[SC-Help] Re: misguided e-mail

[Mike Easter]

Don J. Reid wrote:
> Is this just a misguided e-mail, it's to info@ my company, don't know
> the person.
>
> Should I report it?

My advice about any unknown mail is to not start with 'reading' the mail
or even pay much attention to the subject if you don't 'know' the From
by familiarity.  That is, it is an unknown and presumably unsolicited
mail and likely spam until proven otherwise.

So, the first place we look as at the headers for bogosity.

The headers say that the item is sourced from aol and the From is an aol
addy and it contains a vcard of an aol persona and the software is aol
s/w.  So, header bogosity isn't jumping out at us.

The body content of the html item is a brief message about "You are
invited to accept baldheadtroy's Address Card." and there is a vcard
attached with the addies for the usernames baldheadtroy as an aol/er
and/or troyb26 as a yahoo.

In addition, there is an html function in the mail to click to accpet
the vcard and that causes this:

http://publish-subscr=
ibe-npe.blue.aol.com/pns/action?xok=3D0&ot=3D1&loc=3Den%5Fus&oid=3D93175
8=
6&pfn=3D&pln=3D&ssn=3Dinfo%40jel%2Ecom&psn=3Dbaldheadtroy&action=3Dsub&s
=3D=
MC4CFQCcj%2BWZ8WC6axfjL%2Bk3wUZGOn2DRAIVAJEL2TerVrn7b1r7Hflc1o3G7O7L&_AO
L=
FORM=3Dh300.w300.p5

which is quoted printable and which might get destroyed by wrapping
here, but which also translates to

http://publish-subscribe-npe.blue.aol.com/pns/action?xok=0&ot=1&loc=en_us&oid=9317586&pfn=&pln=&ssn=x&psn=baldheadtroy&action=sub&s=mc4cfqccj+wz8wc6axfjl+k3wuzgon2draivajel2tervrn7b1r7hflc1o3g7o7l&_aolform=h300.w300.p5

<which might also get wrapmunged>

where the 'x' in there at ssn= is info <at> jel.com.  The function of
all of that is for you to be able to be notified if anything changes
about our buddy baldheadtroy's addy or such, allegedly.

So, if you don't know the yahoo troyb26 or the aol/er baldheadtroy, then
this is some kind of 'trivial' unsolicited mail, not your average piece
of spam.

I would be annoyed by the html-ness of the 'publish-subscribe' content
above, and that annoyance would cause me to report it as spam.  The
report will go to aol, and the source is an aol/er doing something.

> Haven't had to report much for the last 6 months, switched over to a
> new provider with spamassign and it works great.

www.spamcop.net/sc?id=z864707806z4ead588bfb80b4d07c0945387cd86b4ez

-- 
Mike Easter
kibitzer, not SC admin