Tag Archive: CBS

Estonian Spammer Forges CBS and The Guardian

Get Rich Quick Scam Forges Genuine News Agencies Web Pages

Gmail Spam

Gmail Spam

I recently received two emails from a friend’s old Hotmail account, but to two of my email addresses.

Email Spam

Email Spam

Probably, the account has been hacked as I could detect no spoofing in the emails’ headers.  These are the emails, with the email addresses blacked out.

Initial Email Investigations

The text is similar in that they try to entice a user using pretty poor English to click on the shortened URL links, which are active.

Here’s how the links work:
To my Email address;
cbsbusiness9

cbsbusiness9

I had http://cbsbusiness9.com/index2.php?/5260 which then goes to

http://cbsbusiness9.com/uk.html?/partners/the-guardian/small-business/5672-9782-67834/making-money-online/

 

To my GMail address;
cbsnews-article

cbsnews-article

I had http://cbsnews-article.com/index2.php?/4032 which then goes to

http://cbsnews-article.com/uk.html?/partners/the-guardian/small-business/5672-9782-67834/making-money-online/

 

The screenshots show the results using a neat Firefox plugin, Flagfox, which displays the source IP address and country on mouse-over.

The WHOIS’s of each domain are almost identical.  These are screenshots.

whois.domaintools.com screen capture 2012-12-12-17-12-26 whois.domaintools.com screen capture 2012-12-12-17-13-17 That Arthor Brown’s a one, eh?  Notice the Ukrainian, Russian and New York connections?   Who is/are  or what is:

TNew line ave 172 95
NY, 18274
UNITED STATES
+1.7343541732

Google Search on +1.7343541732

Google Search on +1.7343541732

Googling the phone number pulls out a heap of (not)surprises including an awful cesspit of scamminess that’s now starting to rival Pacific Webworks’ Google Treasure Chest and Jesse Willms’ Colon cleansing efforts!  (We saw these scams a few years back – check the links)

Just check out the fake news and dodgy sounding sites in the search results….  These are the first couple of pages of current search results:

  • Com-news8.net
  • Bcnews8.com
  • Dildobigg.com
  • Raspberry-Ketone24.com
  • BigGgEts.com
  • HurtGuys.com
  • GrowsPeniss.com
  • HugerAss.com
  • Com-news9.net
  • Com-nbcnews9.net
  • coloncleanse-extreme.com
  • nbc9news.com
  • nbc1news.com

Arthor Brown is in most of them with his Yahoo! email address as [email protected]   Please don’t confuse him with this Arthur Brown, but yes, handle all of these websites like Fire!

Forged Webpages of The Guardian Newspaper

cbsnews-article.com screen capture 2012-12-12-16-3-51

cbsnews-article.com screen capture 2012-12-12-16-3-51

cbsbusiness9.com screen capture 2012-12-12-16-3-23

cbsbusiness9.com screen capture 2012-12-12-16-3-23

The Guardian, is an old and respected news organisation in the UK.  CBS is a long-established US media network.

They, and the purported author of both webpages, Sirena Bergman, must be pretty pissed off about the hijacking of their names.

Also to be annoyed, is Lloyds TSB Bank who apparently are “in association” with this get rich quick scheme for work at home moms!

Completely Forged News Articles!

Indeed they are.

  • The articles are dated “December, 11:41”, which is odd since there’s no day, just month and time!
  • Both articles are embedded in genuine Guardian web-pages, with all the links surrounding the article going to genuine Guardian web-pages or genuine advertiser websites!
  • The hook links in both forged webpages go to http://workinghome22.com/go.php

The forgery is done in the same manner as the well-known phishing scams done for banks and on-line finance and insurance.

Apart from the images sourced from The Guardian, the scammer’s images are sourced from:

  • ddmcdn.com which is HowStuffWorks.com!
  • localconsumeralerts.com
  • prosperadtracker.com
  • ophan.co.uk

So, Who Is workinghome22.com

Bad Gateway

Bad Gateway

The first link was dead, opening a bad gateway so the expected redirect didn’t work.  The tracking pointed back to Ireland!

Bad Gateway

Bad Gateway

The second link worked, but the sweetly named workingfromhome22.com wasn’t the destination.   No, the link immediate re-directed to http://onlineincnow.com/2/?aff_sub=72

Well, at least the affiliate number 72 is getting paid….

But hang on, who exactly is workingfromhome22.com?
workinghome22.com screen capture 2012-12-12-16-31-44

workinghome22.com screen capture 2012-12-12-16-31-44

Well, typing the URL directly takes me to workingfromhome22.com!  This is it!

Cunningly, you’ll note that it’s pulled out my home-town as Bournemouth (where I live) with that awful “mom” Americanism!  No-one in the UK addresses their mother as mom…  I mean, FFS?

The webpage links, containing the disreputably used graphics of Thomson, Reuters, CNBC and NBC Universal all point to http://workinghome22.com/go.php, which is of course in this domain.  So let’s click it, shall we?

Well, pctrck.com is trying to load, but not much else.

Reversing then trying to exit workinghome22.com produces a pop-up of dubious functionality!  Check the words – there’s no cancel button!

workinghoome22_Popup

workinghoome22_Popup

I did however manage to successfully close this page following that.  Whew!

Now Back to onlineincnow.com

OnlineIncNow Location

OnlineIncNow Location

The previously mentioned http://onlineincnow.com/2/?aff_sub=72 is located in the USA.

So What Is It Up To?

OnlineIncNow.com Whois Record

OnlineIncNow.com Whois Record

Good Question!   A WHOIS puts the registrant in China with the DNS servers in Russia!

As I mentioned earlier, the similarity of the scamminess of this thing is just like the Google Treasure Chest/ Google Money Tree / PWW scams of old.

The site is plastered with the logos of well known businesses to ad an air of authenticity to things (just as the original hook sites used The Guardian Newspaper and CBS in the same way) yet at the bottom of the page they disingenuously ad:

This site and the products and services offered on this site are not associated, affiliated, endorsed, or sponsored by NBCNEWS, ABC, USA Today, CNN or Fox News, nor have they been reviewed tested or certified by NBCNEWS, ABC, USA Today, CNN or Fox News.

onlineincnow.com T&C Screenshot

onlineincnow.com T&C Screenshot

Despite all this, it is of course bollox set to deceive.  In fact, it now appears that it’s the well known negative option scam, used by Pacific Webworks (PWW) and Jesse Willms to good effect until they were found out.

Let’s see how this pans out, shall we?…..

Check out the T&C page from the tiny link in the page footer – screenshot on the right.

  • They say that the applicable law is the State of Florida.
  • You will become a “member” and the key phrases are here:

You must register as a “Member” with Online Income Now to access certain functions of the website. You must provide current, complete and accurate information about yourself (the “Registration Data”) when registering as a Member. You agree that such information is truthful and complete. You agree to maintain and keep your Registration Data current and to update your Registration Data as soon as it changes. You are responsible for maintaining the security of your password. Online Income Now is not liable for any loss that you suffer through the use of your password by others. You agree to notify Online Income Now immediately of any unauthorized use of your account or other breach of security known to you. You also, by becoming a Member, agree to report violations of these Terms and Conditions by others to Online Income Now.

For a limited time only, the cost of this product is $97.00 ( usual price $299.95 ) and every 32 days thereafter you will be billed the member’s only price of $9.95 for the monthly use.

MATERIALS PROVIDED TO Online Income Now OR POSTED AT ANY Online Income Now’s WEB SITE

Online Income Now does not claim ownership of the materials you provide to Online Income Now (including feedback and suggestions) or post, upload, input or submit to any Online Income Now Web Site or its associated services (collectively “Submissions”). However, by posting, uploading, inputting, providing or submitting your Submission you are granting Online Income Now, its affiliated companies and necessary sublicensees, permission to use your Submission in connection with the operation of their Internet businesses including, without limitation, the rights to: copy, distribute, transmit, publicly display, publicly perform, reproduce, edit, translate and reformat your Submission; and to publish your name in connection with your Submission.

You’ll see that “Online Income Now” will:

  • make you a “member” (of what?)
  • and you will be regularly billed, (why?)
  • and that for anything you post, upload etc (wah?  whadya mean?  Where is this uploading?),  “Online Income Now” will take no responsibility for what you do!

…………….which is curious as you don’t know what you’ll be doing and they have invited you to do it in the first place!!!

Now Lets Click The Link!  Follow that Opportunity!

onlineincnow.com screen capture 2012-12-12-17-46-50

2 Spots Left!

Amazingly (sarcasm alert) there are two “spots” left in my area!  This is the page… http://onlineincnow.com/2/index2.php

Michelle Johnson is the “guru” who will tell me everything!  So what do I do?  I have two options:

  • Back out
  • Sign up

Let’s Try Backing Out, Shall We?

CannotBackoutFromOnlineIncNow2

Cannot Backout From OnlineIncNow 2

CannotBackoutFromOnlineIncNow

Cannot Backout From OnlineIncNow

Well of course, they won’t let me.  It takes two goes to get out and the first one completely takes over the browser!  Bad.  This is B.A.D.

Ah, well.  Finally escaped.

Let’s Try Clicking to the Signup Page, Shall We?

secure.onlineincnow.com Data Entry Screen

secure.onlineincnow.com Data Entry Screen

I decide on my name, “Jobless Jake” and a random phone number…. The website is now https://secure.onlineincnow.com/2/cc_97.php

What I see is bad, really bad, and any attempt by this pack of jokers at saying they don’t run a negative option scam is now revealed on this sign-up page!

The scam is now revealed for what it is – a negative option scam!        Read it carefully…..  They expressly say;

By enrolling, you will be charged a one-time fee of $97.00

In teeny-tiny letters, note!

But remember, right back buried in the T&C’s they say;

every 32 days thereafter you will be billed the member’s only price of $9.95 for the monthly use.

This is expressly against the FTC code and laws in most countries.  If any extra charges are to be levied for any service or goods, they should be expressly stated on the sign-up page where the customer first enters their financial details.

Gotcha! You Bastards!

Okay, I’ve Had Enough of This. I’m Off!

“Not so fast, young Jobless Jake”, say onlineincnow.com……!

CannotBackoutFromOnlineIncNow3

Cannot Backout From OnlineIncNow 3

They’ve an extra 20% off plus and extra bit of webpage-erese!  The screenshot says it all, though it wasn’t the end of it.  I had one more “Leave Page” option like the earlier one above.

Conclusion

Negative Options are banned by law in most countries.  If you get collared by one, you’ll have a job stopping the bastards taking money from your account for ages.  The only sure way to stop this once you’ve been sucked in is through….

  • Chargebacks.   Get your bank or card company to get a charge-back saying the terms of trade or purchase were hidden (as seen in my screenshot above).

So………………….

  • It’s a scam.
  • Stay away from it.


Enhanced by Zemanta

Related Posts:

My First BRITISH Google Business Kit

In this post Dangerous EffectiveCleanse – and Scams Too! two weeks ago, I mentioned how a scumbag webhost called byet.org is redirecting a client’s Amazon Shop clicks to that other pustule of conmanship called MyBookFace.net

Checks

MyBookFace Homepage Screendump

MyBookFace Homepage Screendump

Well I’ve just checked and it’s still on. (Someone wants to get that fixed!)  At the bottom of the MyBookFace landing page was an yet another advert for home working.  It’s the red one at the bottom and unusually, it’s BRITISH!

“Aye up!”, I thought.  “What’s going on here?”

Make Money Using Google!

What is going on is exactly the same rubbish that we’ve seen countless times from the rich jokers at Pacific Webworks (PWW).

Internet Success - Emily Rosher

Internet Success - Emily Rosher

This time, you’ll find the nice young family of “Emily Rosher”.  The website is at,

http://www.bizsuccessblogs.com/emilyrosher/blog/  (this company is hidden by a domain privacy outfit in Toronto)

As we know from our Google Treasure Chest, Google Money Kit, Google Revolution and other experiences, this isn’t real.  Check out the screendump.  See the smiling honest faces.  See the cheque with the same fingers as last year.  See the false comments and how they’ve stopped due to “spam” and “distasteful contents”…

Helpfully, if you check out at the very bottom of the screendump they tell it’s all false. (You’ll have to click the little green arrow to expand the picture size once it’s loaded to be able to see this)

But the $1.97 shipping fee is now a £1.23 fee.  Nowhere on “Emily’s” blog does it mention any monthly charges, but, y’know, you can still do all the bollocks of trying to cancel and still watch as requests for refunds are handled with disdain even though you think you’re within the time limit.

Q. How do I know this?

A. Because that’s what they do and that’s what they’ve always done.  A leopard can’t change it’s spots.  We have almost countless complaints against these charlatans.

Emily’s Saviour?

“Emily” bases all her success on one product.  It’s got a new name, and looks slightly different to Google Treasure Chest.  It’s called;

Home Business Kit Using Google

You’ll find it here if you follow “Emily’s” link,

https://secure1.s3curehost.com/gophuk/?offer=go_pw_cmv8&cm=514785&id1=894177674&id2=[OPTINFO]&session-id=06281e5f7f823c0036c28274637e9abc#

It just trips off the tongue for a catchy web address, doesn’t it?

A leopard, waiting to pounce on the Unwary?

A leopard, waiting to pounce on the Unwary?

A simple WHOIS on s3curehost.com shows it all run by Intellipay a.k.a Pacific Webworks in Salt Lake City, Utah  (see my other postings for their details).

Page Details

Make Money Using Google!

Make Money Using Google!

But check out the layout!  Handily it’s got a nice Union Flag in case you’re confused.  It also says

Emily's T&Cs

Emily's T&Cs

“As seen on BBC, Economist, Guardian” – but then says at the bottom that it has nothing to do with Google?  Curious…

Let’s go back to Emily’s website.  Check out her Terms & Conditions.  She says,  “This website is not associated with ABC, CBS, CNN, MSNBC, or USA Today.” Er…where did they come from?

Source of “As Seen On…” Statements

Now despite the Google Kit being bollocks, there’s an interesting link in Emily’s T&C page (check the screen-dump).  In a nutshell, this claims that ALL the references ever made about “Stores Seen on ABC, AOL, Global, CNN and CNBC” emanate from this single New York Times post from 2006!

It’s called, Google’s Shadow Payroll Is Not Such a Secret Anymore.  It’s a reasonable enough piece, but one thing it’s distinctly lacking in, is the phrase “Stores Seen on ABC, AOL, Global, CNN and CNBC” or anything remotely similar to it or the various companies listed!

WTF!

Conclusion – or should that be Con, Clue? Shun!

One thing lacking from the “British” google thing is any mention of County Durham – in Britain!  The Philippines & Cyprus, Gibraltar & Nevis are also lacking.  Previously, in the Google Treasure Chest scam, these places popped up all the time.  Myself, @Not Kevin and others have spent many an hour chasing these things down.

PWW is certainly responding to the hits it’s getting both legal from the courts and verbal from all the various websites devoted to pulling apart their shady dealings.

The T&Cs make this clear in the “British” Google thing.  Specific mention is made that forces the “customer” not to start any chargeback proceedings no matter what the cause…. (..er  What about UK distance-selling regulations? Isn’t this a “British” site?  Ha Ha.  Don’t you believe it.)

This PROVES that chargebacks work and is the thing that PWW are most afraid of.  Here’s two bits from the T&Cs that prove this:

1.2 You unconditionally and expressly agree and accept the Conditions set forth herein  as a binding contract (“the Agreement”) enforceable by law.

AND

4.1 You agree that any disputed fee will not be charged back to Your credit card issuer. You expressly agree to submit in writing any objection regarding fees to 230 West 400 South, Suite 100 SLC UT, 84101
4.2 PCO, in its sole discretion, shall determine the validity of Your objection and notify You of its decision. Should You disagree with PCO decision, You agree to mediate the dispute before litigation.
4.3 You agree to indemnify PCO or associated product owners or resellers for any financial harm or any losses caused by Your objections to fees that do not comply with this Agreement. You will be held responsible for the reimbursement of any fees and losses incurred as a result of Your failure to comply with any provision in this Agreement.

Q.E.D.

They’re just putting the frighteners on.   PCO, by the way, stands for http://www.profitcenteronline.com, Profit Center Online.  It’s really PWW and is in Utah at the same PWW address.

Related Posts:

Why Does No-one Lie Anymore?

Sorry. What I meant to say is:

“Why, if ordinary people lie and are punished for it, do public people lie and apparently get away with it, so much so that people think it normal behaviour?”

Or, in other words:

Why do the media not use the word “LIE” , anymore?

Two recent lying events have come to light and show two mealy mouthed lying bitches for what they are! And yet the “meeja” continue to push the lines out that are fed to them by the “public personalities”. Why don’t they just call a LIE what it is? It’s a perfectly good word that everyone knows what it means. It’s short and sweet, so obviously as a linguistic construct it’s a VERY important word – i.e. It’s usual for immediately important words like shit, fuck, man, die, arm, leg, bus, car, airplane, telly, king etc to be very short simply because people can’t afford to waste time on big words. Similarly, unimportant words and phrases like presidential candidate are too long and soon get forgotten.

Anyway, I digress. The two lying bitches, or if that’s a bit too strong – economical with the truth bitches, are Hilary Clinton and the old Geordie bint Heather Mills, a Lindisfarne Gospels’ worth of embellishment of mutton dressed as lamb.

https://youtu.be/8BfNqhV5hg4

Today, it’s come out that Herren Clinton said she went to Bosnia and got off the airplane under fire, ducking and dodging bullets. This CBS news article on YouTube does a very fine comparison between her words and the reality. We all know the camera can lie but the video evidence is very conclusive and hard to forge!

The result;

  • her spokesperson Howard Wolfson said she “misspoke”!
  • She herself called it a “minor blip”!
  • The BBC couldn’t take the weight of authority upon themselves to call it a lie.

I call it a lie and she is lying. It’s as plain as plain can be.

Previous to this, the geordie bint Mills, the character impersonator with the indeterminate and conflicting life history, said, after she’d won the dosh off the weirdly crinkled old Beatle and when she came out of court, that she wanted the settlement kept private because it had details about the child that could be dangerous for her.

Bizarrely, when the pdf came out about the settlement, there was no mention at all of anything like this. All there was the judge’s statement that she was a fucking nutter who had not an ounce of truth and honesty in her – but carped up in very nice prose. WE all know what he meant, but why couldn’t he just say that she was a liar?

So out of all of this, only CBS actually said anyone was lying. What’s everyone so scared of? Who IS the emperor and what clothes are they wearing?

STOP PRESS: This post in India has a lying claim about the pre-fabricating Mills and this 2006 post from “The Independant” is so strangely prescient about the whole affair that Paul Vallely might have a time machine.

Related Posts:

Comments are closed

© 2007-2017 Strangely Perfect All Rights Reserved -- Copyright notice by me