On May 11, 2014, many countries will celebrate Mother’s Day. Plenty of online articles have been giving gifts ideas and advice for making the day special for mom. Companies have also been sending a huge number of promotional emails with a special message about Mother’s Day. Unsurprisingly, spammers have been exploiting this occasion to send out a fresh batch of spam.
Symantec started observing Mother’s Day spam from early April and we have seen a steady increase in the volume of messages ever since. Previous Mother’s Day spam emails often stuck to certain categories. Spam emails offering flower deliveries, jewelry, personalized messages, coupons, and other gifts for mothers were the most common. Survey and product replica spam were also observed in the past.
The following are the major Mother’s Day themed spam campaigns seen this year.
Flowers for Mother
A beautiful bunch of flowers is something any mother will love and spammers use this theme more than any other. From last month, we have seen numerous emails promising flower deliveries by Mother’s Day. Most of these emails included links that redirected to fraudulent websites and some of the links redirected through multiple domains just to increase the traffic.
Figure 1. Preview of a spam email for ordering flowers
The email headers for this category are as follows.
Subject: $19.99 for Flowers and a Vase for Mother’s Day
From: [brand] <Online@[domain]>
Subject: [brand]: $19.99-Flowers for-Mom &-Vase!
From: "[brand] Special" <[brand]Special@[domain]>
Subject: Hi, 50% off Flowers for Mom
From: Fresh Flowers <[brand]@[domain]>
Personalized jewelry for Mom
Beautiful jewelry, particularly rings and pendants with a personalized inscription, is another theme that is a hit around Mother’s Day. Spammers also claim to offer personalized cards or notes along with the product. Like most spam, these emails will usually have links to other sites.
Figure 2. Preview of a spam email selling personalized rings for Mother’s Day
The email header for jewelry-themed spam messages are as follows.
Subject: Give Mom Something Unique This Year
From: Mothers Rings <rings@[domain]>
Product replica spam
This category is not too different from others, except that these spam emails advertise websites selling fake watches, jewelry, and other expensive goods. We observed these emails earlier this year and we continued to see them today. In these campaigns, the spammers give users deadlines for placing orders for the products.
Figure 3. Preview of replica spam related to Mother’s Day
Email headers seen with this spam campaign are as follows.
Subject: Why so soon?
From: Paige (Mother's Day deadline) <Paige@[domain]>
Lose weight by Mother’s Day
We believe that Mother’s Day-themed weight loss medication spam is a spinoff from an ongoing weight loss spam campaign, which has been the largest spam category by volume over the last couple of weeks. These emails include links which redirects to fake news sites offering information about new weight loss products.
Subject: Drop 10LB by Mothers Day
From: Rid 20 Pounds 2 Weeks <Sophia@[domain]>
Portuguese promo spam
We have seen a Portuguese spam campaign sending a large volume of messages promoting products related to Mother’s Day. This spam campaign uses the name of an online site which sells personalized products.
This spam campaign included links redirecting to a fraudulent website, along with a bogus opt-out option.
Figure 4. Preview of Portuguese promotional spam exploiting Mother’s Day
Here is the email header for this spam campaign.
Subject: Dia das Mães! Ajudaremos você com o presente.
From: "[brand]OnLine" <envio@painel1.[domain]>
Translation:
Subject: Mother's Day! We'll help you with this.
Symantec has observed a high volume of Mother’s Day themed hit-and-run spam recently. Most of these emails included links to a .us top level domain (TLD) which, on further analysis, were found to be registered quite recently. The theme of the domain names show that they were created for a Mother’s Day spam campaign. The domain names followed patterns such as flower-1promo-mothersday and mothersdayflower-special.
Symantec antispam filters successfully blocked these spam mails, but as always, we advise our readers not to respond to any of these emails. Remember, take your time to search for a Mother’s Day gift and don’t just click on links found in these spam mails. Symantec wishes all of our customers a happy Mother’s Day.