Fake SpamCop E-mails Doing The Rounds – Beware! – (spaNcop)

Fake SpamCop e-mails are once again doing the rounds as e-mails purporting to be from SpamCop (but actually not from SpamCop) have increased once again over the past few days.

The fake SpamCop e-mails inform the recipient that their e-mail address ‘could’ have been blacklisted for taking part in fraudulent activity.  The e-mail then goes on to advise that you download and open up an archive file which is attached to the e-mail.

It should be noted that SpamCop is a legitimate anti-spam company based at www.spamcop.net.

These fake e-mails are coming from the domain www.spancop.net – notice the subtle difference – then ‘n’ rather than the ‘m’.  E-mails from spancop.net should not be acted on and you should not open any attachments in e-mails from this domain.  The attachments, according to online security companies, contain malware that in some instances is automatically extracted and executed on some machines after it is download to a users computer.

It is strongly advised that you delete these e-mails from spaNcop.net as soon as possible after receiving them.  You can (and probably should) report them as well – I’m sure the real SpamCop would be grateful to hear about these shameless attempts to impersonate their company and damage their reputation.

Please note, spaNcop has nothing to do with spaMcop!

SpamCop are a legitimate company and would never send you e-mails such as the fake ones being received, purporting to be from the real SpamCop.

Please note, the e-mail subject and body will refer to ‘SpamCop’ (spelt correctly), however the fake e-mails are originating from spaNcop.net (you can see this in the ‘From’ field in your e-mail client.

The ‘From’ field of the fake e-mails will look something like the following:

Please be aware that there could (and likely is) variations with the e-mail address, particularly likely in the part before the ‘@’ symbol.

As you can see though, by the time we get to the ‘Subject’ field, the spammers attempt to impersonate the real SpamCop by using their name:

Then the body is typically this or a variation on this theme:

Please note that the real SpamCop never send e-mails such as this one!  Again, once again note that the e-mail refers to the real SpamCop even though it isn’t from them – don’t be fooled!

An attachment, usually an archive, is also attached:

DPS Computing Limited can confirm that the e-mails from spaNcop.net are fake, and the sample e-mails from them that we have analysed all had attachments which contained malware, which appear to mainly target Windows operating systems (although there may be variations out there affecting other operating systems as well).