This one caught my eye for a second. I thought, “I don’t remember booking anything with American lately.” The lazy spammer didn’t even bother to include any graphics to make it look official.
Sender: American Airlines (information-no77537@aa.com)
Subject: Your Order##91991988
Text:
Dear Customer,
FLIGHT NUMBER 984
ELECTRONIC 746879098
DATE & TIME / NOVEMBER 17, 2011, 11:53 PM
ARRIVING / NEW YORK JFK
TOTAL PRICE / 321.56 USD
Please find your ticket attached.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Attachment: AA_Ticket_#8565.zip
==================
Update:
I received the following variant on Nov. 28. No attachment this time, just a link. And this one didn’t say which airline it came from (other than the signature, “Airlines America”). The price of my mythical flight has gone up, though.
Sender: support@rlweiner.com (gee, that’s me!)
Subject: Fwd: Re: Your Flight Order N2295-505368
Dear Customer,
FLIGHT ELECTRONIC NUMBER 590191204
DATE & TIME / DECEMBER 26, 2011, 16:13 PM
ARRIVING AIRPORT: NEW YORK JFK
PRICE : 411.35 USD
Please download and print out your ticket here:
http://www.airlines.com/flight-06250762055
BRITTNI BEAL,
Airlines America
Fingerprint: f8a09213-4b65e7cd
I got almost the exact same e-mail! My order number was different, but all the other info was exactly the same. Lamest spam ever.
I got that one too. I usuually see these things for what they are but I’ve got this girlfriend in NY state. She indicated the other day that she’d get me a random ticket sometime for me to visit her. HMMM>.. almost matched up except for the fact it landed in my junk mail, it has no departure airport and a ZIP FILE to download??? Not COMPLETELY my first day to the rodeo! I do feel like a schmuk alread for even opening the mail as it is though (not the zip file)
I got this today. I thought maybe it was a flight that my mom had booked….it was the exe file that made me realize that it was spam. whew. mine said it was from “American Airlines”
We got it too, from support@hamreequiipment.com which doesn’t even exisit. ALmost hte SAME email. DIffernet name in the signature, Airlines America. Different flight number & date, but essentially the SAME Spam email…
Dear Customer,
FLIGHT ELECTRONIC NUMBER 40-660986912
DATE & TIME / DECEMBER 16, 2011, 01:11 PM
ARRIVING AIRPORT: Chicago O’Hare International Airport
PRICE : 971.30 USD
Please download and print out your ticket here:
Download
ELADIA FRIEDMAN,
Airlines America
American Airlines [noreply@aa.com] is the email address it came from
Notification,
FLIGHT NUMBER A3704L
ELECTRONIC 3429525759
DATE & TIME / DECEMBER 16, 2011, 10:45 PM ARRIVING / NEW YORK JFK TOTAL PRICE / 661.68 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
THERE’S A ZIP FILE ATTACHED……IDK!!
Got a similar thing below at my work email (also included a zip file):
Notification,
FLIGHT NUMBER A20647
ELECTRONIC 8267425489
DATE & TIME / DECEMBER 16, 2011, 10:45 PM ARRIVING / NEW YORK JFK TOTAL PRICE / 794.44 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
I got this today:
From: sales1@rogers.com
To: val44@rogers.com (not my e-mail address)
Dear Customer,
FLIGHT ELECTRONIC NUMBER 88-16630089
DATE & TIME / DECEMBER 11, 2011, 01:19 PM
ARRIVING AIRPORT: Chicago O’Hare International Airport
PRICE : 153.74 USD
Please download and print out your ticket here:
Download
KRISTIE PRITCHETT,
Airlines America
d63b8ce4-791f0a52
I was looking through emails when I came across one supposedly from American Airlines confirming booking to New York JFK on December 17th. It was actually quite alarming as I can`t find my credit card, which I immediately called to put a block on.
Really wierd thing is I don`t even have or have ever had a passport, so I guessed it was
spam and didn`t open the attachment.
Got one today, Dec 8th with an attachment, did not open.
Notification,
FLIGHT NUMBER AA984
ELECTRONIC 354031372
DATE & TIME / DECEMBER 15, 2011, 12:54 PM
ARRIVING / NEW YORK JFK
TOTAL PRICE / 283.30 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
Directly from AA website
What To Do If You Receive a Phishing Email
American Airlines will never ask you to perform security-related changes to your account in this fashion or send emails to collect user names, passwords, email addresses or other personal information. If you receive an email claiming to be from American Airlines, that asks for account information, it should be considered fraudulent and an attempt to obtain personal information that may be used to commit fraud.
If you receive this type of email, do not click on any links, open any attachments, call any phone numbers listed or follow any instructions in the email. Instead, forward a copy of the email, including the header to webmaster@aa.com so that we can investigate further.
hi
i receive this type of email and download the attachment and active it
and have big problem in my computer about all file is disapear from drive C and D
plz how can i solve this problem and remove this virus
thanks
Got this today with Zip file.
Silly.
To: [deleted]
Subject: Your Order#3937135
Dear Customer,
FLIGHT NUMBER A827
ELECTRONIC 523477655
DATE & TIME / DECEMBER 16, 2011, 11:53 PM
ARRIVING / Chicago
TOTAL PRICE / 181.30 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
So I DON’T have a free flight to San Jose, CA? Bummer!
Abdallah,
I’m sorry to hear that you caught this malware. It appears to be called cutwail or poshdo. Do a web search for those terms and you’ll find info. You can check the sites of the various anti-virus companies and see whether their software will remove it. Here’s an article from Trend Micro on it, so I hope their tool will find and remove it.
http://about-threats.trendmicro.com/ArchiveMalware.aspx?language=us&name=TROJ_PUSHDO.AD
Here’s more info on the malware:
http://www.m86security.com/labs/spambotitem.asp?article=900
http://labs.m86security.com/2011/12/cutwail-spam-campaigns-lure-users-to-blackhole-exploit-kit/
And if you do a web search on “malware removal” you’ll find links to lots of tools for removing malware.
In the long term you need to run anti-malware software and keep it updated, and back up your data in case you ever have to restore it.
Best of luck with this!
I’m going to Austin baby! Lol
FLIGHT NUMBER A845
ELECTRONIC 353515603
DATE & TIME / DECEMBER 22, 2011, 12:53 PM
ARRIVING / Austin
TOTAL PRICE / 214.34 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
American Airlines.
Free ticket to Houston Tx!!! Yeah baby!!
Fairly well done. I bet this will get a few people. The payload is a zip file with a system subfolder containing a bunch of 0 byte files and a payload of ticket.exe with an icon of a PDF file. Unless you’ve changed your default view settings (Microsoft OS’s) you’d miss the .exe part. Worse yet the online malware/virus scanner I use all the time called Jotti (25mg limit) http://virusscan.jotti.org/en considers the file clean and our corporate Sophos didn’t pick up a virus either. Being our computer security officer I know better than to open anything that arrives in an email so I submitted the file to Sophos and 5 minutes later they responded with a new signature file labeling it a brand new trojan:
• Ticket.exe — identity created/updated (New detection Troj/Bredo-NV)
Very similar to the ones posted by others.
Here’s what it looked like:
From American Airlines (support.id20218@aa.com)
Subject: Order484547745
Attachment: Ticket.zip
Dear Customer,
FLIGHT NUMBER A845
ELECTRONIC 147659164
DATE & TIME / DECEMBER 23, 2011, 10:43 PM
ARRIVING / Houston
TOTAL PRICE / 225.35 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.
At least you get to go to New York City. I got one of these sending me to Indianapolis. What would I possibly want to go to Indianapolis for???
I got one for 20 dec. going to Columbus, flight no A 827. It didn’t say from where…
Don’t even know where Columbus is, and almost sure I don’t know anyone there….
Am not much uses on a computer… what should I do (not do)?, As far as I know I don’t have a website….. yet..
A.T. — just delete (and ignore) it.
I just got one of these this morning. Did not even cut and paste the information to post here but immediately Googled American Airlines scam and got your site. i think mine said flight A826. I actually went to AA to see if they had such a flight number. Mine had a ticket.zip attached from American Airlines for an electronic ticket to Miami on January 12,2012. Like I’m running to Miami…on American Airlines which I have not flown in about 10 years. My AVG did not pick up anything…but I immediately deleted it.
I’m going to Vegas BABY!!! Oh how I wish. I received one of these emails today. It had a zip file attached and was sent from password.id69535@aa.com.
Dear Customer,
FLIGHT NUMBER AB581
ELECTRONIC 617570431
DATE & TIME / JANUARY 16, 2012, 10:53 PM
ARRIVING / Las Vegas
TOTAL PRICE / 214.23 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
They’re still at it. Got a similar email today. Didn’t open the attachment, though. Hopefully no damage has been done to my computer.
Looks like I’m going to Milwaukee on January 30, 2012.
Hello
FLIGHT NUMBER A745
ELECTRONIC 321710442
DATE & TIME / JANUARY 30, 2012, 10:22 PM
ARRIVING / Milwaukee
TOTAL PRICE / 195.22 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
I got the same kind of spammail!
I’m going to detroit! Haha I wish I would go to Vegas instead of Detroit 😉
Also a Zip file attached and was send from: manager.id49857@aa.com
Dear Customer,
FLIGHT NUMBER A915
ELECTRONIC 277819208
DATE & TIME / DECEMBER 23, 2011, 11:53 PM
ARRIVING / Detroit
TOTAL PRICE / 329.58 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
I just received one of these phishing e mails wand wa son ,y way to lake city san diego not even Utah derrrrrrrrrrrrrr
Yeah, i got the same rubbish today too:
—————-
Hello
FLIGHT NUMBER AA581
ELECTRONIC 807063305
DATE & TIME / JANUARY 11, 2012, 10:33 AM
ARRIVING / Grand Prairie
TOTAL PRICE / 118.34 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you
American Airlines.
———————-
Screenshot prntscr.com/4x2aj
ticket.zip attached.
Blatent, lame piss-poor attempt at an email scam. Forwarded to AA for what it’s worth.
Shame some people still fall for this rubbish!
I’m going to Anchorage in the middle of January! Surprise trip I guess ; )
I got one today from email – American Airlines – and I didn’t open the zipfile it has attached:
Dear Customer,
FLIGHT NUMBER AA847
ELECTRONIC 672519287
DATE & TIME / JANUARY 20, 2012, 10:22 AM
ARRIVING / Minneapolis
TOTAL PRICE / 134.22 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.
Had a problem with USPS spam email a month ago. Got this email earlier today:
From: American Airlines
Date: Dec 30, 2011
Subject: Your Order#60621453
Ticket.zip attached
FLIGHT NUMBER A842BA
ELECTRONIC 194707443
DATE & TIME / JANUARY 27, 2012, 10:53 PM
ARRIVING / Honolulu
TOTAL PRICE / 183.14 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Received this today. According the email, I arrive in Rancho Cucamonga 1/30/12 at 10:32 PM (for a mere $194). I think it will be quicker and cheaper if I just drive (unless there is another Rancho Cucamonga of which I am unaware). Though, with these California freeways and the price of gas, you can’t be too sure.
Lora,
$194 is a great price for an airport that doesn’t even exist! (Unless they mean ONT.)
Yes, I’m going to Cincinnati on the 30th for $178.12. Thanks for this site, I was on hold with AA when I found it.
I got the same email as well last week, only I was so exhausted and not thinking I downloaded that zip file. Nothing seems to be funky as of yet but I have an iMac. Does this have any effect on Macs? thx
DRC,
Here’s info on the contents of the zip file. You’ll have to look through the various reports to see whether Macs are affected, but I’d guess they aren’t.
I also got this emai with my destination as “Aurora”. Since I travel quite frequently with American Airlines I immediately knew it was spam. I especially liked the folksy style of the instructions – you should print out the ticket to use it. At least the Chinese, Russians or Nigerians who are sending these out are spelling everything correctly.
Happy New Year to me!
I got 2 of these today.
Dear Customer,
FLIGHT NUMBER AB581
ELECTRONIC 230852366
DATE & TIME / JANUARY 27, 2012, 10:14 PM
ARRIVING / Riverside
TOTAL PRICE / 275.23 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.
Dear Customer,
FLIGHT NUMBER A627
ELECTRONIC 283368449
DATE & TIME / JANUARY 20, 2012, 10:33 PM
ARRIVING / Colorado Springs
TOTAL PRICE / 118.34 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
From: American Airlines
Sent: Sun, Jan 1, 2012 1:47 pm
Subject: Your order has been completed
Dear Customer,
FLIGHT NUMBER A842BA
ELECTRONIC 794637687
DATE & TIME / JANUARY 27, 2012, 10:14 PM
ARRIVING / Indianapolis
TOTAL PRICE / 278.32 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Here’s the version I got:
Hello
FLIGHT NUMBER AA895
ELECTRONIC 223576482
DATE & TIME / JANUARY 15, 2012, 10:22 AM
ARRIVING / Buffalo
TOTAL PRICE / 247.25 USD
Please find your ticket attached.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
****
TBH I briefly thought someone had got my card details (a few pressies bought over the christmas period) and the email address “support.id20905@aa.com” got me thinking but thanks to your page here my suspicions were confirmed – keep up the good work.
P
I live in Canada so it was odd to receive this. Maybe I would have got excited if it was from Air Canada instead, or maybe if the destination was some place more interesting. Not!
Agreed, truly one of the laziest spams I’ve ever seen.
From: American Airlines (password.id79441@aa.com)
Sent: January-02-12 4:54:13 AM
To: (my email but ended up in my junk mail)
Subject: Order687101202?
Attachments: 1 attachment | Download all as zip (41.3 KB)
Ticket.zip (41.3 KB)
Hello
FLIGHT NUMBER A864
ELECTRONIC 156235772
DATE & TIME / JANUARY 16, 2012, 10:53 PM
ARRIVING / Grand Rapids
TOTAL PRICE / 134.22 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
American Airlines.
Recieved this e-mail yesterday from American Airlines. Realized it didn’t have a logo of any sorts or my name specifically was an automatic red flag for me:
Hello
FLIGHT NUMBER AA551
ELECTRONIC 423290389
DATE & TIME / JANUARY 15, 2012, 10:53 AM
ARRIVING / Riverside
TOTAL PRICE / 275.23 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
Never open an attachment you aren’t sure about.
got one this morning, arriving in Little Rock. Didn’t open the file but read the email…will my computer be infected if I didn’t open the file? Thanks.
got one to Jacksonville this morning. I haven’t even flown in 16 years 🙂
Received this email today, going to Corpus Christie…the scary thing is, I actually booked a flight on AA to Florida a couple of days ago. Luckily this landed in my junk mail so I paid closer attention and didn’t open zip file
I got one too taking me to Grand Rapids for @192.54. Comeup with a better City.
Yep. they’re still at it. Wish they would grow up and do something useful with their time. Cowards can’t handle the real work field.
FIRST: helping.id12110@aa.com
Your Order#1148692
American Airlines to you – 1 hr ago More Details
Add to: To Do, Calendar
Ticket.zip
Dear Customer,
FLIGHT NUMBER A714
ELECTRONIC 595531470
DATE & TIME / JANUARY 31, 2012, 10:33 PM
ARRIVING / Miami
TOTAL PRICE / 192.54 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
SECOND: news.id91412@aa.com
Order74726486
American Airlines to you – 53 min ago More Details
Add to: To Do, Calendar
Ticket.zip
Hello
FLIGHT NUMBER AA532
ELECTRONIC 360029108
DATE & TIME / JANUARY 19, 2012, 10:53 PM
ARRIVING / Huntington Beach
TOTAL PRICE / 275.23 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.
Hello
FLIGHT NUMBER A864
ELECTRONIC 179217272
DATE & TIME / JANUARY 28, 2012, 10:14 AM
ARRIVING / Louisville
TOTAL PRICE / 178.12 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
**They didn’t even bother putting my name on top!
Mine said this:
Hello
FLIGHT NUMBER A864
ELECTRONIC 399657396
DATE & TIME / JANUARY 20, 2012, 11:44 AM
ARRIVING / Aurora
TOTAL PRICE / 224.44 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
HOWEVER – I live in New Zealand. I don’t even know if we have a place called Aurora and if we did, and I hadn’t heard of it, then it’s a smaller town and an American airlines plane would NOT be taking me there. If it’s a scanned document why is it a ZIP file instead of PDF or JPG, do they thing I’m stupid?? I’m sweeping them/blocking them forever.
BTW this was sent to me by helping.id1424@aa.com
I was just informed that I booked a flight to Oxnard, “Oxnard”? Really? Called AA to comfirm the scam and did not open the Zip file.
{unrealted note, I’m sure Oxnard is a nice place, but alway thought it sounded like something you would step in on an Ox farm}
I was travelling when I received a American Airlines handy hint “To use your ticket you should print it”(clunky grammar should have been a clue)on my iphone. For a few minutes I considered my VISA card had been compromised or my teenagers at home were up to no good… but even we Canadians know American Airlines do not likely fly into Plano. I have learned my lesson before and didn’t call the number and risk weirdness on my smartphone. But I did click on the Ticket.zip on my computer when I came to go through my e-mails… but being an imac there have been no ill effects.