Tired of SPAM? We can help you stop it.
We can set up a filter for your business e-mail domain to stop garbage like this from ever reaching your inbox.

Tuesday, October 14, 2014

Shipping Info for you@yourdomain.com

The SPAM filter picked up this one today and I've had a couple of recent client calls about this type of e-mail and another one that claims there is a "New Fax Waiting". The e-mail contains an embedded link that will attempt to compromise any system that visits it.

The message originated in Provo, Utah on an ISP called Unified Layer. The IP Address that sent it was The claimed sender's address is saadi@ihc.com.sa . The company at ihc.com.sa is an insurance broker that has likely been compromised.

Don't believe this. It is an attempt to infect you!

Delete it and move on with your day!


Purchase Notice
Please see the shipping information Date ordered: October 13/ 2014
For your information that the item is being shipped to you.
We also included delivery file to specified address.
Order No: 104213335
Order total: 1779.07 USD
Processed date: Oct 13 2014.

Help !!!!!!!!!!!!!! Cathleen and Mark

I haven't received one of these in a long time due to our filter capturing the vast majority of all the SPAM that hits our servers. This one made it through because it came from as client's personal account on AOL that we have whitelisted. Someone, somewhere, got hold of their password as is sending out spam. If you get one of these, they aren't really where the e-mail claims.

Although it claims to be from Simferopol, Ukraine, the message originates at IP Address in Ashburn, Virginia. It was sent on an MCI network. It routed through AOL in New York City.

Delete the e-mail, Don't read it, don't respond.

Do contact your friend and tell them that they've been compromised. A heavy scan and password changes are in order.


Hello ,
Sorry to bother you this time but this seems to me more than a dreadful ill-luck for me and my family.I am in Simferopol (UKRAINE) right now for a short vacation and unfortunately i ran out of cash, i have tried to access my credit card from the cash machines here but it keeps saying network errors.
I also tried to withdraw funds from my own bank account here but the lady at the paid desk informed me that i can't withdraw from my account here in a foreign country,wondering if i could get a quick loan of ($2,900 USD)  from you to clear some little things here and also take a cab to the airport i promise to refund it as soon as i get back home later this week.
I anticipate your response .
Cathleen and Mark

Friday, October 10, 2014

The Stocktip Of The Year

Uh... no... I think not. Maybe another candidate for scam of the year?

This scam, pump and dump, attempt to infect your systems, comes courtesy of pete25a2@bistrita.astral.ro a Romanian ISP. The message came in from the IP address in Harghita, Romania.

The message is definitely not from TheStreet, Inc. at 63 South Main Street, Newtown CT 06470.

Don't click the links, don't read it, don't believe it. Delete and move on with your day!

Spam e-mail text;

TheStreet Daily
Your newsletter from
TheStreet, Inc.. Trouble viewing?
You've been patient for a while now and finally
it's time.
Confederation MineraIs (CNRMF)
is on the verge of exploding.Thats because they
have hundreds ofmillions of precious metals on their
property and they are weeks away from beginning to dig
it out and selling it up the distribution chain.It is
trading at such a bargain right now that
CNRMF is a no-brainer.
Snap up as many shares of it as you can today before it
goes up too high.Everyone is certain that we
will see it hit past 40cents before month's end.
63 South Main Street, Newtown CT 06470
TheStreet, Inc. Press
| Customer Service
| Privacy Policy

You received this message because you are a
TheStreet, Inc. customer or have registered at
This email was sent to you by The  TheStreet, Inc..

Click here
to update your email preferences.

Wednesday, October 8, 2014

Your PC Has Critical Errors - Fix Now!

UPDATE! UPDATE! - 10-15-2014
This is the first time this has happened since I started this little blog. I got word from the guys at HOST1PLUS in Santiago, Chile and they have shut down the spammer on their systems!  You should keep an eye out for this bad message because it is still out there and showing up from other sources, but won't be coming from this host anymore. It is awesome that someone out there is on top of their systems! Props to HOST1PLUS!

Original post -

Here's a little scam I was just notified about. This came in to a client's e-mail account and they called us right away about it. If they had followed the e-mail's advice they'd likely be infected with a nasty piece of MalWare and a handful of Trojans.

The entire e-mail is a massive image link! Don't click it, don't follow the links, don't try to visit their site. It is a SCAM!

The link in the e-mail leads to http://images.reviewfacilitate.co/RWn6saYa6xELa9ss9 a non-responsive website. The e-mail that claims sending it is info@reviewfacilitate.co . In reality the message references the domain handleinsure.net and originates from IP Address located in Santiago, Chile. The ISP is either Host1plus Hosting Services or Digital Energy Technologies.

Image of the spam scam;

Spam Scam e-mail text;

Windows PC Repair
Diagnose @ Fix Your PC Problems in 3 simple steps:
1. Download Windows Repair Tool
2. Doubleclick on teh Setup file and Follow teh On-Screen Instructions to Install the Procuct.
3 Runa Scan and Fix the Detected Errors by Clicking teh "Fix All" Button.

Ratings: *****

Total Downloads: 103,500,697

Download File Size: 4.1 MB

Download Time: sec on dsl, 2min on dialup

Compatibility; Windows 8, Windows 7, Windows Vista, Windows XP, Windows ME, Windows 2000 32Bit & 64Bit OS Systems

Support: Yes

Upgrade option: Yes

Download Now 

Thursday, October 2, 2014

Pay For Driving On Toll Road - EZ Pass Trojan

We just ran into this nasty little surprise at a client site yesterday. It's a virus posing as an overdue bill from E-Z Pass. The "Get Invoice" link will attempt to install a Trojan on the system. We happened to catch it right away so no harm was done.

It was delivered to our end-user's personal e-mail account on Comcast so our filtering system never had a chance to take care of the issue. We attempted to forward the message through our filtering system and it was denied immediately.

Watch out for this one, it is a very convincing e-mail. It is well built and appears graphically legitimate . However, the English language used in the message is poorly constructed and is the first clue that something is out of place. Also notable are the links pointing to a bogus trojan downloading site when hovering the mouse over them.

Be careful out there!

Screenshot of virus/trojan;

Trojan spam mail text:

Dear Customer,

You have not paid for driving on a toll road. This invoice is sent repeatedly, please service your debt in the shortest possible time.

Here's a link to an article on the BBB about the same scam; Scammers Pose as E-ZPass to Collect ‘Unpaid Tolls’