MalwareCleaning

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg
Showing posts with label facebook scam. Show all posts
Showing posts with label facebook scam. Show all posts

Tuesday, August 13, 2013

Scams, scams everywhere

Posted on 11:53 PM by Unknown

It's the scam season. Well, actually scams are always going around. Facebook is pretty popular to spread those scams, for example the Gina Lisa Facebook scam and the scam to have Facebook in a different color.

There's one recently that caught my attention:

"This is incredible"
















Basically what happened here is that someone on Facebook clicked on the wrong link, and the event got automatically created. Consequently, all of his/her friends were invited to the event as well.

Of the 4 pages that showed up in the search results (there are many more), ~500 people clicked on the bit.ly links. Which is not very much, considering how many people got the invite. Most of the comments on the events were "What is this?", so this means most people realised it's fake.

The CNN logo is being (mis)used, probably to make it look more legit. When you click on the link, you get redirected through affiliates but eventually you land on the following page:


"Dr. Oz Miracle Diet"
















Websites:
hxxp://consumerhealthnews9.org  - URLvoid Report
hxxp://consumerhealthnews6.com   - URLvoid Report

When clicking on any of the links on those sites, you get redirect to:
hxxp://ww90.thorizo.net  - URLvoid Report

More affiliates, more links to click on. The title for this blog post could also have been "affiliates, affiliates everywhere". 



Removal

If it seems that you have created the event, simply go to the event page, click the "wheel" icon and choose "Cancel Event":

Cancel the event















Be sure to also check your Apps, it's possible you allowed a malicious app to post & create things on your behalf:

Check your Apps












If you were invited to the event, simply ignore the message. You can also report the event as scam or spam by clicking on the Report button on the left of the event:

Report the event






















Conclusion


To keep it short and simple:
don't fall for these types of spam/scam, most of the times it's pretty obvious it's fake.

If in doubt, send your friend on Facebook (or if someone sent you the link) via PM if he or she knows what this is about.

You can also use a linkscanner to verify the integrity of a link on either http://www.urlvoid.com or https://www.virustotal.com/

To get some information on a bit.ly (or other URL shortener services) link, you can use any of the following websites:
- http://www.getlinkinfo.com/
- http://longurl.org/
- http://www.longurlplease.com/ (includes Firefox extension)

To report a malicious bit.ly link use:
http://bitly.com/a/report_spam
Read More
Posted in affiliate, blog update, facebook event, facebook scam, scam, spam | No comments

Monday, June 24, 2013

Gina Lisa Facebook scam

Posted on 2:17 PM by Unknown


Yet another Facebook scam, this time luring users with a sextape from Gina Lisa, whom is apparently a German model:


Yet another Facebook scam: "Gina Lisa Sextape"
















Note I only covered up the profile name & profile picture of the user who posted this, the screenshot from the "video" itself is actually not edited. Not sure what it should be covering up there...

When you click on the link you get:
Verify your age first












When you click on the video to "verify your age" you are redirected to what appears to be a site for gambling, pokergames, etc....:

Subscribe and get a free bonus. Looks legit














I suspect you'll probably have to pay up sooner or later to continue playing. Stargames.com is apparently known for spamming blogs & other sites.

hXXp://hot-movie.pw - URLvoid Report
hXXp://stargames.com - URLvoid Report


Interestingly enough, when I decided to also try and visit the page without a proxy, I got the following warning:

Illegal games much?












This scam and/or spam will also post on Facebook on your behalf. Go over your Privacy Settings on Facebook and make sure you delete this "app" if you see it. Remove any posts you have made as well and report posts similar as this made by your friend(s).



Prevention

Pretty straightforward: do not click on any of these links, how tempting they might be ! Ask your friend if he or she knows what it means, and slightly hover over the post until the 'X' becomes visible. You can then mark the post as spam, and it will be removed from your friend's wall.

It might also help to install the WOT extension into your browser. (Compatible with most modern browsers)
WOT is a community-based tool and is therefore very useful for these kinds of scams, whereas other users can warn you about the validity.
More information and to download WOT: http://www.mywot.com/



Conclusion
To keep it short and simple:
don't fall for these types of spam/scam, most of the times it's pretty obvious it's fake.
Read More
Posted in blog update, facebook, facebook scam, Facebook spam, gina lisa, illegal games, poker games, scam, spam | No comments

Wednesday, February 20, 2013

Facebook in a different color? Nah, just a survey scam

Posted on 7:59 AM by Unknown

I got messaged about an obvious scam on Facebook:


New Facebook colors!













Strangely enough, that person's Facebook color was still in blue. Is it possible this is just a scam? ;-)


Going to the application:

The application "Pick a col0r" requests your permissions


 Next screen....:
I choose the blue color. Oh, right...




















You've won!



As with most applications like these, you first have to fill in a survey to get your Facebook in a different color. Obviously, you still won't be able to even if you have filled in all your information for a chance to win product X or Y.


The application will make the same post on your wall as in the first picture. To remove it:

Go to your privacy settings, applications and remove "Pick a C0lor".



Confirm the removal and check the box. 




 Conclusion

You cannot change the color of Facebook at this point, there is no dislike button, ....

All of these 'applications' point to survey scams where you fill in all your information and your inbox will be flooded with spammail. And no, you haven't won anything.




Read More
Posted in blog update, change facebook color, facebook, facebook dislike button, facebook scam, Facebook spam, scam, survey scam | No comments

Tuesday, April 10, 2012

Free Riot codes scam

Posted on 3:38 AM by Unknown
Below you can find a list of confirmed phishing and scam websites.


Update - 14/04/2012 - 21:35 CET
: Both the Facebook page and hxxp://freeriotcodes.com are offline now. There is one other Facebook page (+ 21,000 likes) and a few other websites which are still up & running, but I expect them to be down soon. Great work Riot Games !


Update - 13/04/2012 - 18:07 CET: It seems the domain(s) is (are) accessible again. I have however received an email from Riot and they will be working on the issue as well:

Riot Games working on the issue

Update
- 12/04/2012 - 17:07 CET
: Yesterday I reported the domain hxxp://freeriotcodes.com to their domain registrar, GoDaddy.com. They have acted very fast and the domain is already inaccessible. Great work !



However, the page on Facebook still exists, and a new post has been made explaining the current unavailability of their scam:


'Free Riot Codes' apologising for the inconvenience











I have reported the page to Facebook as well reported it to Riot Games themselves. Hopefully the Facebook page will be offline soon.

Note: another Facebook page is currently trying to scam people. It will be taken offline soon:
hxxp://www.facebook.com/RPCodeGiveaways
--- End Updates

Facebook. A social networking place. For some a dream come true, for others a true nightmare. Guess in which category phishers, scammers and malware authors reside ?


In today's post we will be highlighting a scam specifically focusing on players of the game League of Legends, an action real-time strategy game developed and published by Riot Games.

The scam page on Facebook in question is:
hxxp://www.facebook.com/pages/Free-Riot-codes/141669939249958

Currently, it already has over 41,000 likes:


More and more people are liking the page, thus might be getting scammed



On Youtube as well as on Google+ and Twitter it is -for now- pretty calm. Only a few video's and tweets promoting this scam:


On Twitter, Google+ and Youtube they are also promoting their website, but not as heavily as on Facebook


Some example website where you can get "free" riot points  or "free" riot codes are: 
hxxp://freeriotcodes.com            
hxxp://blogs.gamenov.us/lol
hxxp://cheatsjungle.com/league-of-legends-promotional-code-generator-2
hxxp://cheatsjungle.com/league-of-legends-riot-points-generator
hxxp://elohell.org
hxxp://free-riotcodes.info

hxxp://free-riotpointscodes.com
hxxp://free3600rp.byethost22.com
hxxp://freehackgames.org/league-of-legends-riot-points-generator-3-2-version              
hxxp://freeleaguecodes.com      

hxxp://freeleaguecodes.net       
hxxp://freeleagueoflegendsriotpoints.com
hxxp://freeleagueoflegendsriotpointcodes.com     
hxxp://freeleagueoflegendskins.co.uk         
hxxp://freelolriotcodes.com     

hxxp://freelolriotcodes.netii.net   
hxxp://freelolriotpointz.blogspot.com      
hxxp://freelolrpcodez.weebly.com  

hxxp://freelolskins.com            
hxxp://freeriotcodes.filegame.net              
hxxp://freeriotcodes.info   

hxxp://freeriotcodes.org           
hxxp://freeriotcodes.weebly.com              
hxxp://freeriotcodesgift.com   

hxxp://freeriotpoints.me       
hxxp://freeriotpointsclub.com  
hxxp://freeriotpointscode.com 

hxxp://freeriotpointsgenerators.blogspot.com    
hxxp://freeriotpointsleagueoflegends.blogspot.com         
hxxp://freeriotpointsnow.com              
hxxp://freeriotpointss.com              
hxxp://freerpcodes.com              
hxxp://freerpcodes.tk              
hxxp://getfreeriotcodes.blogspot.com              
hxxp://getfreeriotcodes.com              
hxxp://getfreeriotpoints.com    

hxxp://getfrenocturneskin.webs.com          
hxxp://getriotcodes.com       

hxxp://getriotpoints.info       
hxxp://getriotpointscodes.com    

hxxp://getriotpointsforfree.com 
hxxp://getriotpointsfree.com
hxxp://gogamecheats.com/league-of-legends-free-riot-points  
hxxp://hackerzzs.blogspot.com               
hxxp://hackscheatsgamesprograms.blogspot.com 
hxxp://league-gamers.com
hxxp://leagueoflegends.byethost33.com
hxxp://leagueoflegends2012hack.blogspot.com             
hxxp://leagueoflegendsrphack.com              
hxxp://leaguerp.com   

hxxp://leaguerpgifts.com        
hxxp://leagueoflegendsgenerator.wordpress.com
hxxp://leagueoflegendsrpcodegenerator.blogspot.com    
hxxp://leagueoflegendsrpcodegenerator.weebly.com
hxxp://leagueflegendvoteasestribunall.gaming.lc
hxxp://live.rpgiveaway.com             

hxxp://lolhacktool.blogspot.com 
hxxp://lolfreeriotpoints.blogspot.com              
hxxp://lolmultihack2012.blogspot.com 

hxxp://lolpromobundles.blogspot.com             
hxxp://lolriotpointcodes.blogspot.com              
hxxp://lolrpgenerator.webs.com         

hxxp://lordhacks.com/league-of-legends-hack
hxxp://lordhacks.com/league-of-legends-promotional-code-generator
hxxp://oisn.mypressonline.com/league
hxxp://rafflesforprizes.com

hxxp://riot-codes.com
hxxp://riot-points.free-cards.info   
hxxp://riot.edgehacking.com              
hxxp://riot.freecodesgiveaway.com              
hxxp://riotcodegenerator.com              
hxxp://riotcodes.hacksfiles.com              
hxxp://riotcodes.net              
hxxp://riotcodesforfree.org              
hxxp://riotcodesfree.com              
hxxp://riotcodesfree.net

hxxp://riotgames.qualtrics.com  
hxxp://riotpointcodes.org
hxxp://riotpoints.cu.cc   
hxxp://riotpoints.net
hxxp://riotpointsadderforfree.blogspot.com
hxxp://riotpointscampaign.com        
hxxp://riotpointscodes.info  

hxxp://riotpointsgeneratorfree.blogspot.com           
hxxp://riotpointsfree.com   

hxxp://riotpointsgenerator.co
hxxp://riotpointsgenerator.org   
hxxp://riotpointshop.com        
hxxp://riotpoints-free.com

hxxp://rpcodes.info 
hxxp://rpfree.com
hxxp://rprewards.com
hxxp://rp-free.blogspot.com              
hxxp://rpgiveaway.com              
hxxp://videogamehacks.net/riot-points-generator

hxxp://xpandhacks.net/league-of-legends-riot-points-generator
hxxp://xpandhacks.com/league-of-legends-riot-points-generator-2                

You can +1 it, share it on Facebook, Tweet it ... Share the scam with everyone you like ;-) .

The first link in bold is the one that is visited -and used the most. All you have to do to get your Riot Points for free is to follow these 3 easy steps:

Step 1 - Share it on Facebook
Step 2 - Post the following message once on your wall and 5 times on a Different Game Page on Facebook:
WOW! I just got my League of Legends Riot Code for free! So excited! Thanks hxxp://freeriotcodes.com !
Step 3 - Click "Like and Confirm"


Step 2 in the process - posting on Facebook. In this specific scam, it is not being posted automatically to your wall, you actually have to share it yourself


That's it, 3 simple steps and then you'll be able to download your Riot Points or codes free of charge !

... But wait, there's a timer on the page indicating you'll have to wait before the next giveaway:




Somehow, I got lucky and, through one of the other websites, I was able to visit the download page and acquire my points !

However, ultimately I have to complete a survey to finally download my Riot points. I am getting redirected to several other scams and so on. You can win a smartphone, the new iPad, an iPhone, trendy boots, a Macbook ....

In some cases only your phone number is sufficient, in others you'll have to fill in complete information like your full address, email address ...

Some examples of dubious file sharing websites, which are also showing a popup with some Javascript behind it (another survey scam):
hxxp://cleanfiles.net
hxxp://fileice.net
hxxp://fileme.us
hxxp://fileml.com
hxxp://filenix.com
hxxp://matrixmega.com
hxxp://oceanfiles.me
hxxp://sharecash.org
hxxp://sharkyfiles.com 
hxxp://skippyfile.com 
hxxp://speedyfiles.net
hxxp://tinyfileshost.com
hxxp://topfiles.me


Let's get back to the scam site itself - hxxp://freeriotcodes.com
Registrant:
Hal Medus
10612 Parliament Ave
Garden Grove, California 92840
United States

Administrative Contact:
Medus, Hal hackzforyou@gmail.com
10612 Parliament Ave
Garden Grove, California 92840
United States
6572017037


UrlQuery Result:
Suspicious
http://urlquery.net/report.php?id=40190

URLvoid Result:
2/25 (8.00%)
http://www.urlvoid.com/scan/freeriotcodes.com/



Conclusion

Pretty straightforward: do not click on any of these scams, how tempting they might be! You will not receive a prize, you will not receive a free iPhone and you will certainly not receive any Riot Points or Riot codes! Certainly, never fill in your login credentials!

Some tips:
[*] Install WOT - WOT is a community-based tool and is therefore very useful for these kinds of scams, whereas other users can warn you about the validity.
More information and to download WOT: http://www.mywot.com/

[*] When in doubt, use any of the following URL scanners:
https://www.virustotal.com/#url
http://www.urlvoid.com
http://urlquery.net

[*] The most important one of them all:
if it looks too good to be true, it probably is!
Read More
Posted in blog update, facebook scam, free riot code scam, free riot codes, free riot points, free riot points scam, League of Legends, LoL, phishing, Riot codes scam, survey scam | No comments
Older Posts Home
Subscribe to: Posts (Atom)

Popular Posts

  • League of Legends RP hack
    I recently blogged about a (still current) scam targeting players of the online game League of Legends: Free Riot codes scam . When re-check...
  • test for the blog
    Just testing ... :-)
  • Facebook Support. Personal data has been changed!
    There appears to be a new malicious email being sent out with the subject: " Facebook Support. Personal data has been changed! ID7530...
  • WinMHR: Free Malware Detector
    Today I checked out WinMHR brought to you by: Team Cymru Now, what exactly is WinMHR ? (This is copied from the website) WinMHR is... Free ...
  • Malware Puzzle
    A malware (crossword) puzzle you say? Yes! Why not? I've made a puzzle about malware (and security) related keywords. It comes in .PNG f...
  • Brazilian banking Trojan tricks
    So I encountered what I suspect to be a banker focused on Brazilian banks. (Win32/Bancos) Part 1 - spam mail : Fiscal note Mail from: mail.u...
  • Increase in Dutch banking phishing
    Recently I made a post on Malware Disasters about an increase of targeted phishing in the last few monts. The focus was mainly on Dutch (an...
  • Gina Lisa Facebook scam
    Yet another Facebook scam, this time luring users with a sextape from Gina Lisa, whom is apparently a German model: Yet another Facebook sca...
  • A word on XDocCrypt/Dorifel/Quervar
    I'm sure everyone has heard by now about the so called XDocCrypt/Dorifel/Quervar malware. It has mostly damaged machines in The Netherla...
  • FedEx spam loads malware
    Received an email from (supposedly) FedEx today, seems my parcel was unable to be delivered: Print your receipt!     Mail details: Subject: ...

Categories

  • ACH transfer
  • adobe
  • adobe exploit
  • ADP
  • adware
  • affiliate
  • all your data are belong to us
  • antimalware
  • asprox
  • bancos
  • banking trojan
  • basic malware cleaning
  • battle.net
  • blackhole exploit kit
  • blog update
  • botnet
  • brazilian banking trojan
  • brucon
  • change facebook color
  • conduit
  • cracked hotmail
  • credit card blocked
  • crimeware kit
  • CVE-2006-0003
  • CVE-2010-0840
  • CVE-2012-4681
  • cybercrime
  • d3
  • diablo
  • diablo III
  • diablo phishing
  • DLL injection
  • Dorifel
  • dorkbot
  • encryption
  • end of july
  • exploit
  • exploit kit
  • exprez
  • facebook
  • facebook dislike button
  • facebook event
  • facebook scam
  • Facebook spam
  • facepalm
  • Fake Symantec security check
  • fakeAV
  • fareit
  • FedEx
  • FedEx spam
  • first post
  • flv media player
  • foistware
  • free riot code scam
  • free riot codes
  • free riot points
  • free riot points scam
  • free RP generator
  • fun
  • gina lisa
  • google earth
  • google image poisoning
  • google images
  • hacked hotmail
  • Hacked Hotmail accounts
  • hakin9
  • Hewlett-Packard ScanJet
  • hotfile
  • hotmail
  • illegal games
  • infostealer
  • ING
  • IP and RP Hack Download
  • java
  • java exploit
  • kuluoz
  • lame old malware
  • League of Legends
  • League of Legends MultiHack Generator
  • League of Legends RP generator
  • League of Legends RP hack
  • linkedIN
  • LoL
  • LoL RP Hack
  • low detection
  • malvertising
  • malware
  • malware analysis
  • malware analysis lab
  • malware cleaning
  • malware lab
  • malware puzzle
  • malware tools
  • medfos
  • messenger
  • MSN
  • neosploit exploit kit
  • paypal
  • paypal spammail
  • PC Speed Maximizer
  • pcspeedplus
  • PDF
  • phishing
  • poker games
  • potentially unwanted program
  • pricegong
  • PUP
  • pushdo
  • Quervar
  • Question and Answer
  • rabobank
  • ransomware
  • rapidshare
  • redkit exploit kit
  • RemovalTool.exe
  • Riot codes scam
  • Riot points scam
  • roguevertising
  • rogueware
  • rootkit
  • sasfis
  • scam
  • scareware
  • security
  • security conference
  • security.nl
  • skype
  • skype worm
  • social engineering
  • spam
  • spear phishing
  • spim
  • survey scam
  • team cymru
  • technoviking
  • tepfer
  • test
  • trojan
  • twitter
  • United Parcel Service
  • UPS
  • UPS spam
  • verizon spam
  • video
  • vmware
  • wellsfargo
  • whitesmoke
  • Windows Antibreaking System
  • windows live
  • WinMHR
  • worm
  • XDocCrypt
  • yontoo
  • youtube
  • youtube comment spam
  • youtube spam
  • youtube top comments
  • zeus

Blog Archive

  • ▼  2013 (18)
    • ▼  September (2)
      • Malware: the blame game
      • PayPal spam leads to malware cocktail
    • ►  August (2)
    • ►  July (1)
    • ►  June (3)
    • ►  May (2)
    • ►  April (1)
    • ►  March (1)
    • ►  February (3)
    • ►  January (3)
  • ►  2012 (14)
    • ►  November (1)
    • ►  October (2)
    • ►  September (2)
    • ►  August (3)
    • ►  July (1)
    • ►  June (2)
    • ►  April (3)
  • ►  2011 (15)
    • ►  December (1)
    • ►  September (1)
    • ►  June (1)
    • ►  April (3)
    • ►  March (1)
    • ►  February (5)
    • ►  January (3)
  • ►  2010 (14)
    • ►  December (3)
    • ►  November (1)
    • ►  October (6)
    • ►  September (2)
    • ►  August (1)
    • ►  March (1)
Powered by Blogger.

About Me

Unknown
View my complete profile