They aren't from us and they don't originate on our servers. In all cases, the from address has been forged so that it appears to be from AstronomyDaily.com -- such is the price of popularity!

Here are some of the fraudulent emails we have seen so far, grouped by their subject lines:

Various Subjects

We've seen a number of different messages and subjects containing viruses with the following reply-to email addresses:

We do not use any of those addresses, so if it comes from one of those, it is fraudulent.

Subject: "Save your money buy getting this thing here"

The from address on this one is "Tran Herman" <huisarts@astronomydaily.com>. The message body reads:

The link in the email goes to a site in Australia selling Cialis.

They have forged our domain in the reply-to address.

Subject: "Clear benefits of creative design"

The from address on this one is "Hilma Leonard" <bpohantsch@astronomydaily.com>. The message body reads:

The links in the email go to a professional looking site called "ClearLogo" and their opt-out link goes to a fake ISP that claims to be in Chicago, but a whois lookup shows that both domains belong to a spammer in Russia.

They have forged our domain in the reply-to address.

Subject: "Delivery reports about your e-mail"

The from address on this one is usually Automatic Email Delivery Software, noreply@astronomydaily.com or orlando@astronomydaily.com (just for the record, we don't have an Orlando). The message body reads:

The links in the email are valid and actually go to us, making the message appear more legitimate. There is an attached ZIP file that contains a virus. Keep in mind that variations in the subject, from address, or body text are possible. Just remember that you will NEVER get a valid email from us with a similar message. So if it looks at all similar to this, it's false.

Subject: "Mail Delivery (failure webmaster@astronomydaily.com)"

This one usually has a from address of webmaster@astronomydaily.com, but we have seen completely random from addresses that do not reference AstronomyDaily.com at all. The message body reads:

The sessionid number is randomly generated. This email has a virus embedded in an attachment. The link to astronomydaily.com in the message body is false. It does not link to us -- it activates the virus.

Subject: "Returned Mail: see transcript for details"

This one masquerades as one of your emails that bounced from our server. The from address is usually postmaster@www.astronomydaily.com. We never use that address, so any email from that address is a virus. The email message reads as follows:

Note that this email references "Orlando" again, so it was probably created by the same criminal as the first example above. There are no links in the email, the whole point is to get you to look at the attached file, which contains the virus.

Subject: "Returned Mail: data format error"

This is a variation of the previous message. The from address is usually postmaster@www.astronomydaily.com. Once again, we never use that address, so any email from that address is a virus. The email message reads as follows:

The links are legitimate and actually go to us, but the attached file contains a virus. Expect to see some variation in the date, time and IP addresses referenced in the message text. It appears you are supposed to think you have been blacklisted by us, and that will make you look at the attached file.

Subject: any

This one is older, but still shows up from time to time. The subject, from address, and message body are all randomly generated. So far, we have seen from addresses of staff@astronomydaily.com, admin@astronomydaily.com, or webmaster@astronomydaily.com, but any name@astronomydaily.com is possible. Some of the possible message bodies are:

Other possible messages are:

In all cases, the attached file contains a virus.