Saturday, September 26, 2009

Microsoft Escalated Support Rep Trusts Scam Site [Updated]

Ever been fooled by a malicious site?  Microsoft has.

The other day I came across this scam page, and I was surprised to see that it shows up in Bing search results:

hxxp://explorersecuritysuite .com/info.php?af=213&url=

This alert appears in any browser, even if you go directly to the site.  The scam page pretends that you're getting an official warning from Microsoft.

The page claims:
This website has been reported as unsafe
We strongly recommend to discontinue the use of this website.
[link] Activate my Web protection software
This website has been reported to Microsoft for containing threats that might steal personal or financial information from your computer
If you click on the link, it takes you to this page:

...and if you further click on "Click Here!" you'll be taken to this page:

A non-savvy Web user could easily be tricked by the initial warning into following the links, perhaps even thinking that Microsoft wanted them to buy this "Total Security" product (or perhaps not thinking, due to fear of identity theft and a frantic desire to protect oneself).  After all, what could make someone feel safer online than "total security"?  But surely a more seasoned individual, say for example an advanced Microsoft employee, wouldn't be tricked by such a scheme.  Or would they?

I followed Microsoft's directions for submitting malicious sites, and dutifully reported the deceptive page to Microsoft's Bing support team.  A friendly lady from Bing Technical Support replied and said that "I understand that you are reporting a scam site listed in Bing results. I know the importance of this issue. I will now be escalating your email to our product specialists for further investigation. They will directly take action on your request and will be contacting you with an update soon."  That sounded very promising.  Imagine my surprise when I got this response later:
Hello Joshua,

We have already reported the www.explorersecuritysuite .com.  If you check the query on BING, you should be able to see the warning on the vertical result.

I have provided a link for the query:

Thank you for reporting this matter.

Best Regards,

[name redacted]
Microsoft Global Escalations

Of course, the search query brings up the malicious page at the very top of the results, as seen here:

However, there's no warning from Microsoft anywhere on the search results page.  The closest thing is Bing's quotation of the scam page.  I replied to Microsoft's Global Escalations representative, explaining that "The site itself is malicious, and it pretends to have been reported to Microsoft.  Try the direct malicious link in any other browser and you'll get the same warning when you visit the page.  The warning comes directly from the site, not from Bing or Microsoft.  This is clearly not an official Microsoft alert."  I provided a direct link to the malicious page (non-sanitized, in case this individual might have been confused by hxxp or a space in the domain name).  I sent this reply well over 24 hours ago.  I still haven't gotten a response, and the scam page is still indexed on Bing.

So, how about that?  Even someone who works for Microsoft's Global Escalations department can get fooled by a malicious scam site.

UPDATE: Two days after I sent my last reply to Microsoft Global Escalations, a different representative responded:
Hello Josh,

My name is [redacted] with Microsoft Global Escalations.

I have re-investigated the said site ([unsanitized URL redacted]) and would confirm with you that the site is indeed misleading.

We will be taking action to remove this as soon as possible.

Thank you for reporting this and again brining [sic] this to our attention.

Best Regards,

[name redacted]
Micsrosoft Global Escalations [sic]

Yet another two days after getting this reply, the site was finally removed from Bing.  So from the time I first reported the site to Microsoft until it actually got delisted from Bing's search results was roughly 5.5 days.

Fun storytelling aside, here's the technical stuff, for anyone who might be interested. (Wepawet analysis showing affiliated domains) (Web of Trust report)

A nearly identical domain, windowssecurityinfo .com, also comes up in Bing search results, although the site is not loading at the moment: (example Bing search that brings up this actual domain as a result, just like with explorersecuritysuite),ac670a51 (Bing cache, not linked because it tries to load images and CSS directly from the domain; use caution)

Related fake warning sites that are currently inactive:

browsersecurityinfo .com (Wepawet analysis showing affiliated domains)

suspiciousdomainblock .com/pre1/?af=14s1 (Wepawet analysis showing affiliated domains)

Reports for affiliated domains: (redirects from explorersecuritysuite to expresssoftwarepayment) (including protected.expresssoftwarepayment .com) ("Eco Antivirus"/"Total Security" fake AV site, mentioned on payment page) (redirected from suspiciousdomainblock to authorized-payments) (including protected.authorized-payments .com) ("Eco Antivirus"/"Total Security" fake AV site, mentioned on payment page) (linked from browsersecurityinfo) (redirected from ieprotectionlist to buysecuritysoftwareonline) (including secure.buysecuritysoftwareonline .com)

Fake warning sites from a different fake/rogue antivirus campaign, all of which are currently active:

hxxp://safewebway2009 .com/warning/

hxxp://trusted-web-way .com/warning/

hxxp://protect-my-web .com/warning/

hxxp://rightsafeway .com/warning/

hxxp://web-safe-and-clean .com/warning/

All of these sites redirect to hxxp://yesantivirusplus .com/buy.php?id=

Payment site for Antivirus Plus: hxxps://my-secure-payment .com/cgi-bin/nph-pr/pandora/softcore/buy_soft.php?productid=avplus4&advert=

More fake warning pages:
hxxp:// (site defunct, and URL was not saved on

1 comment:

Comment moderation is enabled. (If you wish to contact Josh privately, you can leave a comment and ask that it not be published.)