August 13, 2010LinkedIn, Part Deux
Only about six hours after the first barrage, the same senders have changed up the message content and Subject, while keeping all the LinkedIn header stuff intact, including the X-LinkedIn header fields and a reference to linkedin.com in the From: field.
The new content is a mix of text come-ons, like the following:
I have attached the SRP Cool Cash Application below as well as a computer copy of your invoice.
We appreciate your business!
Have a great day!
Hi, If you thought you had a tight parking space in the garage, check out the attached.
Sorry it took me so long to get this to you.
The ARI certification is # 3373385
The installed price is $5480 plus sales tax.
Less $600 Manufacturer's instant rebate
Less $300 discount for buying 2 systems
Less $425 SRP Rebate
Less 30% of original purchase price (up to $1500) Federal Rebate Credit
We will see you on the August 12th and then your friend on the 19th of August.
I attached the certificate for you.
All messages come with a .zip attachment (~170KB) with different names. VirusTotal is down (being DDOSed?) so I'm not sure what the attachment is. It can't be good.
And then I realized that Friday the 13th is only half over. Ugh.Posted on August 13, 2010 at 12:59 PM