It asks me to enter my email address to prevent future mailings. If you look at the code highlighted in red, it has a 'Hidden' value to record me, so no matter what I enter, it knows my email. It would then be sold to other spammers. The image is loaded remotely from their site, so if the image displays in your email, it will record that they've hit a genuine email address.
DO NOT click an 'Unsubscribe' link, unless you have previously subscribed to something!
Right click the email and select Properties from the drop-down menu. Click Details then Message Source, then click the window Maximize button. Now you can see how the email is made. They are usually in HTML (HyperText Markup Language).
Return-Path: <hezuzkqc@promo.com.mx>
Received: from [42.213.152.38] ([189.72.168.125]) by mta01-svc.myserve.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20040530162624.BBJR19746.mta01-svc.myserve.com@[42.213.152.38]>
for <myname@myaddress.com>; Sun, 30 May 2004 17:26:24 +0100
From: <auwoibaumx@promo.com.br>
Reply-To: <ogwvdlgeuiuhti@promo.ca>
To: myname@myaddress.com
Subject: Save cash every month
Date: Mon, 31 May 2004 01:13:38 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--03477484493058325008"
Message-Id: <20040530162624.BBJR19746.mta01-svc.myserve.com@[42.213.152.38]>
----03477484493058325008
Content-Type: text/html;
Content-Transfer-Encoding: 7Bit
<HTML>
<BODY BGCOLOR=#FFFFFF LEFTMARGIN=0 TOPMARGIN=0 MARGINWIDTH=0 MARGINHEIGHT=0>
<DIV Align=Center>
<IMG SRC="http://dddd.promotrip.com:81/doot.gif" WIDTH=681 HEIGHT=751 BORDER=0 ALT=""
USEMAP="#doot_Map">
<MAP NAME="doot_Map">
<AREA SHAPE="rect" ALT="Please Click Here!!! It's safe." COORDS="0,0,681,751"
HREF="http://dddd.promotrip.com:81/index.htm">
</MAP>
<FORM action="http://dddd.promotrip.com:81/unsub.cfm" method="post">
<INPUT type="hidden" value="myname@myaddress.com" name="removeEmailAddress">
To prevent future mailings enter your email address in the box and click the "Unsubscribe" button.<BR>
<INPUT type="text" name="RemoveEmailAddress" size="30" tabindex="1">
<INPUT type="submit" value="Unsubscribe" name="B1" tabindex="10">
</FORM>
</DIV>
</BODY>
</HTML>
This is the actual code of a spammer's message. I've altered my own email address and ISP numbers in case a email collector visits this page. The Return Path, From: and Reply-To: addresses are always fake and are randomly generated as these are below:-
Click your 'Refresh' button to see 10 totally new random generated email addresses?
As I've never replied to this message, they are not sure that this is a valid address they have sent their message to, and are trying to get me to reply to confirm it. You can trace the ISP number (Internet Service Provider) and complain, but usually you will not even get a reply. Most are hosted by a company in a country that isn't too bothered, providing they are getting paid.
