PC-Armor Computer Security News Blog

“Referral Notice”

March 17, 2008 on 3:18 pm | In E-Mail Scams | 1 Comment

Greetings,

We have been busy working on a new look and some new offerings to PC-Armor, so we haven’t been writing any new blog stories lately. However, there are some things you might want to keep an eye out for…

First, the NCAA Basketball Championships are now in full swing and you can expect to see a ton of emails with subjects related to this tournament. We had many, many spams come into the PC-Armor blog as comments today and some of the key words in the spam messages you might look for are: Online Sports Book, March Madness, Final Four Betting, Basketball Betting, and NCAA.

Secondly, I received 4 new spams on my personal email account today with the subject of “Referral Notice” and all of them were from an overseas source. The body contained the following text:

–Registered and USDA/FDA apprv.–

Compliant Email Notification:Referral based

We are pleased that you were referred
to us. We would like to invite you to
our special website only available to
existing customers. As a referral we
are extending this oppourtunity for
you to become a customer. Please
see how our products can be of
assistance to you

Peter W. Johnson
New Customer Manager

http://registeredfda[dot]com

Well, I searched the domain name on DNSStuff.com and found that the domain was registered on March 14, 2008 to a company located in China. Anyone who reads security articles, blogs, or other computer security-related sources, understands that many malicious sites are located in China.

Obviously, I did not click the link for the following reasons:

1. It was registered 3 days ago. Many malicious sites are registered just before emails from the domain start flooding inboxes.

2. It is located in China and I simply would prefer to not risk an infection from a domain hosted in a country where many malicious sites originate.

3. The email states it is USDA/FDA approved. Why would the US Government be approving emails from China?

4. They are extending an “opportunity” for me to become a customer. Who are they and what is their product?  Also, they have extended this “special” website to “existing” customers…how many existing customers can they accumulate in just 3 days?

5. The sending email address was spoofed and the address the email was supposedly sent to was not my address. I left this information out; but what is important here is that I checked and nothing made sense.

As always, question all emails; no matter how legitimate they may appear.  You may save yourself time and money in the long run by taking a few extra steps to ensure an email is legitimate and preventing an infection or compromise!