This one caught my eye for a second. I thought, “I don’t remember booking anything with American lately.” The lazy spammer didn’t even bother to include any graphics to make it look official.
Sender: American Airlines (information-no77537@aa.com)
Subject: Your Order##91991988
Text:
Dear Customer,
FLIGHT NUMBER 984
ELECTRONIC 746879098
DATE & TIME / NOVEMBER 17, 2011, 11:53 PM
ARRIVING / NEW YORK JFK
TOTAL PRICE / 321.56 USD
Please find your ticket attached.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Attachment: AA_Ticket_#8565.zip
==================
Update:
I received the following variant on Nov. 28. No attachment this time, just a link. And this one didn’t say which airline it came from (other than the signature, “Airlines America”). The price of my mythical flight has gone up, though.
Sender: support@rlweiner.com (gee, that’s me!)
Subject: Fwd: Re: Your Flight Order N2295-505368
Dear Customer,
FLIGHT ELECTRONIC NUMBER 590191204
DATE & TIME / DECEMBER 26, 2011, 16:13 PM
ARRIVING AIRPORT: NEW YORK JFK
PRICE : 411.35 USD
Please download and print out your ticket here:
http://www.airlines.com/flight-06250762055
BRITTNI BEAL,
Airlines America
Fingerprint: f8a09213-4b65e7cd
I have never seen one of these, but I knew it was false – I am not even in the US, and a flight to Newport is sure to cost me a lot more than $189. On the other hand, I suppose it might have been the one in Wales. Is Newport News actually an airport, rather than a newspaper?
I had already written to American Airlines, denying everything, before thinking to Google for AA spam … What a relief!
Thank you everyone.
Rosina,
Looks like Newport News (Virginia) does have an airport. Lately they’re using small airports like this one, Plano, and Oxnard rather than major hubs. Probably picked at random from a list of all U.S. airports.
I’m going to Anchorage!
Dear Customer,
FLIGHT NUMBER A434BN
ELECTRONIC 400877073
DATE & TIME / JANUARY 25, 2012, 12:44 PM
ARRIVING / Anchorage
TOTAL PRICE / 222.42 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.
Sent from: report.id7132@aa.com
Anchorage in January. How lovely!
I live in Germany … we are now affected, too:
Hello
FLIGHT NUMBER AA895
ELECTRONIC 269903294
DATE & TIME / JANUARY 22, 2012, 11:52 AM
ARRIVING / Toledo
TOTAL PRICE / 422.25 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.
It’s a shame, that they do this with a name of a well-known company. Hope it will stop soon.
Dear Customer,
FLIGHT NUMBER AA429
ELECTRONIC 549087436
DATE & TIME / JANUARY 18, 2012, 12:52 PM
ARRIVING / Honolulu
TOTAL PRICE / 389.33 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you
American Airlines.
Alriiiight, I’m going to Honolulu! 😛
You won the spam lottery. Could have been Anchorage.
Apparently I’m going to Augusta. Not sure if it is the one in Georgia or Maine. Too early for the Masters and too cold for Maine. Oh, well.
Hello
FLIGHT NUMBER A826
ELECTRONIC 349554443
DATE & TIME / JANUARY 24, 2012, 11:22 PM
ARRIVING / Augusta
TOTAL PRICE / 389.35 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you
American Airlines.
from: helping.id55000@aa.com
Well I’m off to Fremont on Jan 24, according to the email received today. So glad to read this is someone’s idea of fun, just for a moment I, too, thought someone had got my card details after Christmas shopping online. I even checked my account!
Fell rather silly now . . .
Where’s Fremont – is it nice?
Sharon, Nottingham, England
Hmmm. There’s a Fremont in CA, near Oakland, but it doesn’t have an airport.
Sharon better bring her parachute
Here’s the one I got from helping-ids6429@aa.com. A826 seems to be a popular non-existent flight number.
Hello
FLIGHT NUMBER A826
ELECTRONIC 645543799
DATE & TIME / JANUARY 19, 2012, 12:52 PM
ARRIVING / Tallahassee
TOTAL PRICE / 234.22 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
what if i clicked on the zip file….
:/
FLIGHT NUMBER A434
ELECTRONIC 898556283
DATE & TIME / JANUARY 30, 2012, 12:44 AM
ARRIVING / Jackson
TOTAL PRICE / 392.54 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
GOt this today with the lovely ZIP.
If you clicked on the Zip file, run a virus and malware scan.
I saw this email today. Mine arrived yesterday (to an old email address). The headers give it away (a feature that can be turned off and on in Netzero).
Bravo to the poster with the American Airlines address. I have forwarded it to them and to NZ’s spoofing department.
My email was basically the same. I was to fly to Vegas, baby. It had a zip file attachment with “Ticket.exe” inside. DOH!
Here’s the header info for the curious (my addy has been edited):
Return-Path:
Received: from mx16.vgs.untd.com (mx16.vgs.untd.com [10.181.44.46])
by maildeliver07.dca.untd.com with SMTP id AABHTE5HHAERTNKA
for (sender );
Sat, 14 Jan 2012 22:06:31 -0800 (PST)
Authentication-Results: mx16.vgs.untd.com; DKIM=NONE
Received-SPF: None
Received: from rsx09.justhost.com (rsx09.justhost.com [173.236.70.178])
by mx16.vgs.untd.com with SMTP id AABHTE5HCA5ESWJJ
for (sender );
Sat, 14 Jan 2012 22:06:27 -0800 (PST)
Received: from vidaliai by rsx09.justhost.com with local (Exim 4.69)
(envelope-from )
id 1RmJEW-0000KP-DS
for MY EMAIL@netzero.com; Sun, 15 Jan 2012 00:06:24 -0600
To: MY EMAIL@netzero.com
Subject: Order has been completed
From: “American Airlines”
X-Mailer: RLSPMailer
Reply-To: “American Airlines”
Mime-Version: 1.0
Content-Type:multipart/mixed;boundary=”———-13266075844F126CE06243A”
Message-Id:
Date: Sun, 15 Jan 2012 00:06:24 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse
report
X-AntiAbuse: Primary Hostname – rsx09.justhost.com
X-AntiAbuse: Original Domain – netzero.com
X-AntiAbuse: Originator/Caller UID/GID – [973 32003] / [47 12]
X-AntiAbuse: Sender Address Domain – rsx09.justhost.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/vidaliai/public_html/stickershok.com/7fb3.php
X-Source-Dir: vidaliaink.com:/public_html/stickershok.com
X-UNTD-BodySize: 53013
X-UNTD-SPF: None
X-UNTD-DKIM: NONE
X-UNTD-SIGN-INFO: 06fdb94134016d05c4596d0590847d4150609080e41905e4ade460
X-ContentStamp: 3:4:2742957665
X-UNTD-Peer-Info: 173.236.70.178|rsx09.justhost.com|rsx09.justhost.com|vidaliai@rsx09.justhost.com
X-UNTD-UBE:-1
Hello
FLIGHT NUMBER AA332
ELECTRONIC 692167848
DATE & TIME / JANUARY 22, 2012, 11:22 PM
ARRIVING / Las Vegas
TOTAL PRICE / 325.22 USD
I got one of these emails today. Freaked me out a little at first as I actually bought a ticket to Philadelphia yesterday!!! Luckily, I didn’t open the zip. I fly too often to believe this kind of ridiculous spam.
Dear Customer,
FLIGHT NUMBER AA524
ELECTRONIC 488166075
DATE & TIME / JANUARY 24, 2012, 12:44 AM
ARRIVING / Philadelphia
TOTAL PRICE / 354.34 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
Hello
FLIGHT NUMBER A826
ELECTRONIC 630002495
DATE & TIME / JANUARY 18, 2012, 12:44 AM
ARRIVING / Oklahoma City
TOTAL PRICE / 243.25 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
As you can see I’m going to Oklahoma City, but it doesn’t show from wich city? what?? hehehen fake fake fake.
Well I’m off to Oxnard even though I have never heard of this place in my life but it looks to be a super cheap trip…$224.44 USD from NEW ZEALAND! Maybe I should go there instead of Austraila! Lol
Dear Customer,
FLIGHT NUMBER A434BN
ELECTRONIC 236904178
DATE & TIME / JANUARY 19, 2012, 10:22 PM
ARRIVING / Oxnard
TOTAL PRICE / 224.44 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.
I got the following message via a listserve. Bottom line: think before you click on attachments or links. And back up your data regularly.
Dear Customer,
FLIGHT NUMBER A842BA
ELECTRONIC 897084008
DATE & TIME / JANUARY 18, 2012, 11:52 AM
ARRIVING / Columbus
TOTAL PRICE / 325.22 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
American Airlines.
Still going the rounds in the UK as of yesterday 21/01/12. Non-existent flight number, no graphics, no departure airport, checking in info, etc., etc., no chance!
“American Airlines order-no4424@aa.com
Dear Customer,
FLIGHT NUMBER A434
ELECTRONIC 950909768
DATE & TIME / JANUARY 24, 2012, 11:22 PM
ARRIVING / Fort Worth
TOTAL PRICE / 399.32 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.”
Yep, I got another one yesterday:
Sender: American Airlines (news-ids235@aa.com)
Subject: Order has been completed
Text:
It included an attachment called Ticket.zip
Got the AA ticket scam in my inbox too. I worry if one of my credit cards was charged somehow. If credit cards are in play, please indicate.
As far as I know, this is “just” malware. Just don’t open the attachment or click the link. Here’s what AA says:
http://www.hoax-slayer.com/american-airlines-malware-emails.shtml
Looks like I’m going to Jackson!
Dear Customer,
FLIGHT NUMBER AB211
ELECTRONIC 8236251
DATE & TIME / JANUARY 25, 2012, 09:11 PM
ARRIVING / Jackson
TOTAL PRICE / 211.12 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for your attention.
American Airlines.
whew — i’m actually traveling next week…so it was kind spooky to receive it…and contrary to some of yours mine came from “information@aa.com ” so, I could’ve fallen for it — however, the fact that I’ve travelled so many times with AA and done e-tickets gave it all away as spam….but searching for “information@aa.com hoax or spam email” just lead me here…not to anything in aa.com. SO, THANK YOU FOR PUTTING THIS UP!!
Mine says I’m going to Dallas… and the attachment is a zip file… so maybe they are getting fancier or better…. I’m not copying the text since my account doesn’t let me from the spam inbox…but it reads very much the same as the previous post going to Jackson! Thanks also to Robert for putting up the link on what American says. thanks! whew!
Mine says I’m shuffling off to Buffalo. Those of us with Mac’s shouldn’t be affected, as usual. If it DID infect Mac’s, we’d hear about this in the news, rather that having to google for info.
I appreciate this site making the information about this easily available. Thank you.
Since I’m on a Mac, I’m curious about what’s actually in the zip file… but no – in the trash it goes.
i almost clicked it i thought my job sent it to me :
from American Airlines information@aa.com
reply-to American Airlines
to xxxxxxxxxxxxxmexxxxxxxxxxxxxxx
date Tue, Jan 24, 2012 at 8:12 AM
subject Your order has been completed
Important mainly because of the people in the conversation.
hide details 8:12 AM (23 minutes ago)
Dear Customer,
FLIGHT NUMBER AB772
ELECTRONIC 8437180
DATE & TIME / JANUARY 27, 2012, 10:09 PM
ARRIVING / Stockton
TOTAL PRICE / 112.11 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
American Airlines.
FLIGHT NUMBER A721BA
ELECTRONIC 7258421
DATE & TIME / JANUARY 28, 2012, 10:09 PM
ARRIVING / Stockton
TOTAL PRICE / 177.11 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
American Airlines.
Re: From:
To: American Airlines
About: Re: Order#5705985
Date: Friday, 2012 January 27 19:35:01 EET
You are not so smart!!!
Result of verification:
The attachment contains a virus called a variant of Win32/Kryptik.ZKN trojan
It is advisable not to download the file to your computer.
Hello
FLIGHT NUMBER A222
ELECTRONIC 5120801
DATE & TIME / JANUARY 31, 2012, 09:12 PM
ARRIVING / Huntsville
TOTAL PRICE / 111.11 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
I got this. I’d like New York, too, though.
Haha, I live in remote Australia and I’m heading to Lake City (???) Pretty bloody cheap though, hope it is business class!
Hello
FLIGHT NUMBER AA994
ELECTRONIC 7956542
DATE & TIME / FEBRUARY 23, 2012, 10:30 AM
ARRIVING / Lake City
TOTAL PRICE / 222.12 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.
I got one today, declaring that I’m going to Buffalo 0_0 I live in Norway… they really suck at picking targets. Oh well, at least I got to see a real spam mail for the first time in my life. Not very impressing, no logo or anything. Kinda disappointed 😛
I got this yesterday – the day I really flew into Phoenix! The fact that it was to Phoenix, that the price is just about $20 less than my REAL flight cost, and the fact that I flew US Airways was very coincidental.
Hello
FLIGHT NUMBER AA418
ELECTRONIC 9749514
DATE & TIME / FEBRUARY 29, 2012, 10:11 PM
ARRIVING / Phoenix
TOTAL PRICE / 137.58 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.
Lame spam is lame.
I sometimes wonder if the originators of these SPAM emails consider putting just a little more effort in.
If you did happen to fall for this very very bad attempt at SPAM and your C: and D: drives have dissapeared DO NOT WORRY. If the contents of your C: Drive were in fact gone, you would not be able to boot your computer, the malware has simply set the ‘HIDDEN’ flag on all your files.
Get a good Virus Scanner and you should be ok.
Got this one yesterday… I can drive this round-trip for less than 25% the airfare cost!
Interesting “From” e-mail address though: helping-no5397@aa.com
And American Airlines lists this as a flight from Dallas/Ft. Worth to Albuquerque! Does it make a special stop in Toledo?
Hello
FLIGHT NUMBER AA389
ELECTRONIC 5589538
DATE & TIME / FEBRUARY 29, 2012, 10:11 AM
ARRIVING / Toledo
TOTAL PRICE / 211.22 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.
Dan — the link you provided for more info on the malware didn’t work. Can you try again?
The tricky thing is, I wanted to block the sender as I’ve had about 3 emails in 2 weeks from them, but noticed it was actually aa.com, which is the actual website. I checked. If I block them, does that mean I won’t be able to get emails from them if I DO fly with them? Also, I was going to forward the most recent one to webmaster as an earlier message suggested, but hotmail said forwarding the message would open all link and risk allowing virus’ onto my computer. What do I do? I havn’t opened any links and I’m running a full scan just to be sure.
Karen — Forwarding the message to a webmaster won’t help. And spammers use lots of different email addresses, so even if you can block the right one (which would not be aa.com) you won’t have accomplished much. If Hotmail’s spam filter is sophisticated enough to block the sender’s IP address or filter spam based on characteristics (not just the subject or sender’s address) you might accomplish something. Otherwise, just click Delete.
Yep – they’re still at it. Apparently I get to go to Tulsa (from Canada).
Dear Customer,
FLIGHT NUMBER AA462
ELECTRONIC 3446362
DATE & TIME / FEBRUARY 13, 2012, 11:25 PM
ARRIVING / Tulsa
TOTAL PRICE / 211.22 USD
Please find your ticket attached.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.
Yep, I got another one today. Apparently I’m flying to Oakland — 15 miles away.
==============
Sender: official-no1657@aa.com
Subject: Your Order#35517 has been completed
Dear Customer,
FLIGHT NUMBER AA849
ELECTRONIC 1237668
DATE & TIME / FEBRUARY 25, 2012, 10:11 PM
ARRIVING / Oakland
TOTAL PRICE / 159.11 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for using our airline company services.
AA customer services.
@Robert – Does this link work? http://www.threatexpert.com/report.aspx?md5=5f4b2278f8368418786bf8c44f4f5dff
The link contains information on the contents of the zip file attached to the American Airlines mail.
@Karen – Unfortunately in this case the originator of the spam is modifying the email header information to make it seem as if it is being sent from AA.com. Blocking (aa.com) will obviously result in you recieving no further e-mails from American Airlines even if they are genuine. To be honest though, this should not be that much of an issue as you can always check your Spam/Junk email folder when expecting a genuine AA email.
I could go on about 3rd Party SPAM software configurations to block a majority of this SPAM but it would take a while. I will keep an eye on this blog post and if someone requests the information i will happily provide it.
– Dan
Dan – That one worked. Thanks.
Since everyone is sharing, wonder if that’s spam in itself o.O
Here’s mine that I noticed today.
Dear Customer,
FLIGHT NUMBER A864
ELECTRONIC 178140684
DATE & TIME / JANUARY 23, 2012, 11:52 PM
ARRIVING / Denver
TOTAL PRICE / 245.22 USD
Your bought ticket is attached to the letter as a scan document.
You can print your ticket.
Thank you for your attention.
American Airlines.
I was worried for a sec that my card or AA account got hacked but then I noticed the zip file.
Got one today for Vegas. I thought my buddies won the lottery and we were all going. ok so I think BIG! but the lottery wasn’t won and my buddies are all broke so……….I did look up the flgt number….it was LGA to DAL. not even Vegas. oh well
I got one today for Pittsburgh 😛 LAAAAME at least make it something exciting. It had an attachment: “Ticket.zip”
The sender’s e-mail was “sign-ids764@aa.com”
I got this one today with a zip file…
Hello
FLIGHT NUMBER AA146
ELECTRONIC 8749700
DATE & TIME / MARCH 04, 2012, 10:30 AM
ARRIVING / Modesto
TOTAL PRICE / 279.27 USD
Please find your ticket attached.
You can print your ticket.
Thank you for your attention.
American Airlines.
I am going to riverside…sender’s e-mail was “help-no.6990@aa.com” (March 1)
Hello
FLIGHT NUMBER AA387
ELECTRONIC 6016082
DATE & TIME / MARCH 07, 2012, 07:25 AM
ARRIVING / Riverside
TOTAL PRICE / 351.21 USD
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you
American Airlines.