By the way, the email also spams the URL http://tinyurl.com/come2gether, which resolves to http://letsdoandsaywedid.blogspot.com, and which features “A Call to Sacrificial Duty”. Interesting.

Here’s the email.

Please give the following some consideration.

Come together
right now
for the Sea

Here’s what the email looks like - innocent enough, right?

And here’s how it reads:

From: “Amazon.com”
Subject: Your Amazon.com Order (D23-4202635-4270272)

Amazon.com
Earth’s Biggest Selection

But, check out what’s underneath the hood - each and every one of those links actually goes to http://www.booksalon.kr:

Remember, you can (and should) always hover your mouse cursor over a link and let your system reveal the actual destination before clicking on a link.

The messages from TM GodsGift all say something similar - something along the lines of “Your number has won 450,000 pounds” or “You have been awarded 700,000 pounds”. Then it gives you an email address to which to reply to “claim your award” (email addresses currently going around include cocacola.claimdpt at live dot com, cocacolaclaim.file at live dot comm and exxonmobil43 at hotmail dot com).

Of course, if you reply to these scammers by email they will attempt to, well, scam you.

So, first, do not reply to these people.

Second, take what steps you can to make your cell phone harder to spam by SMS (what you can do will depend in large part on your cell provider). Third, if you choose to do so, report the spammer scammers.

You can read both how to stop SMS text spam, and how to report it, here.

“Our users don’t realize that even though they are seeing a tiny fraction of the spam addressed to them, because of our spam-filtering systems, the majority of our resources are being used in dealing with the overload of spam pouring into our servers every day, and it’s nearly all addressed to our users,” said a spokesperson for Yahoo.

Although officially Google is still looking at whether to jump on board and start charging their users for processing their spam, a senior-level manager at Google was even more direct. “I think it’s a great idea, and I think that we are going to be doing it too. If email users weren’t so careless with their email addresses, we wouldn’t be in this situation. They are the ones who allowed their email address to be harvested and used by spammers. Why should we have to pay for that?”

While this will affect primarily users of the free email services such as Yahoo, Gmail and Hotmail, some ISPs are purportedly considering charging their paying email customers as well, rather than raising their existing rates across the board. “If I have kept my email address secure, and am not getting a load of spam, why should I have to pay for the processing of the thousands of pieces of spam you get because you weren’t as careful with your email address?” observed the Google engineer.

While the move to start charging users for processing their spam is currently limited to ISPs in the United States, some Internet service providers in other countries are watching closely.

“It’s an idea that makes a lot of sense, and we are watching it very closely,” said Primo d’Avril, General Manager for French ISP TeleConnect.fr.

{P.S. This article originally posted on April 1st, 2010}

Of course, while you shouldn’t open the Western Union attachment, we here at the Internet Patrol are trained professionals, and so have done it for you.

Here’s what it looks like - don’t be taken in by it!:

Western Union - Thank you for using the Western Union Money Transfer®

Dear customer,

Thank you for using the Western Union Money Transfer®.

Your money transfer has been authorized and is now available for pick up by the receiver.

Transfers to certain destinations may be subject to further delay or additional restrictions.

TRANSACTION DETAILS:

Your Money Transfer Control Number [MTCN] is: 1629752260

Please use this number for any inquiries.

Date of Order: 16 March 2010
Amount Sent: $109,99

***********************************************************************************************
If you did not authorized this transfer you can cancel the transfer at any time
by downloading the secure form attached to your e-mail.

NOTE: This is our new security measure against unauthorized transfers made by a third party.
***********************************************************************************************

Thank you for using Western Union!

©2001 - 2010 Western Union Holdings, Inc., All Rights Reserved.

Now, if you’d been duped by this, and provided them with your credit card information and password, when you hit “submit” it actually deposits your information at:

http://logfreshcomment.comoj.com/logfortheatd.php

which is a site hosted by 000webhost.com. But because 000webhost.com provides free and easy hosting, odds are good that they had no idea they were hosting such scammers.

We hope.

It’s important to understand one little-known ‘feature’ of SMS cell phone spam - the vast majority of it is actually sent from the Internet, spamming the email-to-cellphone text messaging gateways that nearly every cell phone carrier maintains. What this means is that your cellphone has an email address, and if people know the magic addressing formula, people can send text message via email to your cell phone. For example, if you are an AT&T customer, your cell phone’s email address is:

your-10-digit-phone-number at txt.att dot net

Similarly, if your carrier is Verizon, T-Mobile, Sprint, or Nextel, your phone’s email address is:

your-10-digit-phone-number at vtext dot com
your -10-digit-phone-number at tmomail dot net
your -10-digit-phone-number at messaging.sprintpcs dot com
your -10-digit-phone-number at messaging.nextel dot com

…respectively.

Once understanding this, you can go about defeating text message spam a couple of different ways.

You can simply block all text messaging, which is what most front-line cell phone service customer service representatives (CSRs) will suggest up front. But as more and more people have given in to text messaging as a form of instant communications with family, friends, and even colleagues, that is not always a terribly practical way to go.

But there’s another way.

At least some cell phone providers offer the option to block only text messages that come from the Internet, and as the vast majority of cell phone text message spam comes via these Internet email-to-mobile phone gateways, blocking just Internet-to-cell text messages will reduce the amount of SMS spam you receive to a tiny fraction of its former self.

Both AT&T and Verizon offer this service. At the time of this writing, Sprint and T-Mobile don’t offer a wholesale “no text messages from the Internet”, but they do offer ways to deal with text messages that originate on the Internet.

So, call your cell provider and ask them how you can stop receiving text message that are sent via the Internet. Here are the customer service numbers for the major providers in the U.S., but if you’re outside of the U.S., or have another U.S. provider, by all means you should call them and ask if they offer such a service:

AT&T Customer Service: 800-888-7600
T-Mobile Customer Service: 800-866-2453
Verizon Customer Service: 800-275-2355
Sprint Customer Service: 888-211-4727
Nextel Customer Service: 800-639-6111

Now, how to go about reporting that cell phone spam:

First and foremost, call your cell phone provider and complain, loudly, to them. And while you are doing so, ask for a credit for the text message received. Even if you don’t pay for the first X text messages you receive under your plan, ask for a credit so that the spam message doesn’t count towards X.

Next, the Federal Communications Commission (FCC) is tasked with both creating policy regarding, and policing, cell phone communications, including spam. And they have a special form online through which you can submit your SMS spam, here:

Report your cell phone spam here.

So, call your provider, file your report, and take back your phone!

The spam, in full, reads:

Subject: Amazon.com - Your Cancellation (0046-68878-96071)
Date: March 7, 2010 10:17:22 PM MST

Dear Customer,

Your order has been successfully canceled. For your reference, here`s a summary
of your order:

You just canceled order #427-36356-9898759

Status: CANCELED

_____________________________________________________________________

ORDER INFORMATION
Sold by: Amazon.com, LLC

_____________________________________________________________________

Because you only pay for items when we ship them to you, you won`t be charged
for any items that you cancel.

Thank you for visiting Amazon.com!

———————————————————————
Amazon.com
Earth`s Biggest Selection
http://www.amazon.com
———————————————————————

As we mentioned in our article last week about the fake Amazon.com confirmation emails, this round of spam also uses masked links that make you think that the link will take you to Amazon so you can figure out just what the heck order they are talking about. But in reality, these cloaked links take you to one of the Canadian pharmacy spam sites that are behind this spam effort.

If you are careful, you can hover over the link with your cursor, and any current browser should reveal the actual site link. As you can see in this image below, we hovered over the link, and found that the link in this Amazon.com cancellation phishing spam really goes to a page called “DinnerInPeru.com/quadratical.html” and that page, in turn, goes to the Canadian pharmacy spam site, called “weightbreezy.com/” (Spammers register hundreds of nonsense-named sites on which to host their wares, knowing that their sites will get taken down as soon as they are discovered by either the ISP or the authorities.)

As always, if you get an email that claims to be from Amazon, Paypal, eBay, or one of the other big sites, instead of clicking on the links in the email, just log into the site and go to your account. If they really are trying to reach you, there will be a notice in your account.

For a little background, here’s what went down. Back in the mid-90s, the United States instituted a “green card lottery”, which would allow some people who were waiting to qualify for a green card (permanent resident status for immigrants) to be entered in a pool of applicants who, if chosen in the ‘lottery’, would jump to the front of the line and avoid a wait of, sometimes, years, to otherwise get their green card. As you might imagine, the Green Card Lottery became a heyday for immigration lawyers.

The law firm of Canter and Siegel (Laurence Canter and Martha Siegel) was perhaps one of the more Internet-savvy law firms back in those early days of the ‘net. They hired a programmer to write a script for them which would post an advertisement for their services for those interested in the Green Card Lottery, and post it to just about every single Usenet group (again, now known to most via Google groups) available. In all, they spammed nearly 6000 newsgroups!

The below is my response - posted to Usenet - to Ms. Siegel’s letter to the American Bar Association publication, the ABA Journal.

Date: Fri, Sep 9 1994 4:17 pm
Subject: Canter and Siegel - ptooey

The following letter to the editor of the ABA Journal, from Martha
Siegel, of Canter & Siegel, appeared in the September issue.

I am personally disgusted by this.

I would urge any of you who feel strongly about this to drop the ABA
editorial staff a line (their email address follows) and let them know
how folks really feel about this issue. My own letter is appended at the
end of this.

The ABA Editorial email address is: [redacted]

Here is Ms. Siegel’s letter, attempting to justify their mass-spamming of thousands of Usenet groups:

“Information, Please

MARTHA S. SIEGEL
PHOENIX

———————————————

And here is my response:

Dear Editor,

Anne P. Mitchell, Esq.
Palo Alto, California

————————–

But if you think that spamming 6000 Usenet groups and then defending it took chutzpah, you ain’t seen nothing yet!

As the ultimate audacious footnote to this, in 1997 Martha Siegel wrote a book, How To Make a Fortune on the Internet

As I always say, the frustrating thing about being a lawyer is that 95% of the lawyers out there…

…give the other 5% of us a bad name.

Project Honey Pot correctly observes that it’s actually very difficult to determine the country of residence for a spammer, however it is relatively simple to determine the country of origin of the spam itself. As they explain, “spammers’ use of bots can make their messages look like they are coming from somewhere completely different than their actual location. As a result, lists of spam origin countries tell you very little about where the spammers are actually located…. On the other hand, they can help provide insight into a country’s security policies because they give evidence on the number of bots operating within a country’s borders.”

Accordingly, Project Honey Pot has collated a list of the countries with the best IT security - and the worst. Those of you in the United States will be happy to learn that the U.S. made the top 10 for best IT security, although we came in number 6, behind the Netherlands, Australia, Belgium, Canada, and Finland (at number 1). The 10 worst countries for IT security - and thus the ten with the highest number of compromised computers that have been pwned by botnet herders and spammers, and so are being remotely controlled to send spam and other nasty things, include Brazil, Macau, Kazakhstan, Vietnam, Turkey, Macedonia, Columbia and, not surprisingly, China in first place, with South Korea at #3 (Azerbaijan has the dubious distinction of being in second place behind China for having the worst IT security).

[On another note, Internet security firm Symantec this week released their own report in which they state that 83% of all spam is sent by botnets, and that 97% of that spam is sent by a total of just 9 botnets, all of which are known and identified in the Symantec report. In fact, two-thirds of that spam comes from just four botnets: Rustock, Cutwail, Bagle and Bobax (sounds like a lawfirm, doesn't it?).]

However, Project Honey Pot has another trick up their sleeve for determining where the spammers (or at least the bot herders) are actually located - they look at where the systems that are harvesting email addresses from the web are located. Explains Project Honey Pot, “Our research indicates that, unlike the bots used to send spam, the machines used for harvesting tend to be more permanent, stable, and closely connected to the actual spammer’s location.”

Project Honey Pot asserts that the U.S. is #1 when it comes to where email address harvesters are (not a destinction of which we are proud, although we suppose one could hold this up as an example of “good” old American ingenuity. Following are Spain at #2 and, ironically given their position of fifth in the world for IT security, the Netherlands at #3. The UAE, Hong Kong, Romania, the UK, China, South Africa and Germany round out the top ten locations for email address harvesters.

Other interesting facts to come out of the Project Honey Pot analysis include that the number of bots has nearly quadrupled every single year, and that the time from when an email address is first harvested until it receives its first spam has jumped from more than 49 days in 2004 to under 22 days in 2009, with fraud and phishing spam hitting harvested addresses more quickly than so-called “product” spam (spam which is hawking a product or service).

If all this makes you feel down, take heart - with the holidays just around the corner you may be heartened to learn that, as Project Honey Pot puts it, “bad guys take vacations too,” and there is a 21% decrease in spam on Christmas, and a 32% decrease in spam on New Year’s Day (although we doubt that it’s due to New Years’ resolutions).

To read the full report, and to learn more interesting spam facts, such as the days of the week and the times of day when spam is at its highest and its lowest, read the Project Honey Pot report here.

But it gets better. The very next line - the one you’ll all be looking for in order to unsub from Frappr’s mailing list (that is, if Frappr is lucky and you don’t just immediately hit “this is spam”) - says:

To be removed from the list send us a message http://www.frappr.com/?a=feedback]

Now, you might imagine that, based on both the wording of that sentence and - you know - Federal anti-spam law, that when hitting that link, you would be unsubscribed, or at least presented with an option to unsubscribe.

But you would be wrong.

Here’s where http://www.frappr.com/?a=feedback takes you:

“Surely,” you are saying to yourself “there must be an unsub option in that drop-down menu area, then, right?”

Nope:

Here’s the full text of this email that you too may receive if “your name and email address were submitted to a Frappr Guest Map at some point in the past 5 years”, so that you can, you know, block it on sight (or even before you see it):

From: thefrapprteam at frappr dot com
Subject: Save Your Frappr Map Today

Two years ago Platial released an updated version of the Frappr Guest Map. Many Frappr members welcomed the change and replaced their old maps with the new ones. But many of you have not yet switched, in fact we still have more than 400,000 Classic Guest Maps still installed and active out in the world. The time has come to talk about your options as we start to retire the old version.

1. For those of you who are loyal to the classic style map, we are offering a simple payment option. $24.99 will keep your map alive and kicking for one full year. The deadline for receipt of payment will be January 1, 2010. At that time we will stop serving the maps.

2. For those who simply want to save their map data, we just released an export tool that gives you access to all the friends and photos from your maps creating a fully offline archive in the popular KML format right on your desktop. To use the exporter just look for the links on your map page on Frappr.com.

More information about both options can be found right on the http://frappr.com homepage.

Oh yeah, plenty of retro Frappr schwag still available.
http://www.zazzle.com/frappr*

Happy Mapping!
The Frappr & Platial Team

[You are receiving this message about Frappr because your name and email address were submitted to a Frappr Guest Map at some point in the past 5 years. To be removed from the list send us a message http://www.frappr.com/?a=feedback]