An effective attack using a poisoned URL may reach tens of thousands of users in a short period when each user 's contact list receives messages appearing to be from a trusted friend .
An effective attack using a `` poison URL '' may reach tens of thousands of people in minutes when each person 's buddy list receives messages appearing to be from a trusted friend .