[SC-Help] Re: Is this message legit re spamcop account?

[Garen Erdoisa]

Bob Stringer wrote:
> I received the e-mail quoted below, indicating that it was
> from "webmaster at spamcop.net" 
> 
> I've changed my e-mail address in the quoted portions,
> including in the link that was provided, to protect the
> innocent. Otherwise it's verbatim.
> 
> I never trust messages like this one, since it simply looks
> like someone's trying to get account information out of me.
> For reasons I'll explain shortly, however, although I wasn't
> going to log in or provide any information, I clicked on
> the link to see what was up. However, all I got was a "404
> Not Found" page at the Spamcop web site.
> 
> This ordinarily would have been be the end of the matter for
> me, except that today is June 6, precisely the date for the
> renewal of my account. I in fact renewed my account though
> PayPal over two weeks ago, but the fact that I've received
> such a message on the renewal date makes me wonder whether
> it could be legitimate. I obviously don't want my account to
> be closed because someone messed up the record of my
> payment.
> 
> So, does anyone know whether this kind of message is sent
> when an account is up for renewal, or whatever? (It seems
> very strange that an account would be closed within 24 hours
> without a response, since not everyone is in contact with
> e-mail every single day of his life).
> 
> Hunting around the spamcop web site I didn't see any obvious
> e-mail addresses for inquiries, and so I sent e-mail
> messages, saying essentially what I've said above, to
> support at cesmail.net, paypal at cesmail.net,
> service at cesmail.net. One of those addresses sent me my
> original renewal notice on May 22, and the other two were
> referenced in the PayPal message confirming my renewal
> payment. I didn't know where else to send it.
> 
> If anyone knows that there's some other address for
> corresponding regarding accounts, or can suggest any other
> address to which I should send a message, I'd appreciate
> being informed. And quickly, since the message, if it's
> legit, indicates my account will be suspended in 24 hours!
> 
> Thanks.
> 
> And here's the message I received:
> 
> From: webmaster at spamcop.net <webmaster at spamcop.net>
> To: xxxxx at xxxxx.net
> Date: Monday, June 6, 2005, 1:42:41 PM
> Subject: Account Alert
> 
> Dear Valued Member, 
> 
> According to our site policy you will have to confirm your
> account by the following link or else your account will be
> suspended within 24 hours for security reasons.
> 
> http://www.spamcop.net/confirm.php?email=xxxxx@xxxxx.net
> 
> Thank you for your attention to this question. We apologize
> for any inconvenience.
> 
> Sincerely,Spamcop Security Department Assistant.
> 

1) Full headers are not shown in the above.
2) the message body source is not shown in the above.
3) you should post messages such as this to spamcop.spam, or better yet, 
feed it to the spamcop parser then post the spamcop tracker url here so 
the rest of us can see how spamcop parsed the message.

Other than that:
It looks to me based ont the wording of the message like a phish scam 
that forged headers to make it appear to you like it might be comming 
from spamcop, but is in reality trying to trick you into entering your 
credit card info so the scammer can steal it.

You'll need to look at the message source to reveal the hidden links 
which will show where the link will really send you if you click on it.

This same sort of tactic is used to target many banks and places like 
paypal and ebay to try to trick users into entering personal info.