from any address to any other address.
 The spammers have recently found that some spam filters (mistakenly)
will pass emails coming from the same address they are sent to, and so
this has become a popular technique.  Most spam filtering services
have compensated by marking email from and to the same address and
originating outside their own networks as very likely being spam.

Chances are very low that anyone else saw this message in the form you
saw it.  They would have seen it come from their own email address and
with their own domain in place of coco3.com.

-Aaron


On Mon, Feb 22, 2010 at 6:44 PM, Roger Taylor <operator at coco3.com> wrote:
> I'm not sure if anybody else got one of these but someone used my
> payment at coco3.com e-mail address and sent me the following message:
>
> To: <payment at coco3.com>
> Subject: A new settings file for the payment at coco3.com has just be released
>
> Dear use of the coco3.com mailing service!
>
> We are informing you that because of the security upgrade of the mailing
> service your mailbox payment at coco3.com settings were changed. In order to
> apply the new set of settings open zip attached file.
>
> Best regards, coco3.com Technical Support.
>
>
>
> --------  end of fake e-mail -------
>
> The e-mail of course contained a dangerous .exe file.  I think it goes
> without saying that if anybody else gets one of these e-mails, it's not from
> me or the site, and do Not open any attachments.
>
> Because of the poor spelling, I can assume it is HexStar or a Russian bot
> again, but what do I know.
>
> Ok, has anybody else received an e-mail like the above?
>
> --
> ~ Roger Taylor
>
>
>
> --
> Coco mailing list
> Coco at maltedmedia.com
> http://five.pairlist.net/mailman/listinfo/coco
>