Gmail Scammers Still On The Make

Email spammers/scammers are masters of the well worn “carrot or stick” school of motivation. They seem to bounce from “this is what you’ll get” versus, “this is what you’ll lose” – with some regularity.

Some samples of each motivational technique taken from my spam honeypot Gmail account in the last few days.

The carrot:

Hi
It`s Kerri again. Will you ever contact me?
I made those nude pictures especially for you and I won’t write to you again!
If you wanna see them just drop me a line at – – – – – – –

and the following heavily edited example.

Robert S.Mueller
FBI Director

Check: To be deposited in your bank for it to be cleared within three working days. Your payment would be sent to you via any of your preferred option and would be mailed to you via UPS. Because we have signed a contract with UPS which should expire by August 20th you will only need to pay $150 instead of $420 saving you $270 So if you pay before August 20th, 2011 you save $270.

Oh yeah, don’t forget to send us your name/address; sex/age; cell number; and –  a scanned copy of your driver’s license.

Yes, I’ll get right on that  

Both of the above are just too preposterous to be taken seriously. Although, as difficult as it is to believe, there are those who are laughably loony enough to  respond.

The stick is a little different, and a good example of this is the various forms of the “Your Gmail account needs verification to avoid being shut down ” phishing attack.

Unaware webmail users are much more likely to respond to the threat of losing their email privileges than you might imagine. If the notice looks convincing enough (and, they often do), some Gmail users are bound to be taken in.

The stick:

If you expand this graphic to its original size, you’ll notice the sender is googleemail.com – close, but no cigar. As well, if you’re a WOT (Web of Trust) user, you’ll see that WOT has cleared the “Sign in” link as being safe.

A rather confusing mixed message. Googlee is not Google, but WOT marks the link as safe.

Unfortunately, this “green light” is a shortcoming in WOT’s reputation assessment since the rating reflects the reputation of the the principal domain, and not a subdomain – which, in this case, the link resolves to.

Sadly, average users are generally unaware that Gmail provides a simple tool to view message headers which contain tracking information for an individual email.

In this case, checking the headers (as shown in the following screen capture) reveals this email actually came from prajim.siaminterhost.com – obviously, not Google.

Of course, I didn’t response to this password phishing attempt and click on the enclosed link. But, those users who fall for this type of crafty scam, are often redirected to a forged version of Gmail’s login page where they can happily provided the requested information.

Advice worth repeating:

If you have any doubts about the legitimacy of any email message, or its attachment, delete it.

Better yet, take a look at the email’s headers. Check the initial “Received from” field in the header, since this field is difficult to forge. Additionally, the mail headers indicate the mail servers involved in transmitting the email – by name and by IP address.

It may take a little practice to realize the benefits in adding this precaution to your SOP, but it’s worth the extra effort if you have any concerns.

If you have a webmail account other than Gmail, check out this page for instructions on finding headers for your specific provider.

Google provides excellent advice on their page – Messages asking for personal information, from which the following has been taken.

Here’s what you can do to protect yourself and stop fraudsters:

Check the email address of the sender of the message by hovering your mouse cursor over the sender name and verifying that it matches the sender name.

Check whether the email was authenticated by the sending domain. Click on the ‘show details’ link in the right hand corner of the email, and make sure the domain you see next to the ‘mailed-by’ or ‘signed-by’ lines matches the sender’s email address.

Make sure the URL domain on the given page is correct, and click on any images and links to verify that you are directed to proper pages within the site. Although some links may appear to contain ‘gmail.com,’ you may be redirected to another site after entering such addresses into your browser.

Always look for the closed lock icon in the status bar at the bottom of your browser window whenever you enter any private information, including your password.

Check the message headers. The ‘From:’ field is easily manipulated to show a false sender name. Learn how to view headers.

If you’re still uncertain, contact the organization from which the message appears to be sent. Don’t use the reply address in the message, since it can be forged. Instead, visit the official website of the company in question, and find a different contact address.

If you enter your Google account or personal information as the result of a spoof or phishing message, take action quickly. Send a copy of the message header and the entire text of the message to the Federal Trade Commission at spam@uce.gov. If you entered credit card or bank account numbers, contact your financial institution. If you think you may be the victim of identity theft, contact your local police.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Government of Nigeria “tortures” 419 Scammers – If Only!

I’m not advocating the torture of cyber criminals and spam scam artists, although ….

This morning, when I received an email (ostensibly), from The Federal Government of Nigeria (The Advance Fee Fraud section), in which it was made clear that – “some scam Syndicates were apprehended in Lagos, Nigeria few days ago and after several interrogations and tortures, (my) details were among those mentioned by some of the scam Syndicates as one of the victims of their operations” , it momentarily entered my mind that torture might be an appropriate penalty. Especially for those involved in this latest “wolf in sheep’s clothing” scam.

I’ve covered the wolf in sheep’s clothing scam here a number of times, including

1051 Site Dr. Brea, CA – Not An Address You Want To Go To!

A Helpful Spam Scammer – A Wolf in Sheep’s Clothing

This particular spam scam is highly instructive, and it illustrates the lengths to which these crooks will go to entrap the unwary and gullible. Unfortunately, the description “unwary and gullible”, is easily applied to substantial numbers of Internet users.

As an experienced and cautious Internet user, it’s safe to say that you will not be deceived by this type of clumsy attempt to defraud but, you might be surprised how often reasonably intelligent people are. So, be kind to your friends, relatives, and associates, particularly those who are new Internet users, and let them know that there is an epidemic of this types of scam on the Internet. In doing so, you help raise the level of protection for all of us.

For reference, I’ve included the full text of this “torturous” email, which contains the usual spelling, grammar, punctuation, and layout errors.

EFCC FRAUD UNIT

Attention,
The Federal Government of Nigeria through provisions in Section 419 of the
Criminal Code came up with punitive measures to deter and punish
offenders.The Advance Fee Fraud section deal mainly with cases of advance
fee fraud(commonly called 419) such as obtaining by false pretence through
different fraudulent schemes e.g. contract scam, credit card scam,
inheritance scam, job scam, loan scam, lottery scam, “wash wash” scam (money
washing scam), marriage scam. Immigration scam, counterfeiting and religious
scam. It also investigates cyber crime cases.
This is to officially announce to you that some scam Syndicates were
apprehended in Lagos, Nigeria few days ago and after several interrogations
and tortures your details were among those mentioned by some of the scam
Syndicates as one of the victims of their operations.
After proper investigations and research at Western Union Money Transfer and
Money Gram office to know if you have truly sent money to the scam
Syndicates through Western Union Money Transfer or Money Gram, your name was
found in Western Union Money Transfer database amongst those that have sent
money through Western Union Money Transfer to Nigeria and this proves that
you have truly been swindled by those unscrupulous persons by sending money
to them in the course of getting one fund or the other that is not real,
right now we are working hand in hand with Western Union and Interpol to
track every fraudsters down, do not respond to their e-mails, letters and
phone calls any longer they are scammers and you should be very careful to
avoid being a victim to fraudsters any longer because they have nothing to
offer you but to rip-off what you have worked hard to earn.
In this regard a meeting was held between the Board of Directors of The
Economic and Financial Crimes Commission (EFCC) and as a consequence of our
investigations it was agreed that the sum of Two hundred thousand US Dollars
(US$200,000) should be transferred to you out of the funds that Federal
Government of Nigeria has set aside as a compensation to everyone who have
by one way or the other sent money to fraudsters in Nigeria.
We have deposited your fund at Western Union Money Transfer agent location
EMS Post office Lagos, Nigeria. We have submitted your details to them so
that your fund can be transferred to you.
Contact the Western Union agent office through the email address stated
below inform them about this notification letter and the transfer of your
fund;
Email:wu_payingdept@qatar.io
Yours sincerely,
Sarah White (Miss)
Assistant Investigation Officer.
The Economic and Financial Crimes Commission (EFCC)
15A Awolowo Road, Ikoyi, Lagos.
Nigeria
http://www.efccnigeria.org
******************************************************************

Please note that some fraudsters are claiming to be Directors or staff of
The Ecomomic and Financial Crimes Commission have recently been sending
phony e-mails/letters and also calling unsuspecting persons, with intent to
defraud them. It is important to note that these fraudsters are criminals
engaged in Advanced Fee Fraud known in Nigeria as 419. Every day, people
throughout the world are falling victim to scams of one kind or another. But
remember – if it sounds too good to be true, it is probably a scam. In the
circumstance, we unreservedly advice you to dissociate yourselve from all
correspondence and transactions entered into based on evidently fraudulent
and fictitious claims.
********************************************************************

“This e-Mail may contain proprietary and confidential information and is sent for the
intended recipient(s) only. If, by an addressing or transmission error, this mail has been
misdirected to you, you are requested to delete this mail immediately. You are also
hereby notified that any use, any form of reproduction, dissemination, copying,
disclosure, modification, distribution and/or publication of this e-mail message, contents
or its attachment(s), other than by its intended recipient(s), is strictly prohibited. Any
opinions expressed in this email are those of the individual and not necessarily of the
organization. Before opening attachment(s), please scan for viruses.”
All business handled under Standard Trading Conditions. Copy available on request.
********************************************************************

Just to be clear, as a strong supporter of Amnesty International, any references I made to torture were for effect, only.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

1051 Site Dr. Brea, CA – Not An Address You Want To Go To!

Back in July 2009, I wrote an article “A Helpful Spam Scammer – A Wolf in Sheep’s Clothing”, which discussed how scammers rely on an apparent “truth” to convince unwary, or unsophisticated surfers, to buy into a scam designed to entrap victims of previous scams.

You would think the principal of “once burned – twice shy” might have impact; but apparently not. The World, it seems, is full of people who are ready to be shorn, not once – but, twice or more.

I have a hard time getting my head around the idea, that people can act so irrationally, they can be convinced to part with their money a second time, in what amounts to a slightly off kilter version of the same scam.

Scammers are not fools, by any stretch of the imagination, and they pursue time proven cyber-crime methods. And so, the following scam email, plucked from one of my inboxes this morning, is representative of the “we’re gonna screw you twice” emails, currently flooding the Internet. Just like most of these type of emails, this one contains the usual spelling, grammatical, and punctuation errors.

Dear Friend,

I am Mrs. Alice Hall. I am a US citizen and i am 48 years Old. I reside
here in 1051 Site Dr.Brea, CA 92821 USA. and i am thinking of
relocating since I am now rich.

I am one of those that took part in the United Nations Compensation
program in Nigeria many years ago and they refused to pay me. I had
paid over $20,000 while in the US, trying to get my payment but all
was to no avail.

So I decided to travel down to Nigeria with all my compensation
documents, And I was directed to meet Barrister Richard Anderson, who is
the member of COMPENSATION AWARD AUTHORITY and a Human Rights Activist (Lawyer), and I contacted him and he explained everything to me. He said whoever is contacting us through emails are fake.

Right now, I am the happiest woman on earth because I have received my
compensation funds of $850,000.00. Moreover, Barrister Richard Anderson
showed me the full information of those that are yet to receive their
payments and I saw your email as one of the beneficiaries who have not
yet received the payment under CASE FILE 54AC003 and that is why I decided to email you to stop dealing with those people which never fulfill their
promises of helping you. They are not with your fund, they are only
making money off you.

Therefore, I would advise you to contact Barrister Richard Anderson for
his assistance and inform him that your CASE FILE is 54AC003. Contact him
directly via the information below.

Name : Barrister Richard Anderson
Email:barrister.mike.edward009@gmail.com
Telephone: +234-8131387018

You really have to stop dealing with those people that are contacting you and telling you that your fund is with them, it is not in anyway with them, they are only taking advantage of you and they will dry you up until you have nothing.

The only money I paid after I met Barrister Richard Anderson was just $350 for the paper works, take note of that.

Thank You and Be Blessed.
Mrs. Alice Hall
Trustee/Treasurer, Triad Foundation Inc.
1051 Site Dr.Brea, CA 92821 USA
Education: BS, Business Administration

As unbelievable as it may sound – there are some people, somewhere, who will believe this nonsense. After all, we don’t normally expect to be deceived by someone who gives us fair warning. You might be surprised, just how often reasonably intelligent people are deceived by this type of clumsy attempt to defraud.

Be kind to your friends, relatives, and associates, particularly those who are new Internet users, and let them know that there is an epidemic of this types of scam on the Internet. In doing so, you help raise the level of protection for all of us.

Ask your friends, relatives, and associates to keep the following tips in mind  while on the Internet:

Don’t click links in emails or social networking sites. If they come from a known source, type them on the browser’s address bar. If they come from an untrusted source, simply ignore them.

Don’t run files that you receive via email without making sure of their origin.

Keep your computer protected. Install a security solution and keep it up-to-date.

If you’re wondering why I’d even bother writing an article on a scheme that sounds so ludicrous – here’s why. The previous article on this topic continues to get substantial daily reads, most of which are as a direct result of Google searches. So, if surfers are searching, then there’s some degree of interest in responding to this type of email – crazy as that may be.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

ANOTHER Gmail “We’re Going To Close Your Account” Phishing Attempt – And The Beat Goes On!

For months now, Gmail inboxes have been flooded with one form or another, of the “Your Gmail account needs verification to avoid being shut down ” phishing attack.

I mentioned earlier this month, that I didn’t expect to see this Gmail  accounts scam reducing in volume any time soon. And sure enough, late today, I received another email, purportedly from the Gmail Team, in which the phisher attempts to convince me that this is the genuine article.

Dear Account User,

Bear with us, we ere undertaking a major upgrade in our Gmail network to ensure the security and privacy of our Gmail users and improve our service.

All Gmail Account needs Verification to avoid it being shut down due to recent problems encountered by Gmail Database system as a result of the ongoing upgrade. Please supply the details below to clarify that your account. so that it will not be deleted.

Username:

Password:

Birth date:

Country:

Note: Account owner that refuses to update his or her account within Seven days of receiving this notice will lose his or her account permanently.

Thank you for using Gmail!

The Gmail Team

It’s the same old, same old, though. Just like most of these type of emails, this one contains the usual misspelling, grammatical, and punctuation errors.

It looks convincing enough though, that some new Gmail users might easily be taken in. I know that you won’t be deceived by this type of clumsy attempt to defraud, but you would be surprised how often reasonably intelligent people are.

As with all emails of this type, the following issues raised immediate questions.

No personalized greeting.

The reply form asks for information that I initially supplied to Gmail when I activated my account.

The reply form asks me to provide my password. Isn’t this supposed to be kept secret even from Gmail?

Advice worth repeating:

If you have any doubts about the legitimacy of any email message, or its attachment, delete it.

Better yet, take a look at the email’s headers. Check the initial “Received from” field in the header, since this field is difficult to forge. Additionally, the mail headers indicate the mail servers involved in transmitting the email – by name and by IP address. In this particular case, the email actually came from vodamail.co.za (South Africa).

It may take a little practice to realize the benefits in adding this precaution to your SOP, but it’s worth the extra effort if you have any concerns.

Google provides excellent advice on their page – Messages asking for personal information, from which the following has been taken.

Here’s what you can do to protect yourself and stop fraudsters:

Check the email address of the sender of the message by hovering your mouse cursor over the sender name and verifying that it matches the sender name.

Check whether the email was authenticated by the sending domain. Click on the ‘show details’ link in the right hand corner of the email, and make sure the domain you see next to the ‘mailed-by’ or ‘signed-by’ lines matches the sender’s email address.

Make sure the URL domain on the given page is correct, and click on any images and links to verify that you are directed to proper pages within the site. Although some links may appear to contain ‘gmail.com,’ you may be redirected to another site after entering such addresses into your browser.

Always look for the closed lock icon in the status bar at the bottom of your browser window whenever you enter any private information, including your password.

Check the message headers. The ‘From:’ field is easily manipulated to show a false sender name. Learn how to view headers.

If you’re still uncertain, contact the organization from which the message appears to be sent. Don’t use the reply address in the message, since it can be forged. Instead, visit the official website of the company in question, and find a different contact address.

If you enter your Google account or personal information as the result of a spoof or phishing message, take action quickly. Send a copy of the message header and the entire text of the message to the Federal Trade Commission at spam@uce.gov. If you entered credit card or bank account numbers, contact your financial institution. If you think you may be the victim of identity theft, contact your local police.

It’s important that you know, that Google is not immune to hacking, as the fairly recent fiasco in China, in which Chinese hackers compromised Chinese activists’ Gmail accounts, illustrates. In fact, Gmail hacking is a much more common occurrence than most users are aware of.

To further illustrate just how common this is, the article I wrote on being hacked – My Gmail Account Hacked From Nigeria, continues to be one of the most read articles I’ve written.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Gmail Suspension Notice Phishing Attempts Continue

Gmail  is one online service that’s constantly targeted by email scammers, and fraud artists. In fact, Gmail  accounts scams have been with us since Gmail came on the scene.

This morning I received another email, purportedly from the Gmail Help Team, in which the spam scammer attempts to convince me that this is the genuine article.

Just like most of these type of emails though, this one contains the usual misspelling, grammatical, and punctuation errors.

Due to the congestion in our Gmail servers,there would be removal of all unused Gmail Accounts.

You will have to confirm if your E-mail is still active by filling out your login info below after clicking the reply button, or your account will be suspended within 24 hours for security reasons.

Account name:
Password:
Country :

Note: This email is only for Account owner.
Thank you for using Gmail !

The Gmail Team

It looks convincing enough, that some new Gmail users might easily be taken in. I know that you won’t be deceived by this type of clumsy attempt to defraud, but you would be surprised how often reasonably intelligent people are.

In this case the following issues raised immediate questions.

No personalized greeting.

The reply form asks for information that I initially supplied to Gmail when I activated my account.

The reply form asks me to provide my password. Isn’t this supposed to be kept secret even from Gmail?

Common sense advice: If you have any doubts about the legitimacy of any email message and its attachment, delete them.

If you are unsure of an emails legitimacy, then take a look at the headers. For example, to do this is Gmail –

Log in to Gmail.

Open the message you’d like to view headers for.

Click the down arrow next to Reply, at the top-right of the message pane.

Select Show original.

Check the initial “Received from” field in the header, since this field is difficult to forge.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Gmail Help Team Spam is Not Helpful

Spam scammers just never give up. Your Gmail  account is one online service that’s constantly targeted by email scammers and fraud artists. In fact, Gmail  accounts scams have been with us since Gmail came on the scene.

This morning I received the following email, purportedly from the Gmail Help Team, in which the spam scammer attempts to convince me that this is the genuine article.

Just like most of these type of emails though, this one contains the usual misspelling, grammatical, and punctuation errors.

Gmail Help Team

Account Inspection Department

Due to congestion in Gmail database system, we have come to realize that your account information on our database system are out of date, because of that we require you to verify your Information. Failure to verify your information will result in account suspension. If you are still interested in using our email service, Please click the reply button and fill the below spaces as requested.

User ID:

Password:

Occupation:

Country:

This message is for Gmail users only.

Thank you for using Gmail!

Gmail Team

It looks convincing enough, that some new Gmail users might easily be taken in. I know that you won’t be deceived by this type of clumsy attempt to defraud, but you would be surprised how often reasonably intelligent people are.

In this case the following issues raised immediate questions.

No personalized greeting.

The reply form asks for information that I initially supplied to Gmail when I activated my account.

The reply form asks me to provide my password. Isn’t this supposed to be kept secret even from Gmail?

Common sense advice: If you have any doubts about the legitimacy of any email message and its attachment, delete them.

If you are unsure of an emails legitimacy, then take a look at the headers. For example, to do this is Gmail –

Log in to Gmail.

Open the message you’d like to view headers for.

Click the down arrow next to Reply, at the top-right of the message pane.

Select Show original.

Check the initial “Received from” field in the header, since this field is difficult to forge.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Give Me Your PayPal ID – Then We’ll Make a Deal!

Like many Bloggers I expect, I get a huge volume of emails requesting link exchanges. In almost every case I reject the proposed exchange – I’m only interested in free sites that serve the public good. As well, I’m only interested in sites that publish articles that are well researched, well written and that have endured the ups and downs of blogging.

Don’t get me wrong – I’m not trying to be an elitist. I am however, entitled to set my own standards. So when I get an site link request like the following, my spam/scam radar automatically switches on.

“Hello Webmaster,

I’m a webmaster for http://www.xxxxxxxxx.com website,  I’ve found your website information and advice to be a very good fit for our visitors so could you please give us the best price for a site wide link on your esteemed website for a period of half and 1 Year? We will make payments Via PayPal so if interested, please mention your PayPal id.

If we are happy with your price, then we will send you the Link details that you can place on your website and we will make the payments to the PayPal id provided by you”.

So is this a scam? You decide based on the following:

They don’t know my name.

They know nothing about my site – no specifics mentioned.

For a period of half and 1 Year? – Awkward phrasing is a hallmark of spammers.

Esteemed website? Sure, flattery works – right?

Incomplete contact information – no phone number or address.

Most importantly; why would they need my PayPal ID? I think you can figure that part out.

Spammers, scammers and cyber-crooks, come in all flavors and sizes, and use every conceivable social engineering trick to swindle the gullible. I suspect that at least some  inexperienced Bloggers – flattered by the attention (wow, someone thinks my site is good enough to pay me for a link!!), will, or have fallen, for this fairly transparent scam.

One last note: This scam appears to be linked to a legitimate business site, which is why I have blanked the site address.

I’m not unreasonable in considering link exchanges – just careful. In fact, in the last few days I have added 2 new sites to my Blogroll, PC Magazine – Windows 7 Tips, (at their request), and Scoroncocolo Tech Pages. Both sites are well worth checking out.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Will Obama Give You Dough? Spare Change You Shouldn’t Believe In

Scammers are taking advantage of Obama’s grant money news to rip you off.

Shocking.

Watch for fake emails, links in ezine articles, and Google campaigns leading you to Obama-scam websites.

Testimonials on these Obama scam sites from people who’ve received government grant dough are as real as Ivanka Trump’s chest, and hardly as charming.

Quotes will urge you to order a CD to learn how to write a successful grant application – and that small S&H charge for the CD is how scammers get your credit card info and mailing address.

Another Obama-stimulus package scam email claims to be from the IRS, and asks you to fill out your personal information online, in order to receive a “stimulus payment.” What’s the most stimulating part of this process? Finding out strangers know a touch too much, about you.

Fortunately, if you follow the usual Internet safety rules, you’ll be okay. Look both ways before opening surprise email attachments and clicking links, and breeze over to YouTube to view some tips for avoiding grant-related scams.

Guest Writer: This is a guest post by Kristopher Dukes of 411-Spyware.com – an invaluable asset in the battle against malware. Pay a visit to 411-Spyware.com, and I’m convinced you’ll become a regular visitor.

The content of this article is copyright 2009 © by Dukes Media, LLC All rights reserved.

Every Good Story Needs a Villain!

This is a guest post by Paul Eckstrom, a technology wizard and the owner of Aplus Computer Aid in Menlo Park, California.

Paul adds a nice humorous touch to serious computer technology issues. Why not pay a visit to his Blog Tech–for Everyone.

This story opens gently enough. It begins with a friendly and helpful Comment posted on a friendly and helpful blog.

Someone had written to share “the results of their work”, which he said “solved his security problems.” He was talking about viruses and spyware, and other malware, and he said his method “covers 99.8%! of all known threats.” He posted his advice/Comment on an article about How To prevent the dangers posed by spyware (and also warns about “rogue” anti-spyware programs). He signed himself “Spycrasher”.

So far, this all sounds pretty good, doesn’t it? 99.8% effective certainly sounds good.

As you have probably deduced, Dear Reader, the “friendly and helpful blog” in question was this one. Tech–for Everyone, like most blogs, provides readers the opportunity to respond, ask a question, or just “put in their two cents”, simply by clicking on “Comments” at the bottom of the article. And also like most blogs, I have the ability to “moderate” which comments get posted and which don’t– for instance, Comments containing offensive language will not be published. Spycrasher’s 99.8%- effective security solution will NOT be seen here.

But.. maybe you’re a little curious as to what it was. And.. maybe, why I deleted it. (Take another peek at today’s title..) “Spycrasher’s” comment said to use three particular anti-spyware programs– in tandem– and he provided download links. (This, alone, triggers red flags.) He mentioned two tools I was not familiar with, and one rather well-known program.

* Hyperlinks are always suspicious (and blocked as a matter of policy), and the first thing I checked was, did the links point to legitimate websites..? Or would clicking on them take you to a poisoned webpage (which could infect your machine) or a pharming site.

No problem there. The links he provided did indeed point to real websites.

* The next thing was to check out the unknown programs themselves. No self-respecting and legitimate tech writer will advocate something they have not used, and tested, themselves. Period.

In my initial research of the first program (XoftSpy-SE), I found a wide range of reviews and comments.. from “this is rogue” to “this is the best thing since sliced bread”, and I learned that the program was “for pay”.
I don’t promote “for pay” software here (but do provide a daily free download), nor, even potentially rogue app’s; and so I stopped right there. I would not allow Spycrasher’s Comment.

· Being the gentleman that I am, I decided to write Spycrasher and thank him for his submission, and explain why I had moderated it. But before I did, I wanted to get a feel for where he was coming from.. so I ran a Whois on his IP…

Now, I gotta tell you.. it is very rare for ARIN to come back with a “no match found”. Very, very strange.

So I traced him.

New York >London >Amsterdam >Berlin >Warsaw…

And then he disappears into a virtual private network somewhere in the Ukraine.

Odd.

* So I used a search engine to find instances of the word “Spycrasher”… and he came up a lot. Spycrasher likes to post in various forums. Quite a few of them, actually. Like, practically all of them.
And he posts a lot of Comments there.
* Guess what? They are all identical to the the one he posted (I should say “pasted”) on mine.. right down to the ‘wink’ smiley ;-).

Very.. odd.

Tip of the day: Be very leery of hyperlinks, folks.. and please understand: not every innocent looking thing you see on the Internet is in fact “friendly and helpful”. There are people whose full-time job it is to try to trick you, and seduce you into doing something you normally wouldn’t.
I am very sad to say.

[note to bloggers/forum moderators/webmasters: you may want to search your published pages for instances of “Spycrasher”, and delete this guy.]

Today’s free link: I am going to repost a program here today, because I have it on every single one of my (Windows) machines, and I think you should too. ThreatFire (originally named “CyberHawk”) is a free, behavior-based anti-malware application. I use it as a supplement to my antivirus and other anti-spyware tools. Heuristic tools like ThreatFire are your only defense against “zero day” exploits.

Copyright 2007-8 © Tech Paul. All rights reserved*