We know that 419 scammers aren’t the least bit concerned with email headers and will continue using free Webmail services to send spam. However, they recognize the fact that most anti-spam filters are using the body characteristics of scam emails to effectively bar these messages from reaching a user’s inbox. So, they feel they must always change their storyline, as far as the message body is concerned anyway. In recent times, spammers have been regularly using text-based attachments (.rtf, .doc, and .txt) in an attempt to evade anti-spam filters. A new tactic observed is the use of URLs, where the actual message is posted on a free Web-hosting site for the recipient to read. Here is a snapshot of one of these types of URL spam messages: As shown in the above example, a URL is added at the end of the message. If a user clicks on the URL, they will see the page below. The page displays a typical 419-scam story, with some Mr. Millionaire naming the recipient as a beneficiary to his will and leaving behind millions of dollars. Spammers advertising pharmacy and replica products generally use these types of free Web-hosting sites to redirect users to the actual site selling the products. 419 scammers have picked up on this tactic and have begun hosting 419 messages on the Web in the hopes that the spam recipients will read them. Some advantages of using free Web-hosting services for scammers are listed below: 1. A free service means no restrictions on the use of these services. 2. There is no scarcity of free Web hosting service providers on the Internet. 3. Use of multiple site locations in the messages brings in some variety. For now, we will continue to monitor this trend and keep readers well informed of any changes to this spam approach. Also, as a best practice, do not answer these types of unsolicited spam emails.