It's _not_ MySpace!

Hi folks,

Last night, I, along with several other people that I know, received an email, purporting to be from a friend on MySpace, offering a new song.

There were multiple enticing links in the email, all similar to this one ....

Click here to get 5-free songs downloaded to Your Space:
h t t p : / / myspace . mp3shest.com /?reloc.cfm=6& id=9129294431_5free

and text like this ....

"At MySpace we care about your privacy. We have sent you this
notification to facilitate your use as a member of the MySpace service. If
you don't want to receive emails like this to your external email account
in the future, change your Account Settings to "Do not send me
notification emails"

Given that none of us are actually members of MySpace, I was immediately suspicious and decided to take a look at it in a bit of detail.

Here's what I found:

Firstly, myspace.m3shest.com resolves to 221.4.246.3, which is part of this address space ...


inetnum: 221.4.0.0 - 221.5.127.255
netname: CNCGROUP-GD
descr: CNC Group Guangdong province network
descr: China Network Communications Group Corporation


Gosh! I thought MySpace.com was in Santa Monica! I'm shocked!

Let's visit the actual site (in a virtual PC, of course). I'll click on the link that offers five free songs.... that can't hurt, can it?
Wait .... I'm not at a MySpace page at all... the link has taken me to h t t p :// uxmp3.com:8080/?aid=4

And where are my five free songs? This place is just selling mp3s for 10 cents a song. I wonder if the RIAA knows about this?

Port 8080? That's a bit suss. Web pages are supposed to be on port 80 normally. Hmmmm.

In summary, on the plus side, there are no exploits, and no codecs, fake or otherwise, to download as far as I can see. It seems to be nothing more than a site selling MP3s.

There are a bunch of things on the minus side, however...

(1) it was advertised in spam (we should _never_ buy anything advertised in spam),
(2) it said it was from MySpace. It clearly has nothing to do with MySpace
(3) It offered me five free songs, but then forgot all about that offer when I got to the website.
(4) When there is that much untrustworthiness to begin with, there is no way to tell what might happen in the future.

It's just bait and switch spam.

You could put your credit card in and buy some mp3s for 10 cents a piece, but you _might_ find that it ends up costing you a lot more in the long run.

Never buy anything from spam.

Roger