htmlads.ru injection attack

Another injection attack following on from this one, htmlads.js looks like it is being injected into IIS 6.0 servers. In this case, the string to look for in your logs in htmlads.js/ads. js which is worth checking for and blocking if you can.

For the records, the domain registration details are:

domain: HTMLADS.RU
type: CORPORATE
nserver: ns1.htmlads.ru. 75.34.216.140
nserver: ns2.htmlads.ru. 216.119.45.147
nserver: ns3.htmlads.ru. 72.48.193.152
nserver: ns4.htmlads.ru. 71.108.37.140
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private person
phone: +7 496 4047474
e-mail: tau@8081.ru
registrar: REGRU-REG-RIPN
created: 2009.10.05
paid-till: 2010.10.05
source: TC-RIPN

Are your personal details on Jigsaw.com?

An interesting post caught my eye about a site called Jigsaw.com over at the CluBlog. It's a sort of collective where people trade other people's business card information, and it might well be the reason why my number of irrelevant direct marketing calls has gone through the roof.

The blog post also usefully tells you how to remove your details - recommended reading!

Injection attacks: adbnr.ru

adbnr.ru seems to be the latest domain to be used by the bad guys in this current round of injection attacks. The injected code to look for is adbnr.ru/ads.js (obviously don't visit that page unless you know what you are doing). That leads to a heavily obfuscated piece of Javascript which I haven't dissected yet.. but really there is no doubt that it is going to try to do something very bad to your computer!

Domain is registered to:
domain: ADBNR.RU
type: CORPORATE
nserver: ns1.adbnr.ru. 75.155.243.39
nserver: ns2.adbnr.ru. 173.93.171.160
nserver: ns3.adbnr.ru. 71.108.37.140
nserver: ns4.adbnr.ru. 67.84.154.208
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private person
phone: +7 812 5706062
e-mail: omit@blogbuddy.ru
registrar: REGRU-REG-RIPN
created: 2009.09.29
paid-till: 2010.09.29
source: TC-RIPN

Both the telephone number and email address have been connected with malware attacks before.

Looks like it is using a fast flux botnet for hosting, but blocking adbnr.ru should be effective.

ads-t.ru and adtcp.ru: Asprox is back

I haven't had time to look at this fully, but it seems that a fresh round of Asprox attacks have started after several months of inactivity - in this case the domains ads-t.ru and adtcp.ru are in use.

Read more at CyberCrime & Doing Time.

max-apprais.com and top-name.net scam

max-apprais.com and top-name.net appear to be two fake domain appraisal companies being "recommended" to domain owners as part of a long-running scam which we have touched on many times before.

max-apprais.com was created on 12th September to an anonymous registrant, hosted on 202.157.181.9 at Katz Global Singapore. It's a copy of max-appraisal.com which is hosted on 124.217.231.209 at well-known black hat hosts YoHost.org.

top-name.net is a very familiar template hosted on 66.7.196.186 (Hostdime, Florida) also to an anonymous registrant (although it appears to be a Canadian resident behind all of this spam).


sedo.com are a well-known and wholly legitimate company and are nothing do to with the spam or scam.

The "pitch" email looks like this:

From: "Domain Trade LLC"
Date: Wed, September 23, 2009 4:26 am

Dear sir,
we are interested to purchase your domain [redacted] and offer between 50% and 65% of the appraised value.
We accept appraisals from companies such as

http://www.sedo.com/
http://top-name.net/
http://max-apprais.com/


If you already have an appraisal please forward it to us.

Please let us know whether you are interested. Upon review of your valuation and in case of an agreement we send payments via PayPal for amounts less than $2,000 and via Escrow.com for amounts above $2,000, as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Domain Trade LLC

Originating IP for the spam is 74.55.131.10

Of course, once they have taken your money for the appraisal, then you will never hear from them again.

If you have been conned by these scammers then start a PayPal dispute to get your money back. We understand that Sedo may offer a refund in any case as they are well aware of this scam. You might also want to file a complaint with the police, especially if you live in Canada where the perp appears to be based.

Rogue ads on answers.com: dotastoc.com

I'm still trying to track this one down, but somewhere on answers.com is a rogue ad that does through several hops to reach a fake anti-virus application. Don't visit any of the following sites unless you know what you are doing!

1. dotastoc.com/442417.js?sid=bWtuamJoX2NvZmZlZS1jODMuZG90YXN0b2MuY29t [212.95.56.102, Germany - Netdirekt E.k]
2. mknjbhyju.exxl.pl/coffee-c83/xalei.html [209.51.196.244, Ohio - XLHost.com Inc]
3. mknjbh_coffee-c83.dotastoc.com/index.html ?Ref=http%3A%2F%2Fwww.google.co.uk %2Fsearch%3Fhl%3Den%26q%3D[redacted]%26btnG%3DSearch%26meta%3D
4. myth-busters.cn/go.php?id=2009-01&key=cd19f5036&p=1 [94.102.48.29, Netherlands - Ecatel]
5. 09computerquickscan.com [multihomed at 78.46.118.1, 78.46.201.89, 78.46.251.41, 88.198.81.153, 88.198.120.177, Germany Hetzner Online AG]

Step 3 requires a referer string to work, depending on the string you may get redirected, for example to usdisturbed.cn/?pid=229&sid=4b5855 [193.169.12.70, Belize "Financial Company Titan Ltd"] then fast-virus-scan4.com [91.213.126.100, Costa Rica Centerinfocom Ltd or 93.169.12.70 again]

Lots of suspect IP addresses there, 212.95.56.102 is the first step and also hosts these following domains that also look suspect:

• Anidmenonpderche.com
• Dotastoc.com
• Ewyuewssf.com
• Fishbiss.com
• Iggiksc.com
• Lur2cont.com
• Niuk.ru
• Pornokogu.com
• Uewiosdasda.com

fast-virus-scan4.com is also being used in some .htaccess attacks, where the hacked site only redirects to the fake virus scanner if accessed through Google or some other search engine, not if it is visited directly.

Update: answers.com appear to have tracked down and removed the ad, although some other sites have been hit by a very similar attack.

YoHost.org on the move to Dragonara.net

It looks like black-hat host YoHost.org is on the move to a set of IP addresses owned by "Dragonara Alliance Ltd" (dragonara.net) - a company that claims to be Swiss (and appears to use hosting in Switzerland) but is registered in the British Virgin Islands.

Dragonara claims to be a high-reliability host where clients can weather out DDOS attacks, which is a useful service. However, a lot of the sites it host seem to be quite dubious, and a lot of sites seems to be pushing "replica" (i.e. fake) Swiss watches. The fact that a Swiss company is hosting sites in Switzerland that appear to be selling fake Swiss watches is something that might end up in an interesting conversation with some Swiss lawyers.

The IP address range to look out for is 194.8.74.1 - 194.8.75.255. The sites listed below are for information purposes only, many may well be perfectly legitimate. If you have any observations, then please use the comments.


194.8.75.34
Liberty72.com
Music-ultra.net
Virtuelldigitale.net

194.8.75.66
Filmkeuze.org
Superadult.org

194.8.75.77
Tyolaly.com

194.8.75.80
Ireplicastore.com

194.8.75.82
Billing-sat.tv

194.8.75.90
Bkjace.com
Jessicareplicas.com
Swissreplicastore.com

194.8.75.94
Good-good-movie.com
I-want-she.com
Oem-workshop.org
Online-oem-store.com
Red-paradise.com
Russian-paradise.com
Net-doktor.eu

194.8.75.98
Highrisefinance.com


194.8.75.107
Watch-replica.net

194.8.75.116
Yohost.org

194.8.75.118
Sadelae.com
Tiffanysets.com
Tyakcek.com

194.8.75.119
Apoace11.com
Beanells.com
Mymodelwatches.com

194.8.75.120
Gaemacs.com
Replicasmart.com

194.8.75.121
Brangelinareplicas.com
Geakcon.com

194.8.75.122
Kejhlle.com
Watch-replicas.com

194.8.75.123
Akeean.com
Brandreplica.com
Sharesdigger.com

194.8.75.124
Beauhi.com
Tiffanylovers.com

194.8.75.125
50st.ru

194.8.75.126
Ppoeatt.com

194.8.75.127
Tyaopce.com

194.8.75.128
Bieaken.com

194.8.75.129
Dakealls.com

194.8.75.135
Replicawatchesreviews.com

194.8.75.141
Agent-service.info
Barlenelectronics.com
Iluvtotravel.com
Sapnastudio.org
Strahovoy-partner.info
Strahovoypartner.ru
Thefbo.com

194.8.75.143
Csmfinance.com

194.8.75.165
Halarona.com

194.8.75.180
Replicas99.com

194.8.75.181
79eurovilla.com

194.8.75.199
Dvd4play.com

194.8.75.202
Thc-torrents.org

*********

194.8.74.12
Aowei.net.ru
Babytrance.us
House-of-friendship.com
Jurassic.net.ru
Kemcua.net
Lightning.net.ru
Tiroteen.net

194.8.74.45
Odnoixniki.com

194.8.74.100
Shara.info

194.8.74.101
Dw-plus.tv

194.8.74.120
Battlenetlogins.com
Directransfer.net
Diyxbox360.com
Flexfolders.com
Hygetropin-hgh.com
Immune-research.com
Premiuma.net
Privacysecured.com
Reversephonenet.com
Tiffanybazaar.com
Topregfix.com
Uc-forum.com
Ucdownloads.com
Vintagevdb.com
Xbox360redlightsguide.com

194.8.74.127
Dw24.tv

194.8.74.129
Anyshop.ch
Huasi.ch
Sowa.ch
Swisstuerk.ch

194.8.74.132
Hotelinsider.info

194.8.74.135
Dw-mobile.org

194.8.74.154
Vaultinvestment.com

194.8.74.158
Fi-success.com
Financijskabuducnost.com
Financijskabuducnost.net
Forexdonos.com
Forexdonos.net
Forexdonos.org
Forexnalozba.com
Forexnalozba.org
Forexnalozbe.com
Forexnalozbe.net
Forexnalozbe.org
Fx-donos.com
Fx-donos.net
Fx-donos.org
Tx-invest.net
Ultra-forex.com
Ultra-forex.net

194.8.74.190
Parnenairdesign.com
Rs-promotion.com
Syjsw.com

194.8.74.193
Practicalsilver.com
Silverurban.com
Solid925silver.com
Tiffanynsnow.com

194.8.74.231
Relsat.org

Fake HMRC tax refund messages

Looks like there's a spam run in progress with the following fake tax refund message:

From: HM Revenue & Customs [mailto:rsa.messages@hmrc.rsamessages.co.uk]
Sent: 10 September 2009 10:16
Subject: [ HMRC MESSAGE ID NUMBER: 381716209 ]

(This is an outbound message only. Please do not reply.)



Dear Applicant,

The contents of this email and any attachments are confidential and as applicable, copyright in these is reserved to HM Revenue & Customs. Unless expressly authorised by us, any further dissemination or distribution of this email or its attachments is prohibited.

If you are not the intended recipient of this email, please reply to inform us that you have received this email in error and then delete it without retaining any copy.

I'm writing to confirm that after the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 327.54 GBP

You have attached the tax return form with the TAX REFUND NUMBER ID: 381716209, complete the tax return form attached to this message.

After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

If you have any questions, please refer to our Frequently Asked Questions (FAQs) or visit our head office address can be found on our web site at http://www.hmrc.co.uk/

Yours sincerely,
Kevin Taylor
Manager, HM Revenue & Customs Tax Credit

TAX RETURN FOR THE YEAR 2009
RECALCULATION OF YOUR TAX REFUND
HMRC 2008-2009
LOCAL OFFICE No. 3819
TAX CREDIT OFFICER: Kevin Taylor
TAX REFUND ID NUMBER: 381716209
REFUND AMOUNT: 327.54 GBP


This e-mail is generated by RSA Security United Kingdom on behalf of HM Renenue & Customs


Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.

or another variant:

From: HM Revenue & Customs [mailto:officer.robinson@hmrc.co.uk]
Sent: 10 September 2009 10:23
Subject: TAX REFUND ID NUMBER: 381716209

TAX RETURN FOR THE YEAR 2009

RECALCULATION OF YOUR TAX REFUND

HMRC 2008-2009

LOCAL OFFICE No. 3819

TAX CREDIT OFFICER: NEIL ROBINSON

TAX REFUND ID NUMBER: 381716209

REFUND AMOUNT: 344.79

Dear Applicant,

The contents of this email and any attachments are confidential and as applicable, copyright in these is reserved to HM Revenue & Customs.

Unless expressly authorised by us, any further dissemination or distribution of this email or its attachments is prohibited.

If you are not the intended recipient of this email, please reply to inform us that you have received this email in error and then delete it without retaining any copy.

I am sending this email to announce: After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 344.79

You have attached the tax return form with the TAX REFUND NUMBER ID: 381716209, complete the tax return form attached to this message.

After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

Our head office address can be found on our web site at http://www.hmrc.co.uk/

Sincerely,

NEIL ROBINSON

HMRC Tax Credit Officer

officer.robinson@hmrc.co.uk

Preston

PR1 0SB

There's an attachment in both cases that attempt to harvest personal details (basically everything you need for identity theft) and sends it off to the attacker. In this case, domains used are jub23bi.biz and xgen99.biz although there are probably others. Scanning your outbound log files for /luk.php or /luk1.php or .biz/luk might reveal anyone who has fallen for it.


Obviously, if you've entered you details into something like this then you need to contact your bank as soon as possible and explain that your account has been compromised.

Macez.com domain scam

Yet another fake domain appraisal scam following on from this one, macez.com has actually been registered for a while but only came into use in September. If you receive an email recommending this appraisal site, delete it. If you have paid for a fake appraisal with PayPal, then you should open up a dispute about the transaction.

Razor blade spam

Here's a new one.. razor blade spam! Gillette Mach 3 Blades are apparently the most stolen retail product in the world, so perhaps it is unsurprising to see spam for what is bound to be fake Mach 3 razor blades.

Subject: Gillette Mach 3 Razor Blades - Best Prices 28414010
Date: Wed, August 26, 2009 10:37 pm

9732866
If you have trouble viewing this email click here. You could make a gift for you boy
friend,farther or sell the items on Ebay.

7657
If you are not a member, or received this email from a friend, and would like to
join our Rewards program, click here.

You've received this message because you've registered to receive email from M3mach.
If you no longer wish to receive email from us click here.

View our privacy policy.
Please don't direct response this mail box.
Contact Us click here.
www.M3mach.com

A pack of 8 Mach 3 blades retails for about $18 in the US, these folks claim to be selling them for less than $7..

..which means that these are fakes. Fake razor blades are just fine if you don't mind facial lacerations, rashes and nasty blood diseases. Looks like they also sell fake condoms too.

This may well be the start of a new trend. Who knows what the spammers will try to sell next? Tinned meat?

CurrencyVendor.com: can you trust it?

Another doubtful World of Warcraft site is currencyvendor.com hosted on the same server as these other WoW scam sites.

Does it look trustworthy? Well, no. It's hosted by YoHost.org on the same server as a load of WoW scams sites, phishing sites, fake internet companies, bogus pharmacies and all sorts of other things. The domain was set up a few days ago, and is hosted on an anonymous server with anonymous contact details. Given the very high number of scam sites on this server, the lack of history and the anonymous contact details we would strongly recommend that extreme caution be taken if dealing with this site.


Update: the people behind CurrencyVendor.com deny that it is a scam, but acknowledge that their web host does host scam sites. They also decline to identify themselves. Draw your own conclusions, but as a general rule doing business with someone who refuses to identity themselves is a bad idea.

$1 + $3 + $8 + $20 + $52 = $84

This is a interesting gambling spam which tries to entice you to an online casino called worldelitecasino.net hosted in China.

Subject: Re: yo mate
Date: Tue, August 25, 2009 5:19 pm

yo mate..


ok I`ll give you my trick but if you give it someone else I`ll fuckin kill you :)
you know in roulete you can bet on blacks or reds. If you bet $1 on black and it goes black you win $1 but if it goes red you loose your $1.
So I found a way you win everytime:

bet $1 on black if it goes black you win $1

now again bet $1 on black, if it goes red bet $3 on black, if it goes red again bet $8 on black, if red again bet $20 on black, red again bet $52 on black (always multiple you previous lost bet around 2.5) if now is black you win $52 so you have $104 and you bet:

$1 + $3 + $8 + $20 + $52 = $84 So you just won $20 :)

now when you won you start with $1 on blacks again etc etc. its always bound to go black eventually (it`s 50 / 50) so that way you eventually always win. But there`s a catch. If you win too much (like $800 a day) casino will finally notice something and can ban you. I was banned once on red teaching casino. So don`t be too greedy and don`t win more then $200 a day and you can do it for years. I think bigger casios know that trick so I play for real money on smaller ones, right now I play on elite world casino: www.worldelitecasino.net for more then 3 months, I win $50-$200 a day and my account still works. You`ll find roulette there when you log in go to "specialt games" - "american roulete". And don`t you dare talling about it anyone else, if too many people knows about it casinos will finally found a way to block that trick. If you have any questions just drop me a line here or on skype.

c ya

In brief, the spam is pitching a roulette "system" that guarantees that you will win, and recommends an online casino where you can use it. The target site has an executable called SmartDowload.exe which was written by RealTime Gaming, Inc.

So, in fact the "Casino" doesn't exist - it leads to a legitimate (but potentially unwanted) desktop gambling application, the executable itself looks like part of Realtime Gaming's affiliate program of something (the Download ID is 1273059)


Presumably the spammer gets some payment per signup or something.. and this can actually be a lot of money in some cases.

So.. what about this "system" then? Well, in reality it doesn't work. It's a version of the Martingale System which basically says that you should double your bet each time you lose (in this case double-and-a-bit).. because eventually you will win your money back. That sounds fine in theory, but eventually you either:

1. Run out of money - because the value increases expontentially, in the example in the spam the next levels to bet would be $130, $325, $813, $2031, $5078, $12,595, $31,738, $79,345, $198,364, $495,910 and then $1,239,776). You will always run out of money before the casino does.
2. Hit the house limit - most casinos have a limit beyond which you cannot bet, usually a few thousand dollars. So, you'd hit the house limit before the Martingale system ever paid off, even if you did have nearly unlimited funds.

There's a more detailed writeup at Greg Kochanski's blog explaining the maths behind it.

Personally, I think there's only one thing to remember about casinos: the house always wins!

"PD Domains": topnameappraisals.com and greatestnamesonline.com scam

Two more scam domain appraisal sites - greatestnamesonline.com and topnameappraisals.com following on from pddomains.com and countless other ones.

If you receive an unsolicited email listing either of these two companies as appraisal outfits, then it's a scam. More information here.

Update: there's also topnameappraisal.com which is another domain doing exactly the same thing.

dia-company.net scam

Another job scam from Michell.Gregory2009@yahoo.com. It's not clear exactly what "job" they are offering, but it will definitely be a scam and probably be illegal.

Subject: Job Search Results on Monster.com

Greetings,

Our Company is ready to offer full and part time work in your region. We are among top managing companies in North America and Europe.

If you are interested in career growth and good salary, send your resume ONLY to the Company?s email address: hd@dia-company.net

Reply only via corporate email, so please just use this one for further contact and
correspondence: hd@dia-company.net

With best regards,
HD department
DIAGROUP

The domain registration details are:

Domain name: dia-company.net

Registrant Contact:
NA
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Administrative Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Technical Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Billing Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

DNS:
ns1.freedns.ws
ns2.freedns.ws

Created: 2009-06-25
Expires: 2010-06-25

That email address is well-known.

The site is hosted on 121.12.127.241 in China, it is probably safe to assume that every other site is similarly some sort of scam or malware site and should be avoided.

• 00freewebhost.cn
• Anilyclickux.com
• Anilydclick.com
• Anilymclicks.com
• Armor1.info
• Armor2.info
• Autohitssite.com
• Bote-abfertigung.com
• Ckinter.cn
• Ckinter.ru
• Compy.info
• Dia-company.net
• Earntoclicklr.com
• Festgroup.net
• Googleautohits.com
• Googledolis.com
• Googledues.com
• Googleehits.com
• Googleipad.com
• Googleledal.com
• Googlepayclicks.com
• Googlepayhits.com
• Googlepaylr.com
• Googlesrx.com
• Ilos-group.com
• Ilos-group.net
• Inzo-group.com
• Inzogroup.net
• Inzo-group.net
• Jethitclicks.com
• Makemogoogle.com
• Mavr-best.com
• Medikmenty.com
• Mybotnet.org
• Perenils.cn
• Prex-group.com
• Prex-group.net
• Resogroup.net
• Smallclicks.net
• Spyware-file.info
• Spywarehome.info
• Spywarepc.info
• Spyware-systems.info
• Taxvac.com
• Thjgoogle.com
• Tincash.cn
• Varnagroup.net
• Vicogroup.net
• Viphack.ru
• Vsehorosho.info
• Zentin.net.cn

Some "World of Warcraft" Scam sites

I don't play WoW myself, but there are a whole bunch of bad guys out there trying to rip off player accounts for money. Here are some recent domains hosted at scam-friendly YoHost.org that you should avoid.. if you HAVE entered your password into one of these sites, then change it NOW.

• Blizzard-battle.net
• Blizzard-promotion.com
• Promotions-battle.net
• Promotions-worldofwarcraft.com
• Worldotwarcaft.net
• Wowmovieteaser.com
• Wowtcgpromotion.com

CA eTrust goes nuts with StdWin32 and other false positives

CA eTrust ITM has gone completely nuts today, with a load of seemingly random false positives mostly for StdWin32 in a large number of binaries, including some components of eTrust itself.

The core problem seems to be a signature update from 31.6.6672 to 33.3.7051, there seems to be little consistency in what is being detected as a false positive although there are multiple occurrences of Nokia software, VNC and event DLLs and EXEs belonging to eTrust's core components.

Probably the best thing to do is block the update or change the Realtime scanning behaviour to "disabled" or "report only".

Update: problem seems to have started at about 0525 GMT when the new signature pattern applied. There no consistent pattern to the infected files, it looks like it happens at random. Several other people seem to be having the same issue!

Update 2: Signature pattern 34.0.6674 appears to fix this problem. You can then enjoy repairing your faulty machines.. thanks CA!

Update 3: Amusingly, CA eTrust seems to have deleted its own key components in many cases. I don't know if this is the first recorded case of an anti-virus application mistaking itself as malware!

Update 4: CA have released a statment as follows:

Last night, CA released a new updated antimalware engine. This new release has resulted in false positive detections of a number of files. CA Threat Manager customers are the only customers being affected by this issue. This is not a result of signature updates and does not impact CA consumer Internet security products.

To resolve the issue, CA has rolled back the new engine and re-released its previous antimalware engine. CA customer support representatives are on call to answer customer questions and to provide remediation support. A remediation tool to rename the quarantined files is now available through CA support and will soon be accessible online.

CA is aggressively working to resolve the issue, assist any customers who have been affected, as well as identify the root cause of the incident. We apologize for this inconvenience and look forward to the roll out of our new antimalware engine, which will ultimately offer our customers many benefits including enhanced malware protection and improved performance.

Update 5: Got a mention on El Reg.. funny thing is that I went in to work today wearing my El Reg T-Shirt. Coincidence? Consiparacy? Cockup?

PS: Please remember to read the comments if you are still having problems!

Fleos.com and Flyappraisal.com scams

Two more domain appraisal scams following on from this one, Fleos.com has been around for a few days and is a copy of the flyappraisals.com / flyrating.com fraud.

In the same vein, the scammers have also registered Flyappraisal.com which will not doubt be used for another batch of fake domain appraisal fraud soon.



Avoid these, and if you have paid for a so-called appraisal via PayPal, then use the PayPal dispute procedure to get your money back.

pddomains.com scam

This is part of a long-running scam where you receive an unsolicited offer for a domain name.. the scam is that you are offered a choice of three appraisal services, the cheapest of which is controlled by the scammer. Once you have paid for your appraisal, the offer to buy the domain mysteriously dries up.

Subject: Offer to buy [redacted]
From: "Resale Domain" <resaledomain@gmail.com>
Date: Sun, August 9, 2009 6:00 am

Dear Sir,

we are interested to buy your domain name [redacted] and offer 65% of the appraised market value.
As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
pddomains.com
accuratedomains.com

If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Thank you,

B. Phillips
Resale Domain

The site looks professional enough, but it's a cookie-cutter design that has been used for previous frauds here, here, here and here although sometimes the same crew use this design.

Email originates from 64.186.128.191 in the US and points to a domain on 124.217.231.209 in Malaysia. WHOIS details are anonymised and the domain was only registered on 7th August, nontheless the most likely perpetrator is detailed here.

If you have paid for an appraisal, then you should start a PayPal dispute to get a refund. Hopefully, that will also get the fraudster's account shut down.

MS09-034 is coming..

Just a reminder that Microsoft are announcing an out-of-band patch today to fix a critical IE / Visual Studio flaw. If you manually authorise updates to client PCs via WSUS, then you will need to break the usual schedule and deploy this as soon as you can.

More info here and here.

"Best Crisis Prices": dotbestshop.com / bestcrisisprices.com fake shops

I mentioned bestcrisesprices.com a few weeks ago, and it seems that they have a new domain called dotbestshop.com which is also a fake ecommerce site.


Both sites are hosted on an an anonymous hosting account at 124.217.231.121 in Malaysia, the domain contact details are either anonymous or fake. The contact details on the website are also fake, and have been stolen from legitimate businesses.

It claims to be a member of the BBB, but it isn't as the BBB reports that it is mis-using their logo.

This is part of a large organized crime ring, nominally connected with China. Although it claims to be based in Louisiana, there is no evidence at all that this is a US operation. Avoid dealing with them at all costs.