UPDATE 09DEC2009 - Google files suit against these guys - see @gcluley story for more.One of the most interesting spam campaigns in the past week has been the "Google Jobs" scam. Its interesting from a number of angles, including how they make their money, but first let's talk about how the spammers are abusing Google, Twitter, and Microsoft to avoid being detected as spammers.
The spam messages have subjects which have a random number letter combination at the start and the end of each subject:
X1 Become a Google Employee
F8 Earn cash with Google! 0Q
C1 Finally be able to have time for yourself and still make money! Google is hiring online workers! Start today! 0X
Q1 Google Bizop 2O
X6 Google can help you to a new sucessful career right now! 0E
E4 Google can help you! 2F
Q3 Google has millions of new job positions available right now! 4Z
E4 Google is looking to hire you! 1G
T1 Google is not only a fun way to search, but a fun way to work! 1E
Z0 Google is now hiring 0F
P6 Google is now looking for people willing to work from the compfort of your own home! 0Y
W0 Google is paying my bills! 0O
B4 Google needs your help today! Join the team! 9N
G5 Google needs your help! New job openings today! 8O
U1 Google needs YOUR help! Now hiring workers willing to work from home! 0S
9V5 Google now looking for stay at home workers right away!
S2 Google now offers job opportunities that pay big! 4P
C0 Google now offers the biggest job opportunities out there! 7X
D1 Google now pays you money to work for them! 1G
K9 Google offers the best amount of money for a job 2K
F4 Google pays you to work home 2S
W2 Google saved millions who were jobless! 5S
A7 Google search engine wants your help today! Click for more info 3S
B6 Having a hard time finding a job? Google is seeking workers like yourself online! Start today 1M
E9 Money making scams online making you mad? Google is trust worthy and free! Try now! 1N
G4 Most successful online job, Google pays you top dollar for your online work! 1M
Y1 Need a job worth working for? Google is here for you 1B
D8 No more getting screwed over by scamming online jobs! Google is safe and reliable! 0U
V8 Now hiring! Google needs online workers to help them out! Get started with them today! 1C
M9 Profit with Google! 1J
Y1 Ready to start earning real money online? Google will get you started right now
K8 Start making money with Google! 1K
F3 The economy stinks right now but your job shouldn't! Google is now hiring YOU! 2E
Z7 Tired of the same lame online scams? Ready to make REAL money? Google is the number 1 trusted name! Click to start today! 0O
R9 Want to work for Google? 0F
X6 Work for Google! 0G
F3 Work from home for Google! 0F
L8 Work with the best company around, Google! 0I
Twitter Abused
Each of the Twitter status messages received in our spam this morning links to a page that looks something like this.
In each case the link points to: http://newsnet6.com/monies
/a6561102/status/5817363391
/aaldrete/status/5818444236
/aalex_2009/status/5819820937
/abosa78/status/5818406975
/AdrianagomezM/status/5817587081
/adrielesl/status/5818093026
/agoesth/status/5818882905
/aie_bermejo/status/5817756511
/aiwa/status/5819426048
/ale2999/status/5818656578
/alimanti/status/5819905239
/alonghud/status/5820966152
/amelia_rumero/status/5820449899
/Ameliabraddell/status/5821100231
/amezing77/status/5818938105
/andrecebolinha/status/5818863563
/aNiLuApSs/status/5820464509
/AniPanch/status/5820884536
/ankakoz/status/5817234962
/anna_den/status/5819796053
/anniekidult/status/5821181103
/Annienme/status/5817156804
/ansilva/status/5819822629
/atanersaid/status/5818954024
/Aureablumen/status/5818746905
/avogelzangs/status/5820686081
/Bassy309/status/5818700570
/baxenn/status/5818228963
/Bazzyto/status/5817635541
/belshalat/status/5817500661
/berginroy/status/5821202365
/boongboong99/status/5821037464
/Bornbored/status/5817608287
/Braveheartless/status/5820741050
/breakofdawning/status/5818371061
/BrownSuga911/status/5818314226
/brummie_sarah/status/5821206995
/Chahida/status/5819921457
/CLHaney62/status/5818486553
/CNL1984/status/5820042785
/Comodon_Johnson/status/5818351991
/Corpsman21/status/5818932354
/craigwillmurray/status/5820817353
/crossedcrafts/status/5818175618
/czyrie/status/5821126199
/Devilbecks/status/5817942285
/diaboempanico/status/5818832572
/dngrbrn/status/5820857927
/drikacoqueiro/status/5821006462
/DrMuffin/status/5820089229
/Ely_0122/status/5819972691
/enghamada/status/5820192570
/espenvatn/status/5820729762
/estalicious/status/5818010185
/euslbria/status/5818620966
/faboodesign/status/5820885437
/faye_1986/status/5820273861
/felipemessias/status/5818441759
/FeloCassette/status/5820712859
/fernandabeck/status/5817819577
/flamesroyal/status/5817574871
/Flatini78/status/5817893040
/FOLKESY/status/5817769679
/fosterkr/status/5818742065
/FunkyBastard328/status/5820851640
/GeeJeeh/status/5820776083
/gillybeanfogo/status/5818259055
/giota_k/status/5818911850
/gpierce/status/5819659876
/guakangler/status/5819928456
/GuilloGomez/status/5817145012
/gzp0s3rbs/status/5818628264
/hazman_13/status/5817980167
/hborrat/status/5818688984
/hirian/status/5820887714
/hogsmeade_89/status/5820310749
/igamba/status/5820988297
/iml3g3nd/status/5820513483
/IronGhost24/status/5821003575
/IrvingHolmes/status/5819374006
/isalat/status/5817715237
/israel4life/status/5818223509
/j_fosk/status/5821022063
/jack1967/status/5820336011
/jackeem1234/status/5817809863
/jainvi2/status/5819017254
/Jairhomicide187/status/5819875487
/Jairock07/status/5817783305
/janpang/status/5820318836
/javiernt/status/5818197267
/JemPollyX/status/5820459416
/jennieechau/status/5817831172
/Jim222001/status/5818058689
/JoaquinBarajas/status/5820836792
/Joe_W_Herzog/status/5818871379
/JoLuvsTim/status/5818778380
/juanime/status/5819523635
/julia1984/status/5819970535
/kackyfo/status/5820523521
/kaizume/status/5818948711
/kas16uk/status/5817563870
/kayz2009/status/5821177632
/kdmgame88/status/5817548491
/khreatuur/status/5818379312
/kimienr_6/status/5819712032
/kinrpg/status/5818202645
/laurrajohnson/status/5820174472
/Leos2006/status/5817255624
/Les555/status/5818309931
/leslyok/status/5818551532
/lfcmarc/status/5819019624
/lilianarodrig/status/5818413856
/lionelbrown/status/5817750816
/lonelypoppy/status/5819191152
/louiszygadlo/status/5820912558
/lyly2184/status/5818755937
/mabaker1nz/status/5818790953
/mackodhy/status/5819592739
/Mariela28lopez/status/5817716930
/marli74/status/5817725548
/Maudelpin/status/5820831355
/mcalderero/status/5821074938
/meganlee89/status/5820105731
/mfjuninho/status/5819028766
/millerbolao/status/5818853406
/MIRADAFED/status/5821199632
/mishaelah/status/5818821474
/mjmeach/status/5818453525
/mohamedhisham/status/5820591669
/mojmadani/status/5820542138
/MsTrishKelly/status/5818320789
/munstir/status/5821093428
/murillo1983/status/5820343219
/murilofts/status/5817087583
/nainavyapish/status/5818969121
/Najla87/status/5820166739
/NatieMaus/status/5820799903
/ng_gina/status/5818787668
/nRath/status/5820908600
/OHar88/status/5819933845
/oliverioalmeida/status/5817230728
/Olusanmi/status/5819166588
/otroladillado/status/5818281431
/pammi4art/status/5817167182
/patch_panel/status/5818786418
/Paulusks/status/5817953617
/peckerwood_1488/status/5818931160
/piese1975/status/5817347525
/Puca88/status/5818865819
/ReGGaE_Arm/status/5817265254
/resquillo/status/5816806231
/Ricardo8484/status/5820789953
/ritamassela/status/5821170275
/RJNOTJR/status/5818154306
/rockernurse/status/5818203744
/rs_andrade/status/5820131665
/rstorm98/status/5819543035
/Rudjy/status/5818674760
/SaAghhhhh/status/5817702976
/saby6910/status/5819824366
/sangeethakr/status/5820129636
/Schnauzibaerli/status/5820319485
/shahpoto/status/5816795601
/shawrigh/status/5817143707
/SherryCline/status/5819629502
/Sherrylee60/status/5821117086
/sicochrane/status/5820322599
/silverado6/status/5818286557
/SirRosswell/status/5820191644
/SonguiD/status/5820786520
/SpaceAlbertros/status/5820925887
/SpankyTJ/status/5820379911
/Spartan239/status/5818899539
/speedboatchase/status/5819825169
/sridharsa/status/5819221617
/srivika/status/5818496254
/srv820711/status/5820999606
/StRidd/status/5819977882
/Struthicle/status/5818731042
/SupplyDemand/status/5820661993
/suzuma12/status/5817561318
/tatebaillie/status/5819779088
/tazluko/status/5820384526
/thanosg/status/5818040423
/thiagospc/status/5819925524
/tibun/status/5820914416
/Tijms/status/5819744615
/Tim08nz/status/5817507492
/timothymarsh/status/5818266399
/Torque20/status/5821029006
/toxicks/status/5817915472
/vanessaparker3/status/5817343713
/vdespoux/status/5816812730
/virginie41/status/5818777406
/Well_Costa/status/5821179988
/willim0/status/5818408247
/wonviku/status/5818171749
/WUBIH/status/5819577498
/www6rbtopcom/status/5818654237
/xiomarasierra/status/5818643906
/xleigg/status/5817588202
/xueyingwong/status/5819366648
/XX_Alicia_XX/status/5817547062
/XxCONNIE28xX/status/5817526259
/xxdrummerperuxx/status/5817738841
/yamz25/status/5817916620
/yeachyiyu/status/5820346336
/Yhoana/status/5818554271
/Yuri_C/status/5820881858
/zapheusk/status/5821116394
/ZeroAlx/status/5818032778
All of those Twitter accounts listed above were seen in spam between midnight and 5 AM on December 1, 2009. Each was created by criminals who are furthering this scam. If you know more details about the tool they are using to perform this automatic account creation, please let me know!
Spaces.live.com abused
Each of the Spaces.live.com messages received in our spam this morning links to a page that looks something like this.
In each case the link points to: http://newsnet6.com/monies
Spaces.live.com:
cid-00175ee6f7039261.spaces.live.com
cid-01da47be945fb859.spaces.live.com
cid-0843122cfd2f0f2c.spaces.live.com
cid-0c369a3bdc181912.spaces.live.com
cid-12b68f5cfde198ae.spaces.live.com
cid-1b14af4e6b13a00e.spaces.live.com
cid-1bcbd3f88fd825dc.spaces.live.com
cid-1ec9b10063ed6071.spaces.live.com
cid-1ee827d7ef55919a.spaces.live.com
cid-212718be48c03c4e.spaces.live.com
cid-234f321364a7f0ef.spaces.live.com
cid-237e0bd5f3cb94a4.spaces.live.com
cid-25ae5b0309b98cb4.spaces.live.com
cid-29ac336ef2843098.spaces.live.com
cid-2c221801e480d27c.spaces.live.com
cid-2f2ba7813a47f35f.spaces.live.com
cid-3474f1551e1fb7bd.spaces.live.com
cid-3dbd6e59b5b20c58.spaces.live.com
cid-3e6c595561987424.spaces.live.com
cid-413195ae822c46e1.spaces.live.com
cid-45cc813db3b17c11.spaces.live.com
cid-4a03ae180a0a8796.spaces.live.com
cid-51ef19eab2a23c61.spaces.live.com
cid-544804ba4619d6cf.spaces.live.com
cid-564b9387d24e0bd1.spaces.live.com
cid-591abde3032dd4a2.spaces.live.com
cid-5b6a14764c03b65a.spaces.live.com
cid-5f691397074c4c69.spaces.live.com
cid-6210dd0a7efff9c0.spaces.live.com
cid-6becc2f81380876b.spaces.live.com
cid-6c51c375edf1f658.spaces.live.com
cid-6e10526d1942d42e.spaces.live.com
cid-72321187e6f1ec7f.spaces.live.com
cid-73378003c8b9c9ad.spaces.live.com
cid-77db0792b0a09f4d.spaces.live.com
cid-787c972d11c514e6.spaces.live.com
cid-7d556d49eb6b35e3.spaces.live.com
cid-7eec343d1c65e260.spaces.live.com
cid-7fa8c5eab21eb1a9.spaces.live.com
cid-8193f4d1a986b3ef.spaces.live.com
cid-83251dda2b7fea1c.spaces.live.com
cid-838a50c9f8d752b1.spaces.live.com
cid-8bfde2abf1064f3c.spaces.live.com
cid-8e35dd30add2bb8c.spaces.live.com
cid-91522feb250b98bd.spaces.live.com
cid-91c5ca5fa735fc78.spaces.live.com
cid-988fd6f38d5b21bc.spaces.live.com
cid-9e415f17dd11698a.spaces.live.com
cid-9e54fe97100af77f.spaces.live.com
cid-a09500527f8617fb.spaces.live.com
cid-aa9427ad0b347855.spaces.live.com
cid-ad288eb9e7eadf09.spaces.live.com
cid-ad936bb767dc8658.spaces.live.com
cid-ae7742355651c65b.spaces.live.com
cid-b13cd58dd7674cdb.spaces.live.com
cid-b31cd1a5f9c37d53.spaces.live.com
cid-b3b7605e9c586197.spaces.live.com
cid-b66a51e94ac4583c.spaces.live.com
cid-b7ba83dc77d40bee.spaces.live.com
cid-bbdec1324ea3261c.spaces.live.com
cid-c2621008c2da26a0.spaces.live.com
cid-c27a3f80110bd984.spaces.live.com
cid-c44695791fafc195.spaces.live.com
cid-c52c7ddec733a81e.spaces.live.com
cid-d0c4535691e84f34.spaces.live.com
cid-d16a56015f714f5c.spaces.live.com
cid-d7339893dafeafcf.spaces.live.com
cid-d968763b7eb03029.spaces.live.com
cid-e18d333540a5b261.spaces.live.com
cid-e9236701c484c221.spaces.live.com
cid-ebb7f35c34ee4838.spaces.live.com
cid-ec89f3d9c6561c83.spaces.live.com
cid-ede0248f3c9b8c2b.spaces.live.com
cid-f4ada2d5cbabde56.spaces.live.com
cid-f7d6db42a4d2d799.spaces.live.com
cid-ff1267d1196482f3.spaces.live.com
All of those spaces.live.com accounts listed above were seen in spam between midnight and 5 AM on December 1, 2009. Each was created by criminals who are furthering this scam. If you know more details about the tool they are using to perform this automatic account creation, please let me know!
BlogSpot Abused
Here's the content of a typical Blogspot page in this campaign:
Hi, welcome to my page!
(font color='white')DsisSjelxTLg3Et2dac61AjXKeCJzPg3(/font)(b)
(a href='http://newsnet6.com/monies/8HnSqJ7gcIFXOzRsStqJ')
If page does not refresh..Tick Here(/a)
(/b)
(meta content='0;url=http://newsnet6.com/monies/?wQi7vnGl3pg4yLOiWNF1XNOmFfXXREiEV' http-equiv='refresh'/)
The font color = white prevents the next line of text from being visible on the white background, but introduces randomness to the page to make it hard for Google to say "find all the pages that contain exactly this". The same is true of the garbage in the URL, which is intended to make each URL unique so they can't even say "find all the pages with THIS URL".
The Meta Content = 0 line makes the page forward "in zero seconds" to "newsnet6.com/monies".
Blogspot pages:
Addiefdtw.blogspot.com
Alishagnzn.blogspot.com
Alishamfqe.blogspot.com
Allysongodj.blogspot.com
Avisegnr.blogspot.com
Bernadetteemhl.blogspot.com
Brianarqrh.blogspot.com
Carmelaaiun.blogspot.com
Carolbwyr.blogspot.com
Chandralzfb.blogspot.com
Charityiysn.blogspot.com
Cheriehnfx.blogspot.com
Christiamfz.blogspot.com
Christianflmw.blogspot.com
Clarafdwj.blogspot.com
Clarapbwr.blogspot.com
Consuelophgw.blogspot.com
Cynthiaigpt.blogspot.com
Cynthiapyhy.blogspot.com
Daisyrrph.blogspot.com
Diannefwwi.blogspot.com
Dorothydusl.blogspot.com
Ebonyipby.blogspot.com
Ednatxfw.blogspot.com
Ernestinewwfh.blogspot.com
Evangelinanyru.blogspot.com
Evaohov.blogspot.com
Fayvrnx.blogspot.com
Francescazcru.blogspot.com
Imeldanafa.blogspot.com
Jeaninecrsv.blogspot.com
Jeanteuw.blogspot.com
Jilldtvp.blogspot.com
Jillianbdle.blogspot.com
Jolenelefv.blogspot.com
Josefarbjn.blogspot.com
Karifjka.blogspot.com
Karyndwef.blogspot.com
Kathrynnpsm.blogspot.com
Kerryajpb.blogspot.com
Kerryesgc.blogspot.com
Lakeishacuib.blogspot.com
Lanamuty.blogspot.com
Latishathpg.blogspot.com
Laurenscln.blogspot.com
Leighkfaq.blogspot.com
Leliathws.blogspot.com
Leonorpxbb.blogspot.com
Lethajmnp.blogspot.com
Lucilleliqf.blogspot.com
Lucindavohe.blogspot.com
Madeleineesgu.blogspot.com
Madelineyceu.blogspot.com
Marcellagzdi.blogspot.com
Marissaenen.blogspot.com
Maxinerxyb.blogspot.com
Melvazoik.blogspot.com
Mercedesqvvz.blogspot.com
Natashavrjg.blogspot.com
Neldacejo.blogspot.com
Noemijcrm.blogspot.com
Nolafile.blogspot.com
Odessaiixd.blogspot.com
Pamelapvut.blogspot.com
Patricaaqfv.blogspot.com
Patriceywfl.blogspot.com
Robbiecwgq.blogspot.com
Robbieohjk.blogspot.com
Rosalindjctc.blogspot.com
Sandraeogn.blogspot.com
Saraarap.blogspot.com
Sonyabtre.blogspot.com
Staceygsyu.blogspot.com
Taniadsau.blogspot.com
Thelmasbzr.blogspot.com
Toniapvla.blogspot.com
Valarieuhca.blogspot.com
Vernaalhk.blogspot.com
Veronicalujd.blogspot.com
Vickieiivz.blogspot.com
Wildajpqy.blogspot.com
Willielovm.blogspot.com
Elvanzcr.blogspot.com
Lisavghh.blogspot.com
Stefaniesezt.blogspot.com
Valariersmg.blogspot.com
All of those blogspot accounts listed above were seen in spam between midnight and 5 AM on December 1, 2009. Each was created by criminals who are furthering this scam. If you know more details about the tool they are using to perform this automatic account creation, please let me know!
Whichever of the scam pages you start at, the Twitter, Live.com, or Blogspot page will lead you to the same webpages, which look like this:
further down on that page, they give you the simple steps to follow:
Step 1: Go to this link, fill out a basic online form, and hit submit at EZ Money System. Pay the $1.95 trial
Step 2: Follow the directions at EZ Money System
Step 3: You will start earning your first money in about 24 hours. Your first checks will be about $500 to $1,500 a week. Then it goes up from there.
So, how does it really work?
Here's a screen shot of Step one:
So far, so good!
See the link we're choosing - $1.95 Activation!
Wait! Is that Fine Print at the top of the webpage???
Your Membership is the perfect tool to start making money on the Internet. We've helped thousands of people achieve their goals. By submitting this form you are ordering Creative Search Training and the trial membership for $1.95 Instant Access. If you do not cancel within the 3-day trial period, you will be charged a one-time amount of $129.95. In addition, you will be provided access to an online Learning Center which will bill at $39.98, unless you cancel, 30-days from the date of enrollment and you will be re-billed every 30 days at $39.98 per month until cancelled. To cancel call 888-753-4203 M-F, 7am-5pm, MST within 3 days of the date you ordered. As special bonus gifts, you will also receive a Risk Free 14-day Trial membership to HomeSource. You may cancel anytime during the trial period by calling 1-800-537-0984 M-F, 8am-5pm, MDT. If membership is continued you will automatically be charged $29.95 a month.
So, after 3 days, we need to call the number 888-753-4203 to cancel our trial and 800-537-0984 to cancel our HomeSource or else we get charged:
$129.95 one-time
39.98 per month for Learning Center
29.95 per month for Homesource
or basically $200 for the first month and $70 per month thereafter.
For the record, we tried repeatedly all day yesterday to "cancel". The phone rings repeatedly without being answered at both numbers. Its not actually possible to "cancel".
