Spam Scam #6: The Internet Service Provider Consorcium09/23/08Spam Scam #6: The Internet Service Provider ConsorciumOk, time to discuss another malware email that I received today. I wanted to describe this so that I can help others learn to identify scam/malware emails. The body of the email is as follows:
Return-Path: <monitoring@isp.com>
X-Original-To: rick@ekle.us
Received: from isp.com (unknown [192.206.246.200])
for <rick@ekle.us>; Tue, 23 Sep 2008 05:12:49 -0700 (PDT)
From: monitoring@isp.com
To: rick@ekle.us
Subject: Your internet access is going to get suspended
Date: Tue, 23 Sep 2008 07:12:49 -0500
Dear Sir!
The Internet Service Provider Consorcium was made to protect the rights of software
authors, artists. We conduct regular wiretapping on our networks, to monitor
criminal acts.
We are aware of your illegal activities on the internet which were originating from
You can check the report of your activities in the past 6 months that we have
attached. We strongly advise you to stop your activities regarding the illegal
downloading of copyrighted material or your internet access will be suspended.
Sincerely
ISC monitoring team
Attachment: user-EA3911X-activities.zip
Ok, so how do I know this is a scam? Let's describe each in detail. From Email Address: monitoring@isp.comFirst of all, this email address is very generic. 'isp.com' is not the domain name of my ISP. Had this been the domain name of my ISP, I might be inclined to believe it is real. Because this is a very generic name it is clearly fake. However, to the uneducated, they may think that it is their ISP sending this instead of a generic 'ISP'. Plus, the from email address of an email is easily faked. These should never be trusted. From IP Address: 192.206.246.200The IP address that sent an email cannot be faked. Had this email truly been from my IP address, it would have been within an IP range owned by my ISP. I just looked up the geographic location of this IP and it returned that it is from the 'CARROLLTON-FARMERS BRANCH INDEPENDENT SCHOOL DIST'. In other words, it's a school in Texas somewhere. I live in Florida. My ISP is not a school in Texas! This email likely came from a 'zombie' computer in a gradeschool district in Texas somewhere. 'Consorcium'Misspellings are often a sign of scam emails. The misspelled word 'Consorcium' in the email is a blatant sign that this email is fake. The correct spelling is 'consortium', by the way, as any spell-checker will tell you. Scare TacticsThis message is clearly meant to try to scare you. It accuses you of engaging in illegal activity on the Internet. It basically threatens you to open the attached file or you will lose your Internet access. Suddenly you are afraid of not only losing your Internet access but of going to jail! A true email on this subject would likely be much more polite. Zip file attachmentsAny time I see an attachment that is a ZIP or an EXE I instantly get very suspicious. This attachment is usually the malware program. You unzip the attachment, run the EXE inside and your computer is infected. I downloaded this attachment (very carefully) and viewed the contents. It contains a file named 'user-EA3911X-activities.exe'. Clearly this is not a record of your 'violations'. If it were it would likely be in a text file or a Word document or something similar. An EXE means this is a program. Were you to run this program it would likely infect your computer. However, when I attempted to extract this program so i can scan it with my virus checker to see what kind of virus/malware it is, my unzip program reported that the zip file was corrupt! These stupid malware people can't even send a valid zip file! So there you have it. My quick and dirty analysis of this scam email. I hope this saves you from having to fall victim to this scam. 26 comments
09/25/08 @ 11:23
Comment from: Diana [Visitor]
09/29/08 @ 11:02
Comment from: Sara [Visitor]
10/07/08 @ 14:02
Comment from: Rocio [Visitor]
10/12/08 @ 19:36
Comment from: Kerry [Visitor]
10/15/08 @ 07:05
everybody needs to know this---exe attachments found by your antivirus should be quarantined not deleted, until you know if the file will be activated by such actions
10/27/08 @ 09:50
10/27/08 @ 09:52
Comment from: Emil Mollberg [Visitor]
I maintain several blogs with lots of written and other´s material and always try to keep a straight line about all rights concerned as far as I can. I live in Berlin, so this is going all the world round, then? But so are my blogs on LiveJournal, MySpace and Wordpress; one of which has incidentally been hacked down pretty much simultaneously (wordpress, is placed on our private server, but still suddenly "gone") which may or may not have anything to do with this scam. So "international", the useless schoolkids of today, aren´t they? But unable to spell anything right in their own language.
11/06/08 @ 07:07
Comment from: M Cox [Visitor]
11/06/08 @ 12:42
11/06/08 @ 14:29
Comment from: Martin [Visitor]
I also take precautions when words are mispelled. I'm in Canada. I see that this e-mail is making a world tour. Can't we find those people and put them in jail ?
11/10/08 @ 10:10
Comment from: ANNIE [Visitor]
Reported it to my ISP provider,and they taking it further. Oh, the ones I got today, threatens prosecution. Well I know I did not download anything,much less commited a crime. As someone asked before, where do these morons get the e-mail addresses from? I am in South Africa, so the mind boggles, but luckily, anti virus warned of infected e-mail, and did its job.
01/07/09 @ 09:27
Comment from: Shar [Visitor]
01/09/09 @ 21:16
Comment from: Roselee [Visitor]
Thank you again.
01/12/09 @ 22:07
Comment from: Frank [Visitor]
received exact same message. It is a good thing to know there are places where we can go to look up these things.
01/16/09 @ 14:40
Comment from: Ross Dix-Peek [Visitor]
01/26/09 @ 14:38
Comment from: R.B. [Visitor]
02/19/09 @ 20:31
Comment from: BOBZEE [Visitor]
02/23/09 @ 06:55
Comment from: Lisa [Visitor]
Thank you for your time.....
02/27/09 @ 00:48
Comment from: anita [Visitor]
Thanks.
03/05/09 @ 21:36
Comment from: Hein [Visitor]
Thank God for U.
03/07/09 @ 10:08
Comment from: Teaser [Visitor]
03/18/09 @ 15:42
Facebook notifier (asks for your username & password)! One of your old classmates added you as a friend on Facebook. We need to confirm that you know her in order for you to be friends on Facebook. To see her picture please check your attachment. (picture attachment) Thanks, The Facebook Team Facebook © 2008 Remember to forward warnings on to your contacts about the above. Thanks for letting me share!
05/22/09 @ 08:28
Comment from: Eric [Visitor]
Showing her this article (and the comments posted by others) convinced her of the falsity of these mails. Thanks!
02/15/10 @ 09:56
|