Search Engine Optimization & Web Hosting Solution

TOKYO (MacHouse) - More than 17 hours ago, an organized spam terrorist group sent out at least 3 copies of an e-mail message. (See Screenshot 01.) Sender’s e-mail address is shown as music@help-customer.org. The title of the message is shown as ‘Download New Version of iTunes.’ If he or she clicks on any of the links shown in the message, the mail recipient will eventually reach a website looking as if it were an official iTunes download site.

Screenshot 01 - Source: MacHouse

Screenshot 02 - Source: MacHouse

Screenshot 03 - Source: MacHouse

The actual sender of the message is most likely help-custometer.org itself with no question. The header doesn’t appear to be altered. (See Screenshot 03.) Although WhoIs information on this domain suggests that it’s registered in Panama, the domain itself is run by an organized spam sender called Lucky Solution ISP. We have seen the name several times behind spamming acts. According to the Spamhaus Project, another identity of Lucky Solution ISP is Expedite Media Group. (See Screenshot 05.) Furthermore, if you run a traceroute search on a spam-hosting nameserver, you often end up with an ISP named Internap Network Services Corporation (internap.com), which the Spamhaus Project also suggests affiliated with Lucky Solution ISP.

Screenshot 04

Screenshot 05 - Source: spamhaus.org

Screenshot 06 - Source: get-itunes-today.com

The actual sponsor of this spam terrorist act is the website of get-itunes-today.com. (See Screenshot 06.) This website is installed apparently to make it look like that one can download iTunes for free. But iTunes is a freeware title from Apple, Inc. in the first place. At the center of the top webpage, it says “Take any video or DVD movie and use our handy conversion software. Convert and transfer to your iPod.” If you believe this statement is true, then you may want to ask them “Does that software title have a name?,” “What are system requirements?” and “Where can I see more information on this software?” This website also suggests that they run the iTunes Store. (See the left bottom corner of Screenshot 06.) But doesn’t Apple, Inc. run the iTunes Store? Why would you need their help in accessing the iTunes Store?

So why should one go to this website and download iTunes? In fact, if you click on any link that says ‘download iTunes free!,’ ‘Download Now,’ ‘Join Now’ or ‘Get Instant Access,’ you will be forwarded to a membership page. (See Screenshot 07-9.)

Screenshot 07 - Source: secure.signupsecurity.com

Screenshot 08 - Source: secure.signupsecurity.com

Screenshot 09 - Source: secure.signupsecurity.com

By the way, we have seen this sort of scam somewhere else, right? It’s the same affiliate package used by the websites of livetv-now.com, www.online-tvnetwork.com and others.

So where is the website of get-itunes-today.com hosted? Two of the nameservers designated by this website are ns1.misk.com and ns2.misk.com. And these nameservers lead us to www.misk.com, which runs a domain registration service. (See Screenshot 10.) They also seem to offer a web hosting service. But we are not sure if the website of get-itunes-today.com is really hosted here. So let’s take a look at Screenshot 06 again. If you place your Mouse over Download Now, Join Now, Get Instant Access and others, the status bar will tell you that the forwarding link is http://64.15.143.9/get-itunes-today_com/join.asp?revid=none&domain=Get-iTunes-Today.com.

Screenshot 10 - Source: misk.com

Screenshot 11

Screenshot 12 - Source: iweb.com

Okay… So who’s behind the IP address of 64.15.143.9? If we trace this IP address, it looks like it’s been used by a Canadian web hosting company called iWeb Technologies Inc. (See Screenshot 12.) If you access http://64.15.143.9/get-itunes-today_com/, you will see the exactly same content that we see in Screenshot 06. (See Screenshot 13.)

Screenshot 13 - Source: Unknown

Screenshot 14 - Source: whois.domaintools.com

Screenshot 15 - Source: whois.domaintools.com

Finally, who is behind this iTunes scam operation? We don’t have the ultimate answer. But it’s interesting to note that help-custometer.org and get-itunes-today.com share the same WhoIs information. (See Screenshot 14-5.) Nonetheless, this registration information has been used by many spam domains these days.






p.s. iWeb has confirmed that the IP address of 64.15.143.9 belongs to them and that the scam website is hosted there.













References:

The Spamhaus Project - Brian Kramer / Expedite Media Group
Another Free Satellite TV Scam Website Found at INTERNETTVACCESS.COM
Free Satellite TV Scam Website Hosted at SIBERNAME.COM Again
What Happened to LIVETV-NOW.COM?
LIVETV-NOW.COM Sponsors Spam Messages Sent by CLIENTSSUPPORT.NET

********** ********** ********** ********** ********** ********** ********** **********

MacHouse is not funded by tax payers' money. We have limited resources. We also need time to sleep and eat just as others. So we will not act as the International police to contact all victims of website abuse. All you have to do is to subscribe to spam messages and spam posts. If we can, why don't you?