{"id":1926,"date":"2013-01-30T16:10:34","date_gmt":"2013-01-30T07:10:34","guid":{"rendered":"http:\/\/www.joewein.net\/blog\/?p=1926"},"modified":"2013-01-30T16:12:58","modified_gmt":"2013-01-30T07:12:58","slug":"garcinia-cambogia-weight-loss-spam-from-hacked-yahoo-accounts","status":"publish","type":"post","link":"https:\/\/joewein.net\/blog\/2013\/01\/30\/garcinia-cambogia-weight-loss-spam-from-hacked-yahoo-accounts\/","title":{"rendered":"Garcinia Cambogia weight loss spam from hacked Yahoo accounts"},"content":{"rendered":"

I’m seeing another round of weight loss spam that abuses third party Yahoo accounts for sending. It is similar to the earlier “Raspberry Ultra Drops”<\/a> weight loss spam that also used compromised Yahoo accounts.<\/p>\n

Here is one of the advertised domains, which is hosted on many different servers:<\/p>\n

biggsetfatburningsecret.com. 1439 IN A 91.207.7.134
\nbiggsetfatburningsecret.com. 1439 IN A 94.75.193.33
\nbiggsetfatburningsecret.com. 1439 IN A 94.75.193.38
\nbiggsetfatburningsecret.com. 1439 IN A 142.0.79.134
\nbiggsetfatburningsecret.com. 1439 IN A 142.0.79.140
\nbiggsetfatburningsecret.com. 1439 IN A 176.53.119.24
\nbiggsetfatburningsecret.com. 1439 IN A 176.53.119.27
\nbiggsetfatburningsecret.com. 1439 IN A 176.53.119.68
\nbiggsetfatburningsecret.com. 1439 IN A 176.53.119.69
\nbiggsetfatburningsecret.com. 1439 IN A 198.144.156.42
\nbiggsetfatburningsecret.com. 1439 IN A 199.116.117.166
\nbiggsetfatburningsecret.com. 1439 IN A 199.127.98.117\n<\/p><\/blockquote>\n

The domain is registered through Ukrainian registrar ukrnames.com using forged WHOIS contact details.<\/p>\n

The buy link on that site redirects to authenticgreencoffee.com, a domain registered last July, with the owner hidden behind a WHOIS proxy.<\/p>\n

Other domains hosted on the same servers, some of which are part of the “Work from home mom” scam series:<\/p>\n

bestfoodsforburningfat1.com
\nbiggsetfatburningsecret.com
\nbiggsetweightlosssecret.com
\nbigjim-foods.com
\nblogprogramflatstomach.com
\nblogquickprogramdiet.com
\nburnfatinfewdays.com
\ndietsforburningfat.com
\neatingplansforweightloss.com
\ngetflatstomachtoday.com
\ngetweightlossandburnfat.com
\nicbs-news.com
\nicm-news.com
\nircnn-news.com
\nlosingweightrapidly.com
\nmnc-news.com
\nmyscecretweightlosssolution.com
\nneverseeweightlossagain.com
\nplantipsflatstomach.com
\nplantodayflatstomach.com
\nrapidweightloss-blog.com
\nrealmenshealthblog.com
\nrevolutionarydiet2013.com
\nrevolutionarydietformula.com
\nrevolutionarydietloss2013.com
\nrevolutionarydietsolution2013.com
\nrevolutionarydietsolutions.com
\nrevolutionarydietweightloss.com
\nrevolutionarydietweightloss2013.com
\nrevolutionarydietweightlosssolution.com
\nrevolutionarydietweightlosssolution2013.com
\nrevolutionaryfatburning.com
\nrevolutionaryfatburningformula.com
\nrevolutionaryfatburningmethod.com
\nrevolutionaryflatstomachsystem.com
\nrevolutionarynaturaldiet.com
\nrevolutionarynaturalweightlosssystem.com
\nrevolutionaryweightloss1.com
\nrevolutionaryweightloss2013.com
\nrevolutionaryweightlossdietplan.com
\nrevolutionaryweightlossdietsolution.com
\nrevolutionaryweightlossdietsolutions.com
\nrevolutionaryweightlossplan.com
\nrevolutionaryweightlosssolution.com
\nsecretultrafastdiet.com
\nsolutionflatstomachsecretsnow.com
\nsolutionflatstomachtoday.com
\nsolutionwithweightonline.com
\nthebigjim.com
\ntipsflatstomachquick.com
\ntipsflatstomachsystem.com
\ntipsprogramflatstomach.com
\ntodayblogflatstomach.com
\ntodayflatstomachblog.com
\ntodayflatstomachquick.com
\ntodayquickflatstomach.com
\nultrafastsecretsdiet.com
\nweightlossgreatnews.com
\nweightlossthatworkisnotmagicpill.com<\/p><\/blockquote>\n

The “work at home mom” scam series also used hacked Yahoo accounts for advertising websites that are made to look like network TV news sites, so these scams are probably related.<\/p>\n

The spam senders are often abusing mail interfaces meant for mobile phones. The Yahoo message IDs of the spams contain some of these strings:<\/p>\n

.androidMobile@web
\n.BPMail_high_noncarrier@web
\n.BPMail_high_carrier@web
\n.BPMail_low_noncarrier@web
\n.BPMail_low_carrier@web<\/p><\/blockquote>\n

Probably “.androidMobile” is for use by the Yahoo Mail for Android app, though the spam is not necessarily sent from Android phones. More likely it is just using the servers provided for Android, but accessing from a PC.<\/p>\n

The “BPMail” IDs are an interesting one. I suspect the “_noncarrier” variants involve IP addresses not connected to one of the phone carriers that bundle Yahoo mail with their service, while the “_carrier” variants mean the IP address is part of the provider’s address pool, though it could be used by a PC accessing via a wireless broadband modem. <\/p>\n

“High” and “low” could be an internally assigned spam rating, though that is mere speculation. However, “.BPMail_high_noncarrier” is the most common Google hit of these 4 that comes up when searching for information about this type of spam. When investigating a pool of spam samples, this was the order of declining frequency: “.BPMail_high_noncarrier” was by far the most frequent, followed by “.BPMail_high_carrier” and finally relatively small numbers of “.BPMail_low_noncarrier” and “.BPMail_low_carrier”.<\/p>\n

The spam recipients (common numbers: 1, 3, 9 or 10) tend to include the last addresses the legitimate owner of the Yahoo account has emailed. So perhaps the spammers are harvesting email addresses from the “Sent” folder of the Yahoo account after gaining access to it.<\/p>\n

I find it amazing that Yahoo has yet to find a away to close the vulnerability that allows this spam and fraud to continue, despite the months and years since it was first observed.<\/p>\n","protected":false},"excerpt":{"rendered":"

I’m seeing another round of weight loss spam that abuses third party Yahoo accounts for sending. It is similar to the earlier “Raspberry Ultra Drops” weight loss spam that also used compromised Yahoo accounts. Here is one of the advertised … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,6,21,2],"tags":[],"class_list":["post-1926","post","type-post","status-publish","format-standard","hentry","category-android","category-fraud","category-scams","category-spam"],"_links":{"self":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/comments?post=1926"}],"version-history":[{"count":4,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1926\/revisions"}],"predecessor-version":[{"id":1930,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1926\/revisions\/1930"}],"wp:attachment":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/media?parent=1926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/categories?post=1926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/tags?post=1926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}