This one caught my eye for a second. I thought, “I don’t remember booking anything with American lately.” The lazy spammer didn’t even bother to include any graphics to make it look official.
Sender: American Airlines (information-no77537@aa.com)
Subject: Your Order##91991988
Text:
Dear Customer,
FLIGHT NUMBER 984
ELECTRONIC 746879098
DATE & TIME / NOVEMBER 17, 2011, 11:53 PM
ARRIVING / NEW YORK JFK
TOTAL PRICE / 321.56 USD
Please find your ticket attached.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Attachment: AA_Ticket_#8565.zip
==================
Update:
I received the following variant on Nov. 28. No attachment this time, just a link. And this one didn’t say which airline it came from (other than the signature, “Airlines America”). The price of my mythical flight has gone up, though.
Sender: support@rlweiner.com (gee, that’s me!)
Subject: Fwd: Re: Your Flight Order N2295-505368
Dear Customer,
FLIGHT ELECTRONIC NUMBER 590191204
DATE & TIME / DECEMBER 26, 2011, 16:13 PM
ARRIVING AIRPORT: NEW YORK JFK
PRICE : 411.35 USD
Please download and print out your ticket here:
http://www.airlines.com/flight-06250762055
BRITTNI BEAL,
Airlines America
Fingerprint: f8a09213-4b65e7cd
I got one of these today and I did panic a little at first… I’m always so paranoid about my details and of course straight away I assume someone had been using my credit card and all my details. So glad it’s spam though. So thanks! (:
I also got one on the 9th march, but have only just noticed it as it was sent to my junk emails, I still panicked at first thinking someone had got my card details, thanks to this site it was deleted!
This is the one I got today… Where the heck is Plano?
Hello
FLIGHT NUMBER AS2487
ELECTRONIC 1508967
DATE & TIME / MARCH 24, 2012, 10:29 PM
ARRIVING / Plano
TOTAL PRICE / 214.14USD
Your ticket is attached.
You can print your ticket.
Thank you
American Airlines.
(news-no49101@aa.com) This is the email mine origionated from.
Plano is in Texas. American doesn’t even fly there. In fact, it looks like there isn’t even an airport there.
Got the same thing with a .zip file attached. I found it amusing that the flight was supposedly booked for 02/12/2012 yet I didn’t get the email until 02/28/2012. 16 days after my flight apparently already left LOL!!!
Dear Customer,
FLIGHT NUMBER AA643
ELECTRONIC 3599655
DATE & TIME / FEBRUARY 18, 2012, 09:25 AM
ARRIVING / St.Paul
TOTAL PRICE / 351.21 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
AA customer services.
OH I guess this is still going on. So Fremont is in CA and I need a parachute huh? Damn. I mean, a ticket for 320 bucks from the UK to the US isn’t so bad… Haha. Probably one of the worse scams I’ve seen. I’ve flown AA before (as I fly via them and their carriers to see my partner who is stationed in San Angelo down in Texas) so I knew it was fake to begin with, but now knowing I need to parachute just adds a level of giggles to this…
Maybe they’d let you out in Oakland — there’s an airport there. 😉
hahaha – – Received this today (Oct. 3, 2012) – – Rancho Cucamonga?? – – Really??
Dear Customer,
TICKET / 1 701 5817501764 1
SEAT / 29E/ZONE 2
DATE / TIME 20 OCTOBER, 2012, 10:29 AM
ARRIVING / Rancho Cucamonga
FORM OF PAYMENT / CC
TOTAL PRICE / 154.54 USD
REF / EF4645 ST / OK
BAG / 7PC
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
Yes Susan, there is a Rancho Cucamonga. But I don’t think they have an airport. Maybe just a municipal one.
just got this one. at first i was like, I thought my wife booked with Delta, then noticed the destination was Seattle, wait she’s going to Chicago. this spam is definitely lame.
Dear Customer,
E-TICKET NUMBER / 1 983 1199935918 1
SEAT / 37A/ZONE 3
DATE / TIME 26 OCTOBER, 2012, 10:09 AM
ARRIVING / Seattle
FORM OF PAYMENT / CC
TOTAL PRICE / 176.76 USD
REF / OE9125 ST / OK
BAG / 4PC
Your ticket is attached.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.
I’ve been getting fake Delta messages as well. The subjects have been:
Your order is processed
Your order #184052 has been completed
Order #9720 is processed
No graphics, no logos, just plain, lame text, like this:
Hello,
E-TICKET / EH183155337
SEAT / 65E/ZONE 2
DATE / TIME 4 OCTOBER, 2012, 11:35 AM
ARRIVING / San Francisco
FORM OF PAYMENT / CC
TOTAL PRICE / 237.36 USD
REF / OE.7601 ST / OK
BAG / 3PC
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
Delta Air Lines.
That one was amusing, since I was already in San Francisco on the 4th. Another version sent me to Wichita, a third to Arlington. Each one has an attachment called Delta_A_Ticket_Print_Document_nnnn.zip (the numbers have differed).
I just got this today. I knew it was spam. What pisses me off though, is that AVG and MalwareBytes did not alert on the scan of the AA_Ticket_Print_Document.exe that was attached. Of course I did not run it, but was extremely disappointed in my security packages.
I got one today too.
On Tue, Oct 2, 2012 at 8:10 PM, American Airlines wrote:
Dear Customer,
E-TICKET NUMBER / 1 676 1005881675 1
SEAT / 39A/ZONE 2
DATE / TIME 19 OCTOBER, 2012, 12:21 AM
ARRIVING / Anchorage
FORM OF PAYMENT / CC
TOTAL PRICE / 141.41 USD
REF / KE2981 ST / OK
BAG / 7PC
Your bought ticket is attached.
You can print your ticket.
Thank you
American Airlines.
Well now Delta is sending them 😉
Dear Customer,
TICKET NUMBER / EH145100661
SEAT / 74F/ZONE 2
DATE / TIME 26 NOVEMBER, 2012, 12:35 AM
ARRIVING / Stockton
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 225.92 USD
REF / LE.8261 ST / OK
BAG / 5PC
Your bought ticket is attached.
You can print your ticket.
To open archive, pleace use password: deltaairlines
Thank you for your attention.
Delta Air Lines.
.rar file attached
received one today 11/8/2012
Subject: Your order is ready
From: American Airlines
Sent: Nov 8, 2012 06:29:21 PM
To:
Reply-To: your_ticket@a-airlines.com
Attachments : TICKET-FLY986404AA.rar
To open archive pleace use this password: AATicket Dear Customer,
E-TICKET / 3 504 1291968873 3
SEAT / 72A/ZONE 3
DATE / TIME 27 JUNE, 2012, 10:46 AM
ARRIVING / Kansas City
FORM OF PAYMENT / CC
TOTAL PRICE / 366.66 USD
REF / KE8903 ST / OK
BAG / 7PC
Your ticket is attached.
You can print your ticket.
To open archive please use this password: ticket24
Thank you for your attention.
American Airlines.
So no zip file for me, just a rar file which I didn’t open.
Mine was really sloppy – check out the date of the flight, “27 June 2012” – that’s over four months ago!
Received one last week with a .rar file attachment that I did not open:
To open archive pleace use this password: AATicket Dear Customer,
TICKET NUMBER / 2 619 1306159979 2
SEAT / 57A/ZONE 3
DATE / TIME 19 JUNE, 2012, 10:56 AM
ARRIVING / Moreno Valley
FORM OF PAYMENT / CC
TOTAL PRICE / 225.25 USD
REF / OE7473 ST / OK
BAG / 6PC
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
To open archive please use this password: ticket82
Thank you
American Airlines.
You were smart not to open the attachment.
The latest one I got didn’t even say which airline it was from or where I’d be departing from:
Today I got one claiming to come from Southwest. It didn’t look anything like a real Southwest confirmation — no logo, just plain text with a graphic of a Southwest plane at the bottom. Lamer still, it says I’m going from Salt Lake City, Illinois to PAOLO ALTO, MO, which I don’t think exists. And it identifies the airport in MO as PHX, which is actually in Phoenix, AZ. The line that says “{LET:choosing Southwest for your tour!” is particularly good. The links lead to a hacked WordPress site at mode-yase.com. Bon voyage!
Here’s the text:
robert@rlweiner.com 2012-11-19 OB57H9 INITIAL SLC WN PHX0.00T/TFF 0.00 END AY2.50$SLC2.50 4245610957026 2013-11-22 1936 2012-11-20 Depart SALT LAKE CITY IL (SLC) at 8:23 PM on Southwest Airlines Arrive in PAOLO ALTO MO (PHX) at 11:25 PM
Ready to fly!
{LET:choosing Southwest for your tour! You can find everything you want to know about your booking below. Happy voyage!
Upcoming Flight: 11/20/12 – SLC – Phx Knight
This email attacker is still trying. Today it was targeted at staff at a UK University. Our systems recognise the risk (it contains a Trojan virus), and links / attachments are automatically disabled. However, it is clear from previous recipients who have added their names to Robert’s website, that some just don’t understand how the attachment carries a payload that automatically activates if opened. Individuals who don’t work for corporates or government establishments often don’t get the automatic protection that big organisations build into their IT infrastructure. They also fail to get trained in procedures that can minimise risk to their personal systems. This is why attacks are still worthwhile to the scammers. What we really need are stronger controls over domain registrations, email accounts and other facilities that are easily abused.
In the case of the AA type of scam the guidelines are simple. If you receive an email from someone not on your contacts list and containing an attachment and/ or unexpected offer, then don’t even open it. Bin it.
Got one just now. Said I could download my ticket to Anchorage! Haha, funny part was the “ticket” price was $233.00…not from NC! Stupid spammers.
How about only $195 to Pittsburgh from London , UK .
Still too much ?
Got this one this morning and freaked out a bit as I didn’t purchase any ticket, let alone own a credit card:
“On Monday, December 14, 2015 5:46 AM, America Airlines wrote:
Dear customer,
Your payment was successfully processed, your credit card was charged.
E-Ticket is attached to this email.
Order details and e-ticket information:
FLIGHT NUMBER – VG984359
DATE & TIME – Dec 21 2015, 23:40
DEPARTING – New York
TOTAL PRICE – $ 720.00
Thank you for flying with America Airlines.”
Tried several times to open the zip file to no avail. Then I realized there is no “America Airlines”. Confused to as why this didn’t go into my SPAM folder.
I’m glad you couldn’t open the Zip file. I can’t think of an airline that sends e-tickets as attachments, much less as Zip files. I’d run a malware scan just to make sure your computer didn’t catch anything.