Buy this stock...it's legit...honest!

It seems that there's been a rash of spam arriving in many users' e-mail accounts promising riches if the person buys their penny stock.

What's interesting is many of the e-mails appear to be able to bypass spam-blocker software, because they are arriving in my regular inbox instead of my "junk mail" inbox. From what I've seen in some of the e-mails that I've received, they are using strange word combinations in the subjects (like "sociology adjudication") and they are putting in a lot of "gibberish words" (it usually looks like a snippet from a short story) in the body of the message so it can bypass the spam-blocker software. In some cases, they are making the e-mail look like a genuine stock news feed.

From a non-technical perspective, I wonder if there are people who really buy what these messages are selling. If they wouldn't buy a "designer" scarf from a street vendor who claims that it's a genuine Hermes, why would they buy stock from a stranger who sends you an e-mail claiming that the stock is a "sure thing"? Usually, these "penny stock" spams are pump and dump schemes (Read this article from the Security and Exchange Commission (SEC) if you want to know what pump and dump is).

If you are an IT professional (ex: network administrator) who is receiving questions from your user base about these messages, here is some advice to give to your base:

• Tell them to let you know about the spam, and after they let you know about it, tell them to delete it.


• Warn your user base on purchasing stocks from these solicitations.


• If you receive the e-mails on your home e-mail address:




• Report the e-mail as spam to the manufacturer of your spam-blocking software and your ISP.


• If you are in the United States, you can report the e-mail to the SEC at enforcement@sec.gov.

As the IT professional, you should report the e-mail as spam to the manufacturer of your spam-blocking software and your company's ISP. Time permitting, you can try to perform a trace on the e-mail to find out where the e-mail originated. However, many of these e-mails are using spoofed addresses or they have hijacked someone's e-mail address or mail sender to use to send the spams.