Get Rich Quick Scam Forges Genuine News Agencies Web Pages
Gmail Spam
I recently received two emails from a friend’s old Hotmail account, but to two of my email addresses.
Email Spam
Probably, the account has been hacked as I could detect no spoofing in the emails’ headers. These are the emails, with the email addresses blacked out.
Initial Email Investigations
The text is similar in that they try to entice a user using pretty poor English to click on the shortened URL links, which are active.
Here’s how the links work:
To my Email address;
cbsbusiness9
I had http://goo.gl/yKvD3 which then goes to
http://cbsbusiness9.com/uk.html?/partners/the-guardian/small-business/5672-9782-67834/making-money-online/
To my GMail address;
cbsnews-article
I had http://goo.gl/UK5jj which then goes to
http://cbsnews-article.com/uk.html?/partners/the-guardian/small-business/5672-9782-67834/making-money-online/
The screenshots show the results using a neat Firefox plugin, Flagfox, which displays the source IP address and country on mouse-over.
The WHOIS’s of each domain are almost identical. These are screenshots.
That Arthor Brown’s a one, eh? Notice the Ukrainian, Russian and New York connections? Who is/are or what is:
TNew line ave 172 95
NY, 18274
UNITED STATES
+1.7343541732
Google Search on +1.7343541732
Googling the phone number pulls out a heap of (not)surprises including an awful cesspit of scamminess that’s now starting to rival Pacific Webworks’ Google Treasure Chest and Jesse Willms’ Colon cleansing efforts! (We saw these scams a few years back – check the links)
Just check out the fake news and dodgy sounding sites in the search results…. These are the first couple of pages of current search results:
- Com-news8.net
- Bcnews8.com
- Dildobigg.com
- Raspberry-Ketone24.com
- BigGgEts.com
- HurtGuys.com
- GrowsPeniss.com
- HugerAss.com
- Com-news9.net
- Com-nbcnews9.net
- coloncleanse-extreme.com
- nbc9news.com
- nbc1news.com
Arthor Brown is in most of them with his Yahoo! email address as [email protected] Please don’t confuse him with this Arthur Brown, but yes, handle all of these websites like Fire!
Forged Webpages of The Guardian Newspaper
cbsnews-article.com screen capture 2012-12-12-16-3-51
cbsbusiness9.com screen capture 2012-12-12-16-3-23
The Guardian, is an old and respected news organisation in the UK. CBS is a long-established US media network.
They, and the purported author of both webpages, Sirena Bergman, must be pretty pissed off about the hijacking of their names.
Also to be annoyed, is Lloyds TSB Bank who apparently are “in association” with this get rich quick scheme for work at home moms!
Completely Forged News Articles!
Indeed they are.
- The articles are dated “December, 11:41″, which is odd since there’s no day, just month and time!
- Both articles are embedded in genuine Guardian web-pages, with all the links surrounding the article going to genuine Guardian web-pages or genuine advertiser websites!
- The hook links in both forged webpages go to http://workinghome22.com/go.php
The forgery is done in the same manner as the well-known phishing scams done for banks and on-line finance and insurance.
Apart from the images sourced from The Guardian, the scammer’s images are sourced from:
- ddmcdn.com which is HowStuffWorks.com!
- localconsumeralerts.com
- prosperadtracker.com
- ophan.co.uk
So, Who Is workinghome22.com
Bad Gateway
The first link was dead, opening a bad gateway so the expected redirect didn’t work. The tracking pointed back to Ireland!
Bad Gateway
The second link worked, but the sweetly named workingfromhome22.com wasn’t the destination. No, the link immediate re-directed to http://onlineincnow.com/2/?aff_sub=72
Well, at least the affiliate number 72 is getting paid….
But hang on, who exactly is workingfromhome22.com?
workinghome22.com screen capture 2012-12-12-16-31-44
Well, typing the URL directly takes me to workingfromhome22.com! This is it!
Cunningly, you’ll note that it’s pulled out my home-town as Bournemouth (where I live) with that awful “mom” Americanism! No-one in the UK addresses their mother as mom… I mean, FFS?
The webpage links, containing the disreputably used graphics of Thomson, Reuters, CNBC and NBC Universal all point to http://workinghome22.com/go.php, which is of course in this domain. So let’s click it, shall we?
Well, pctrck.com is trying to load, but not much else.
Reversing then trying to exit workinghome22.com produces a pop-up of dubious functionality! Check the words – there’s no cancel button!
workinghoome22_Popup
I did however manage to successfully close this page following that. Whew!
Now Back to onlineincnow.com
OnlineIncNow Location
The previously mentioned http://onlineincnow.com/2/?aff_sub=72 is located in the USA.
So What Is It Up To?
OnlineIncNow.com Whois Record
Good Question! A WHOIS puts the registrant in China with the DNS servers in Russia!
As I mentioned earlier, the similarity of the scamminess of this thing is just like the Google Treasure Chest/ Google Money Tree / PWW scams of old.
The site is plastered with the logos of well known businesses to ad an air of authenticity to things (just as the original hook sites used The Guardian Newspaper and CBS in the same way) yet at the bottom of the page they disingenuously ad:
This site and the products and services offered on this site are not associated, affiliated, endorsed, or sponsored by NBCNEWS, ABC, USA Today, CNN or Fox News, nor have they been reviewed tested or certified by NBCNEWS, ABC, USA Today, CNN or Fox News.
onlineincnow.com T&C Screenshot
Despite all this, it is of course bollox set to deceive. In fact, it now appears that it’s the well known negative option scam, used by Pacific Webworks (PWW) and Jesse Willms to good effect until they were found out.
Let’s see how this pans out, shall we?…..
Check out the T&C page from the tiny link in the page footer – screenshot on the right.
- They say that the applicable law is the State of Florida.
- You will become a “member” and the key phrases are here:
You must register as a “Member” with Online Income Now to access certain functions of the website. You must provide current, complete and accurate information about yourself (the “Registration Data”) when registering as a Member. You agree that such information is truthful and complete. You agree to maintain and keep your Registration Data current and to update your Registration Data as soon as it changes. You are responsible for maintaining the security of your password. Online Income Now is not liable for any loss that you suffer through the use of your password by others. You agree to notify Online Income Now immediately of any unauthorized use of your account or other breach of security known to you. You also, by becoming a Member, agree to report violations of these Terms and Conditions by others to Online Income Now.
For a limited time only, the cost of this product is $97.00 ( usual price $299.95 ) and every 32 days thereafter you will be billed the member’s only price of $9.95 for the monthly use.
MATERIALS PROVIDED TO Online Income Now OR POSTED AT ANY Online Income Now’s WEB SITE
Online Income Now does not claim ownership of the materials you provide to Online Income Now (including feedback and suggestions) or post, upload, input or submit to any Online Income Now Web Site or its associated services (collectively “Submissions”). However, by posting, uploading, inputting, providing or submitting your Submission you are granting Online Income Now, its affiliated companies and necessary sublicensees, permission to use your Submission in connection with the operation of their Internet businesses including, without limitation, the rights to: copy, distribute, transmit, publicly display, publicly perform, reproduce, edit, translate and reformat your Submission; and to publish your name in connection with your Submission.
You’ll see that “Online Income Now” will:
- make you a “member” (of what?)
- and you will be regularly billed, (why?)
- and that for anything you post, upload etc (wah? whadya mean? Where is this uploading?), “Online Income Now” will take no responsibility for what you do!
…………….which is curious as you don’t know what you’ll be doing and they have invited you to do it in the first place!!!
Now Lets Click The Link! Follow that Opportunity!
2 Spots Left!
Amazingly (sarcasm alert) there are two “spots” left in my area! This is the page… http://onlineincnow.com/2/index2.php
Michelle Johnson is the “guru” who will tell me everything! So what do I do? I have two options:
- Back out
- Sign up
Let’s Try Backing Out, Shall We?
Cannot Backout From OnlineIncNow 2
Cannot Backout From OnlineIncNow
Well of course, they won’t let me. It takes two goes to get out and the first one completely takes over the browser! Bad. This is B.A.D.
Ah, well. Finally escaped.
Let’s Try Clicking to the Signup Page, Shall We?
secure.onlineincnow.com Data Entry Screen
I decide on my name, “Jobless Jake” and a random phone number…. The website is now https://secure.onlineincnow.com/2/cc_97.php
What I see is bad, really bad, and any attempt by this pack of jokers at saying they don’t run a negative option scam is now revealed on this sign-up page!
The scam is now revealed for what it is – a negative option scam! Read it carefully….. They expressly say;
By enrolling, you will be charged a one-time fee of $97.00
In teeny-tiny letters, note!
But remember, right back buried in the T&C’s they say;
every 32 days thereafter you will be billed the member’s only price of $9.95 for the monthly use.
This is expressly against the FTC code and laws in most countries. If any extra charges are to be levied for any service or goods, they should be expressly stated on the sign-up page where the customer first enters their financial details.
Gotcha! You Bastards!
Okay, I’ve Had Enough of This. I’m Off!
“Not so fast, young Jobless Jake”, say onlineincnow.com……!
Cannot Backout From OnlineIncNow 3
They’ve an extra 20% off plus and extra bit of webpage-erese! The screenshot says it all, though it wasn’t the end of it. I had one more “Leave Page” option like the earlier one above.
Conclusion
Negative Options are banned by law in most countries. If you get collared by one, you’ll have a job stopping the bastards taking money from your account for ages. The only sure way to stop this once you’ve been sucked in is through….
- Chargebacks. Get your bank or card company to get a charge-back saying the terms of trade or purchase were hidden (as seen in my screenshot above).
So………………….
- It’s a scam.
- Stay away from it.
Related articles
How WordPress Spam Works
Posted in Internet Tags:Alternative , BLOCK , Comment Spam , Contact , Court , data , dodgy , Email , engine , filter , Florida , God , good , Human , IP address , Jeff , Last Updated , LAW , Lawyer , Mad , money , name , NOTE , Pacific , Pacific Webworks , Pakistan , Plugin , PLUGINS , POST , PROVE , PWW , Registrant , SEO , smokescreen , social networking , Spam , United States , URL , USA , weasel , WebWorks , whois , WordPress , YEARS
WordPress Comment Spam
Q. Why Do They Do It?
A. As a minimum, they do it to open a back-door into your blog that allows the perpetrator to place reverse linkages to another website to increase that website’s visibility in search engine results (so called “Search Engine Optimisation” – SEO ). This back-linkage they use to increase website search hits, which they can charge an ignorant website beginner big money for.
At the worst, the culprit would gain full access to the blog allowing free posting and deletions or even the complete removal of your website content.
Today’s Example
Today, I got a comment that made me check further as notionally, it looked okay-ish. These are the details (click image for full-size view of the comment as it appears in the WordPress admin section):
Comment Spam Example
The Jacksonville lawyer is in Florida and has this website; http://www.divorceyes.com/index.html, and the actual comment is pretty kosher, although brief, saying;
This is all very nice, but check out the IP address….
WHOIS 113.203.135.140
By checking the WHOIS for this, we see that the IP Address for this supposedly reputable Florida lawyer (Divorce Yes) is in Karachi, Pakistan! Well are they? My guess, given the cheap web costs in the USA, is that Divorce Yes is in the US and that they wouldn’t for an instant even consider anywhere else!
And so it is! The actual WHOIS for Divorce Yes is in Florida! (The actual WHOIS for the web-hosting, fortehosting.com is in Illinois). The registrant’s name (Miller) also agrees with the Divorce Yes’s contact details here, but note; the email address in the comment, [email protected], is not the same as the email address on the contact page, which is [email protected]
Conclusion
There isn’t a conclusion really. This is just an example of the way that text harvesting is being used to make seemingly intelligent comments slip past the comment filters on a WordPress blog.
As many of these filters rely on an IP address, if the webmaster lets a dodgy IP address through just once then it’ll be marked as “good” by the filters which will then allow the spammer to post even more comments, all for the various nefarious reasons that I mentioned first.
This is why I use a plugin like WP-SpamFree, and using it I can block all incoming pings from a given IP address, in this case, 113.203.135.140!
For interest, I’ve edited out the back-link from the spam comment above and you can find it on this post, Pacific Webworks, Lawyers and Social Networking, here.
Alternative Conclusion
This isn’t a conclusion again, but my examination of alternative possibilities, but note the following:
It could be, although I cannot prove or disprove it, but because some of this spam I receive is now pretty readable as with this one above, that plugins are being used for much of the hits I get. This comment could be such an example, or the law website name is being used textually as a smokescreen for the Pakistani spammer. I see lots of adverts along these lines that couldn’t possibly rely on manual human link placements for their effectiveness….
I’d be interested to hear from Miller Law or their website designer on this one. It’s not the first time that I’ve had reputable businesses appear on my website like this and I’d like to know what it appears like at their end, if at all. It does make me wonder if this very website is being used to cloak spam at other websites in the same manner.
This is why I’ve left all URL back-links to the parties in place so that they’ll see them in their logs.
Related posts:
Weird Comment Spam I don’t know if it’s linked, or not, but since the WP upgrade a few days ago I’ve had an extra type of comment spam fall into my spam filters. Thankfully the spam filters worked, but still filled up the “spam comment” area for further perusal. Maybe it’s a plugin? Whatever. Dodgy...
Introduction I knew there was something really, really dodgy about that MyBookFace.net crap highlighted in this post the other day. Not only are they connected to some serious malware (as detailed in the posting), but they’ve an interesting line in popups!!! Google Treasure Chest Rises Yet Again! Here’s what to do… Go to http://mybookface.net making...