I happen to have a few friends, not unlike myself, who are either looking for good full-time work or are looking to supplement their income with some part-time at-home work.  This one seemed too good to be true.

ADHEREL

Unfortunately, a good friend of mine had her Facebook account hacked and her contacts were getting spammed.  The link in the spam was (I’ll obscure it a tad so that they don’t get any Google juice off this article) fitterhappier_dot_vndv_dot_com_slash_onlinejobs_dot_html.  It just so happened that my friend has been looking to supplement her income, and the note to me made it sound as if she was asking my advice on the validity of the site.

Well, let me tell you right now, it’s 110% bullshit!  And here’s how I know.

The article seems friendly enough, with a story about a local mother who’d lost her job and found this program, which saved the day apparently.  But then I noticed something peculiar.

The location of the alleged mother was my city, and the text of the article had no space between the state and the next word in the sentence.  I checked the top of the article and, sure enough, it was from “The AlabamaTimes, Online Edition.”  Again, note there isn’t a space after Alabama.

So, being the clever fellow that I am, I did a quick “View Source” and this is what I found.  Here’s the code for the “Online Times” edition…

<div id="sitename"><span id="name1stRow">The <script language="JavaScript">

document.write(geoip_region_name());</script>Times</span><span id="name2ndRow">Online Edition</span>

Well, lookie here… they inserted a javascript function, geoip_region_name, between “The” and “Times”.  Nefarious.  So I looked at where the “mother” in the article was from.

<p>Are online jobs the next big thing? For Mary Steadman it sure is. Mary, a mother from <script language="JavaScript">

document.write(geoip_city());</script>, <script language="JavaScript">

document.write(geoip_region());</script>is thriving, in the middle of an economic recession working in the comfort of her own home.</p>

Looks like this “mother” is from more javascript functions, namely geoip_city, geoip_region.

Double nefarious!

So beware, cats and kitties, there are those out there in cyberspace that would do you harm.  And they’re clever.  Not very clever, mind you, but somewhat clever.

Perhaps I should run with scripting turned off… that surely would have called all manner of attention to this scam.  I’m going to look further into the code to see if it’s doing any harm to peoples’ computers.