TCHS Alumni News
Temple City (California) High School
 •   •   •   • 
News Views: TCHS Alumni News Log
SPAM: Fake Classmates.com mailings
Over the past few days we've received numerous emails purporting to be from Classmates.com. They are spam, but they provide a good lesson in how to spot phony mailings. Usually we wonder why TCHS alumni pay c.com to look at their ads when instead they could help us build a better resource for TC folk. However, here is an example of the recent mailings; there have been other formats.
We are pleased to announce our Class Reunion on January 25, 2009.

Please join us for a night of Glamour and Elegance as we celebrate our 2009 Year Class Reunion.

We don't want to let another year go by without the opportunity for all of us to get together, reminisce about old times and learn about what our old friends have been up to.

Proceed to view Your inbox video messages - 1 message: http://classmates.profile.InterstitialControl.user-c4mbh8c2z. startininstallations.com/ login_video737.htm?/content/LOGIN=m7nffh8cindkqrt

With best regards, Russell Slaughter. Customer Service Department. Copyright 1995-2008 Classmates Online, Inc. All Rights Reserved.

(Link wraps to accommodate browsers.)

There are several giveaways.
  1. The entire message is generic. There is no mention of TCHS or a class or a person. (Note that if you get more than one of these, "Russell Slaughter" will be replaced by another name.)
  2. Classmates.com and other legitimate outfits like banks and governments don't send generic mailings. In fact, most banks and governments and schools don't use email to deliver important news.
  3. Any legitimate mail from a subscription should have your full name or user ID in the TO: line.
  4. Read this sentence: "Please join us for a night of Glamour and Elegance as we celebrate our 2009 Year Class Reunion." Was it written by a native speaker of English?" We don't think so; "our 2009 Class Year Reunion?" Come on!
  5. Look at the URL. Don't be fooled by the word "classmates" in it. The sending server is always the last part of the first segment, following the double slash and preceding the first single slash. In this email the sender is startininstallations.com, not classmates.com.
There are other clues one can follow with a terminal and full Internet connection.
  1. Most people don't know how to follow the trail further; we do. Here's the registered owner of startininstallations.com: Registrant: Name: Godwin Holgado; Address: 310 LUNN RD; City: FORT MEADE; Province/state: FL; Country: US; Postal Code: 33841. It's probably fake, but if you wish to write Godwin a letter or turn him in to the US or FL Atty Generals, feel free.
  2. Following the registration further, one finds that the domain name server (DNS) in the registration (weekandhool.net) is in Portugal. Meaningless names are a good indicator of conspiratorial intent anywhere you find them (can you say "Enron?"). If you care to write to the head of the Judicial Police (Policia Judiciaria) in Lisbon, you can follow this link: Wikipedia.
If you click the URL you will bet little sympathy from us for the results. There is no Jan. 25 gala. There is only spyware, malware or a come-on to lose your identity or your savings. A little common sense says this is garbage.

This service brought to you by TCHS Alumni News, which is the
Best
Very Best
alumni assn. on the Web and deserves your support.

Additional comments by registered users are welcome in the forums.

Home • Lost & Found • Advertise! • Contact