Google Treasure Chest, or Kit, and Mysterious ‘Help’ from a Stranger

April 17, 2009 by Strangely | 11 Comments

Pre-Script

Comments are now closed on this posting as Google Treasure Chest is dead.
However, the problem has not gone away – the menace continues.

For further information, all chat on this and subsequent scams is now here:
Google Revolution, Different Name, Same Scam!
and here:
More on Google Profits and Pacific Webworks/

Google Treasure Chest

The saga that is Google Treasure Chest in all it’s various incarnations took an unusual turn the other day and it’s only now I’ve got round to writing about it. For completeness, this is part of the story documented in these three links (and the shrapnel emanating!)

Google Adsense

The unusual problem is to do with this comment on the Google Treasure Chest – it’s a scam and a half! posting.

http://strangelyperfect.tv/3099/google-treasure-chest-its-a-scam-and-a-half/#comment-1176

It’s from a guy named ‘jeff’. The IP address is put down as somewhere in Alaska and the email address is a gmail.com one. The problem is the wordage and content of the comment, because notionally it looks okay. It says;

Strangely Perfect has a link to this scam:
googleads.g.doubleclick.net/aclk?sa=l&ai=BztmIm33nSc_wF5uorAPAz9S1ApethJcBx4WBrwzAjbcB4L40EAEYAiCPg6QOKAI4AFC7seKP
_v____8BYMnmp4a0o6AXoAGdjMruA7IBE3N0cmFuZ2VseXBlcmZlY3QudHa6AQk0Njh4NjBfYXP
IAQHaAUxodHRwOi8vc3RyYW5nZWx5cGVyZmVjdC50di8zMDk5L2dvb2dsZS10cmVhc3VyZS1j
aGVzdC1pdHMtYS1zY2FtLWFuZC1hLWhhbGYv4AECqQK39pSQk9irPqgDAcgDB-gDYegDyAL1A
wAAAAT1AwBAAAA&num=2&sig=AGiWqty_8Dkk4B5fCXsxHe4HgUcV1MOm5w
&client=ca-pub-0574746273596969&adurl=http://www.trackednet.com/statistics/ngm/&nm=33

I’ve stripped off the ‘http’ and addded carriage returns to the query string otherwise it shoots right across the page, and even worse, it would allow the link to run.

What’s interesting is that somehow ‘jeff’ has managed (or bothered?) to add a adsense link with my google adsense reference number. Now this isn’t hard to find. Check the source code for any of my pages and they’ll all contain the code as a google ad is on every page as they are in the sidebar.

In other words – it’s not rocket science.

But why would someone want to do that? The actual text is “Strangely Perfect has a link to this scam”, followed by a link.

But the comment is on the actual post where the actual Google Treasure Chest scam is dug into.

Q. So where does the actual link point to?
A. Not where you think – is the answer!

The end URL, http://www.trackednet.com/statistics/ngm/&nm=33 is a 404 dead end. The front query string is also dead. Only when the link is clicked (and I’m credited, bizarrely), does the link take you anywhere and that place is a redirect from trackednet.com via a ‘Go’ page to:

http://www.entrepreneur.com/homebasedbiz/index.html

This is a California based company and is in a very nice glazed building off the San Diego Freeway.

Confused

So I’m a trifle confused. What’s this comment doing on the post? It’s a kind of self-referential hell. Is it a mistake by ‘jeff’ who posted the comment on the wrong website? Is it part of a link duffing-up process? Is it people posting extra links back to their site on popular posts to ensure the link stands out and isn’t in with the normal bunch of links?

When ‘jeff’ said “Strangely Perfect has a link to this scam”, it’s as if he’s coppied a link from my sidebar adverts and pasted it into a comment…… I hope it’s a genuine mistake and not some new ‘thing’ that I’m at present unaware of!

HSBC data loss and the Mysterious Phone Call
I had two interesting calls yesterday from foreign gentlemen. Their basic call went thus: “Hello, is that Mr Rees?” Hmm...
And Now We Have Tiny URL Spam!
A comment spam of a new sort just arrived so it’s most definitely connected to the recent Microsoft RPC warning...