How to wash laundry…ahem, money – by Dr. Roger Amar

December 31, 2008 by Gary Illyes
Filed under Online Security

Dr. Roger Amara, a doc from Malaysia explained me today how his client and himself wanted to transfer money from one account to another in order, probably to loose it’s track. Only one problem appeared: his client died, and now I would be the one who’d need to continue the process. Too bad it’s a scam.

ESTEEM GREETINGS

Good day to you.I would have contacted you through surface
mail, but because of time and for security reasons,I had
to reach you by email I apologize for breaking into your
privacy.

Meanwhile,let me introduce myself to you.I am Dr.Roger E.
Amar,I am a doctor at Hospital Queen Elizabeth
Malaysia,For the past six years,I have been the private
doctor to her Excellency,Chief Mrs.Stella Chincona
Obi.Last month,she came to our clinic for a liver
transplant and my assistant (~~NAME REMOVED~~) helped me in
the transplant operation.

The liver transplant was successful,but minutes later she
had some Complications that threw her into a terrible
coma.all the efforts we made,she died.A day before the
transplant operation,she came to my apartment to finalize
a deal with me,She has already called me from her country
two weeks before her arrival in Malaysia,to inform me
about this transaction and what she want me to do for
her.the main plan is to use my position as a reputable
doctor with the hospital,to remit the sum of $4.5 million
into Hospital Queen Elizabeth account with our bank.

The whole arrangement was completed and the fund was
carefully deposited with our bank.Her plans was to
transfer the fund into some private bank accounts in
Switzerland once she gets back to her country,so that the
management of the hospital will not know about the fund
and claim it. But unfortunately.she died some hours after
the liver transplant.

My main reason for contacting you is for you to assist in
transferring this sum of $4.5 million by presenting you
as a business partner or beneficiary to the deceased since
she has no next of kin,and more over no one knew about
this funds apart from me and her,because some auditors
will be coming in to check and balance Hospital Queen
Elizabeth account by next month and they will surely
discover the fund. Then,the hospital management will claim
the fund.

based on this secrecy of this fund,I would not be able to
handle this transaction alone.I need somebody that is not
related or connected to me in anyway,to be able to secure
this fund,as soon as possible.So,I consider it necessary
to intimate you on the profitable venture.I am even
thinking of us going into partnership,we can invest the
fund in any profitable business there in your country and
you will be in charge of all the affairs there.Which ever
way you want it is okay by me.

We don.t have much time to waste,so please,reply
immediately to enable us arrange on how to get this fund
transferred before the hospital claims it.

My sincere regards,

Dr.Roger E. Amar.
d602rogar@pisem.net
d601rogar@krovatka.su

Tags: Phishing, scam, spam

Oh well, I got another million… by Mr. Song Li

December 31, 2008 by Gary Illyes
Filed under Online Security

1 Comment

I have to be the most lucky guy in the world: there’s no day when I don’t inherit or win a few millions. At least that’s what the emails i get state. Like the one below:

Good Day

Compliment of the day to you, although you may be skeptical receiving this
email as we have not met before, I am Mr.Song Lile I work with Hang Seng
Bank Ltd.I have a business proposition involving the sum of
$24,500,000.00usd in my bank which I know we will be of mutual benefit to
both of us, and I believe we can handle together, once we have a common
understanding and mutual cooperation in the execution of the modalities.

Should you be interested, please forward the following to me:

1.Full names,
2.Occupation,
3.Private phone number,
4.Current residential address.

Via this email address: info_songlile02@yahoo.com.hk
Your earliest response to this mail will be highly appreciated.

Best Regards

Song Li.

It is clearly a scam. I’m not going to answer this one, but if I would, the phisher most likely would ask me to wire or deposit some money in a bank account which would cover the expenses of the transfer. Nonetheless to say that I would see nothing in return. He would be happy, me not.

Tags: Phishing, scam, spam

Confidential Spam from Ahmed Moola

December 29, 2008 by Gary Illyes
Filed under Online Security

How to write a content scraper or feed aggregator for Wordpress in 10 minutes with PHP and cURL

December 29, 2008 by Gary Illyes
Filed under PHP

3 Comments

A few days ago we published an article which sheds some light on the ethics of content scraping.

Content scraping — in short –means that a webmaster copies a 3rd party’s content in an automated way. If you copy the whole article, then then this is content theft, if you republish the excerpt of the article and link back to your source, then you created a service similar to Technorati.

So, what will you need for this script? Obviously, You will need PHP installed. CURL is also needed as it’s much more fast than — for example — fopen(). If you want to automate the publishing of the scraped content on your blog, then you have to have Wordpress installed and configured to receive the posts via e-mail. And that’s all.

In this post we will scrape the content using the 3rd party blogs’ RSS feeds. So, think about some feed URLs for your own script, we will use Technorati’s developer API cos it’s easier for us.

Let’s see the script, step by step. First we create two arrays: one will be empty by default, this will contain the fetched RSS items, and another one which will contain the RSS URLs. The second array can be also grabbed from a database, we hardcoded it in the source because it’s not likely we’ll ever modify the script again. Then write some functions which can parse the RSS feed as in it’s original format it’s pretty useless for us. So, here’s the script, if something is unclear, ask in the comments.


/*construct our arrays, first is empty, will be filled by the functions*/

$rss_items = array();

/*the below array contains the URLs we'll grab the RSS from*/

$RSS_URI = array("http://api.technorati.com/search?key=YOUR-API-KEY&query=health&format=rss&language=en",
			"http://api.technorati.com/search?key=YOUR-API-KEY&query=medical&format=rss&language=en");

/*simple function to parse the XML file, aka the RSS and push the contents in the $rss_items array*/

function parseRSS($xml){
global $rss_items;
    $cnt = count($xml->channel->item);
	if($cnt > 1){
	    for($i=0; $i<=5; $i++){
			$url 	= $xml->channel->item[$i]->link;
			$title 	= $xml->channel->item[$i]->title;
			$desc = $xml->channel->item[$i]->description;
			$poster = parse_url($url, PHP_URL_HOST);
			$cont = $desc."[...] \r\n";
			$cont .= "More on $poster\r\n";
			$titem = array(	"url" 	=> $url,
						"title"	=> $title,
						"desc"=> $cont,
						"auth"=> $poster);
			$rss_items[] = $titem;
    	}
	}
}

/*grab the content of every URL we specified in the $RSS_URI array*/

foreach ($RSS_URI as $rss){
	$ch = curl_init($rss);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_HEADER, 0);
	$data = curl_exec($ch);
	curl_close($ch);
	$doc = new SimpleXmlElement($data, LIBXML_NOCDATA);
	if(isset($doc->channel)){
	    parseRSS($doc);
	}
}

/*construct and send the mails to Wordpress's post-by-email address*/

foreach($rss_items as $rss_item){
	$subject = $rss_item['title'];
	$content = $rss_item['desc'];
	$from = "YOUR-ADMIN-MAIL-ADDRESS";
	$headers = "From: $from";
	mail('WORDPRESS-MAIL-BY-POST-ADDRESS',$subject,$content,$headers);
}

/*contact our Wordpress engine to post the grabbed items*/

$ch = curl_init('http://YOUR-BLOG-URL/wp-mail.php');
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_HEADER, 0);
	$posted = curl_exec($ch);
	curl_close($ch);

Final step, save this file somewhere on your webserver. Be sure to hide well because if you put it in a publicly accessible place and someone wants to play, it accesses the script then your automated blog is filled with posts in no time.

Now let’s decode the script in human readable format:

Will take every URL from the $RSS_URI array, grab the URLs’ content and transform it in a big multidimensional array
For every item it grabbed and pushed in the $rss_items array, it will build and send an email — using PHP’s native mail() function — to the address you specified as post-by-email address
Will open the http://YOUR-BLOG-URL/wp-mail.php address to make Wordpress to post the e-mails

A nice addition to this content scraper on Unix based systems can be to set up a cron job, which will automate the whole process. Making you to not touch your Wordpress for a very, very long time.
If you don’t like the cron idea, you will have to access the script using your browser, pointing it to the address where you’ve saved the file.

Have questions? Ask below.

Tags: $url, content scraper, feed fetcher, PHP, rss

Mr. Zafar Habib Khan sais I’m a millionaire… again

December 27, 2008 by Gary Illyes
Filed under Online Security

Leave a Comment

United Arab Emirates. One of the coolest places on the planet. This time I got a letter from Mr. Zafar Habib Khan, who, as he states works for a bank in the UAE. As usual, his client died, money is frozen in his bank and he needs my help to grab the money. Here’s the full story:

Greetings from Dubai,

This letter must come to you as a big surprise, but I believe
it is only a day that people meet and become great friends
and business partners. I am Mr. Zafar Habib Khan,currently
Chief Investment Officer with a reputable bank here in U. A. E.
I write you this proposal in good faith,believing that I can
trust you with the information I am about to reveal to you.

I have an urgent and very confidential business proposition
for you. On November 6, 2000, an Iraqi Foreign Oil consultant
/contractor with the CHEVRON PETROLEUM CORPORATION, MR MOHAMMAD
AL NASSER made a (Fixed deposit) for 36 calendar months,valued
at US$17,500,000.00 (seventeen Million Five hundred Thousand
Dollars only) in my bank and I happen to be his account officer
before I was moved to my present position recently. Upon
maturity in 2003, as his account officer and as well the bank
manger, it is my duty to notify him on the maturity date so I
sent a routine notification to his forwarding address but the
letter was returned undelivered.

After sometime, I tried sending back the letter, but it was
again returned and finally I discovered from his contract
employers, Chevron Petroleum Corporation that Mr. Mohammad Al
Nasser died as a result of torture in the hand of Saddam
Hussein (former Iraqi President) during one of his trips to
his country Iraq, as he was accused of leaking information
to the Americans. On further investigation, I discovered
that Mr. Al Nasser’s family wife and two sons died during
the Gulf War in Iraq and was the reason why he did not declare
any next of kin or relation in all his official documents,
including his Bank Deposit paperwork in my Bank and did not
leave any WILL. This sum of US$17,500,000.00 have been
floating and placed under dormant/unserviceable account by my
bank management since no one have heard from the owner since
2003. I wish to let you know that all the investigation I
have made so far, my bank management is not aware of it, I am
the only one that have the information.

With the recent change of government in my country and with
their efforts to support the United Nations in checkmating
terrorism aid in the U. A. E. By end of this year, the
government will pass a new financial control law which will
give the government authority to interrogate account owners
of above $5,000,000.00 to explain the source of the funds,
making sure it is not for terrorism support. If I do not
move this money out of the country immediately, by end of
the year the government will definitely confiscate the money,
because my bank cannot provide the account owner to explain
the source of the money.

I cannot directly transfer out this money without the help
of a foreigner and that is why I am contacting you for an
assistance. As the Account Officer to late Al Nasser,coupled
with my present position and status in the bank as Chief
Credit & Risk Officer , I have the power to influence the
release of the funds to any foreigner that comes up as the
next of kin to the account, with the correct information
concerning the account, which I shall give you. All documents
to enable you claim this fund will be carefully worked out and
there is practically no risk involved, the transaction will be
executed under a legitimate arrangement that will protect you
from any breach of law, beside U. A. E is porous and anything
goes.

If you accept to work with me, I want you to state how you
wish us to share the funds in percentage, so that both
parties will be satisfied. If you are interested, contact
me as soon as you receive this message so we can go over
the details. Thanking you in advance and may God bless you.
Please, treat with utmost confidentiality. I shall send
you copy of the

deposit certificate issued to Al Nasser when the deposit
was made for your perusal.

I wait your urgent response.

Regards,

Mr. Zafar Habib Khan.

Tags: Phishing, spam

How to wash laundry…ahem, money – by Dr. Roger Amar

Oh well, I got another million… by Mr. Song Li

Confidential Spam from Ahmed Moola

How to write a content scraper or feed aggregator for Wordpress in 10 minutes with PHP and cURL

Mr. Zafar Habib Khan sais I’m a millionaire… again

Recent Posts

Recent Comments

What we write about