One mystery gripping this part of the UK is the mysterious "body parts" murder, where part of a dismembered victim have been left near the roadside in several locations: Wheathampstead, Puckeridge and Cottered in Hertfordshire and the head was dumped in Asfordby, Leicestershire.
Given that the Puckeridge part was reportedly left by the northbound carriageway, that gives a clue as the the direction that the "dumper" was travelling. And making an assumption that the head was the last part to be dumped because it was the furthest away from the others, then you can take these four data points and plot them into Google Maps.
You can see more here. Of course, speculation is just that, but if does appear that the dumper did a loop around Hertfordshire perhaps near the A414, A10, A507 and then drove up the A1 for about an hour before turning off. Yes, there's a technology aspect here - a tool like Google Maps makes it very easy to visualise this sort of data.
OK, this is all pretty gruesome and don't forget that someone has lost their life. But there's a grim fascination as to where the next discovery will be. Will that fit into the pattern?
Thursday, 9 April 2009
Wednesday, 8 April 2009
secretdesiresuk.com spam
Yuck.
Debbie 'n' Paul. They say: "SecretDesiresUK is the culmination of 3 years of false starts and hard work by Debbie and Paul, of Orion Network Designs. We are both Swingers and have worked in the Adult Industry long enough to understand exactly what people want from an Adult Social Networking Site."
What? Like spam?
Let's log in. No confirmation of email address is needed. Bad luck Mr President.
67 members. And yes, the photograph gallery shows plenty of "members". Including some nudie shots of Debbie 'n' Paul. Yuk.
I'm not prudish, and frankly I believe that consenting adults should be able to get on with whatever they want to in private. But spamming this crap out at random is just going to get the wrong kind of attention.
If you get one of these, forward the email to security -at- hostgator.com.
Subject: SecretDesires - The Ultimate Social Networking for Singles and CouplesOriginating IP is 78.145.126.63, secretdesiresuk.com is hosted on 174.132.193.251. The domain is registered to HostGator rather than the actual registrants, who are..
From: "Secret Desires"
Date: Wed, April 8, 2009 5:25 pm
Are you a couple or single looking for FUN??
Worldwide Coverage with Audio and Video Cam Chat Rooms!
Virtual Kisses and Profile Voting!
Profile Pictures and Videos!
Massive Video Database growing Daily!
Come and Enjoy the Ride!!
You must add at least one valid profile picture to remain a FREE member!!
Secret Desires - What's Yours??
Debbie 'n' Paul. They say: "SecretDesiresUK is the culmination of 3 years of false starts and hard work by Debbie and Paul, of Orion Network Designs. We are both Swingers and have worked in the Adult Industry long enough to understand exactly what people want from an Adult Social Networking Site."
What? Like spam?
Let's log in. No confirmation of email address is needed. Bad luck Mr President.
67 members. And yes, the photograph gallery shows plenty of "members". Including some nudie shots of Debbie 'n' Paul. Yuk.
I'm not prudish, and frankly I believe that consenting adults should be able to get on with whatever they want to in private. But spamming this crap out at random is just going to get the wrong kind of attention.
If you get one of these, forward the email to security -at- hostgator.com.
Labels:
Spam
Saturday, 4 April 2009
luxgroupnz.com / LuxGroup scam
There are lots of legitimate ocmpanies with the name LuxGroup or Lux Group or something similar. This particular fake "LuxGroup" uses the domain luxgroupnz.com to push some sort of fraudulent job offer, probably a money mule or some other criminal activity.
Name : Michell
Organization : Michell
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
Country :
Postal Code : 85230
Phone Number : 86--56343365
Fax : 86--56343365
Email : Michell.Gregory2009@yahoo.com
Site is hosted on 222.73.37.250, name services are proved by NS1.CHOSTSERVICE.COM and NS2.CHOSTSERVICE.COM. Other domains hosted on that server are:
If you get one of these ignore it.
The luxgroupnz.com domain was registered on April 1st 2009 through XIN NET TECHNOLOGY CORPORATION to:
Subject: A better career with LuxGroup
Good Day,
Major International Company is ready to offer you part(1-2 hours a day) and full time(5-8 hours per day) job in the USA. If you are interested, get back to us by email and send your resume or a short description of your former activities. Excellent career growth perspectives and merited salary.
For more info about terms, conditions and financial remuneration, get back ONLY to our corporative email address below: advjob@luxgroupnz.com
With regards,
Lux Group, Hiring Department
Name : Michell
Organization : Michell
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
Country :
Postal Code : 85230
Phone Number : 86--56343365
Fax : 86--56343365
Email : Michell.Gregory2009@yahoo.com
Site is hosted on 222.73.37.250, name services are proved by NS1.CHOSTSERVICE.COM and NS2.CHOSTSERVICE.COM. Other domains hosted on that server are:
- A-finance.net
- A-finance.org
- Aiminfo.info
- Careertrip.cn
- Danunafig.ru
- Dessgif.com
- Hot-jobster.cn
- I-love-pets.ru
- Icm-mail.biz
- Icm-network.net
- Isearchword.info
- Itellu.info
- Itellu.ru
- Lastyp.ru
- Mountain-travel.ru
- Mycotteges.ru
- Oceananswers.info
- Oceanofsearches.info
- Pinigeliai.com
- Temp-biz.cn
- U-search.info
- Yadrenamat.ru
- Yaponamat.ru
If you get one of these ignore it.
Labels:
Job Offer Scams,
Lapatasker,
Money Mule,
Scams,
Spam
Friday, 3 April 2009
Hostfresh dead?
Sandi reports that Hostfresh has been de-peered, the latest organized criminal web host to be removed from the interwebs.
This Hong-Kong based outfit provided the back end hosting for malware infections including early versions of Conficker. It has been increasing apparent that they are basically an outpost of the Russian Business Network.
Hostfresh-hosted domains have scattered, but it probably won't be long until they find another RBN-friendly host that doesn't know what happened to Atrivo, McCole, Ukrtelegroup and Estdomains.
This Hong-Kong based outfit provided the back end hosting for malware infections including early versions of Conficker. It has been increasing apparent that they are basically an outpost of the Russian Business Network.
Hostfresh-hosted domains have scattered, but it probably won't be long until they find another RBN-friendly host that doesn't know what happened to Atrivo, McCole, Ukrtelegroup and Estdomains.
Labels:
Hostfresh
Thursday, 2 April 2009
BlizzardImageHosting.com - possible Joe Job
We have an email trap that seems to be hit exclusively by a low number of Waledac related spam (fake "terror reports", pharma spam, penis enlargement etc). We know that this particular address was harvested from a compromised PC, so the only people who have the address are the Bad Guys.
Unexpectedly then, the following email turned up:
So, my initial thoughts were that blizzardimagehosting.com were in league with the bad guys. Let's check out their WHOIS details:
Marquee Media operates a web server at 216.17.107.72, which contains an ill-advised mix of adult sites and general interest sites (porn sites and fishing on the same server?) all the WHOIS details are consistent, and there seems to be nothing illegal going on.
Here's the thing - nothing at all about blizzardimagehosting.com fits the Waledac profile. This seems to be a small business running out of Illinois, nothing more. At a best guess, Marquee Media has somehow displeased the Waledac gang, either through something to do with adult content or web hosting.
So.. if you get a spam for blizzardimagehosting.com then treat it with scepticism, and as far as I am concerned this company is probably not guilty of this spam run and instead it looks like a Joe Job.
Unexpectedly then, the following email turned up:
From: (removed)
Sent: 01 April 2009 20:33
To: (removed)
Subject: Free Image Hosting
BlizzardImageHosting.com is a new leader in online image & photo hosting,
portfolios, and slideshow creation. We offer features you wont find
at other image hosting sites and we offer it FOR FREE!
- Upload Unlimited Images
- Share Images With Anyone and Anywhere
- Get Gigabytes of Monthly Bandwidth
and much more...
Sign up now!
http://blizzardimagehosting.com/index.php
(c) 2003-2009 Blizzard Image Hosting All Rights Reserved
So, my initial thoughts were that blizzardimagehosting.com were in league with the bad guys. Let's check out their WHOIS details:
Marquee, Media Networks webmaster -at- marqueemediaonline.comThe address is actually a branch of PakMail, but that probably means in this case that Marquee Media Networks rents a post box. The WHOIS details for marqueemediaonline.com indicate a name of Christopher Maher. So do these WHOIS details look suspicious? Not really. Usually, Waledac related domains come with WHOIS details that indicate telltale traces in China or Russia, the details for blizzardimagehosting.com are not inherently suspicious.
Marquee Media Networks
6741 Sprinkle Road, Ste 293
Portage
MI
49002
US
Phone: +1.2694929957
Fax: +1.2694929958
Marquee Media operates a web server at 216.17.107.72, which contains an ill-advised mix of adult sites and general interest sites (porn sites and fishing on the same server?) all the WHOIS details are consistent, and there seems to be nothing illegal going on.
Here's the thing - nothing at all about blizzardimagehosting.com fits the Waledac profile. This seems to be a small business running out of Illinois, nothing more. At a best guess, Marquee Media has somehow displeased the Waledac gang, either through something to do with adult content or web hosting.
So.. if you get a spam for blizzardimagehosting.com then treat it with scepticism, and as far as I am concerned this company is probably not guilty of this spam run and instead it looks like a Joe Job.
Labels:
Joe Job
Friday, 27 March 2009
"Shanghai QiPeng Network Information Technology" / "Sopper Investment Co. LTD"
This particular pitch has been around for a long time - a domain name registrar (or reseller) who is "checking" about a domain registration that might infringe on your trademarks. Of course, registrars are not responsible for checking trademarks (can you imagine how complicated and expensive the process would be!)
Usually this approach is an attempt to get you to register useless domain names at inflated prices.. and in all probability these domain names they are warning about will never even be registered. If you really are concerned, then register them through a reputable registrar, else you are best off ignoring it.
The same approach can be seen here and here.
Usually this approach is an attempt to get you to register useless domain names at inflated prices.. and in all probability these domain names they are warning about will never even be registered. If you really are concerned, then register them through a reputable registrar, else you are best off ignoring it.
Subject: Domain Issues for "[redacted]"
From: "Ramon zhang"
Date: Fri, March 27, 2009 9:20 am
If you are not the person who is in charge of this, please forward to the right person/department. Thank you)
Dear CEO,
We , a registrar organization in China, have something to check with you. We received an application today One South Korea company called " Sopper Investment Co. LTD" is applying for "[redacted]" as internet brand and following Asian/.CN domain names to use.
[redacted].com.tw
[redacted].hk
[redacted].in
[redacted].net.cn
[redacted].org.cn
[redacted].tw
After our initial checking, we found the internet brand and keyword of these domain names are as same as your company¡¯s.Because of it involves your company's intellectual property, so we need to check this with your company. If the aforesaid company is your subsidiary company or your business partner, please DO NOT reply us, we will approve the application automatically. If you have no any relationship with this company, please contact us within 7 workdays. If out of the deadline, we will approve the application submitted by "Sopper Investment Co. LTD" unconditionally.
Look forwarding to hearing from you.Thanks.
Best Regards,
Ramon Zhang
Leader Checker
Shanghai QiPeng Network Information Technology Co.,Ltd
Tel£Âº +86-21-6992-9440 Fax£Âº +86-21-6992-9447
Postal Code£Âº 200063
website:http://www.qipeng.org.cn
Shanghai QPNIC Web Property Solutions Limited is a comprehensive company engaged in the Internet intellectual property services that mainly provides network-based service, network intellectual property service.
Company objective: The good faith first, the customer is supreme.
The same approach can be seen here and here.
Thursday, 26 March 2009
dns@nisource.com Joe Job
NiSource is a US electricity and gas provider. This spam appears to be a Joe Job aimed at the DNS support mailbox at that company. In this case the originating IP is 166.156.53.33.
Since the email is soliciting replies via email, it is most likely a revenge attack for something or other.
From: Mabel Mcdaniel [mailto:dns@nisource.com]
Sent: 26 March 2009 14:55
To: [redacted]
Subject: Replica Watches
A lot of brands, 100-300 usd.
Mail to order: dns@nisource.com
Since the email is soliciting replies via email, it is most likely a revenge attack for something or other.
Monday, 23 March 2009
songmeanings.net compromised?
songmeanings.net is a popular and relatively crud-free lyrics site that attracts millions of visitors a year. Alexa ranks it as about the 5000th most popular site in the world (dynamoo.com ranks in at about 290,000).
Unfortunately, the email database at songmeanings.net appears to have been compromised and the email addresses are now receiving "Canadian Pharmacy" spam routed via spaces.live.com. It is unknown if any other details have been taken, in all likelihood this is probably a trojan that has taken email addresses only.
(They are not the only one. Tradedoubler is an advertising network that has been similarly compromised).
Unfortunately, the email database at songmeanings.net appears to have been compromised and the email addresses are now receiving "Canadian Pharmacy" spam routed via spaces.live.com. It is unknown if any other details have been taken, in all likelihood this is probably a trojan that has taken email addresses only.
(They are not the only one. Tradedoubler is an advertising network that has been similarly compromised).
Pozde.com domain valuation scam
A copy of the recent Pedma.com domain appraisal scam, this time with the name pozde.com. The pitch is something similar to the following:
The WHOIS entry for pozde.com is a crude fake:
So why is it a scam? Pedma.com was definitely a scam - when you sent off your PayPal payment there was no way to specify what you wanted appraising, the fact that Pozde.com has added this in is immaterial. The WHOIS entry is fake (the registrant is in Canada, not Iceland).
Site is hosted on 124.217.231.173 in Kuala Lumpur. Send abuse reports to abuse -at- piradius.net.
If you feel that you have been defrauded and you live in Canada, you can file a complaint with the RCMP.
Added: some other domains to watch out for, owned by the same person are:
Dear sir,Pozde.com is the fake appraisal site, and because it is cheaper than the others (which are legitimate) there's a chance you will try to use it. Although this time they have remembered to give you a box to specify your domain (they didn't with the old version), you should be under no doubt that this is an attempt to defraud.
we are interested to buy your domain name [REDACTED] and offer to buy it from you for 70% of the appraised market value.
As of now we accept appraisals from either one of the following leading appraisal companies:
sedo.com
pozde.com
moniker.com
accuratedomains.com
If you already have an appraisal please forward it to us.
As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.
We appreciate your business,
Thanks,
P. Jackson
The WHOIS entry for pozde.com is a crude fake:
Registrant:In fact, it is actually registered to:
Richard Smith
563 queen st
bruckberg, er 54767
Iceland
Domain Name: POZDE.COM
Created on: 19-Nov-08
Expires on: 19-Nov-09
Last Updated on: 20-Mar-09
Administrative Contact:
Smith, Richard admin@bizing.biz
563 queen st
bruckberg, er 54767
Iceland
+1.9024312570 Fax --
Technical Contact:
Smith, Richard admin@bizing.biz
563 queen st
bruckberg, er 54767
Iceland
+1.9024312570 Fax --
Domain servers in listed order:
NS1.IPNAMES.NET
NS2.IPNAMES.NET
Registrant:You should also consider the domains tysoo.com (recently bought by Manuel Fichter) and dexpay.com as suspect, because it seems that there is a pattern emerging here.
Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
Domain Name: POZDE.COM
Created on: 19-Nov-08
Expires on: 19-Nov-09
Last Updated on: 05-Mar-09
Administrative Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024312570 Fax --
Technical Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024312570 Fax --
So why is it a scam? Pedma.com was definitely a scam - when you sent off your PayPal payment there was no way to specify what you wanted appraising, the fact that Pozde.com has added this in is immaterial. The WHOIS entry is fake (the registrant is in Canada, not Iceland).
Site is hosted on 124.217.231.173 in Kuala Lumpur. Send abuse reports to abuse -at- piradius.net.
If you feel that you have been defrauded and you live in Canada, you can file a complaint with the RCMP.
Added: some other domains to watch out for, owned by the same person are:
- veecs.com
- grooc.com
- usbabes.info
- tysoo.com (being transferred)
- dexpay.com
- bizing.biz
- fastbooster.com
- moviesforme.org
- casinocrew.com
Labels:
Appraisals,
Domains,
Scams
Tuesday, 17 March 2009
pedma.com domain appraisals?
From time-to-time I get a unsolicited offers to buy domains that I hold, so it isn't wholly unexpected to get the occasional email about them. Here's one that came in today:
So, let's say that I'm interesting in selling this domain and want to get a professional appraisal. Sedo charge $29, Accurate Domains charge $27 and Pedma charges $22.95. What's more, Pedma promises to refund your appraisal money or buy the domain itself if you don't sell it within 6 months.
Pedma looks like the best option. But who are they exactly?
Here's the thing - there is almost nothing about them in Google. It looks like they have been in the domain appraisal business for hardly any time at all. So isn't it odd that they are being recommended?
Let's look at the WHOIS details:
The site itself seems to be free of malware, so poking around at the pedma.com site reveals a few other interesting things.
Click through to the Contact page:
The following contact details are listed:
Clicking through on the "Buy Now" link takes you to a PayPal page, also mentioning Canada:
The payee is "Unique Desktop". Whoever they are. This is one of the weakness of PayPal - I don't really have an idea who I am dealing with here. I don't advise that you pay them anything, indeed there is no part of the payment process that actually specified what domain you want appraising or your contact details.
A further clue that something is wrong comes from their "Service" page which contains the following text:
So: this "appraisal" site appears to have been active for just a few days, the site content is stolen from others, the contact details on the page do not match the WHOIS, the payment process does not allow you to specify the domain to appraise and your contact details, and the IPs have recently been connected to another dubious domain name pitch.
It looks on the surface as if this is an attempt to get people to sign up for this so-called appraisal service, and nothing more. Pedma.com is certainly not a recognised or trustworthy site, so it is likely that the offer to buy the domain is similarly dubious. Of course, if you work for Pedma.com, please feel free to correct any errors in the comments section below.
If you have spent any money on the appraisal, then I would advise you to start a PayPal dispute to recover the money as there is some evidence to suggest that the original offer is not genuine.
Additional information:
a bit more research shows indicates the domain pedma.com was sold via eBay item #170253846100 in August 2008 to a member called unique*money, presumably this is Manuel Fichter.
Now, it might be that Mr Fichter sold the domain on and perhaps it is a coincidence that the new owner lives in the same area and has used exactly the same telephone number. Note that the seller "bargaindomains" is a reputable eBay seller who just sold the domain on in August.
About the London address: there is no company by the name of "Pedma" operating in the UK, according to Companies House.
The PayPal billing name of "Unique Desktop" is connected with the domain "fastbooster.com". The terse WHOIS details for that mention an email address of willyfichter@googlemail.com, but earlier last year it had a rather more full domain description:
It is hard to be 100% certain who is sending out these "offers". But at a guess, one of these Mr Fichters might have an idea.
Update:
pedma.com has been suspended by HostGator. Yeay.
Another update (18/3):
The owner of pedma.com is now desperately trying to punt the domain name on Sedo for $1000, which is a bit rich considering that he ripped off Sedo's text for the fake appraisal site!
For reference, the relevant mail headers are:
Subject: Regarding your domain [REDACTED].COM
From: "James Johnson" j.johnson98@rocketmail.com
Hello,
I came across your domain name [REDACTED]COM and I would be interested in buying it from you.
Here is my offer, you have to send me a professional appraisal from one of the following companies. and I will pay you 85% of the appraised price.
For payments under $2000 I prefer to use paypal. And for larger amounts of money I prefer if we used escrow.com
I accept appraisals from any of these companies:
-sedo.com
-pedma.com
-accuratedomains.com
If you already have an appraisal from one of those companies please forward it to me, and we will do business.
Regards,
James Johnson
Received: from eatfire.nexcess.net (208.69.122.200)Well, my spidey sense started to tingle. The domain in question is not great and I'm really holding it for a future project that I haven't gotten around to. So I have certainly never had it professionally appraised.
by [redacted] with SMTP; 17 Mar 2009 10:07:22 -0000
Received: (qmail 10697 invoked by uid 108); 17 Mar 2009 10:06:16 -0000
Received: from unknown (HELO LYNKSIS) (admin@1nb0x.com@174.133.179.205)
by eatfire.nexcess.net with ESMTPA; 17 Mar 2009 10:06:16 -0000
From: "James Johnson"
Subject: Regarding your domain [redacted]
To: [redacted]
So, let's say that I'm interesting in selling this domain and want to get a professional appraisal. Sedo charge $29, Accurate Domains charge $27 and Pedma charges $22.95. What's more, Pedma promises to refund your appraisal money or buy the domain itself if you don't sell it within 6 months.
Pedma looks like the best option. But who are they exactly?
Here's the thing - there is almost nothing about them in Google. It looks like they have been in the domain appraisal business for hardly any time at all. So isn't it odd that they are being recommended?
Let's look at the WHOIS details:
Registrant:It's hard to say if the details are genuine or not, but it certainly isn't an obvious fake. But a few days ago, pedma.com was registered to someone else:
Billy McDOW
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 12-Mar-09
Administrative Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --
Technical Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --
Domain servers in listed order:
NS1501.HOSTGATOR.COM
NS1502.HOSTGATOR.COM
Registrant:About the same time, the IP address of pedma.com changed from 208.69.122.200 to 174.132.194.58. Now, the 208.x.x.x address was mentioned a few days ago on another blog for questionable domain practices, so you might suggest that this is not a coincidence.
Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 05-Mar-09
Administrative Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --
Technical Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --
Domain servers in listed order:
DNS53-1.NEXCESS.NET
DNS53-2.NEXCESS.NET
The site itself seems to be free of malware, so poking around at the pedma.com site reveals a few other interesting things.
Click through to the Contact page:
The following contact details are listed:
20 Crawford StreetIt looks like this may be an accommodation address or perhaps a virtual office of some sort, probably located above a shop [sorry, IE required]. Definitely not Canada. (Update: it looks like a branch of Mail Boxes Etc thanks to Google's new UK streetview.)
London
W1H 1PJ
United Kingdom
Email: support@pedma.com
Clicking through on the "Buy Now" link takes you to a PayPal page, also mentioning Canada:
The payee is "Unique Desktop". Whoever they are. This is one of the weakness of PayPal - I don't really have an idea who I am dealing with here. I don't advise that you pay them anything, indeed there is no part of the payment process that actually specified what domain you want appraising or your contact details.
A further clue that something is wrong comes from their "Service" page which contains the following text:
How much is your domain really worth? An expert evaluation of a domain name's value is critical intelligence for domain buyers and sellers looking to determine a fair market price. An appraisal is your first step to making a great sale!In fact, the majority of this text is stolen directly from Sedo and Moniker - it's a straight copy-and-paste job.
Every appraisal individually researched by domain industry pros, because no software is a substitute for real-world experience.
Your domain name could be worth thousands of dollars and may even be tax deductible!
Join many others who discovered what their domains were worth using our Domain Name Appraisal Service! Your domain will be appraised based on a number of separate factors including marketability, brand recognition, unique type in traffic, and comparison with other domain name sales. In addition to the following criteria:
* TLD Value
* Length
* Hyphen
* Web Frequency
* Search Frequency
* Industry Value
After you make your first purchase we will email you your Pedma Account log in information. Once you are logged in, you will find all your domain appraisals neatly organized (including appraisal reports, and appraisal banners). We make it easy to keep track of all your appraisals!
So: this "appraisal" site appears to have been active for just a few days, the site content is stolen from others, the contact details on the page do not match the WHOIS, the payment process does not allow you to specify the domain to appraise and your contact details, and the IPs have recently been connected to another dubious domain name pitch.
It looks on the surface as if this is an attempt to get people to sign up for this so-called appraisal service, and nothing more. Pedma.com is certainly not a recognised or trustworthy site, so it is likely that the offer to buy the domain is similarly dubious. Of course, if you work for Pedma.com, please feel free to correct any errors in the comments section below.
If you have spent any money on the appraisal, then I would advise you to start a PayPal dispute to recover the money as there is some evidence to suggest that the original offer is not genuine.
Additional information:
a bit more research shows indicates the domain pedma.com was sold via eBay item #170253846100 in August 2008 to a member called unique*money, presumably this is Manuel Fichter.
Now, it might be that Mr Fichter sold the domain on and perhaps it is a coincidence that the new owner lives in the same area and has used exactly the same telephone number. Note that the seller "bargaindomains" is a reputable eBay seller who just sold the domain on in August.
About the London address: there is no company by the name of "Pedma" operating in the UK, according to Companies House.
The PayPal billing name of "Unique Desktop" is connected with the domain "fastbooster.com". The terse WHOIS details for that mention an email address of willyfichter@googlemail.com, but earlier last year it had a rather more full domain description:
Owner Contact:
Willy Fichter
Immo-World24 Limited
Am Soeldnermoos 17
Hallbergmoos, 85399, DE
Punycode Name: fastbooster.com
Unicode Name: fastbooster.com
Admin Contact
Willy Fichter
willyfichter@googlemail.com
Am Soeldnermoos 17
Hallbergmoos, 85399, DE
phone: +49 89381684552
Technical Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305
Zone Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305
Record expires on: 2009-05-04 20:35:24
Domain servers in listed order:
shades02.rzone.de
docks18.rzone.de
It is hard to be 100% certain who is sending out these "offers". But at a guess, one of these Mr Fichters might have an idea.
Update:
pedma.com has been suspended by HostGator. Yeay.
Another update (18/3):
The owner of pedma.com is now desperately trying to punt the domain name on Sedo for $1000, which is a bit rich considering that he ripped off Sedo's text for the fake appraisal site!
Labels:
Appraisals,
Domains,
PayPal,
Scams,
Spam
Friday, 13 March 2009
Adobe9.0-PDF.com
Here's an oddity when typing "Adobe" into Google.
The first ad refers to a web site called Adobe9.0-PDF.com - that's not Adobe, surely?
Nope.. it doesn't look like Adobe. Let's scroll down a bit
The bit at the bottom is interesting:
So, this is kind of curious. Who's running this site? A look at the WHOIS for 0-pdf.com shows an anonymous registration, so no clue there.
The site is hosted on 208.118.54.244 along with several others:
Registrant: Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
Domain Name: XTREMESOFTWARE-LTD.COM
Created on: 13-Apr-07
Expires on: 13-Apr-09
Last Updated on: 13-Apr-08
Administrative Contact: Software Ltd, Xtreme Support@XtremeSoftware-Ltd.com
Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
8007843167 Fax --
Technical Contact: Software Ltd, Xtreme Support@XtremeSoftware-Ltd.com
Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
8007843167 Fax --
Domain servers in listed order:
NS1.COVERTTECHNOLOGY.NET
NS3.COVERTTECHNOLOGY.NET
NS2.COVERTTECHNOLOGY.NET
Incidentally, shuffle across a few IPs to 208.118.54.247 and there seems to be another server belonging to the same outfit.
Company records for Xtreme Software Ltd indicate that it was forcibly dissolved, and the director was:
Dave Shullick is also linked with the domain xtremetransactions.com and Xtreme Innovations, LLC of Ohio. Shullick and another site was mentioned in the Guardian article enetitled Money for nothing in 2006. But as the company was forcibly dissolved in December 2008, the who is running these web sites?
Xtremetransactions.com is also linked to from the Adobe9.0-PDF.com site, showing that the two are closely related.
The UK address isn't much of a clue - it belongs to a company called Fletcher Kennedy, who specialise in forming other companies. Fletcher Kennedy are nothing to do with the site, but they have fulfilled the legal role of company secretary for both "Xtreme" companies, but they appear to have terminated that relationship.
Is the other XTREME-SOFT company any relation? It's odd that they both have very similar names and the same address, but the only director listed for XTREME-SOFT LTD is in Saudi Arabia:
So, here's an outfit that is hiding its details and appears to have been operating by a firm that had been forcibly dissolved. So who exactly is running it now?
Anyway, that's enough foreplay. Let's get down to the money shot. Let's say that you want to download the software, first there's a registration screen.. then you get to see what this is all about:
Yup, they're trying to stiff you with a £27 charge plus 83p per month to download a free bit of software. Goodness only knows what "download accelerator plus" is.
Here we go.. £37 for something that you can get for free. My advice? Avoid this one at all costs!
If you have paid money to this company any want a refund, this RipoffReport suggests the following:
The first ad refers to a web site called Adobe9.0-PDF.com - that's not Adobe, surely?
Nope.. it doesn't look like Adobe. Let's scroll down a bit
The bit at the bottom is interesting:
All tademarks and copyrights are used for comparison and/or compatibility purposes only and are the property of their respective owners. This website has no affiliation whatsoever with the owner of this software program and does not re-sell or license software. All software is freeware and/or shareware with the understanding that the user may need or want to pay for it later. Membership is for unlimited access to our site's resources. We provide an organized website with links to third party freeware and shareware software, technical support, tutorials and step by step guides.To cut a long story short, you have to pay to download this free software (this is for "support").. of course you could just download it directly from Adobe.
So, this is kind of curious. Who's running this site? A look at the WHOIS for 0-pdf.com shows an anonymous registration, so no clue there.
The site is hosted on 208.118.54.244 along with several others:
- 0-pdf.com
- 1-pdf.com
- Burning-toolz.com
- Downzfree.com
- E-s0ftware.com
- Es0ftware.com
- Freedownloadhq.com
- Freedownloadsnow.net
- Grafix-viewer.com
- Internet-callz.com
- Mediaplayer-stop.com
- Populartitlez.com
- Security-bundle.com
- Virus-tools.com
- Xtremesoftware-ltd.com
Registrant: Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
Domain Name: XTREMESOFTWARE-LTD.COM
Created on: 13-Apr-07
Expires on: 13-Apr-09
Last Updated on: 13-Apr-08
Administrative Contact: Software Ltd, Xtreme Support@XtremeSoftware-Ltd.com
Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
8007843167 Fax --
Technical Contact: Software Ltd, Xtreme Support@XtremeSoftware-Ltd.com
Xtreme Software Ltd.
7 Petworth Road
Haslemere,
Surrey GU27 2JB
United Kingdom
8007843167 Fax --
Domain servers in listed order:
NS1.COVERTTECHNOLOGY.NET
NS3.COVERTTECHNOLOGY.NET
NS2.COVERTTECHNOLOGY.NET
Incidentally, shuffle across a few IPs to 208.118.54.247 and there seems to be another server belonging to the same outfit.
- 11-now.com
- 7-now.com
- 8-now.com
- 8-pdf.com
- 8-software.com
- 8-ultra.com
- 9-express.com
- 9-now.com
- 9-ultra.com
- Anti-viruz.net
- Antiviruz-now.com
- Avast-hq.com
- D0wnloadz.net
- Download-9.com
- Downloadcenterz.com
- Downloadzcenter.com
- Downloadznow.net
- Downloadzsoftware.com
- Dvdshrink-hq.com
- Ed0wnloads.com
- Esoftware-now.com
- Irfanview-center.com
- Irfanview-hq.com
- Mediaplayer-hq.com
- Panda-hq.com
- Pdf-now.com
- Pdf-soft.net
- Powerdvd-7.com
- Rarsoftware.com
- S0ftware-now.com
- S0ftware.com
- S0ftwarez.com
- Software-hq.net
- Softwarecenterz.com
- Swhq-cs.com
- Tutorial-hq.com
- Winamp-hq.com
- Winrar-hq.com
Company records for Xtreme Software Ltd indicate that it was forcibly dissolved, and the director was:
DIRECTOR: SHULLICK, DAVE
Appointed: 07/11/2005
Date of Birth: (redacted)
Nationality: HUNGARIAN
No. of Appointments: 1
Address: 6434 BAY CEDAR LANE
BRADENTON
MANATEE
FLORIDA 34203
USA
Dave Shullick is also linked with the domain xtremetransactions.com and Xtreme Innovations, LLC of Ohio. Shullick and another site was mentioned in the Guardian article enetitled Money for nothing in 2006. But as the company was forcibly dissolved in December 2008, the who is running these web sites?
Xtremetransactions.com is also linked to from the Adobe9.0-PDF.com site, showing that the two are closely related.
The UK address isn't much of a clue - it belongs to a company called Fletcher Kennedy, who specialise in forming other companies. Fletcher Kennedy are nothing to do with the site, but they have fulfilled the legal role of company secretary for both "Xtreme" companies, but they appear to have terminated that relationship.
Is the other XTREME-SOFT company any relation? It's odd that they both have very similar names and the same address, but the only director listed for XTREME-SOFT LTD is in Saudi Arabia:
DIRECTOR: QUBAISI, MOHSENIt's not clear if these two entities are actually related in any way.
Appointed: 22/03/2006
Nationality: SAUDI
No. of Appointments: 1
Address: 31952 KOBAR STREET
SAUDI ARABIA
So, here's an outfit that is hiding its details and appears to have been operating by a firm that had been forcibly dissolved. So who exactly is running it now?
Anyway, that's enough foreplay. Let's get down to the money shot. Let's say that you want to download the software, first there's a registration screen.. then you get to see what this is all about:
Yup, they're trying to stiff you with a £27 charge plus 83p per month to download a free bit of software. Goodness only knows what "download accelerator plus" is.
Here we go.. £37 for something that you can get for free. My advice? Avoid this one at all costs!
If you have paid money to this company any want a refund, this RipoffReport suggests the following:
MONEY RETRIEVED!Allegedly, the contact email address is support@software-hq.net (and that domain seems to have generated a lot of complaints) but you may be better off contacting your bank if you believe that you have been misled in any way.
Don't let these people get away with what they do.
Keep on emailing them as well as the third-party that bills their accounts. I got a full refund, including the so-called $5.99 service charge.
Explore you options on the next. Report them to the internet fraud site. Contact your bank and report them. In fact, do everything that you need to do.
I did not stop, until I got everything back.
Labels:
Adobe,
Fake Retailers
Thursday, 12 March 2009
Did the BBC just break the law?
The BBC's lightweight tech program "Click" took over a botnet of 20,000 machines to demonstrate the perils of zombie PCs. The BBC insists that this is perfectly legal: "If this exercise had been done with criminal intent it would be breaking the law."
So was it legal? Well, not according to the Computer Misuse Act. The BBC states that "the owners of unprotected PCs have been made aware that they are vulnerable to future attacks" and
"Click advised them on what steps to take to make their systems more secure". In fact, you can see precisely what they did on this video clip.
So.. did they just alter the data on the compromised PCs? It certainly looks like it - and because they have both gained unauthorised access to a PC and have altered information on it, then that is potentially a criminal offence under section 3 of the act.
But that's just UK law (and they are skating on thin ice as it is). In some other countries, unauthorised access and alteration of data for any reason is likely to be a criminal offence. The BBC probably did this with good intent, but it was quite possibly an ill-advised thing to do.
Added:
El Reg is covering this here, they quote Graham Cluley of Sophos who says that he believes the BBC did break the law. It looks like there is a storm brewing.
Now, I don't think the BBC breached security to access any data. Unauthorised access to a bot application is tricky, but the question revolves around them changing the wallpaper. It was certainly ill-advised in my view.
So was it legal? Well, not according to the Computer Misuse Act. The BBC states that "the owners of unprotected PCs have been made aware that they are vulnerable to future attacks" and
"Click advised them on what steps to take to make their systems more secure". In fact, you can see precisely what they did on this video clip.
So.. did they just alter the data on the compromised PCs? It certainly looks like it - and because they have both gained unauthorised access to a PC and have altered information on it, then that is potentially a criminal offence under section 3 of the act.
3 Unauthorised modification of computer materialCertainly the BBC carried out an unauthorised modification. But did they have the requisite intent?
(1) A person is guilty of an offence if—
(a) he does any act which causes an unauthorised modification of the contents of any computer; and
(b) at the time when he does the act he has the requisite intent and the requisite knowledge.
(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing—Clearly, the BBC did not have malicious intent to carry out a) b) or c), so under UK law they are probably just about in the clear.
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data.
But that's just UK law (and they are skating on thin ice as it is). In some other countries, unauthorised access and alteration of data for any reason is likely to be a criminal offence. The BBC probably did this with good intent, but it was quite possibly an ill-advised thing to do.
Added:
Copied from the comments (thanks Joel!)
Erm... why did you miss out the important bit - which is (1):
(Computer Misuse Act 1990)
1 Unauthorised access to computer material (1) A person is guilty of an offence if—
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at—
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
As I understand it, this means that you only have to secure access to a program or data (i.e. ANY ACCESS AT ALL) without authorisation to have acted illegally. Hence, what they have done is certainly illegal. I doubt anyone will be punished though...
Joel
El Reg is covering this here, they quote Graham Cluley of Sophos who says that he believes the BBC did break the law. It looks like there is a storm brewing.
Now, I don't think the BBC breached security to access any data. Unauthorised access to a bot application is tricky, but the question revolves around them changing the wallpaper. It was certainly ill-advised in my view.
Labels:
BBC,
Computer Misuse Act
Tuesday, 10 March 2009
PIFTS.EXE
Well, this is interesting. Users of Norton Antivirus are finding an application calls PIFTS.EXE that is try to call out. But every time anyone posts a query on the Norton support forum, it gets deleted immediately (see this search).
PIFTS.EXE appears to be a part of a patching application. The executable itself is unencrypted and contains several interesting bits of text such as:
One odd thing is that the PIFTS.EXE executable is padded out to precisely 100KB (102,400 bytes) with a string saying "XXPADDINGPADDINGXX" several times. Presumably Symantec have their own reason for making sure that the file is exactly this length.
PIFTS.EXE appears to be contacting a statisitical tracking server, possibly to report back on the installed version. Perhaps this violates Symantec's privacy policy, perhaps it's part of the testing process that was accidentally included in the update.
Some people might say that the way Symantec is deleting posts indicates a cover-up. It is certainly suspicious, but my best guess is that there's a quality control issue here and the PIFTS.EXE process was never meant to be released.
VirusTotal gives it a clean bill of health. ThreatExpert shows that it doesn't do much except call home.
PIFTS.EXE appears to be a part of a patching application. The executable itself is unencrypted and contains several interesting bits of text such as:
- http://stats.norton.com/n/p?module=2667
- The ping url is %s PATCH021809DB
- d:\perforce\entiredepot\consumer_crt\patchtools\patch021809db\release\PIFTS.pdb
- SOFTWARE\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEngine
One odd thing is that the PIFTS.EXE executable is padded out to precisely 100KB (102,400 bytes) with a string saying "XXPADDINGPADDINGXX" several times. Presumably Symantec have their own reason for making sure that the file is exactly this length.
PIFTS.EXE appears to be contacting a statisitical tracking server, possibly to report back on the installed version. Perhaps this violates Symantec's privacy policy, perhaps it's part of the testing process that was accidentally included in the update.
Some people might say that the way Symantec is deleting posts indicates a cover-up. It is certainly suspicious, but my best guess is that there's a quality control issue here and the PIFTS.EXE process was never meant to be released.
VirusTotal gives it a clean bill of health. ThreatExpert shows that it doesn't do much except call home.
Labels:
Anti-Virus Software,
Symantec
Classmates trojan: "Should I leave my Crazy Fat Wife for a younger woman?"
An unusual bit of social engineering here:
If you click on the link (not advisable) you get the following page (hosted on a botnet somewhere):
You are then prompted to install and run a file called Adobemedia10.exe at which things will start to go seriously wrong.
The VirusTotal report indicates a very low detection rate for the binary (VBA32 flags it up as Embedded.Rootkit.Win32.Agent.ex). However, the ThreatExpert prognosis shows just how much damage this does, and identifies a C&C server at 58.65.232.17 which is a well-known malware server hosted by black hat hosting outfit Hostfresh.
This looks like a fairly horrible thing to try to clean up, and probably best to recover data, reformat and reinstall.
Subject: Classmates personal message: Please help me to decide which way to choose
From: "Gold - Classmates" online@groups.classmates.com
Special video report March 10, 2009
Message from your group member:
"Should I leave my Crazy Fat Wife for a younger woman? Please look video and Help me
to decide, please ........I need your help,
if possible - Write your opinion on the page wall"
Proceed to open full message text:
(removed)
Sincerely, Leslie Burks.
2009 Classmates Message Center.
If you click on the link (not advisable) you get the following page (hosted on a botnet somewhere):
You are then prompted to install and run a file called Adobemedia10.exe at which things will start to go seriously wrong.
The VirusTotal report indicates a very low detection rate for the binary (VBA32 flags it up as Embedded.Rootkit.Win32.Agent.ex). However, the ThreatExpert prognosis shows just how much damage this does, and identifies a C&C server at 58.65.232.17 which is a well-known malware server hosted by black hat hosting outfit Hostfresh.
This looks like a fairly horrible thing to try to clean up, and probably best to recover data, reformat and reinstall.
Labels:
Classmates.com,
Hostfresh,
Trojans,
Viruses
Friday, 27 February 2009
MikeCahil@gmail.com: "New Jobs"
There are several different layers of fraud and deception when it comes to offering and applying for jobs.
This particular approach is via a spam, and seems to be a deceptive way of offering cheap Indian contractors to companies. India is very much a centre for spam because of very lax laws, in this case "Mike Cahil" is offering to fill roles in a variety of fields, but why would you want to do business with a spammer in any case? Remember the Boulder Pledge.
Originating IP is 59.164.72.134, a subscriber to TATA Communications in India. The netblock is widely listed as being very spammy. A poke around at blacklists indicates that 59.164.0.0/16 is a real spam sewer, and strict mail administrators could consider blocking the entire lot.
This particular approach is via a spam, and seems to be a deceptive way of offering cheap Indian contractors to companies. India is very much a centre for spam because of very lax laws, in this case "Mike Cahil" is offering to fill roles in a variety of fields, but why would you want to do business with a spammer in any case? Remember the Boulder Pledge.
Originating IP is 59.164.72.134, a subscriber to TATA Communications in India. The netblock is widely listed as being very spammy. A poke around at blacklists indicates that 59.164.0.0/16 is a real spam sewer, and strict mail administrators could consider blocking the entire lot.
From: "Mike Cahil" MikeCahil@gmail.com
Subject: New Jobs
Hi ,
I am doing a check with you, to see if there are any IT or Engineering jobs, I can help you today at [redacted]. I can help fill any Contractor positions or Direct-Hire positions or Contract-to-Hire positions.
Additionally, I can also help in the Accounting / HR / Sales / Management positions too.
Please do reply.
Thanks … Mike
email: [redacted]
Thursday, 26 February 2009
Strange Tripod phish
Why anyone would want to phish for a Tripod account is beyond me, but for some reason webmail accounts seem to be a target. This phish for Tripod credentials has (so far) the following subjects:
Subject: For Tripod user
Subject: Important information from Tripod Team
Subject: Tripod Confirmation Form
The rest of the email is similar to the following:
Oddly, the .eu and .tw hosts in question do not resolve at the moment, presumably these will be registered later. A trick that spammers sometimes use is to send out the spam and THEN register the domains, in order to trick spam filters.
It's probably a phish, it could be a drive-by download. In any case, best avoided and if you HAVE entered details into one of these phishing accounts then you should change your Tripod password and the password on any other site that uses the same username / password combination.
Subject: For Tripod user
Subject: Important information from Tripod Team
Subject: Tripod Confirmation Form
The rest of the email is similar to the following:
The "http" link is fake, underneath the real URLs are www.tripod.lycos.comttlfile.eu/adm/redirect/www/form/tripodcf.aspx?=[redacted] and www.tripod.lycos.comproftd.tw/adm/redirect/www/form/tripodcf.aspx?=[redacted]. (I have redacted tracking information).
From: "Tripod Customer Service" support@support.lycos.com
Dear Tripod user!Due to technical issues, the new Tripod software release is
currently on hold. However, a series of enhancements have been made. The new
client-server protocol is one of them. Now you need to complete Tripod Confirmation
Form to update your Tripod account.Please use the link below to access Tripod
Confirmation
Form:http://www.tripod.lycos.com/adm/redirect/www/form/tripodcf.aspx?[redacted]
Sincerely,
The Tripod Team
This message has been automatically generated.
Please do not reply to this message.
For information about the Lycos Privacy Policy Please see:
http://info.lycos.com/privacy
For information about the Terms and Conditions of this service Please see:
http://info.lycos.com/legal
Oddly, the .eu and .tw hosts in question do not resolve at the moment, presumably these will be registered later. A trick that spammers sometimes use is to send out the spam and THEN register the domains, in order to trick spam filters.
It's probably a phish, it could be a drive-by download. In any case, best avoided and if you HAVE entered details into one of these phishing accounts then you should change your Tripod password and the password on any other site that uses the same username / password combination.
Labels:
Phishing
Wednesday, 25 February 2009
SQL injection attack: telecom.dgnet.net
This seems to be an emergent threat at this moment - a number of ASP / SQL / Windows site have been hit with a SQL injection attack with the following injected Javascript: telecom.dgnet.net/images/pen.gif. Yeah it says GIF, but it isn't.
The site telecom.dgnet.net is at 121.14.137.36, this forwards to another site at www.batnigt.com/ver.htm (on obviously, do NOT visit that site) which tries to run a number of exploits on visitors PCs, including what appears to be an old ADODB.stream exploit (perhaps MS04-024), the Snapshot viewer exploit (MS08-041) and some sort of exploit for RealPlayer plus what MIGHT be an exploit for MS05-020 (but I need to look at this further). If a visitor's PC is up-to-date on Microsoft patches and does not have RealPlayer then it should probably be OK.
If you manage client PCs, then block or monitor for telecom.dgnet.net and batnigt.com. If your server has been infected with this attack then you need to clean up the database and then sanitize your SQL inputs.. try Googling for that term.
The site telecom.dgnet.net is at 121.14.137.36, this forwards to another site at www.batnigt.com/ver.htm (on obviously, do NOT visit that site) which tries to run a number of exploits on visitors PCs, including what appears to be an old ADODB.stream exploit (perhaps MS04-024), the Snapshot viewer exploit (MS08-041) and some sort of exploit for RealPlayer plus what MIGHT be an exploit for MS05-020 (but I need to look at this further). If a visitor's PC is up-to-date on Microsoft patches and does not have RealPlayer then it should probably be OK.
If you manage client PCs, then block or monitor for telecom.dgnet.net and batnigt.com. If your server has been infected with this attack then you need to clean up the database and then sanitize your SQL inputs.. try Googling for that term.
Labels:
SQL Injection,
Viruses
Friday, 20 February 2009
CA eTrust woes, Win32/Tnega.AC and widespead update failure
CA eTrust has thrown up a couple of problems - first a false positive identifying Win32/Tnega.AC in the setup.exe for Office 2000 Professional, with signature version 31.6.6361.0.
However, when having a poke at this it turns out that the current version is 31.6.6367 and 6361 is a few days old. A check of our distribution servers show that every single one of them worldwide failed to download version 31.6.6362 from the CA servers and fell over. This happened at around 2245 GMT on 17/2/09.
Log files are showing the following error: Error [0xc0010003] initializing redistribution job.
If you are running CA eTrust ITM, then it's worth checking that your signatures are up-to-date.
However, when having a poke at this it turns out that the current version is 31.6.6367 and 6361 is a few days old. A check of our distribution servers show that every single one of them worldwide failed to download version 31.6.6362 from the CA servers and fell over. This happened at around 2245 GMT on 17/2/09.
Log files are showing the following error: Error [0xc0010003] initializing redistribution job.
If you are running CA eTrust ITM, then it's worth checking that your signatures are up-to-date.
Labels:
CA,
eTrust,
False Positive
Point Focus LLC: "The offer you can not say no to!"
"The offer you can not say no to!" Really. I betcha I can. My notes are in bold.
Subject: The offer you can not say no to! ["No": just did, did you see that?]Originating IP is 92.84.13.66 in Romania. Just say "no".
Point Focus LLC is now expanding!
To deal with the international payments processings we are now looking for people willing to facilitate establishing of our all-round-the-globe business connections and assist saving considerably by tax disbursing reduction. This position of the Financial Assistant involves accepting payments from our Australian, UK and US ( rarer Spanish) clients to your account and resending to our partners.
You are getting paid right by the moment you cash the payment. It's the commission in amount equal to 4% out the sum posted on your account. This very amount you're deducting before sending anything out. So, estimated roughly, you can make up to 2000$ extra monthly.
[A straight money mule operation then, laundering stolen money. 4% for basically doing nothing. Except you will never actually get to keep the 4% when the police catch up with you]
Plus, you get:
- flexi-time (usually 2-3 hours a day)
- Saturdays & Sundays off [woo!]
Requirements:
- Have to be aged 21 or above
- No criminal record [don't worry, you will soon get a criminal record if you participate in this scheme]
- Regular Internet access
- Ability to accept payments using your bank account [for the transfer of stolen money, which will be nice and traceable for the cops]
- Ability to resend the money through Western Union [which is NOT traceable, and is therefore money laundering]
If feel qualified, please, attach the following info to start up with:
[information that we should have known if we were offering you a job]
- Fist Name:
- Last Name:
- Age:
- Sex:
- Country
- State, City, Zip
- Phone number (home and cell)
- Valid email address
NOTE!!!! the email address you use to contact us for the first time is: IBCGroup0@gmail.com , in the subject field put "interested".
[odd that the email address doesn't match the one you sent from]
Please, use only mentioned email address, otherwise we'll fail to receive your response.
Labels:
Job Offer Scams,
Money Mule,
Scams,
Spam
Subscribe to:
Posts (Atom)