{"id":5907,"date":"2017-01-19T11:10:02","date_gmt":"2017-01-19T19:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/19\/news-89\/"},"modified":"2017-01-19T11:10:02","modified_gmt":"2017-01-19T19:10:02","slug":"news-89","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/19\/news-89\/","title":{"rendered":"Malwarebytes Labs Blog Comment Safari"},"content":{"rendered":"<p>Comments on the Malwarebytes labs blog can be well written, valuable additions to our published work, and sometimes provide additional data that we missed. These are not those. Today we\u2019re looking at some comments we got from spammers who apparently don\u2019t look too closely at which site they\u2019re at before they hit &#8220;Send&#8221;.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Financial scams<\/strong><\/h3>\n<p>sparksdean91@gmail.com sent in the following opportunity:<\/p>\n<p><em>got my already programmed and blanked ATM card to withdraw the maximum of $50,000 daily for a maximum of 20 days.I am so happy about this because i got mine last week and I have used it to get $100,000.Mrs Glory is giving out the card just to help the poor and needy though it is illegal but it is something nice and she is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card.get yours from her.Just send her an email On atmmachine005@gmail.com<\/em><\/p>\n<p>Unsurprisingly, the same text shows up on a spam blacklist coming from a Nigerian IP in September of last year. As we can see below, these sort of financial scams tend to be copy pasted for years, by more than one scammer at a time:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-16019\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentfinance-600x71.png\" alt=\"commentfinance\" width=\"600\" height=\"71\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentfinance-600x71.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentfinance-300x36.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentfinance.png 1316w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<h3><strong>Russian hackers for hire<\/strong><\/h3>\n<p>ghosthackingfoundation@yahoo.com posted news of hackers for hire:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-16020\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking-600x173.png\" alt=\"commenthacking\" width=\"600\" height=\"173\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking-600x173.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking-300x87.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking.png 1426w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Suspiciously similar to the previous pitch, these guys are playing on growing public awareness of online fraud rings to aid an air of \u201clegitimacy\u201d to their goods. Searching on the contact email provided yields a bit more of an honest pitch:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-16018 size-full\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking1.png\" alt=\"commenthacking1\" width=\"2520\" height=\"460\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking1.png 2520w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking1-300x55.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commenthacking1-600x110.png 600w\" sizes=\"auto, (max-width: 2520px) 100vw, 2520px\" \/><\/p>\n<p>So what\u2019s the problem here? Firstly, real hackers tend not to advertise in places like the comments section of the Economist. Also, there\u2019s a robust industry involved with taking money for hacking services and then disappearing. Read a little more about how using these \u201chacking services\u201d worked out for others: <a href=\"http:\/\/www.ripoffreport.com\/r\/Hacker-For-Hire-Review-Neighborhoodhacker\/internet\/Hacker-For-Hire-Review-Neighborhoodhacker-hacker-for-hire-service-hackerforhirereview-1172072\" target=\"_blank\">link<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Magic spells<\/strong><\/h3>\n<p>luciarose000@gmail.com takes things in a weirder direction with a wizard for hire:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-16017\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard-600x227.png\" alt=\"commentwizard\" width=\"600\" height=\"227\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard-600x227.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard-300x113.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard.png 1392w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>This one has oddly kept the same contact phone number since 2013<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-16016\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard1-600x503.png\" alt=\"commentwizard1\" width=\"600\" height=\"503\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard1-600x503.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard1-300x251.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentwizard1.png 926w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Almost exclusively posted from Nigeria, these listings aren\u2019t necessarily fraudulent on their face, but often serve as an entry point for the scammer to wheedle more and more money, or gain access to the mark\u2019s financial accounts. There\u2019s some pretty good advice from a \u201creal witch\u201d here on why you shouldn\u2019t talk to a spell caster from Nigeria:\u00a0<a href=\"http:\/\/www.wishbonix.com\/fake-and-scam-spell-casters\/\" target=\"_blank\">link<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>The totally real Illuminati<\/strong><\/h3>\n<p>maganasolutioncentre@gmail.com offers us the best of a bunch, an invitation to join the Illuminati:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-16021\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentillluminati-600x222.png\" alt=\"commentillluminati\" width=\"600\" height=\"222\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentillluminati-600x222.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentillluminati-300x111.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/01\/commentillluminati.png 1444w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>We actually saw these two years ago <a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2014\/04\/return-of-the-illuminati-spam-mails-of-doom\/\" target=\"_blank\">here <\/a>(thanks to Chris Boyd.)\u00a0The gist of it is that to get your new Illuminati membership card (which you should definitely not show anyone), you need to forward some fairly detailed financial information to Nigeria and wait patiently. Probably not a great idea. This particular Illuminatus also advertises at that number for cures to HIV, herpes, and cancer, as well as winning lottery numbers for unspecified countries.<\/p>\n<p>Nigerian comment spam comes in waves, but it tends to have the same theme \u2013 if you wire some money to them, they can fulfill grossly outlandish promises. Hopefully people who read deep into internet comments will remember to do so with a critical eye.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/01\/malwarebytes-labs-blog-comment-safari\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/01\/malwarebytes-labs-blog-comment-safari\/' title='Malwarebytes Labs Blog Comment Safari'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2014\/02\/photodune-2988879-scam-computer-key-m.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>Today we\u2019re looking at some comments on our blogs we got from spammers who apparently don\u2019t look too closely at which site they\u2019re at before they hit &#8220;Send&#8221;.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/social-engineering-cybercrime\/\" rel=\"category tag\">Social engineering<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/419\/\" rel=\"tag\">419<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/illuminati\/\" rel=\"tag\">Illuminati<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/nigerian\/\" rel=\"tag\">nigerian<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/scam\/\" rel=\"tag\">scam<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/spam\/\" rel=\"tag\">spam<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/spammers\/\" rel=\"tag\">spammers<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/01\/malwarebytes-labs-blog-comment-safari\/' title='Malwarebytes Labs Blog Comment Safari'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10593,4503,10594,4479,3985,10510,10518,10595],"class_list":["post-5907","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-10593","tag-cybercrime","tag-illuminati","tag-nigerian","tag-scam","tag-social-engineering","tag-spam","tag-spammers"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/5907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=5907"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/5907\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=5907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=5907"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=5907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}