Hijack Alert: Email Confirmation for [name]

These hijack alerts are starting to become as mainstream as the job scams, and I'll probably give up on reporting them in detail soon. In fact, I don't intend to report this one in detail. It's just another email designed to make the recipient go "OMG!! WTF??" and click on the link. At the other end of the link (after your browser silently navigates through a twisty little maze of HTTP redirects and other obfuscation) is the infamous Web Attacker software, which attempts to compromise your computer through various known browser bugs.

The best way to be safe from this attack at the moment is still, "don't use Microsoft Windows -- at least, not for anything Internet related." Seriously, that's the best advice I can offer, unhelpful as it is. Second best is, "use a browser other than Internet Explorer, and don't ever ever click on links in spam, no matter what." The text of today's angst-inducing lie follows for the benefit of those wise enough to search: square brackets indicate redacted text; visit the URLs at your own peril. Note that in this particular case I received a bounce message, meaning that the spammer in question sent this spam using one of my addresses as the "from" address. There's not a lot you can do to prevent this, so why worry about it?

Date: Tue, 12 Sep 2006 16:59:08 +0200
Subject: Email Confirmation for [name]
Dear [name].

   Thank you for your subscription to http://prismhouse.com/scken4182.html

   You have been billed as KRBILL LLC for the amount of:
   3.95(USD) for 3 days (trial) then 34.95(USD) recurring every 30 days .

   Your new subscription identification number is:573716,

       Your membership access information is:
       Username for your subscription: Skilores
       Password for your subscription: FGyju75u
       E-mail: [name]@[domain]

  Membership website: http://prismhouse.com/scken4182.html

Thank you for choosing KRBill as the eMerchant for your subscription!
Customer Support/Cancel Your Subscription 12/09/2006 16:59

Info: A New Twist on the Lottery Scam?

Lottery scams have been around for quite a while, and are so common that I have a blog dedicated to them. The most suspicious thing about lottery scams is that you win a lottery you never entered. The sender usually spins some bull story about how it's your email address that's won, and the sponsor is some benevolent set of corporations that want to promote Internet use. If you believe that sort of thing, you're just plain credulous, I'm sorry to say.

A new variation on the scam which sounds a little more credible has just come to my attention. Rather than tell you you've won a lottery you never entered, they give you a free opportunity to enter a sweepstakes. If you're as cynical as I am, you can guess what happens next: you win the lottery, and it's the same old scam all over again. This is pretty smart from the scammer's perspective. Not only is the whole cover story more credible, but the people who reply and enter the lottery have immediately identified themselves as easy marks.

I won't post a sample in full, since there is too much tracking data in the URLs. Thanks goes to JR for submitting it.

From: "Eligibility Notification " <s.baker@afternooncake.com>
Date: 31 Aug 2006 15:51:43 -0400
Subject: , You Have Been Selected to Win a Million Dollars

WIN A MILLION DOLLARS!
AUDREY SOLARA SWEEPSTAKES DIRECTOR

To Whom It May Concern,

You're one of the authorized individuals who has a chance to WIN $1,000,000!

You've been selected as a candidate to receive this e-mail announcement.
Not everyone has been sent this private message.
To enter our WinAMillion Sweepstakes simply visit the link below.
[etc]

News: Stock spammers charged

The US Securities and Exchange Commission has charged a "recidivist securities law violator" and his wife with "orchestrating a fraud scheme to inflate the price of WebSky, Inc., a San Francisco-based penny stock company, using spam email." According to the press release, "the couple pocketed more than $1 million in proceeds as a result of the scam." It should come as no shock to discover that they haven't been entirely honest about things, both in the spam they used to promote the stock, and in their dealings generally. Thanks to The Register for bringing this to my attention. It's always nice to hear of a scammer facing justice.

Meta: Blog Upgrade

A quick apology to anyone who was using the Atom feed of this site and just received a bunch of old posts as though they were new. This is a result of my cutting over the blog to an upgraded version that Google are now offering. Hopefully there won't be any other undesirable side-effects.

Phone Scam: Your 1 True Love

This is a bit different for me, but this kind of practice peeves me no end. There is a site called "Your 1 True Love" which is apparently targeting Britons and Australians through a Google AdWords campaign. "Predict your one true love," says the ad. "Find your ideal soul mate predicted right down to the name." Obvious baloney, but a harmless bit of fun, right? Wrong: it's a nasty little trap for the unwary.

The page to which the ad links has a form for your name, your mobile phone number, and your date of birth. The button is a pretty graphic that says "YES, I wish to receive my soulmates name" with "and agree to the terms and conditions" in small print underneath. Mobile number? Terms and conditions? I can see where this is going: it's a premium rate SMS scam.

Digging a little deeper into the HTML source for the page, I see there's Javascript code to ensure that the mobile number entered follows the form of either a UK mobile number or an Australian mobile number. I also find a mention of the terms and conditions, but its hidden inside an HTML comment, so you can't see it at all unless you look at the source. The deactivated link goes to a poorly-formatted page which has the following text.

Terms and Conditions Of Service

Your 1 True Love is a subscription based mobile phone service, you must be at least 16 years of age or older and have the bill payers permission.

You will receive a prediction of your true love followed by love predictions. Cost is $5 per message with up to 15 predictions/messages sent to your phone per month.

You can stop subscription at any time by sending stop to 19999003. For full terms and conditions click here.

Note that the "click here" text in the above quote is not a link. I can't tell at this stage what that "19999003" number is about: numbers of that form (starting with "1") in the UK are "Access/Short code" numbers, and the same applies in Australia to the best of my knowledge. In the UK, however, the range starting with "199" is not yet allocated. I have no idea what the state of affairs is in Australia. The number could be completely bogus, I suppose.

Anyhow, this is fairly typical for a premium SMS scam: trick people into "signing up" for an indefinite supply of useless, expensive messages, then suck their phone account dry with it.

I'm not usually one to advocate vigilantism, but in this particular case I think turnabout is fair play: if you find a Google Ad for this particular crowd, be sure to click on it early and often, since they pay per click. Their assumption is that they can make the scam pay, so long as they get enough suckers to "sign up" by submitting their phone number on that form. Go ahead and give them a taste of their own.

The domain name in question is "your1truelove.com", and the registration for that domain is through "Domains by Proxy, Inc." -- for obvious reasons.