I got 8 of these at 2 different email addresses, always a sign of spam. The pitch is similar to the American Airlines ticket scam but not as well done. The U.S. Air logo looks terrible, the formatting is sloppy, all the departure cities and times are the same — only the flight number and confirmation code (and hyperlink destination) vary, and there’s no arrival city (which is perfect if you think about it). This site says the links lead to malware. Here’s what they look like:
Version 1:
Sender: US Airways – Reservations (reservations@myusairways.com)
Subject: Please confirm your US Airways online registration.
Text:
You should check in from 24 hours and up to 60 minutes before your flight (2 hours if you’re flying abroad). Then, all you have to do is print your boarding pass and proceed to the gate.
Confirmation code: 768404
Check-in online: Online reservation details
(Check-in link leads to http://christopher-garrison.com/40MVPL5A/index.html)
Flight 5232
Departure city and time
Washington, DC (DCA) 10:00PM
Depart date: 4/5/2012
Version 2:
Same sender
Subject: US Airways online check-in.
Same text, but flight 3164 (leaving at the same time, and from the same place, as flight 5232) and confirmation number 906794
Check-in link leads to http://humanitariantreks.com/Pwam2FNa/index.html
Version 3:
Same sender and subject as #1. Confirmation code 634101, flight 2707 (again, 10 pm from DC)
Check-in link leads to http://galleryshoponline.co.za/sjFbaiZp/index.html
Version 4:
More of the same. Confirmation code 249073, flight 2702 (again, 10 pm from DC)
Check-in link leads to http://e-lingerie.co.za/Afk3VXew/index.html
Version 5:
Flight 1334, confirmation 208947
Check-in link leads to http://orjinalwonderlift.com/2HGyrfcS/index.html
Version 6:
Flight 0605, confirmation 737322
Check-in link leads to http://dreammgmt.com/s3JgEpEu/index.html
Version 7:
Flight 4369, confirmation 124433
Check-in link leads to http://209.227.241.177/Afk3VXew/index.html
Version 8:
Flight 1299, confirmation 436767
Check-in link leads to http://liprandibienesraices.com/sjFbaiZp/index.html
Yup. I only got 4 on one email address so far. But, since I don’t have reservations with them, I was pretty sure it was spam. I did notice the links were *not* to the correct site, and that was enough for me to be sure it was bogus. Noticed the flights were all from D.C. (no airport name) but missed the other tips you saw.
Just goes to show you what kind of people there are out there!
I hope we aren’t helping them by showing them how lame their spam was…
;'{P~~~
Got the same email. Sending IP: 46.2.71.254 Somewhere in Turkey.
role: Koc Net NCC
address: Koc.net Haberlesme Teknolojileri ve Iletisim
address: Hizmetleri A.S
address: Ayazma Cad. Unalan Mah.
address: Camlica Is Merkezi B3 Blok
address: 34700 Uskudar Istanbul
address: Turkey
phone: +90 216 5563000
fax-no: +90 216 5563232
remarks: For abuse reports please send to abuse@koc.net
When you click on the link, you go to a site where you get a 403 Forbidden page at:
Name Nuclear Fallout Enterprises
Handle C02700308
Street 1950 Stemmons Fwy
Blank
City Dallas
State/Province TX
Postal Code 75207
Country US
Registration Date 2011-02-18
Last Updated 2011-03-19
Comments
RESTful Link http://whois.arin.net/rest/customer/C02700308
See Also Upstream network’s resource POC records.
See Also Upstream organization’s POC records.
Boy, I’d just gotten that email and was about to respond with “sorry; you got the wrong person” … then I thought, “let’s see if this is spam.” I searched for the myusairways.com email address and your post showed on the first page.
Thanks!
Mary Woodsen
Nuclear Fallout Enterprises!
So mine, which I opened since I have an open USAir flight is Flt 1379 (one of the incoming flights I was on) from Wash. D.C. I emailed back to USAir sender, and got “this account has been suspended.” I’m wondering how to rid myself of the malware?
Jan – if you didn’t click on the URL you should be OK. But download and run an anti-malware scanner like malwarebytes if you want to be sure.
I got this one this morning and tried to contact US Airways (not at the return address they gave) and failed, then searched out this site. Does US Air know about this?
Yes, U.S. Airways knows. See http://www.usairways.com/en-US/contact/scamalert.html
Just received three of these emails this morning. I was sure it was some kind of spam, with malware threat attached. Thanks for confirming my suspicions.
I got the same emails, but what is really unnerving is that they were sent in a really odd fashion. To my home: and sent to both my husband and I in the “to”. AND to both work emails. It makes me really uncomfortable to know that somehow they managed to link me to both emails.
Kelly – I noticed the same thing. Some of the spams had two of my email addresses on the To line. I hadn’t noticed that on earlier spams.
Here I was hoping that my husband was surprising me with a romantic getaway…LOL
After a lull of several months I got 9 of these yesterday. They looked the same as the earlier ones. The subjects were:
Confirm your US airways online reservation.
US Airways online check-in confirmation.
US Airways online check-in.
I have just recieved one off the above, version 1, & I live in the UK so flying out of Washington tomorrow will be a feat as I am at home!!! Makes you laugh at the stupidity of it all especially today, 9/11, of all days to try it.
Yep, they’ve baked a fresh batch. I got a dozen of them today.
What could I do if I click in the US Airways link?
Maria — you did click it? If so, run an anti-virus and malware scan on your computer. If you don’t have anti-virus software already (and you should), you can try the ones I use: Avast and Malwarebytes, which are free. There are lots of other free choices as well.
I got a dozen of these today. They’re basically the same as before. The subjects were:
US Airways online check-in confirmation.
Please confirm your US Airways online registration.
US Airways reservation confirmation.
Confirm your US airways online reservation.
Sample text:
You have to check in from 24 hours and up to 60 minutes before your flight (2 hours if you’re flying internationally). After that, all you have to do is print your boarding pass and head to the gate.
Purchase code: 522241
Check-in online: Online booking details
Payment method: Credit Card
Money will be withdrawn during 72 hours
Flight 5648
Departure city and time
Chicago IL (DCA) 10:00 AM
Depart date: 12/05/2012
I cannot get esaver@myusairways.com to stop emailing me after 5 years!!!!!!! That is not the only email address!
I tried everything.
There’s no way to unsubscribe from spam.
If you manage your own mail server, you can block that address. If you use Outlook, you can set up a rule to delete mail from a specific sender. If you have a trainable spam filter you can try teaching it to recognize and trash this type of message.