Same meds but much more spammy
Authentication-Results: mta220.mail.re3.yahoo.com from=yahoo.com; domainkeys=neutral (no sig)
Received: from 220.127.116.11 (HELO mta220.mail.re3.yahoo.com) (18.104.22.168)
by mta220.mail.re3.yahoo.com with SMTP; Tue, 01 Jul 2008 22:56:47 -0700
Received: from 240.35.121.227 by ; Wed, 02 Jul 2008 07:54:16 +0200
From: "Horace " <firstname.lastname@example.org>
Reply-To: "Horace " <email@example.com>
Subject: Same meds but much cheaper
Date: Tue, 19 Jan 38 03:14:07 GMT
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
Now you have the opportunity to save your time and money!
With US based online p/h/a/r/m/acy store you can buy any meds you need!
Forget about prescriptions and doctors. Now you save your time.
Forget about high prices at local stores. Save your money now!
Go visit http://nomffioew.info
Seems to be the same spammer who sent the miracle replica watch from 1938.
Poor Horace is so addicted to spam he even uses random hash buster text for his e-mail address.
The e-mail is indicated as multipart/alternative in the header, but the source only contains a text/plain version. This is most likely a variation of an old trick where spammers placed a legitimate-looking message in the text/plain version and the spam message in the text/html version. The main goal is most likely to generate as many variations of the e-mail as possible. Adding a text/html version would only complicate this task. More variations improve the spammer's chances of bypassing some spam filters.
Related Cyber Criminal Profiles:No related profiles found.
Similar Spam Examples:Drugstore Pharmacy Spam - Are generics as good?
Canadian Pharmacy Spam - Worlds best pain killers here
Quit smoking spam - The most effective anti-smoking method
Canadian Pharmacy, Medications and Drug Spam - Image has been damaged
Spammers using Opera's revolutionary e-mail client