Click here to get back home

adwords scam email (new?)

 HomeNewsGroups | Search | About
 alt.www.webmaster    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
adwords scam email (new?) freemont 06-24-2008
Posted by freemont on June 24, 2008, 2:57 pm
Please log in for more thread options
Showed up in Inbox today:

<quote>
Dear Advertiser,

We were unable to process your payment. Your ads will be suspended soon
unless we can process your payment. To prevent your ads from being
suspended, please update your payment information.

Please sign in
to your account at http://adwords.google.com/select/login, and update your
payment information.

We look forward to providing you with the most effective advertising
available. Thank you for advertising with Google AdWords.
------------------------------------------------------- The Google AdWords
Team --
</quote>

The url actually goes to http://www.adwords.google.com./

That url with the dot at the end loads a page that looks like AdWords, but
Opera protests the server's certificate doesn't match its hostname. Some
interesting headers:

Subject:
Your ads are not running.
From:
Return-path:
X-Mailer:
Microsoft Outlook, Build 10.0.2616

Oh, and BTW I have never used AdWords.

--
"Because all you of Earth are idiots!"
¯`·.¸¸.·´¯`·-> freemont© <-·´¯`·.¸¸.·´¯

Posted by Mark Goodge on June 24, 2008, 3:27 pm
Please log in for more thread options
On Tue, 24 Jun 2008 18:57:43 +0000, freemont put finger to keyboard
and typed:

>Showed up in Inbox today:
>
><quote>
>Dear Advertiser,
>
>We were unable to process your payment. Your ads will be suspended soon
>unless we can process your payment. To prevent your ads from being
>suspended, please update your payment information.
>
>Please sign in
>to your account at http://adwords.google.com/select/login, and update your
>payment information.
>
>We look forward to providing you with the most effective advertising
>available. Thank you for advertising with Google AdWords.
>------------------------------------------------------- The Google AdWords
>Team --
></quote>
>
>The url actually goes to http://www.adwords.google.com./
>
>That url with the dot at the end loads a page that looks like AdWords, but
>Opera protests the server's certificate doesn't match its hostname.

It looks like an example of Rule #3. My guess is that the attempted
phish was generated by a script which is supposed to add the actual
compromised site after the dot, thus generating a URL like this:

http://www.adwords.google.com.compromised.example.com/

(Except that it would probably have been obfuscated more than that)

This sort of bodged spam or phish is actually quite common. I see a
fair amount of spam addressed to "Dear %firstname %lastname", or
variants thereof, as well as broken phishing URLs. The real clues, as
always, are in the headers which mark it as non-genuine.

Mark
--
Stuff, some of it good, at http://www.good-stuff.co.uk
"Let's see colours that have never been seen"

Posted by Ex_OWM on June 26, 2008, 7:41 am
Please log in for more thread options

> Showed up in Inbox today:
>
> <quote>
> Dear Advertiser,
>
> We were unable to process your payment. Your ads will be suspended soon
> unless we can process your payment. To prevent your ads from being
> suspended, please update your payment information.
>
> Please sign in
> to your account at http://adwords.google.com/select/login, and update your
> payment information.
>
> We look forward to providing you with the most effective advertising
> available. Thank you for advertising with Google AdWords.
> ------------------------------------------------------- The Google AdWords
> Team --
> </quote>
>
> The url actually goes to http://www.adwords.google.com./
>
> That url with the dot at the end loads a page that looks like AdWords, but
> Opera protests the server's certificate doesn't match its hostname. Some
> interesting headers:
>
> Subject:
> Your ads are not running.
> From:
> Return-path:
> X-Mailer:
> Microsoft Outlook, Build 10.0.2616
>
> Oh, and BTW I have never used AdWords.

I've got it several times over last few weeks and as I, like you, have never
used adwords, it was easy enough to identify as a scam.



Similar ThreadsPosted
Is this a scam message? February 27, 2006, 12:11 pm
BrainFox Scam! April 29, 2006, 11:46 am
Scam Methods September 5, 2006, 10:43 pm
SCAM ALERT November 24, 2006, 6:22 pm
Totalnic/Pacnames Latest Scam? February 16, 2005, 8:59 pm
Id theft, the lowest scam (article) January 6, 2006, 12:19 pm
Acunett.com web-hosting = fraud, total scam. April 24, 2006, 4:12 pm
Consumer Warning about MICFO.COM Hosting -Credit Card Scam- March 7, 2007, 10:46 pm
adwords.....need help March 29, 2006, 2:00 am
Adwords November 14, 2006, 4:23 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap