80% of "Olympic" domains are scams and spam

Today we looked at all identified domains containing the string "olympics", which had been accessed by our customers over the course of a day. It turns out that 80% of them are scams or spam and they can be classified into three main categories.

Typo squatting

Spammers can take advantage of users making mistakes when typing a domain name directly into the browser address bar by purchasing domain names close to their intended target - for example: gooogle.com (3 letter o's) or gogle.com (1 letter o) for google.com, yaho.com or yaoo.com for yahoo.com, etc.

The main target of typo squatting in the US is the official NBC site for the Olympics: nbcolympics.com. Here are the domains that capitalize on user mistakes:

• cnbcolympics.com (extra c)
• nbcolympic.com (missing s in olympics)
• wwwnbcolympics.com (missing dot between www and nbcolympics.com)
• msnolympics.com (msn instead on nbc)
• nbolympics.com (missing c in nbc)
• nbcolympics.org (.org instead of .com)
• nnbcolympics.com (2 n's in nbc)
• mbcolympics.com (m instead of n in nbc)
• ncbolympics.com (c and b inverted in nbc)

These domains are mostly parked. They are covered with advertising in the hope that users will click on one of those links since there is no useful content on the page.

cnbcolympics.com

Domain names cost only about $10 and hosting can be free, so this can an effective way to make some money with a minimal initial investment.

"TV on PC" scam

Scams for receiving Cable/Satellite TV on a PC for a very low monthly fee are not new. Scammers are taking advantage of the Olympics to attract people who are ready to spend a few bucks to watch the games in real time.

Numerous pages, mostly parked on free hosting sites are created to redirect users to the TV scams. These redirection pages may be designed as reviews from users promoting the scam, or simple HTTP redirection scripts with no content actually displayed to the victim.

This technique is used by the largest number of "olympics" domains:

• londonolympics2012livestream1.webspawner.com
• london2012olympicslivestreamfreeonline.webspawner.com
• londonolympic2012tv.com
• olympics2012onipad.com
• watch2012olympicsonline.puzl.com
• olympics.gamelivehd.com
• londonolympics.chuckduck.info
• watcholympics2012live.com
• watchsummerolympics.com
• watch-olympics-online.info
• olympicstv.trueonlinetv.com
• watcholympicslivestreams.us
• olympic2012.livetelecast.us
• olympics2012london.tk
• olympic2012.onlinepremiumtv.com
• olympics2012live.onlinestreamingfree.net
• londonolympic.info
• london2012olympicslivestream.sitew.com
• olympicgames2012livestream.sitew.com
• watcholympics2012-openingceremonyonlinefree.sitew.com
• olympics2012lives.sitew.com

londonolympics2012livestream1.webspawner.com

TV scam after redirection: satellitedirect.com

"Made for Adsense" sites

"Made for Adsense" (MfA) sites are highly targeted websites that drive web traffic from search engines. They contain enough content to get listed in search engine results for as a specific query. They contain a lot of ads and encourage users click on them in order to get to some of the more interesting content. MfA sites typically have very few pages.

 Here are some examples related to the Olympic games:

• olympicstable.com
• 2012-london-olympics-news.com 
• olympic-games-2012-london.com
• olympicsgames.com
• olympicgames2012.com
• nbcolympica.com
• olympiczone.com

More ads than content: 2012-london-olympics-news.com

We've seen a few other scams - mostly old tricks revisited to fit the Olympic games.

• software to see the Olympic games that is actually spyware/adware: streamolympicsonline.com
• survey scams: olympics2012videoclips.vidrr.net

I guess the good news is that most of the scams are targeting 'low hanging fruit' and don't involve sophisticated exploits.

London Olympics Email Scams (updates)

In light of the popularity of the Olympics knowing that scammers will come out of the woodwork to take advantage of the event – we're continually monitoring for Olympic scams and maliciousness, no matter how unsophisticated. And so far, unsophisticated has been exactly what we have been seeing.

Here is an example of the standard sort of Olympics "lottery" pitch that we are seeing from the scammers over email:

Scam attachment

Below are a few updates for what we are currently seeing today:

Received: from [216.172.135.113] by web5710.biz.mail.ne1.yahoo.com via HTTP
From: Lottery Draws Notice [websjod@gmail.com]
Reply-To: internetaward166@gmail.com
Subject: View The E-Mail Attachment And Contact Your Claim Agent
Body: KINDLY OPEN THE ATTACHED FILE
Attachment: 2012 London Olympics Lottery Draws Notice.doc
Scammer email to send data: internetaward166@gmail.com

--

Received: from [173.245.64.182] by web180804.mail.gq1.yahoo.com via HTTP
From: London Olympics 2012 [bolympics111@gmail.com]
Reply-To: London Olympics 2012 [lon2012.0lympics@london.com]
Subject: Read the Attached Letter
Body: Read the Attached Letter
Attachment: LONDON OLYMPICS LOTTERY.pdf
Scammer email to send data: lon2012.0lympics@london.com

--

Received: from [209.73.132.40] by web5717.biz.mail.ne1.yahoo.com via HTTP
From: LONDON 2012 OLYMPICS LOTTERY [smithed2012@gmail.com]
Reply-To: 2012lonolympicsgames@london.com
Subject: Congratulation
Body: INTERNATIONAL PROMOTIONS LONDON 2012 OLYMPICS LOTTERY
Attachment: LONDON 2012 OLYMPICS 1-1.doc
Scammer email to send data: 2012lonolympicsgames@london.com

--

Received: from smtpout.telepacific.net ([208.57.218.234])
From: "Very.co.uk"[account@very.co.uk]
Subject: Account Bonus for Olympics 2012
Body: Dear Customer, Here is a notification that your account is due to be credited. Click on My Account below to accept this offer and also get a discount for the Olympics 2012.
Link: hxxp://contabilidadpymes.cl/images/login/en/index.html
This is a phishing page for very.co.uk online shopping site.

Very.co.uk phish page using Olympics as a driver

--

Received: from [67.195.23.211] by web184804.mail.gq1.yahoo.com via HTTP
From: LONDON OLYMPICS 2012 INTERNET LOTTERY ANNIVERSARY [i.olympic2012@london.com]
Reply-To: LONDON OLYMPICS 2012 INTERNET LOTTERY ANNIVERSARY [revgraigjon01@gmail.com]
Subject: You have won from London Olympic 2012
Body: Open the attachment
Attachment: LONDON OLYMPICS 2012.doc
Scammer emails: revgraigjon01@gmail.com, unclaimrevgraig@consultant.com

--

Received: from User ([217.16.182.244]) by redwood-mtg.com
From: "Mrs. Linda Joseph"[webinfo66@yahoo.com]
Subject: London 2012 Olympics Lottery Winner
Return-Path: webinfo66@yahoo.com
Body: basic scam email asking for victim banking info to be returned in order to claim winnings (summarized due to length)
Scammer email: webinfo66@yahoo.it

--

In addition to these, I’ve seen reports of scams using image files (e.g., JPGs) to by-pass content inspection checks (a common practice among scammers/spammers) containing the same sort of instructions for victims to send their banking information in order to claim their winnings.

In addition to scams, we have seen everything from gambling sites, online shops, TV/streaming services, news / social media sites, and even a florist sending email promotions using the Olympics as a marketing driver.

I will make updates to this post with anything new that I see over email throughout the Olympics, additionally I will make a separate post on the web angle.

London Olympics: Stay away from scams, data theft and phishing

The Summer Olympics in London have kicked off and cyber criminals, spammers and data thieves are wasting no time, capitalizing on Olympic related scams.  Currently, the volume of websites selling bogus Olympic tickets are on the rise. These sites normally propagate their campaings though unsolicited ad banners, popups, social networking sites and email messages. Let us examine one such site in detail.

This bogus site is liveolympictickets(dot)net, which also has a Facebook page as shown below:

The website claims to sell official tickets for the London Olympics. As you can see from the screen shots below, they have tried to retain the same
aesthetics as the official London 2012 site: [http://www.london2012.com/].  This bogus site allows you to add items to your shopping cart, checkout and pay using a credit card. It works just like any other normal ecommerce website.

The site also has external links which redirect to other websites that have the same kind of bogus tickets offers. Some of these sites include pay-per-click scams.

Let us try to examine what is happening in the background. When you type in your personal details such as email, address, phone no. etc., they get sent via plain text (no encryption). The same applies when credit card details are sent, exposing them on the network.

These websites do not have adequate security mechanisms in place, visiting and entering private information could lead to information leakage/theft. This website is just a needle in the haystack. There are numerous such sites which try to market fake promotions/live streaming/tickets. 


Stay away from these websites. The official London Olympics site maintains a list of websites which are known to sell fake tickets, check them before buying any tickets: [http://www.london2012.com/spectators/tickets/ticket-checker/]. 

If you are concerned about the legitimacy of a website, Zulu, Zscaler's cloud based URL risk analyzer can be used to check for malicous/spam/phishing sites etc. Visit [http://zulu.zscaler.com] for more Information.

London Olympics 2012: Prime time for spammers

Spammers love major events as they present an opportunity to social engineer victims with content that they’re likely to be interested in. The Olympics represent a golden opportunity for spammers – the world’s largest sporting event, that will draw a global audience for the next two weeks. As such, we expect to see a plethora of Olympic related scams, which are already beginning to emerge.

Below is an example of an email message that has been circulating that is essentially an Olympic themed version of the ever-popular Nigerian 419 email scam.

From: LONDON 2012 OLYMPICS LOTTERY PROMOTION [mailto:johnwilliamsa2011@gmail.com]
Sent: 15 July 2011 01:09 PM
To: undisclosed recipients:
Subject: CONGRATULATION!

PLEASE OPEN THE ATTACHED FILE

LONDON 2012 OLYMPICS LOTTERY PROMOTION!

The London 2012 Olympics lottery is proud to inform you that you have won £1,950,000.00 GBP (One Million Nine Hundred and Fifty Great Britain Pounds) why you have won? Your e-mail address is one of 15 lucky addresses who have won in the monthly promotion.

We wish to congratulate you on your victory; winners shall be paid in accordance with his/her settlement center. Stated below are your identification numbers:
Batch number: 18/006/1094/lipda/sl,
Reference number: lli/240142/011,
Pin: 2012, file number: flie//5612/1364.
Security code: olylon2012,

FILL THE DETAILS REQUESTED:

1. YOUR FULL NAME………………………………………...
2. YOUR COUNTRY NAME………………………………….
3. MOBILE NUMBER…………………………………………
4. OCCUPATION………………………………………………
5. FAX NUMBER………………………………………………
6. PASSPORT COPY OR ID…………………………………
7. BATCH NUMBE…………………………………………..
8. REFERENCE NUMBER……………………………………
9. PIN NUMBER……………………………………………….
10. FILE NUMBER……………………………………………..
11. SECURITY CODE………………………………………….
12. DATE OF BITH……………………………………………. .

The London 2012 Olympics lottery team, whereby all winners are selected computer ballot draws or server, this email draw or server visits all internet providers and email address around the globe, be it COM, ORG, NET, AOL and all country based web abbreviations, as you have .CA in Canada and .UK in United Kingdom and AOL in USA .ZA in South Africa and India .IN

Remember, you must contact your claim agent Mr. Richards Lord by email or through his office telephone number to make your claim of this great winning prize known to him, with the above requested information.

CONTACT YOUR CLAIM AGENT IN LONDON, UNITED KINGDOM.
MR. RICHARDS LORD
TELEPHONE PHONE: +44 703 174 9631
EMAIL: londonolympic_2012@hotmail.com

You have to note that the London 2012 Olympics Lottery is creating awareness of the Olympics sprit around the world, which is to be host in United Kingdom.

Online Lottery’s Operator, works in collaboration with the London 2012 Olympics Board to ensure that the most effective service is offered to the Lottery winners - within the responsible gaming framework at all times.

MRS. LINDA ROSE.
PROMOTION MANAGER.
LONDON 2012 OLYMPICS LOTTERY AWARD.
COUNTRY: UNITED KINGDOM.

Sample-1

The message is a perfect example of a 419 scam. It asks for personal information and informs you that you’re the recipient of a tremendous financial prize. Below is yet another example.

From: LONDON 2012 OLYMPICS PROMOTION [mailto:uk2012olympics@london.com]
Sent: 01 March 2012 11:49 PM
To: undisclosed recipients:
Subject: 2012 LONDON OLYMPICS E-MAILSSELECT PROMOTION

Head Office

London 2012

One Churchill Place

Canary Wharf

London E14 5LN

LONDON OLYMPICS EVENT AWARENESS AND PROMOTION COMPANY.

2012 London Olympics lottery draw notice 

This is to inform you that London Olympics event awareness and promotion company, and London 2012 summer Olympics Organizing Committee (LSOOC) here in London (U.K), has held an Internet Raffle Draw among all internet e-mail users, and your e-mail address was among the 10,000,000.00 (Ten million) e-mail addresses that was picked by the computer during the Second Quarter Raffle Draw (SQRD).

We are therefore with great pleasure, to notify you that your e-mail address once again, happened to come out top number (1) out of the 10,000,000.00.(Ten million) e-mail addresses on the final ballot draw.

 Please note that this has made you the jackpot winner of the sum of GBP£ 1,000,000.00 (One Million British Pounds) and free entrance tickets to watch the games live in London. 

Be aware that this Internet Raffle Draw (IRD) was organized by  London Olympics event awareness and promotion company.and London 2012 summer Olympics Organizing Committee (LSOOC), to create awareness to the world, as England is finalizing their preparation for the hosting of the 2012 summer Olympics.

BELOW ARE YOUR WINNING DETAILS:

COMPUTER DRAW NUMBER: 177

EMAIL CODE NUMBER: TTYEEWSSE2211775643000

FINAL JACKPOT NUMBER: 0001
SN: 2012 / LSOOC / LOC / UK 

WINNING INSURANCE POLICY NUMBER: JJA23UK

WINNING FUNDS INSURANCE COMPANY: NFU MUTUAL LONDON

REFERENCE NUMBER: EAASL/941OY1/04

BATCH NUMBER: 12/27/Du34

WINNING NUMBER: 3

Note that this program is being sponsored by below listed U.K companies:

1. Vodafone company U.K Limited
2.Fenchurch communications U.K Limited
3.Business mobile U.K Limited

 Mr. Kuash Behler, Our First Quarter Winner of

GBP£ 2,500,000.00 from Amsterdam, Holland.

Our Second Quarter Winner Mrs. Ali Fatima from Nepal receiving her winning cheque of GBP£1,000,000.00 also on the picture is her husband and friends rejoicing

\With them.

 Congratulations from all our staff, we also extend our thanks to the Sponsors for being part of our awareness and promotional program.

PRIZE CLAIMING INSTRUCTION:

YOU ARE HEREBY NOTIFIED THAT YOU ARE AMONG THE 7 WINNERS OF THE SUM OF GBP£ 7, 000, 000, 00 (SEVEN MILLION British Pounds) EACH ENTITLED TO RECEIVE GBP£ 1,000,000.00 (ONE MILLION British Pounds)

Your Fund is now deposited with our correspondent Paying Bank (BARCLAY'S BANK, LONDON) insured in your name for security reasons, you are advised to please keep your winning details very confidential from the members of the public to avoid double claim as your winning/payment will be cancelled should Two (2) claims be submitted under the above specified winning details.

Please note that claiming agents has been appointed in strategic areas around the world to help and ensure an easy and immediate claim to all our lucky winner's. We have checked your location and your claiming falls under group B.

You are to call and forward you’re winning details to our appointed and accredited Agent    (MR. M. ROBERT NULL)  
Office   Mail:  robertnull2010@null.net

Cell: Tel: + 44-7031741865    Fax: +447014237785   to enable him clear your file for immediate payment. Visit:    http://www.london2012.com    for more details.

You can also confirm your winning by directly calling/contacting our head office here in London on the bellow Details:

Signed By Dr. V. Beavis                                 Copyright © 1996-2012                      
[Award Board Director]                                       The U.K National Lottery Inc.

Head Office U.K                             All rights reserved. Terms of Service - Guideline

E MAIL :  board.directors@london.com                                         

 100860 8556 2548 9576UK

Sample-2

These scams have become so common that the official Olympic website is actually maintaining a list of those which have been identified in order to warn the general public. Here is a list of the email spam/scam variations related to London Olympics 2012:
• 2012 Games Entertainments Co-ordinator
• 2012 Olympic Draws
• 2012 Olympic Promo
• 2012 Olympic Promotion Board United Kingdom – South Africa
• 2012 Olympics, A Lottery For The Future
• 2012 Summer Olympic Lottery
• 2012 Summer Olympic/Paralympic Games
• Australian Lottery (in affiliation with the London 2012 Olympics Committee)
• AUTHORISATION NOTE: P&G WORLDWIDE PARTNER / London 2012 Olympic Games
• BBC Olympic Prize
• Big Big London 2012 Olympic Lottery
• BT & London 2012 Olympics Promotions Team
• CocaCola Company and London 2012 Official Award Notification
• Coca Cola London 2012 Olympic Games Promotions
• Deloitte/London 2012 Olympic Games Promotional Draw
• Ford Olympic 2012 Promo
• Future 2012 Olympics – Congratulations!
Grosvenor/London 2012 Olympic Games Promotional Draw
• London 2012 Draw Results
• London 2012 Employment
• London 2012/ FIFA International Online Lottery
• London 2012 grant award
• London 2012/Microsoft 2011
• London 2012 press release
• London 2012 Olympic Games Raffle Award
• London 2012 Olympics/Microsoft Sweepstake
• LONDON 2012: Ticket Number: LND0026
• Olympic 2012 Awareness Lotto
• Olympic Torch
• P & G Olympic Promotion

It is advisable that if a message contains any of the above mentioned text, such messages should be dropped. Today, many antivirus solutions and email gateways provide aggressive spam filters but messages can always slip through, so individuals should be wary of any message requesting personal information, regardless of the source.