"You Have Recieved a Postcard From..."

[IJ Reilly]

Probably like everybody else I've been receiving a flood of spam recently allegedly containing links to e-postcards sent to me by friends and family members. They masquerade as hallmark.com, postcards.com, egreetings.com, etc. Surprisingly, at least some of the IP numbers trace back to a server in Herndon, VA (usually these things live on servers in places like Russia or Romania).

I presume whatever these links do doesn't affect OSX. But I haven't read about this one anywhere so I'm wondering if anybody knows what these spam-scammers are trying to accomplish. Is it a phishing scheme? Some other nasty business?

 

[Turkish]

I've been getting a lot of these, too.

I accidentally hit one of them and it started a .exe download, which I opened and it did nothing.

Not to say I'd reccomend it, but that was my experience. Woe unto careless Windows users...

 

[xsedrinam]

It's been just this week. Also a batch of .pdf which is getting by my filters and wasting time, although I don't bother opening any of it, after the first "postcard" one. It goes directly to junk, does not pass go, does not collect $200.

 

[plinden]

It runs postcard.exe on your PC if you go to the links. That's apparently a Trojan downloader. It's been around in various forms since the end of last year.

And why haven't we heard much about it? It's just what you expect to happen when you go online

 

[GoCubsGo]

I get those too. I thought for a second someone just loved me!

 

[Queso]

Here's a nice bit of info on it for those that are interested.

 

[IJ Reilly]

Here's a nice bit of info on it for those that are interested.

Thanks, but that's a bit too technical for me. I notice a javascript and a QuickTime exploit. Is the Mac vulnerable in any way?

 

[plinden]

Thanks, but that's a bit too technical for me. I notice a javascript and a QuickTime exploit. Is the Mac vulnerable in any way?

Since all the downloaded files are exes and rely on Windows systems files, no. Not yet anyway.

I'm not willing to go to any links though.

 

[FrankBlack]

I've received two of them in as many weeks. I set an email filter, so that anything containing the words "Hallmark.com" gets deleted.

Sounds like another good old spam attack.

 

[Ugg]

All I've gotten is a bunch of spam in cyrillic and most of it is pharmaceutical in nature.