November 27, 2011

Spam and email threat analysis for the week ending Nov 27, 2011

For the fourth week in a row my spam volume and percentage has dropped, this time by 6% from the previous week, down to 24%. Malware bearing emails were completely gone this week.

The top category of spam last week was Russian Bride dating scams. It's hard to believe that anybody in an English speaking country would fall prey to the ridiculous and poorly worded messages sent by Russian criminals posing as prospective dating partners for Americans or Canadians. The entire purpose of these scams is to develop a relationship, then exploit it for monetary gain. It is an easy way for cyber criminals tpo obtain your credit card details and sell them on Russian "carder" forums.

Aside from the Russian Bride scams, the other significant categories of spam were for pirated software, hosted on Ukrainian domains, fake pharmaceuticals and male enhancement pills, fake diplomas, counterfeit watches and illicit weight loss drugs.

The following are the categories of spam, by percentage, from November 21 through 27, 2011, as obtained from my anti-spam program: MailWasher Pro.

During the last week I received 411 email messages, to all of my accounts. Of those, 100 were classified as spam by MailWasher Pro, which is 24% spam. My custom Blacklist auto-deleted 10 spam messages and 7 more were deleted by the DNS Blacklists built into MailWasher Pro. My personal spam filters accounted for 83 and I reported 14 spam messages to SpamCop.

Here are the categories of spam as classified by my custom spam filters.

Russian Bride Dating Scams: 13.00%
Other, miscellaneous categories: 12.00%
Blacklisted senders, from my own blacklist: 10.00%
Ukrainian Spam Domain Links (.com.ua) (all pirated software): 9.00%
Counterfeit Replica Watches: 8.00%
Pharmaceuticals: 7.00%
DNS Blacklists of spam servers: 7.00%
Male Enhancement: 7.00%
Fake Diplomas: 7.00%
Russian (.RU) spam domain links: 6%
Counterfeit Cialis: 5.00%
Weight Loss scams (HCG): 5.00%
Counterfeit Name Brand Goods: 4.00%

The above stats were derived from MailWasher Pro and most were classified by anti-spam filters I write and publish. I frequently update these filters.

The following updates were made to my spam filters this week.

Casino Spam,
Known Spam [From] (Rock Cruit Management Money Mule job scams),
Male Enhancement [S]
Misspelled Viagra,

I made 0 additions to my custom blacklist (individual email addresses and wildcard Regular Expressions):


MailWasher Pro is a POP3 email client spam filter
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

November 24, 2011

Web hosting special at HostGator: 50% Off, Extended to Nov 28

UPDATED on Nov 28, 2011, for Cyber Monday!

Are You Looking for Web Hosting With Quality Support? 24/7 Support Via Phone, Live Chat, and Email! Look no farther! HostGator is having its annual Black Friday Cyber Monday half price sale, beginning at 12:01 AM, November 28, and running until 11:59 PM, Nov 28, 2011, CST. All hosting types are included, from shared annual , to monthly, to dedicated servers.

The time zone conversions should revolve around Central Standard Time as the reference. So, if you are in the Eastern time zone, the sale begins at 1 AM Nov 28 and ends at 12:59 AM on Nov 29. You will know if you are within the sale time because the HostGator website has been updated for the 50% off deal.

Here are the details for the Black Friday Cyber Monday sale:

50% OFF on ALL hosting services. This includes shared hosting (as low as $2.48/month prepaid), reseller hosting, VPS hosting, Dedicated servers and Windows hosting! This does not include domain names.

Purchasers do NOT need to insert a coupon code to receive the special. The correct coupon code will automatically be inserted on all orders placed on Black Friday.

The discount applies to the clients first invoice. HostGator's VPS and dedicated server hosting services are only available on a monthly basis, therefore the promotion will apply to only the first month.


Get hosted with HostGator, for half price

Read the details about HostGator's various webhosting accounts

If you are ready to open an account with HostGator, Use this link.

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

November 20, 2011

Spam and email threat analysis for the week ending Nov 20, 2011

For the third week in a row my spam volume and percentage has dropped, this time by 3% from the previous week. Also, the number of malware bearing emails was way down from previous weeks, with just 9 messages with malware attachments arriving this week.

The top categories of spam last week were for Male Enhancement, weight loss tablets and pirated software (on Ukrainian .com.ua domains). The remainder were filled by spam for replica watches, Russian bride dating scams, some fake diploma spam and Money Mule job recruitment scams. Malware bearing email threats were fake alerts about canceled ACH transfers and payments, failed direct deposits, etc. They contained Trojans that silently steal your logon credentials to your online banks, then empty them of your savings.

The following are the categories of spam, by percentage, from November 14 through 20, 2011, as obtained from my anti-spam program: MailWasher Pro.

During the last week I received 390 email messages, to all of my accounts, which is exactly the same amount as last week. Of those, 119 were classified as spam by MailWasher Pro, which is 30% spam. My custom Blacklist auto-deleted 9 spam messages. My spam filters accounted for 110 and I reported 19 spams to SpamCop.

Here are the categories of spam as classified by my custom spam filters.

Male Enhancement: 17.65%
Weight Loss scams (HCG): 14.29%
Ukrainian Spam Domain Links (.com.ua) (pirated software): 11.76%
Other, miscellaneous categories: 9.24%
Russian Bride Dating Scams: 8.40%
Counterfeit Viagra: 8.40%
Blacklisted senders, from my own blacklist: 7.56%
Counterfeit Replica Watches: 5.88%
Counterfeit Cialis: 5.04%
Pharmaceuticals: 5.04%
URL Shortener spam links: 3.36%
Zip (malware!) Attachment: 3.36%

The above stats were derived from MailWasher Pro and most were classified by anti-spam filters I write and publish. I frequently update these filters.

The following updates were made to my spam filters this week.

Ukrainian spam domain links,
Replica Watches,
Work At Home Scam (#2 for version 6.x)

I made 1 addition to my custom blacklist (individual email addresses and wildcard Regular Expressions):

+@*nacha.+

That wildcard email entry into the blacklist blocks all of the current incarnations of ACH scams that use "nacha" in the email address.

MailWasher Pro is a POP3 email client spam filter
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

November 13, 2011

Spam and email threat analysis for the week ending Nov 13, 2011

For the second week in a row my spam volume and percentage has dropped, this time by 5% from the previous week. Also, the number of malware bearing emails was down from previous weeks. There was a new entry into the malware scams: Postal delivery failures.

Most of last week's spam was for pharmaceuticals (including Viagra and Cialis), from fake pharmacies, male enhancement pills, Russian brides, pirated software (on Ukrainian .com.ua domains) and replica watches. There were a measurable amount of serious security threats present in three major categories: Wire Transfer and Tax Submission fraud, Courier and Postal Service scams and Money Mule job recruitment scams. These security threats came in attached files containing Trojans, or via links to malware serving websites.

I personally notified one website owner that new folders on his website, containing JavaScript includes to malware servers in Russia, were being used in spam links. Due to my taking the time to contact him, he was able to remove those threats. More people need to get involved in notifying webmasters who are unaware that their websites have been compromised by criminals.

Without any further ado, here are the categories of spam, by percentage, from November 6 through 13, 2011, as obtained from my anti-spam program: MailWasher Pro.

During the last week I received about 390 email messages, to all of my accounts. Of those, 130 were classified as spam by MailWasher Pro. That is 33% spam. My custom Blacklist did a good job of blocking all manner of spam and scams sent from domains on my blacklist.

Here are the categories of spam as classified by my custom spam filters.

Ukrainian Spam Domain Links (.com.ua) (pirated software): 28.66%
Pharmaceuticals: 15.92%
Viagra: 10.19%
Counterfeit Replica Watches: 9.55%
Blacklisted senders, from my own blacklist: 8.28%
Russian Bride Dating Scams: 7.01%
Male Enhancement: 5.10%
Tax Fraud malware scams:3.82%
Money Mule job recruiter scams:3.82%
Other, miscellaneous categories: 3.18%
DNS Blacklist Servers: 1.91%
Courier malware scams: 1.27%
URL Shortener spam links: 1.27%

The above stats were derived from MailWasher Pro and most were classified by anti-spam filters I write and publish. I frequently update these filters.

The following updates were made to my spam filters this week.

Misspelled Viagra,
Wire Transfer Fraud.
New Filter: From India.
New Filter: Tax Fraud (EFTPS).
New Filter: Postal Service Scam

I made 4 additions to my custom blacklist (individual email addresses and wildcard Regular Expressions):

*.sdfdsf@+
[email protected]
info.manager@+.gov
@usps.net

MailWasher Pro is a POP3 email client spam filter
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

November 7, 2011

Spam and email threat analysis for the week ending Nov 6, 2011

This week, I saw a significant, 22% drop in the amount of email spam from the week before. The overall amount of spam was also down from the previous week, as were the number of threats carried in email messages.

While most of last week's spam was for the usual pharmaceuticals, male enhancement, Russian brides, pirated software, fake diplomas and Nigerian 419 scams, there was a fair amount of of security threats present in two major categories: ACH fraud and Money Mule job scams.

The ACH scams are old hat now and contain links to Trojan exploit servers in Russia, using a recurring theme about a cancelled money transfer from your bank to another un-named bank. The devil is definitely in the details for those scammed into clicking on the link in those messages. Fortunately, there weren't as many as there were a week or two ago. Read my blog article about how to block the fake ACH notices.

I just wrote an article two nights ago (Nov 5, 2011), about the Money Mule job scams making the rounds. The email spam blast that is continuing to come in all have the same body text as the one I quoted in that article. Please read the article if you need to verify that a job offer you got in your inbox is a Russian Money Mule or Reshipping scam. I don't want any of my readers falling victim to a money laundering or stolen goods trafficking scam.

Without any further ado, here are the categories of spam, by percentage, from October 30 through November 5, 2011, as obtained from my anti-spam program: MailWasher Pro.

During the last week I received about 450 email messages, to all of my accounts. Of those, 170 were classified as spam by MailWasher Pro. That is about 38%. My custom Blacklist did extremely well in blocking all manner of spam and scams sent from domains on my blacklist.

Here are the categories of spam as classified by my custom spam filters.

Ukrainian Spam Domain Links (.com.ua): 22.27%
Blacklisted senders, from my own blacklist: 13.74%
Male Enhancement: 10.43%
Russian Bride Dating Scams: 9.95%
Other, miscellaneous categories: 9.48
Counterfeit Watches: 8.53%
Money Mule job scams: 6.64%
Fake Diplomas: 4.74%
Pharmaceuticals: 4.27%
Cialis: 3.79%
Viagra: 3.79%
Pirated Software: 2.37%

The above stats were derived from MailWasher Pro and most were classified by anti-spam filters I write and publish. I frequently update these filters. The following updates were made to my spam filters this week.

Courier Scam #4,
Money Mule Scam,
Nigerian 419 Scam #3,
Work At Home Scam #1.
Work At Home Scams split into 2 filters, for version 6.x.
New Filter: Wire Transfer Scam

I made no additions to my custom blacklist (wildcard expression):


MailWasher Pro is a POP3 email client spam filter
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

November 5, 2011

Work at home Money Mule job scams abound with holidays approaching

For the last week or so, I have seen a steady increase in the number of illicit work at home job scams arriving by email. So far, just this morning, I have seen 5 different subjects, with slightly different "reference" numbers, all spoofed as coming from one of my own email addresses. This coincides with the approaching Black Friday and Christmas shopping season in the US and Canada.

I have no doubt that my readers are also seeing more mysterious online job offers arriving by unsolicited email (spam). With so many of us struggling to make ends meet, in a middle that keeps getting farther apart, some of you may be tempted to reply to such an offer. Please don't do it! It is a scam and will get you in big trouble. Let me explain...

Work at home job scams have been around for well over a dozen years. In recent years the people running these scams have found that it is more profitable to recruit hapless individuals, in desperate search of a job, into a money laundering, or stolen goods reshipping scheme, than to cheat them out of a few dollars over a fake envelope stuffing, or medical billing position.

What is a money mule?

A Money Mule is a person who knowingly, or unknowingly receives stolen, or illegally obtained funds, allows them to be deposited into their own bank, then transfers that money from their bank to another one, located in another country. This act is known as Money Laundering. The illicit money comes to them by means of the use of banking key loggers, like the Zeus or SpyEye, or by illegal activities like arms or drug sales, or extortion. Sometimes, the money being laundered is done so on behalf of known terrorist organizations.

What is a reshipper scam?

A reshipper scam is where a person is recruited for a job where they receive physical goods delivered by the post office or a parcel delivery service, which they repackage, or re-label, then reship them to a specified, foreign destination. The reshipper may or may not be aware that these goods were obtained with stolen credit or debit cards.

In both of these "job" descriptions, in most civilized, law abiding countries, serious laws are being broken by all participants in these schemes. Money Mules are easily tracked down when victims notify the Police about money illegally transferred out of their bank accounts. The banks have a money trail for all money transfers. Most Money Mules are told to set up a direct deposit account, to receive and transfer stolen funds. As I mentioned earlier, this is known as "Money Laundering" - which is a Federal Felony in the USA and Canada, punishable by lots of time in a Federal Penitentiary and huge fines.

Reshipping job participants are involved in moving stolen merchandise (from auction sites, office supply, computer and electronics stores, catalog stores, etc) to offshore recipients. All reshipping mules are guilty of felonies for trafficking in stolen goods.

How can one tell if an online job offer is really a Money Mule, or reshipping scam?

Here is where you need some street smarts, as well as a good amount of awareness about Internet scams. Sometimes, a person's common sense may let them down when their back is against the wall, financially. Don't let your guard down! The little you now have may all be taken from you, either by the criminals you are working for, or the Authorities, when you are traced and busted.

The way that they get your name varies. Most of the time it is just a blind spam blast, to all recipients in a particular country, from a spam database they bought, or compiled. Sometimes, the recruiters pay underlings to search through job wanted ads where people leave a resumé and identifiable information and a contact email address.

The first thing to look for is the name and website of the sender. A legitimate job offer will include plenty of details about the sender's organization and how they came to contact you. All links will actually point to their domain and not some odd URL with no connection to an agency specified in the email message. Any reply to or contact information will be on the website mentioned in the email headers and body text. Finally, the sender's email address will definitely not be your own address! That is a dead giveaway that the message is a scam!

A typical Money Mule or reshipper scam email resembles the following one that I received earlier today.

From: ME! One of my email accounts
To: Same account
Subject: Work offer inside

Body text main key phrases:


We have an excellent opportunity for an apprentice applicant to join a rapidly expanding company.

An at home Key Account Manager Position (Ref: 41324-385/6HR) is a great opportunity for stay at home parents or anyone who wants to work in the comfort of their own home.

This is a genuine offer and not to be confused with scams!

You will be processing orders from your computer. How much you earn is up to you.
The average is in the region of US$600- US$750.00 per week, depending on whether you work full or part time.

Our contacts: [email protected]


The contact email address given in the message body is a known fake job domain. The current trifecta of Money Mule recruitment domains is: jobsearchoo.com, newstatejob.com and usanewjobgov.com. They replaced many earlier domains and will soon be replaced with others. Most anti-spam filters are able to recognize known spam domain links and email addresses and blacklist them for your protection.

If you think you will get in, make some quick money and get out fast, think again! Most of the time, Money Mules and reshippers are cut loose before their first payment is due. The agencies who were in constant contact with you for the first few weeks will be nowhere to be found when your first payday approaches. Your bank account may also be fully emptied. Only the most valuable recruits are actually paid and allowed to continue. Those folks are not blind to what is going on; they are willing accomplices and criminals themselves. They also face long, hard jail time if/when caught.

The criminals running these scams leave nothing to chance. They have your real address, phone number, DOB, SS#, place of work, spouse's name and bank account on file, before they "trust you" enough to begin dropping stolen money into your bank account. Mules who contemplate taking the money and running would be better off in jail, in solitary confinement. The people running these scams may live abroad, in Eastern Europe, but they have powerful and dangerous contacts in most Western countries, whom they are willing to pay to track down people who try to scam them back.

Many of the Money Mule/Reshipper scams are now run by Russians, Latvians, Ukrainians and Romanians. The laws in those countries have yet to catch up with those in the US and Canada, regarding financial or merchandise theft committed in other countries. When a Mule transfers money, or reships merchandise, it is typically to one of those countries, or another in Eastern Europe.

Protection for MailWasher Pro users

If, like me, you use MailWasher Pro to screen your incoming POP3 email for scams, spam, and malware threats, I have written and published filters, that I keep updated as needed, which block Money Mule and Work At Home scams. All of my filters are available on my Custom MailWasher Pro Filters page. The spam filters are available for both the old and new versions of MailWasher, which use different formats. The ones relevant to this article are labeled: "Money Mule Scam" and "Work At Home Scam" (1 and 2, for version 6.x).

Facebook Twitter LinkedIn Pinterest Instapaper Google+ Addthis

back to top ^

Blog Links

Sponsored Message

I recommend Malwarebytes to protect your computers and Android devices from malicious code attacks. Malwarebytes detects and blocks spyware, viruses and ransomware, as well as rootkits. It removes malware from an already infected device. Get an 18 month subscription to Malwarebytes here.

If you're a fan of Robert Jordan's novels, you can buy boxed sets of The Wheel Of Time, here.

As an Amazon and Google Associate, I earn commissions from qualifying purchases.


CIDR to IPv4 Address Range Utility Tool | IPAddressGuide
CIDR to IPv4 Conversion



About the author
Wiz FeinbergWiz's Blog is written by Bob "Wiz" Feinberg, an experienced freelance computer consultant, troubleshooter and webmaster. Wiz's specialty is in computer and website security. Wizcrafts Computer Services was established in 1996.

I produce this blog and website at my own expense. If you find this information valuable please consider making a donation via PayPal.

Follow @Wizcrafts on Twitter, where I post short updates on security issues, spam trends and things that just eat at my craw.

Follow Wizcrafts on Twitter


Malwarebytes' Anti-Malware is the most frequently recommended malware removal tool in malware removal forums, like Bleeping Computers. It is extremely effective for removing fake/rogue security alerts, Bots, Spyware and the most prevalent and current malware threats in the wild. Learn about Malwarebytes Anti-Malware.


MailWasher Pro is an effective spam filter that protects your desktop email client. Using a combination of blacklists and built-in and user configurable filters, MailWasher Pro recognizes and deletes spam before you download it. MailWasher Pro reveals the actual URL of any links in a message, which protects you from most Phishing scams. Try it free for 30 days.





Creative Commons License This weblog is licensed under a Creative Commons License.
The content on this blog may be reprinted provided you do not modify the content and that you give credit to Wizcrafts and provide a link back to the blog home page, or individual blog articles you wish to reprint. Commercial use, or derivative work requires written permission from the author.
Powered by Movable Type

back to top ^