The Internet Patrol has received several examples of spam which has been sent out under the Lockergnome name, and through Apple’s mail servers.
The spam includes fake confirmation requests to join various Lockergnome newsletter mailing lists, In addition, other pieces of the spam campaign include actual Lockergnome newsletters, despite not having confirmed (or even requested) to receive them.
The copies of the spam Lockergnome newsetters we saw were addressed to “[email protected]”.
The fake spam Lockergnome confirmations look like this, and also spoof Lockergnome’s real email service provider, WhatCounts:
From: [email protected]
Subject: Your confirmation is needed (ok i160929001150989078925)
Date: June 22, 2006 8:11:35 AM PDT
Your email address ‘[email protected]’ has been submitted to be
subscribed to the ‘Media Center’ mailing list. The list creator
has asked that all new sign-up requests be confirmed.
To confirm that you want to join this list, simply reply
to this message leaving both the subject and message body intact. It’s important that
the words ‘ok i160929001150989078925’ appear in either the subject or
body of your message (it’s fine if they appear in both places).
Also, make sure that your message is sent to ‘[email protected]’. If you
simply press your email client’s ‘reply’ button this should happen automatically.
Alternatively, you can simply click on this link to confirm your
request: [link redacted]
The IP addresses through which this spam is being relayed include 184.108.40.206, 220.127.116.11, and 18.104.22.168, all of which are Apple mail server machines. (They are mail-in6.apple.com,, relay7.apple.com, and mail-out3.apple.com, respectively.)