(The quickest way to register)

Forum

  1. User picture
    • c۞g on Thu 21 Apr 2011
    • 04:43:43 AM UTC

    Facebook rollercoaster scam

    Facebook rollercoaster scam
    Thursday, April 14, 2011
    Additional screen captures available on the linked article.

    aka: Profile Peekers

    Facebook scam / Youtube scam | malware / Phishing

    Spamvertised domains:

    List of domains/hosts:

    jrflinnao.info
    jrflinnah.info
    jrflinnam.info
    jrflinnaj.info
    jrflinnai.info
    jrflinnan.info
    jrflinnaf.info
    jrflinnag.info
    jrflinnak.info
    jrflinnal.info
    jrflinnaz.info
    jrflinnar.info
    jrflinnav.info
    jrflinnaw.info
    jrflinnax.info
    jrflinnaq.info
    jrflinnb.info
    jrflinng.info
    jrflinnay.info
    jrflinnau.info
    jrflinnap.info
    jrflinnas.info
    jrflinnat.info
    jrflinnc.info
    jrflinne.info
    jrflinnd.info
    jrflinni.info
    jrflinnf.info
    jrflinns.info
    jrflinnq.info
    jrflinnk.info
    jrflinnl.info
    jrflinnn.info
    jrflinnj.info
    jrflinnm.info
    jrflinno.info
    jrflinnr.info
    jrflinnp.info
    jrflinnw.info
    jrflinnt.info
    jrflinnx.info
    jrflinnu.info
    jrflinny.info
    jrflinnv.info
    jrflinnac.info
    jrflinnae.info
    jrflinnz.info
    jrflinnaa.info
    jrflinna.info
    jrflinnad.info
    jrflinnab.info

    which direct to Phishing site:
    youtube.funtricks-a.info
    funtricks-a.info

    "get code" button loads JavaScript from:
    youtube.funtricks-a.info/e.js

    also involved:
    zxc.funtricks-a.info

    Other directly loading (phishing) domains coaxing to copy / paste javascript:

    List of domains/hosts:

    346gd.info
    4sdss.info
    7efdsf2.info
    ags-netcom.info
    alberto-netcom.info
    alunet.info
    ami-netcom.info
    anda-com.info
    asfszdsf.info
    azu-net.info
    azureus-netcom.info
    dabooka.info
    dasbookd.info
    dfdsf3.info
    dfhdf6.info
    drgfhd.info
    dsdsg4.info
    dsfxbc.info
    dxfdfg.info
    ellibroc.info
    ellibroc.info
    estonasa.info
    facenet-com.info
    fbglitch-a.info
    fbglitch-b.info
    fbglitch-c.info
    fbglitch-d.info
    fbglitch-e.info
    fbglitch-f.info
    fbglitch-g.info
    fbglitch-h.info
    fbglitch-i.info
    fbglitch-j.info
    fbmeter.info
    fbmethod-com.info
    fbviewmetvi.info
    fdgrf2.info
    fgdfg3.info
    fishing-net.info
    flarinas.info
    funboom-a.info
    funboom-b.info
    funboom-c.info
    funboom-d.info
    funboom-e.info
    funhouse-a.info
    funhouse-b.info
    funhouse-c.info
    funhouse-d.info
    funhouse-e.info
    funjewel-a.info
    funjewel-b.info
    funjewel-c.info
    funjewel-d.info
    funjewel-e.info
    funtricks-a.info
    funtricks-b.info
    funtricks-c.info
    funtricks-d.info
    funtricks-e.info
    gfesf.info
    gfxfds3.info
    gocomnet.info
    jgfjgh77.info
    jgh5s.info
    jghdr6.info
    jrflinnaa.info
    jrflinnz.info
    lebookb.info
    linet-com.info
    luca-net.info
    lume-com.info
    luzcom.info
    recomnet.info
    reti-netco.info
    retinet.info
    retriaca.info
    sdfdsf2.info
    sdfdxv.info
    stdhx.info
    thebooke.info
    vuze-netcom.info
    xcvxs.info

    Main Host serving the above referenced domains:
    dwapps.net

    The JavaScript (copied / pasted in browser address bar has a destination link:
    hxxp://funtricks-a.info/final.php

    which requests scripts from:
    wegetpaid.net

    that provide affiliate links which display (for me) an "IQ Quiz" - similar to the CPALead SMS scams - linked through:
    trk.alskeip.com
    alskeip.com

    example:

    javascript:obj.openUrl('http://trk.alskeip.com/aff_c?offer_id=1341&aff_id=4333&source=85d05e6e263461b529e1df34b6b9dd14.1925&aff_sub=carlos-fb1','1341');

    The exampled JavaScript (above) directed me to:
    Smart Mobile Quiz Club
    hxxp://www.1newtest.com/b/V2tccsbdswa/?afid=863
    1newtest.com

    The "quiz" requires entering your mobile phone number for "results" with a charge.
    Ther :Terms are linked to:
    txtterms.com
     
    This is a subscription service billed as $5 weekly recurring charges for 3 alerts per week.

    ∞ - and you and I Opto, ergo sum

Comments:

  1. User picture
    • c۞g on Thu 28 Apr 2011
    • 05:49:46 AM UTC

    RE: Facebook rollercoaster scam

    celebritycrazy.info
    bbbindia4.in
    lilchuckeeonline.com
    visitooorb.blogspot.com
    yellonow.info
    fbinvites.org
    impressionvalue.mobi

    ∞ - and you and I Opto, ergo sum

    • User picture
      • c۞g on Thu 28 Apr 2011
      • 03:45:59 PM UTC

      visitooorb.blogspot.com

      Blog has been removed
      Sorry, the blog at visitooorb.blogspot.com has been removed. This address is not available for new blogs.

      ∞ - and you and I Opto, ergo sum

  2. User picture
    • c۞g on Fri 29 Apr 2011
    • 07:01:49 AM UTC

    RE: Facebook rollercoaster scam

    changeups.info

    ∞ - and you and I Opto, ergo sum