Re: attachment; filename="photo1.jpg.pif"

From: Portnoy, Gary (gportnoyat_private)
Date: Tue Apr 24 2001 - 09:38:39 PDT

  • Next message: Kevin Jackson: "Re: Increase in Sun RPC Scans" 

    Here is what the text says, loosely translated:

"Hi!
I got your email address from a common friend (your was the first address he
thought of).  I just got on the internet for the first time and just got
this email address.  I am writing my first email!  My friend told me that if
I have any questions, I could ask you.  I am cute and friendly (look at the
photo attached).  I'll be waiting for a response from you.  Write me a
little info about yourself and what more you want to know about me.  Bye-bye
:))))))) "

My guess, if the file is not a virus, that this is some kind of a mail-order
bride rig, or an attempt to get you to reveal info about yourself.  Maybe if
you carry on some sort of conversation with her, she'd ask you for CC # or
something...

Later

-----Original Message-----
From: Dzzie Z [mailto:dzzieat_private]
Sent: Tuesday, April 24, 2001 2:39 AM
To: INCIDENTSat_private
Subject: attachment; filename="photo1.jpg.pif"


hey guys

today I got a this mail and was wondering if anyone else
on the lists here have gotten a similar one.

I dont have the font installed for the (presumably)
russian txt but I find it pretty unlikely that a plain ole
spammer would be using tricks like "photo1.jpg.pif"

i peeked at the unencoded binary (60k) file, and the headers
definatly dont look like any of the other pif file on my
system, and they dont quite look like a c++ file either.
I dunno. glad for text only mailers though : )

anyone else seen this m/o ?

contact me off list if you want
the mimed file.


+OK 87078 octets
X-Apparently-To: dzzieat_private via web11102
X-Track: 10: 40
Received: from mx5.port.ru  (EHLO smtp5.port.ru) (194.67.23.40)
  by mta495.mail.yahoo.com with SMTP; 23 Apr 2001 22:11:39 -0700 (PDT)
Received: from [212.96.196.64] (helo=smtp.mail.ru)
	by smtp5.port.ru with smtp (Exim 3.14 #3)
	id 14rv68-000EK9-00
	for dzzieat_private; Tue, 24 Apr 2001 09:10:49 +0400
Received: from 2-193.dialup.comset.net (2-193.dialup.comset.net
[213.172.2.193])
	by smtp.mail.ru (8.11.1/8.11.1) with ESMTP
From: Света Ковалева <bipwdkrat_private>
X-Mailer: The Bat! (v1.42f)
X-Priority: 3 (Normal)
To: <dzzieat_private>
Subject: Привет!!!
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----------6D16C1DFC68B15F"
Message-Id: <E14rv68-000EK9-00at_private>
Date: Tue, 24 Apr 2001 09:10:49 +0400

------------6D16C1DFC68B15F
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 8bit

Привет!
Твой  адрес мне дал один наш общий друг ( первый адрес , который ему пришел
в голову).
Я недавно в интернете и только что получила этот почтовый ящик!
Так что я первый раз пишу электронное письмо!!!
Он сказал что если у меня возникнут вопросы, то я могу спрашивать у тебя...
Я довольно симпатичная и общительная.
(можешь на фото посмотреть)
Жду ответа от тебя!!!
Напиши немного себе и то что ты хочешь знать обо мне.
Пока! Пока!
:)))))))))
------------6D16C1DFC68B15F
Content-Type: application/octet-stream; name="photo1.jpg.pif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="photo1.jpg.pif"

    This archive was generated by hypermail 2b30 : Tue Apr 24 2001 - 09:53:54 PDT