This morning, I received this gem. I changed the return address and the phone numbers.
Received: from [18.104.22.168] (helo=tdyoireznpl.tmxmykph.ua)There are so many things to notice. The incorrect spellings and numbering (1, 2, 4) are how they arrived. The interesting mix of drug spam and weapon spam.
Subject: Free heroin shipping!
FREE HEROIN SHIPPING!
1. Heroin, in liquid and crystal form.
2. Rocket fuel and Tomohawk rockets (serious enquiries only).
4. New shipment of cocaine has arrived, buy 9 grams and get 10th for free.
Everebody welcome, but not US citizens, sorry.
ATTENTION. Clearance offer. Buy 30 grams of heroin, get 5 free.
Please contact: SPAMMER_EMAIL@gmail.com
On the technical side, they claim to be from Afghanistan and the 0093 country code is for Afghanistan but the email address listed is gmail (frowny face to them), the "helo" exchange with the mail service indicates it came from .ua which is the Ukraine. But the IP address listed is neither of those. The IP address is allocated to .... are you ready...
OrgName: AT&T Global Network Services, LLC
Address: 3200 Lake Emma Road
City: Lake Mary
So we have spam from Florida, claiming to be from the Ukraine, and wanting us to contact some drug/weapon runner in Afghanistan. My guess is that this is likely spam from one of those infamous Russian botnets driven by the Russian mob.
The marketing and salesmanship is brilliant in a warped way. You have to smile at the offer of free shipping and buying 9 grams and get one free. And who could resist the Clearance offer? All we are missing is an order by midnight tonight and the more you buy, the more you save.
The pinnacle of the marketing here is that this offer is not available for American citizens. Wow! What a great use of reverse psychology. Now all of the Americans reading this spam want the drugs with free shipping and a six-pack of "Tomohawk" missiles. Hold me back.
This is nothing I will reply and it is already deleted but very entertaining to read. This is even funnier than the offer I got recently which was supposed to be from an RTEMS Steering Committee member and slipped through the the RTEMS Users mailing list this week. It wanted us all to look at their photo set at a Russian "sex flirt girls" site. I really hope they were not pictures of him. LOL