OK, so a hacker gets your email address and your password and can now go to a webmail website and send emails pretending to be from you. Maybe the webmail address for your email is obvious and the attacker can now sign on to your webmail and see your contacts. They can spam them and send emails as though they were from you.

It is a problem, but sending emails that pretend to be from someone else is child’s play anyway. It takes seconds to set up and do. So why would a hacker spend time and effort phishing for email addresses?

The problem with email security.
I have said for a while now and continue to believe it – your email security is the crux of your entire internet security. Blow that and you blow everything. It’s as simple as that. Your email address and password and the one key that can give a hacker unlimited access to everything you do on the internet.

And yes, I really do mean everything!

The first part of an attack
Once a hacker can logon to your webmail they can glance through your emails looking for key emails. Anything from banks, paypal and so on is useful for them. They will tell the attacker what you are using. You might also have been careless and left a welcome email laying about from a bank that is your reminder to your password there.

And if that fails…
The next step is no doubt very easy. A quick glance through your emails and they can guess where you are from (looking at your time zone being a huge clue!). Now they can visit all of the most popular banks that cover your region as well as PayPal and request password resets.

OK, most will be “email not recognised”, but once they hit upon your bank and get the response that they need, they have the link to reset your password. Now you can’t access your bank details but they can.

The two part fix
It goes without saying that the first part of this fix is to guard that email password very jealously. If you can, set up a separate email address and use one for emails and the other for password resets. Use very strong passwords (the longer and more complicated the better).

The second part is to use secure institutions. Some sites (e.g. ClickBank) will not allow withdrawals for a week after a password reset. My bank will also send you a text message with a key before any password resets are activated. That way, you need email address and the mobile phone.

But losing your email password is more than just a lot of spam in your name, you could also lose your bank accounts.

                          

Of course, why would any anyone want to know your name, email address and password to upgrade your email account? Simple – because they want access to your email and unlike your email provider, there is no master password.

In fact, any upgrade to security would NOT involve them logging on as you. They might insist that you update your password (something that a lot of ISPs do not provide easy access to), but they would never ask you for your password.

So, what could they do when they got your details? Send emails from you? Yes, but they can actually do that already. Far worse is they might have access to your list of contacts and be able to email them as if it were from you, but even that is that they can read your emails.

And if reading your emails does not sound bad then stop and think what can be involved there. It could be the start of identity theft! The next post will explain that!

Attn:

Support.

                          

You could open the PDF, read the instructions on how to claim your £450,000 and then email Mr Trevor Allan at the Google Promotion Award Team. Oh, but that’s not a Google email address.

I’d guess that what would happen next is that he would say that there is an insurance to pay to receive the money transfer, or their are telegraphic transfer charges to cover first which the recipient has to pay. Whatever the reason given, you part with £30, £50 or whatever amount of money and never hear from him again.

Alternately you could notice that email sender is one peter@parkafm.co.kr; that the email is sent to ‘undisclosed recipients’; and that you never actually paid for a ticket in this draw. If you weren’t aware of the draw until you won it, how would they be funding such a high prize?

Steer clear, it is a well worn scam. It only takes a 100 people to each pay there £50 and the scammer has soon recovered the buttons it takes to send such an email.

Dear Winner,

Sincerely,
Dr. Leslie Spears.
Google Promotion Award Team.

                          

It pretends to be from PayPal and is trying to frighten the recipient into thinking there is a huge charge back against them. There is a html attachment to open to ‘resolve’ the problem.

Open it and that is when the problems really would begin. Just delete the email and forget it. Some warning signs that it is fake:

1) “Dear Member” – PayPal will always reference you by name.
2) Email header says “To: none” – this would be to your registered email address
3) Email header says “Cc: recipient list not shown:” – this shows the same email is going to hundreds of people, there is no need to Cc: if this was genuine
4) The email encourages you to use an attachment – if worried, open up a browser session, go to PayPal and sign in.

Dear Member [wrong - PayPal will always reference you by name]

Sincerely,
PayPal
Chargeback Department

                          

What is it ‘offering’? Well it seems to be very confused and I expect that is part of the ploy. It makes out that it is offering domain registration services, but starting from $75 for 1 year! (I can renew for about 7 years for that price).

However, read carefully and you will see that the offer is actually for “ANNUAL WEBSITE SEARCH ENGINE SUBMISSION FOR DOMAIN NAME”. Yes, pay $75 and they will submit your website to Google. Why? Well no good reason. The website in question is doing quite well in Google and this idea that people have that you have to keep submitting to search engines is rubbish. Maintain a good website and you never have to remind the search engines it exists.

In fact, to take it one step further, I never actually even submit new sites to Google, yet they are usually listed within a few days of going live. Ignore this email, it is just a scam. Most of the content is below:

As a courtesy to domain name holders, we are sending you this notification for your business Domain name search engine registration. This letter is to inform you that it’s time to send in your registration and save.

Privatization allows the consumer a choice when registering. Search engine subscription includes domain name search engine submission. You are under no obligation to pay the amounts stated below unless you accept this offer. Do not discard, this notice is not an invoice it is a courtesy reminder to register your domain name search engine listing so your customers can locate you on the web.

                          

I have been sent a letter by the “Asia Business Partners” that sounds very inviting. So inviting, my first thoughts were “scam”.

The old adage is that if it sounds too good to be true then it probably is, so I searched the name on Google and found a few people who say they were taken in by the scam.

The letter simply says that someone wants to buy this type of business in the area I live and is willing to pay £200,000 to £2 million for such businesses. The reason – they want to emigrate to the UK and by owning a UK business they can do so.

This alone sounds rubbish! Why would running a UK business allow immigration? The letter says there are no fees or commissions (from Asia Business Partners) as the purchasers pay it all.

But from what I have read on forums people agreeing to sell have been left with huge translation fees to pay. People have mentioned £4,000 of fees as they have negotiated with the client, who eventually walks away from the deal.

So whilst it does sound a very tempting offer, I think I will just have to ignore the letter. If you have received the letter yourself and know either that it is genuine or it is a scam I would be interested to know.

The letter basically goes:

If you are the owner of the above business I would like to have a confidential discussion to canvass if you would be interested in selling the business to my clients.

We do not charge commissions or any fees to vendors as we are paid by the purchasers’ agent as part of the immigration prcess.

                          

The BBC’s report claims that these phone calls are coming from organised crime gangs, employing call centres that are employing 300-400 people. They are also paying website owners huge fees each month for on-site advertising, showing the value of these scams.

The scam
Once you have been led through the first part of the telephone script the caller will attempt to convince you that they need to install some free anti-virus software, usually adding to the call that they are officially authorised by Microsoft (they are not!) to try to convince you.

The results
However, once the software is installed the gangs can harvest personal details from your machine using the applications that they have just installed. This means they might have access to credit card details, internet banking logon details and more.

Finally, once they have got everything that they want from your machine they might also blackmail you into paying for the ‘free’ software, with constant messages on your system if you fail to pay, or even your computer locking up until the payment is made.

                          

Quite cleverly it was aimed at the email address that is displayed on my contact page, which is (of course) a website design site. However, that’s a receiving email only and doesn’t associate with PayPal, so I knew straight away that I was receiving a Phishing email!

Obviously, it is trying to look as genuine as possible by providing plenty of details, however, any PayPal email will always start with your name, not “PayPal Member”.

Whatever you do, do not click on the link in the email. It certainly won’t take you to the PayPal website!

Here is the email’s content:

Dear PayPal Member,

–
This message has been scanned for viruses and
dangerous content and is believed to be clean.

                          

Quite simply, it is an email asking you to verify your website’s hosting set-up. It is very easy to get hold of a list of website owners and to send such an email. What they can then do once you have conscientiously told them your logon details is to use your website as the next stepping stone in the chain. Maybe you will host the next ‘verification’ page and wonder why your traffic is going through the roof. Or maybe your site will be used to host some page in which the phishing is targeted at online banking.

In short, if you are sent an email and asked to click a link and validate ownership, do not click the link. If you are worried, just sign on as your normally would. But avoid clicking on the link in the email at all costs.

Here is the content of the email.

Dear Customer,

Designated trademarks and brands are the property of their respective owners.

                          

Firstly the caller asked me if I was Mr Thompson. When I told him that I wasn’t, he just confirmed that I was the owner of the phone line and then introduced himself as someone giving free computer help. It was made out to be a pretty ordinary service.

After making sure I was sitting in front of the computer he got me to right click on My Computer and select Manage, then to find Event View.

He then got me to count all of the error and warning messages within Application, Security and System. All fairly safe so far, but he was insistent that I should not click on any of these error messages.

Now these error messages are harmless. That is probably why he did not want me to click on them and made them out to be dangerous to click on. If I had, I would have seen the error message and recognised them as when software etc had hung in the past.

For example, one of the warnings is an application purposely preventing the system going to standby – because it needed the computer to keep running.

He then tried to talk me through the next part of the scam, which was to open the run prompt and go to www.logmein123.com. This was needed because the machine would die within a few weeks if not corrected. At that point it was time to end the call.

The next step, from what I have read, is to give them access to your machine (using the innocent third party service) and then they will clear the errors and fix the machine.

Actually, the report says that they fill your computer with software that virtually blackmails a payment out of you for a couple of hundred. Refuse to pay and you can’t use your computer!

If you do have random people phoning up offering help to sort your computer, just put the phone down. They are not really randomly phoning people to give assistance and sometimes even go as far to say that there have been lots of problems reported in your street!

And never give someone access to your computer if you have not invited them in. It is dangerous and expensive!

                          

So you receive the email on the right (click to enlarge). It clearly tells you:

“We are planning to sell communicatinggreen.com in the next couple of days. Since you own [your domain], I thought you might be interested in communicatinggreen.com.

“You will also maximize the value of [your domain] by buying communicatinggreen.com.”

So they own this website and it has traffic and they want to sell it. Right?

Who currently owns this website?
Wrong! But, what exactly is going on. Well next I looked at the whois information for this domain, which is basically when it was registered and when it will expire.

The key lines here are:
Status: pendingDelete
Updated Date: 11-jun-2010
Creation Date: 31-mar-2009
Expiration Date: 31-mar-2010

What this tells us is that the domain name was first registered only last year (31-March-09) and was allowed to expire this year. It is also “Pending Delete”, which means that it has not been renewed and is going to expire. No-one owns is.

What are Premium Value Domains offering?
So, is this a scam? Not quite. What Premium Value Domains are offering to do for you is to grab the expired URL as soon as it becomes available. But, they are not doing this and then hoping to find a buyer, they are finding a buyer and then hoping to buy the old name – another company could equally well get it before them.

Are the benefits genuine?
Is it worth buying it? I would say not! Looking at Alexa there is no traffic ranking; looking at the Way Back When archive there is no old website and searching on Google only finds about 20 entries for the domain name, all of these being references to this pending deletion.

Why then would it “increase your traffic to [website]“ and “maximize the value of [your website]“?

In short, it won’t. There is no hidden value in an expired name that appears never to have had a website hosted and therefore, has never had any traffic.

What should you do?
My advice to you if you receive such spam is to delete it. Should by some fluke the domain name be a good name for you, then approach suitable companies yourself who can buy expiring domains. Do not reply to spam as you do not know how much over the odds they might charge and it encourages more spam.

                          

Unless you really want your domain name registered in China, there is no need to respond. And if you do, I would recommend finding a suitable registrar rather than replying to a spam email and encouraging them to send more!

Here’s a copy of the content of the email.

Dear Manager:

John
Oversea marketing manager

                          

Below is a sample of the email. Do not click the link if you receive a copy!

If you have received this email, do leave a comment below – it makes me feel that I am helping people! If you don’t want the comment published, just say so!

                          

“Hello!

You have recieved a Hallmark E-Card.

To see it, click here,

There’s something special about that E-Card feeling. We invite you to make a friend’s day and send one.

Hope to see you soon,
Your friends at Hallmark

Your privacy is our priority. Click the “Privacy and Security” link at the bottom of this E-mail to view our policy. “

Apart from the careless spelling of ‘received’, it looks good. But follow that link and you have just installed a virus. Instead of going to the Hallmark website, it goes to http://211.137.202.133/hallmark.exe. An anonymous website and that hallmark.exe will no doubt be a virus. Click the link and you could have spyware, keystroke logging or anything installed.

For me, it was simple to spot. It was sent to a rarely used email address. It didn’t include the name of the sender or recipient, and putting the mouse over the link showed it was nothing to do with Hallmark.

The email has been binned. Do the same if you receive one of these fake emails.

                          

DEAR CUSTOMER,
paypal is pleased to notify our online banking customers that
we have successfully upgraded to a more secure and encrypted
SSL servers to serve our esteemed customers for a better and
more efficent banking services in this year.
Due to this recent upgrade you are requested to update your
account information by following the reference below. using our
new secure and safe SSL servers. To validate your online banking account
click on Update Online Banking .

This Email has being sent to all our paypal customers, and it is
compulsory to follow as failure to verify account details will lead to
account suspension.

Thank you.
PayPal Online Banking Security Team
2009 paypal© internet Banking . All rights reserved. Version 1.0 31w23m3

If you receive this email, or anything like it, please do not click on the link. It is not authorised and the actual target website of the link is zionwaterville.com. At best, the destination page will look like PayPal and attempt to collect your login details so that the phisher can clear your PayPal balance and use the account for money laundering and other illegal activities. At worst, it could immediately download a virus to your machine.

If you are worried that you might have disclosed your login information, type www.paypal.com into your browser address bar, sign in and change your password. Never click on links in emails to PayPal (or any other financial sites). Always use a bookmark or type the URL into the address bar.

Stay safe…