Today’s news-hungry web user might be in for a surprise the next time they open their email. A potentially harmful barrage of spam is peppering the U.S., masquerading as “NEWS” from such trusted sources as BBC, CNN, USA Today, and others.
This spam attack continues as I write this — hitting our honeypost addresses at a rate of about one every four minutes. They are targeting the unemployed, work at home, or others interested in similar news headlines. However ‘generic’ headlines such as “Obama’s policies affecting unemployed” or “BBC: Online giant Google, worth over 100 billion dollars” are being used to scoop in a wider range of victims.
DO NOT CLICK: The first impulse is to CLICK the link. But if you see any of the domains below, DO NOT CLICK.
These cyber criminals, allegedly located in China, have different plans for you and your identity. They have built a series of bogus “NEWS” pages, containing supposedly important news about the economy, unemployment and other financial woes. They are very convincing news pages — but actually land you in a phishing site, or revenue producing affiliate sites with stalker links. Clever pop-up warnings, carefully placed on the screen to mask the URL, open if you try to leave the page. Below I’ve posted just one of the stalker pages, and it’s pop-up.
Here are just a few of the SUBJECT lines, and accompanying domains among the 96 which arrived in the past 8 hours:
- Yahoo! investigates claim :
breakingnews92 [dot] com/ - TBS: “Change your life in 60 seconds!” :
breakingnews72 [dot] com/ - ITV: Breaking news! :
yourlocalnews29 [dot] com/ - CNN: Breaking news! :
lifechangenews9 [dot] com/ - BBC USA investigates claim :
lifechangenews9 [dot] com/ - Need some money? CNN wants to help :
dontgetscammed39 [dot] com/ - Need some money? Yahoo! wants to help :
lifechangenews9 [dot] com/ - Unemployed? Fox! investigates. :
yourlocalnews29 [dot] com/ - Need some money? BBC USA wants to help :
breakingnews72 [dot] com/ - CNN! investigates: Home-Maker Dad investigated :
breakingnews72 [dot] com/ - Unemployed? BBC USA investigates :
localnews93 [dot] com/ - Lost your job? CNN USA wants to know :
ipadnews29 [dot] com/ - Stay-at-home Father Makes 9936/Month Part-Time :
localnews97 [dot] com/ - Work-from-home Dad Makes 5,025/Month Part-Time :
newsbreaking88 [dot] com/ - Work-at-home Mom Makes 8510/Month Part-Time :
breakingnews92 [dot] com/ - Breaking news for Homemaker Mom :
localnews97 [dot] com/ - Change your life in 60 seconds. :
localnews93 [dot] com/ - Have you ever considered working on the internet? :
dontgetscammed39 [dot] com/ - Have you ever considered working on the internet? :
dontgetscammed39 [dot] com/
All these domains were created on February 2, 2011. All were registered to : Bingven, in Yanqing, Beijing, China
All registered at : BIZCN.COM, INC.
Most emails were sent through servers in Brazil (According to SpamCop)
This is what the cyber criminal provided to the Whois system when registering the domains on February 2nd. (Usually and probably forged and bogus.) The ‘owner’ however, is also the entity who stands to profit from your click to the web site.
Landing on these pages puts you in jeopardy. At the very least, you are tagged for future harassment, and potential damages. It also pops-up a blockade window when you attempt to leave. That page offers “get rich quick” schemes for work-at-home riches. Of course you know the mantra :
“If it looks too good to be true, it probably is.”
DO NOT CLICK. Be sure of the domain you intend to visit, and make sure it’s a trusted domain.
Thanks for reading…
You can also keep up with the efforts to curb spam and cybercrime by reading the news at 
Knujon and HostExploit.com. And, you should switch to SpamCop and take a stand against spam.
This is one of the sites you arrive at when clicking to “read more” on the “news” site. This pop-up attempts to convince us to stay on this page, and offers another page as substitute.
