“I make myself very available.” This attitude leads to both opportunities and annoyances. More often than not, it leads to annoyances. Once of the key annoyances it leads to is spam. Spam arrives in my mail box, my PO box, my email inbox, and now in my AOL Instant Messenger client. But the spam I’ve been receiving isn’t your typical spam that offers cheap prescription drugs, a larger penis, a second mortgage, or an opportunity to help a former Nigerian prince disburse his father’s estate. This was much different.
I woke up this morning to this message, at least the third of this type that I’ve received:
(4:39:17 AM) shoppink141: hey
First, in case you’re wondering why my copy of AIM doesn’t have a million animated wacky smileys and advertisements with sound playing on my screen, it’s because I’m using Pidgin, the free, open-source alternative to not just AIM, but MSN messenger, Yahoo messenger, and a host of other popular chat programs. If you use more than one messaging service, Pidgin is the way to go. Try it.
Anyway, I looked at the user profile, and I recognized it immediately as being nearly identical to the other messages I’ve received like this. The away message and profile read:
be back in a bit...
---
I once wanted to kill the most beautful girl in the world... and then i realized, suicide is a sin :-*
my profile holla at cha girl 
The thing about this that I find most interesting is that the screen name was apparently registered at some time in 2006. This leads me to believe this was at some point a legitimate AIM account that was hijacked by the spam-bot, probably because of a trojan horse virus or phishing attack. But the entire reason that I received this message is apparent right here: there is a prominent link to “my profile”.
The spammer uses a number of psychological tactics to entice the user to click the link.
- The profile uses “girly” colors — no self-respecting man would ever use such a color scheme.
- There is an overtly visceral quote that implies the message’s sender is in fact a beautiful woman and not a computer program.
- The link is followed by the imperative phrase “holla at cha girl”, directing the user to click the link so that they can contact this user.
And as we all know, online advertisers love to use images of women because there are simply so many desperate men on the internet. You could try to contact the user directly by sending them an instant message, of course. This is perhaps the most clever psychological tactic used by this bot. If you send the bot a message, it sends back a “buddy typing” signal, but never sends a message (note the keyboard icon in the upper-right corner of the IM window, next to the red ‘X’):
The bot will never change status, it will seem to type to you in perpetuity. Can you see how this would lead unsuspecting users to click the link in the bot’s profile?
You receive a message, purporting to be from a good-looking girl, saying hello, but they seem to be having trouble replying to you. Perhaps you would check their profile and try and view their “other” profile.
If you were to, you would be linked to http://perfspot.bigtracking.com/. I had never heard of this URL, and a quick Google search revealed that basically, neither had anyone else. In fact, it seems that BigTracking.com is just a parked page, and therefore that “perfspot.bigtracking.com” is just a front for something. PerfSpot was actually the first site I was linked to by these spam messages. It made it seem as if PerfSpot itself was being promoted. PerfSpot appears to be a legitimate but unpopular social networking site, however since I didn’t sign up, I can’t confirm that’s what it actually is.
That page, perfspot.bigtracking.com, contains only a JavaScript redirect to the URL “http://perfspot.bigtracking.com/fw.redirect”, which then contains an HTTP redirect to “http://generousgenie.com/”. Generous Genie contains numerous hot-linked references to a site called rewardsgateway.com, which unsurprisingly is in the business of selling advertisements and leads to online marketers. As is the hallmark of all illegal, out-of-compliance operations, this site’s contact page is completely blank (try it). This is not to say Rewards Gateway is directly responsible for the spam messages. Here’s how this works:
Rewards Gateway operates its own shady advertising ring. But they only make money when people actually see the ads. So they get “affiliates” — third party spammers, err, publishers — to spread the word for a fee. Usually that fee is dependent on sign-ups for some kind of offer (e.g., we pay you for each person you get to not only click the ads, but sign up for the advertiser’s product). Thus, the spammers, err, publishers, go out and find creative ways to get people to sign up for their affiliate network offers. In this case, someone’s created a rather nifty AIM spam bot to do that. Of course, how they are harvesting screen names is still a bit of a mystery to me, but frankly I’ve spread my screen name out there so much it would be hard to miss it.
For anyone interested in adding me to more spam lists, my screen name is “ImCoolandTough”. Have you received similar AIM message spam? Do you know anything more about these spammers? Comment below and share!
17 responses so far ↓
1 jason // Nov 27, 2007 at 8:36 am
don’t forget about the screennames lildevil90182,mysterychick2812,jasmine405951,
jasmine65199,LilJkiddBaller6,SuperSexySteph32,
thefaithiscream,xxoxalyoopxoxx,verywetsitesk and about 20 more that i’ve allready blocked. i thought i knew exactly who it was because of the some of the names and when i started getting the messages. but now you page makes me second guess that. do you have any ties to michigan?
or to denso?
2 peteru // Nov 28, 2007 at 2:41 pm
Sorry Jason, I’m not from Michigan nor tied to Denso. Thanks for the other names, I’m sure I’ve seen some of them before.
3 Nick // Nov 29, 2007 at 10:55 pm
sn’s that keep bugging me, mx55kx and jasmine461815
meh
4 Annamarie // Dec 4, 2007 at 11:01 am
I have had jade207726 as well. Blocked that and jasmine461815.
5 Shawn // Dec 6, 2007 at 8:07 pm
I’ve been messaged by jasmine135520 and smeggy120213. I clicked on the link and actually signed up for the facebook-like website, it seems legit. I haven’t seen any adverse effects, so I guess (hopefully) it didn’t install anything on my computer.
6 Joe // Dec 28, 2007 at 10:49 am
I just got a slightly different one– from a CrushAlert96965. It leaves me a “blast” from the BuddyBulletin feature of AIM, says nothing to me when I type, but has a link in its profile saying “Click here to reveal your crush.” Upon hovering, the hyperlink is http://alinks.bigtracking.com/?5
Yes, a question mark, it’s not an unknown character.
7 Karl // Jan 2, 2008 at 10:08 am
Thanks for posting something about how fake these bots and website are–yours is the only result I get on google when I searched “alinks.bigtracking.com”. My bot was CrushAlert73865.
8 peteru // Jan 2, 2008 at 4:33 pm
Got another one from CrushAlert4844 today. It read: “You’ve received a buddy crush from someone on your buddy list!”
9 Mike // Jan 4, 2008 at 1:12 pm
Yes, I got one from “CrushAlert18520: You’ve received a buddy crush from someone on your buddy list!” today.
They don’t respond and In the bot’s profile, it reads the same “Click here to reveal your crush.” with click here as a link to
http://alinks.bigtracking.com/?5 .
O.k. I’ll just warn this idiot ad and be on my way, nope. Aim Bots can’t be warned… it has the AIM Icon that every other Aim Bot, trying to gain your trust.
This site just redirects the user to a sub-site of yourcrush.net which is another ad trying to get people to sign up for an “imatch gold membership”
I just used another p.o.s. computer to find out where the links went. I google searched the screenname and found nothing, but another google search of “alinks bigtracking” brought me to this site.
10 dave // Jan 5, 2008 at 9:42 pm
jellagurl2148 is one i got at like 4:30 am.
11 Kristen // Jan 8, 2008 at 4:13 pm
I got an im just now from CrushAlert75939
I am usually really good with avoiding spam and viruses that are from aim “bots” and such but I was dumb this time.. is this a virus or just spam? All it did was send me to a blank page and I ex’ed out because i realized that it was fake.
12 Michael // Jan 11, 2008 at 3:44 pm
I got a, jade836746 talking about a crush alert from someone on my buddy list.
13 Ash // Jan 13, 2008 at 12:49 pm
i just got the jade836746 one too
14 David // Mar 9, 2008 at 5:03 pm
I got one some time yesterday from a crush alert. I have something to add to this though, and you may find this interesting…
A couple months ago one of those bots sent me a message on AIM, and I replied to the bot. Shortly thereafter, I got a message from a random person asking who I was. So I asked this person who he/she. I don’t remember the details but somehow he got a message from my screen name telling him to click one of those potentially malicious links.
I believe the message he got was somewhere along the lines of, but not necessarily exactly,
“AIM Forward: MyScreenName has sent you a message. “Hey, check out this cool new site! click here!”
So he got a message from a bot that used my own screen name. That’s rather crafty…. because if he checked my info he would find that I am in fact, a real person.
Also, sites like perfspot ask for your e-mail address and password so that they can retrieve your address book. If you allow them to do that, then they automatically send out an invite from you to everyone in your address book to join the site.
15 Joe // Mar 12, 2008 at 5:36 pm
i got the CrushAlert4844 today…these things are really stupid.
16 Jillian // Mar 12, 2008 at 6:59 pm
I just got an IM “CrushAlert21443 (9:03:48 PM): hey” then the IMer signed off, signed back on, and went away. Kinda confused me, I was a little thrown off but I googled and found this site. I did click the “revealcrush.com” that was in the profile, I admit I was curious an extremely bad move, but nothing happened but was sent to an actually crush website where they ask for name and number and they will send information to your phone. Howeever, the rates are $10 a month.
17 li // Apr 28, 2008 at 3:32 pm
i got 1 from blueeyeser saying “You’ve got a aim crush alert click to find out who you’ll never beleive it!!” and they say be4 i got 1 from clkpamela
Leave a Comment