Sponsored by..

Tuesday 22 December 2009

mailbox-email.com scam

Part of a long running dating scam, mailbox-email.com looks like a free email service, but isn't. Hosted on 222.170.127.122 in China, the server also hosts various fake dating and prescription sites.

All of these following sites are some scam or another, avoid them:
  • Adltfuntime.com
  • Adultmeetspot.com
  • Amazmail.com
  • Aprofilepage.com
  • Blowingawaytherestnow.com
  • Email-mailbox.com
  • Findallthebestherenow.com
  • Findnewfriend.net
  • Free-email-chat.com
  • Free-email-connect.com
  • Free-email-fun.com
  • Free-email-live.com
  • Freeextender.net
  • Freemailaccounts.net
  • Freemailnow.net
  • Getitatrxcenternow.com
  • Greatestofrxznow.com
  • Happeningrxcenternow.com
  • Hotlivemailchat.com
  • Kingofthekingofrxznow.com
  • Myemailhome.net
  • Netherlandsdns.com
  • Nodocneededforrxmedznow.com
  • Plygroundadlt.com
  • Realdealrxbrandnamesnow.com
  • Sexyhotlivechat.com
  • Skinny-me.info
  • Ysjhdfjd.com
  • Zeuhiuer.com

Tuesday 15 December 2009

Piradius.Net / Adobe Zero-Day threat

Another good reason not to have Adobe Reader on your PC - the ISC is reporting yet another zero-day threat being exploited by the bad guys, using the domain foruminspace.com.

And guess who is hosting it.. yes, our old friends at Piradius.net, going to show just how dark grey their hat is and demonstrating another very good reason to block 124.217.224.0 - 124.217.255.255.

Saturday 5 December 2009

"freeemailnow.net" scam

The domain freeemailnow.net looks like.. well, it looks like a free e-mail provider. But it isn't, it's part of some sort of fraudulent scheme, most likely a dating scam.

The pitch arrives something like this:

Subject: your profile
From: "Pasquale Clay"
Date: Fri, December 4, 2009 11:55 pm

Hey!
I know you dont know me, but I d like to get to know you.
I stumbled upon your contact information, am looking for a chat friend and maybe more.
Write me back at: snowfall1@freeemailnow.net

i am anxious to talk with you
A look at the SOA records points to ns1.netherlandsdns.com and admin.affilnet.net - affilnet.net is familiar, indicating that this is a re-run of the warmfuzzylove.com scam but again annoyingly missing a picture of a pretty Russian girl.

The registration details for freeemailnow.net are anonymous, nameservers are ns1.netherlandsdns.com and ns2.netherlandsdns.com, both on 222.170.127.122 in China along with freeemailnow.net itself.

There's a bunch of fake pharma sites sharing the same server:

  • Acquireflowherenow.com
  • Acquirerxmedzherenow.com
  • Allthebestatyourfingertips.com
  • Alwaysbetterrx.com
  • Anyrxmedications.com
  • Beatingallcompetition.com
  • Besatifiedmedsnow.com
  • Bestrxbuyshere.com
  • Blowingawaytherestnow.com
  • Championrxsource.com
  • Cheapcodeines.com
  • Choosefr0mthebest.com
  • Codeineoffers.com
  • Codeinepromo.com
  • Crazymedsupplyforyou.com
  • Discount-codeine.com
  • Easyrxhere.com
  • Expressmedz4u.com
  • Findallthebestherenow.com
  • Fingtertiprxmedacces.com
  • Firerxmedication.com
  • Flowagerofgood.com
  • G00dsonline.com
  • Getallyourfavorites.com
  • Getitatrxcenternow.com
  • Getmedicatedonline.com
  • Getrxeasily.com
  • Getrxeasilyonline.com
  • Getrxmedicationsherenow.com
  • Goodzchoices.com
  • Greatestofrxznow.com
  • Greatmedicalshere.com
  • Greatrxdepot.com
  • Greatrxg00ds.com
  • Greatrxonline4u.com
  • Grillindealz4u.com
  • Happeninggoodtime.com
  • Happeningrxcenternow.com
  • Honorablechoice.com
  • Incrediblerx4u.com
  • Kingofthekingofrxznow.com
  • Maxsav3r.com
  • Maxsaverz.com
  • Meddiezcenter.com
  • Medzfromonlinetoyourhome.com
  • Mosthighlysoughtafter.com
  • Neverendingflowages.com
  • Neverwaitrx.com
  • Newrx4champions.com
  • Niceflowofmedz.com
  • Nodocneededforrxmedznow.com
  • Nomorewaitinginlinenow.com
  • Onpointflowage.com
  • Qualitycodeine.com
  • Quickrxmedications.com
  • Readysetgetmedz.com
  • Realdealrxbrandnames.com
  • Realdealrxbrandnamesnow.com
  • Realdealrxrefills.com
  • Refillrx-depot.com
  • Reliableflowagehere.com
  • Reliablemedsource4u.com
  • Reliablerx4uonline.com
  • Rightrxchoice.com
  • Rx-refilldepot.com
  • Rxmainsource.com
  • Rxmedsolution4unow.com
  • Rxmedzatthefingers.com
  • Rxmedzinnotime.com
  • Rxremedies4u.com
  • Rxthatbeatsallothers.com
  • Rxwindowonline.com
  • Rxsourceforwinners.com
  • Selectfromallthebestmeds.com
  • Selectionfromthebest.com
  • Simeplyarx.com
  • Smokingdealz4u.com
  • Swiftestmedz.com
  • Theeasyreliablesourcenow.com
  • Theflowageoccurshere.com
  • Themybetterrx.com
  • Toprxsuppliers.com
  • Toprxsupplierz.com
  • Uniqueflowagesnow.com
  • Wehaveallyourfavorites.com
  • Wehavethemforyou.com
  • Wehavewhaturlookingfornow.com
  • Wehavewhatyourlooking4.com
  • Your-rxs.com
  • Netherlandsdns.com
Anyway, this is the same old scam and it should be avoided along with the fake RX sites that go with it.

Thursday 3 December 2009

"Bank of England" scam email

This is some sort of fraud or phishing attempt, the email originates from richardscott269@msn.com but solicits replies to richardscott555@rediffmail.com - both of these are free email providers, and I'm pretty sure that the Bank of England can afford its own email servers. Avoid.

Subject: Payment Notification
From: "Richard Scott" <richardscott269@msn.com>
Date: Thu, December 3, 2009 10:12 pm

From: Richard Scott
International Settlement Dept.
Bank of England
http://www.bankofengland.co.uk/
Ref: BOE/ISD/ACD/4556/09


ATTN :

The International Settlement department of Bank of England is obligated to contact you for the immediate release of your fund whose account has be come dormant and subsequently transferred to this department as unclaimed fund.Our findings have revealed that the problem behind your inability to have received your fund from the corresponding bank resulted from lack of transparency, insincerity and incessant demand for money by your representative(s) for unusual payments. We have therefore decided to establish a direct transfer payment system (DIPS) with you for the prompt release of your funds without any hitch.

We therefore request that you respond to this email immediately ( forwarding your direct contact telephone number) to enable us proceed with the release of your fund accordingly.

Yours in service,
Richard Scott.

Wednesday 2 December 2009

Incisive Media / writeathomesystems.com spam

Incisive Media is a little-known firm that comprises the rump of the much better known VNU Publications that was sold off into private equity a few years ago.

You might know the name "Incisive Media" through their miserable failure to sustain Personal Computer World which was one of the oldest computer magazines in the world, but they also own several other professional publications.

So, I was a little surprised to see that Incisive now seems to be in the business of sending out get-rich-quick spam.

Subject: Private Equity Europe
From: "Chesther Jane" <mcjane99@gmail.com>
Date: Wed, December 2, 2009 7:21 pm


Respected Friends,
“Who else wants to earn a full-time income writing on the INTERNET? You can start earning money writing online even if you have no prior experience.” If you can write at a 9th grade level, you could easily earn a full time income writing online.
Companies are desperately looking for entry level writers. If you want to start
earning money writing at home, this may be the most important page on the Internet you’ll read all year. Right now, you can make really good money, quickly and easily.
http://miniurl.com/22939
Chesther Jane
to unsubscribe reply REMOVE

Thank you for visiting my site!

http://www.incisivemedia.com/public/showPage.html?page=330349

DISCLAIMER
Private Equity Europe and Incisive Media do not take any responsibility for the
content of this email

The spam originates from 62.140.213.241 which is an Incisive Media IP address, and a close look at the mail headers shows more evidence:

Message-ID: <02 Dec 2009 19:21 IncisiveMailer@www.incisivemedia.com>

The URL miniurl.com/22939 forwards to Caroline.mikepsanderswri.click2sell.eu which is a laughably pathetic work-at-home scheme on the click2sell.eu affiliate network. To give click2sell.eu some credit, they are pretty good at terminating spammers.. which is why spammers try to mask their affiliate URLs.

I said "laughably pathetic", because you end up at writeathomesystems.com which attempts to recruit people to part with cold hard cash in order to learn how to write and market articles on the web.


Now, I'm not the best writer in the world.. and we all make tpyos now and again, but this one has a howler:

Yes, that says "(Prize will be changed tomorrow from $34.95 to $64.95)" when I'm really pretty sure that they mean "price".

Incidentally, a check of the Google cache shows that it was still referring to a price change "tomorrow" six days ago. I think there's a word for that.

Anyway, despite writeathomesystems.com truly crappy ad copy and highly dubious marketing techniques, they are not responsible for the spam. And as already mentioned, I know that click2sell.eu are pretty good at terminating spammers... so who is responsible?

Well, obviously the affiliate is responsible.. but also the people who strenuously deny responsibility are right in the frame.. remember the footer from the Incisive Media spam?

DISCLAIMER
Private Equity Europe and Incisive Media do not take any responsibility for the
content of this email
That's a bit like saying "I don't take any responsibility for taking a shit in your shoes" even though you have just left a big steaming turd in someone's footwear. And one vital question is.. where did the spammers get their email addresses from? Did Incisive sell them on? Or were they scraped?