An effective attack using a `` poison URL '' may reach tens of thousands of people in minutes when each person 's buddy list receives messages appearing to be from a trusted friend . An effective attack using a poisoned URL may reach tens of thousands of people in a short period when each person 's buddy list receives messages appearing to be from a trusted friend .