FAKE SKYPE EMAIL: “Download VOIP Addons for Skype Free Talks”

I just got a fake email from “Skype Support” and wanted to let everyone know about it. If you are viewing this page, I assume you got here by searching because you got the email too. Don’t visit the website.

I visited it in my sandboxed Linux machine and it redirected me to a fake imitation of the Skype software. But just going from the email, here are the clues to show it’s fake:

1. It comes from the email address “skype@mediaresearch.tv”. If it’s not @skype.com, and it’s claiming to be Skype, don’t trust it.

2. One of the “updates” says “Now available on PSP!” – I presume this refers to the PlayStation Portable. And I highly doubt Skype will be releasing a program for the PSP; that just doesn’t seem like a target platform for them.

3. The links all point to skype-upgrade.com. Why not skype.com? (hint: because it’s not actually from Skype)

4. The copyright line says “Copy rights Skype 2010”. Really? “Copy rights”? This just screams foreign translation.

5. I did a Google Maps search for “3029 Maranta Rd, NY, 10310” with no results. I then looked up 10310, which is Staten Island, NY, and did another search for “3029 Maranta Rd, Staten Island, NY” and still no results. Either Google Maps doesn’t know about it, or it’s a fake address.

6. According to Wikipedia (since I couldn’t find their address from skype.com), Skype Limited (the company which makes Skype) is a Luxembourg-based company; headquarters in Luxembourg. This further invalidates the address.

7. The WHOIS lookup for “skype-upgrade.com” doesn’t even resemble the lookup for skype.com.

If this isn’t enough evidence for you, then hey, go download some spyware. I reported the email to Skype and they responded with instructions on how to opt-out of their newsletter… I replied back with these facts and am yet to hear a response, but I hope they wake up and actually pursue the scammer.

I doubt it though.

Update: It seems these emails are being sent to addresses registered at the CCleaner forums (see below comments from Roger and John), though I am not personally registered at these forums so our emails are likely being stolen from other places as well. I also got a similar Adobe Reader email this morning.

Complete contents of the email: (converted to text, links stripped)

SKYPE VoIP ADDONS UPDATES
This is to notify that new updates have been released for Skype. Following are major new features:
– Talk more for free via Voice Over IP (VoIP)
– Lower cost when connecting to landlines (much cheaper than Calling Card)
– Record your conversation (better than telephone quality)
– Instant messaging & file-sharing, video calls
– Now available on PSP!
To check and upgrade, go to Skype Updates Center or copy this link to your web browser: http://www.skype-upgrade.com
Skype has changed the way we think of telecommunications.
Thank you for choosing us.
With best regards,
Skype Support
3029 Maranta Rd, NY, 10310, USA
Copy rights Skype 2010 – All Rights Reserved
3029 Maranta Rd, NY, 10310, USA
To opt-out from this list, please update your preferences
This entry was posted in Uncategorized. Bookmark the permalink.

36 Responses to FAKE SKYPE EMAIL: “Download VOIP Addons for Skype Free Talks”

  1. Anonymous says:

    I got the same email, glad I searched for it! Thanks for posting this – your blog seems to be the only Google result for “skype-upgrade.com”.

    Any ideas where they might have got the email addresses from? It was sent to one of my secondary inboxes. I’ve only been using that address for a few sites recently: UK2.net and “10:10”. Have you given them your email address recently by any chance?

    Anyway, I predict quite a few hits on this page today, since like I said, yours is the only Google result right now!

    Thanks again mate.

  2. Timely that skype apparently recently released an update so that this email seemed like it was more legit. I went to my skype and checked for updates and there was one, but I let the software take care of that itself.

  3. Jennifer says:

    Thanks for publishing this notice. It is good to have my suspicions confirmed.

  4. Bart says:

    This whole article is moot. Here’s what you need to do.

    As a general rule:

    NEVER ACT ON INFORMATION YOU RECEIVE THROUGH EMAIL

    Email is for information. IT IS NOT A SOURCE FOR DOWNLOADING. If you get an email notification from (someone claiming to be) your company about software updates I can assure you it will be on the official company website too. So next time simply visit the official website of your software (in this case skype.com) and look for the updates from there. If you can’t find it, DON’T USE IT. It’s most likely fake.

    ONLY DOWNLOAD SOFTWARE FROM A TRUSTED SOURCE!

    If you live by such simple rules you’ll almost never have to be afraid for malicious software. You don’t have to be an internet detective with sandboxed Linux systems like the person who wrote this article.

  5. Gary says:

    You nailed it, Richard. The subject looked suspicious so I examined the headers and links without opening the email and found that same anomalies you saw, but this one is better than many such fakes. You’ll get a lot of hits, but I’m afraid “skype-upgrade” will too.

  6. Richard says:

    Thanks everyone, I’m glad I could help. Anonymous, I have not recently signed up for UK2 or 10:10. Bart, thanks for the summary and those are good points. And Gary, yes unfortunately I’m sure they are going to successfully catch a lot of people. But I created this post specifically to give an answer to any Google searches for the email, so I hope it helps a lot of people who actually think to search before downloading their junk.

  7. Howard says:

    Thanks from me too.

    It sucked me in to going to the web-page. (gmail doesn’t display the sender’s email address automatically, which I now realise is a BAD THING).

    What then made me suspicious was the fact that the “Already have skype? upgrade now” button does not take you to a skype login page, but rather asks for your email address and other into. That, plus the picture of three gorgeous girls waving at me through my skype connection (supposedly).

  8. 1. It comes from the email address “skype@mediaresearch.tv”. If it’s not @skype.com, and it’s claiming to be Skype, don’t trust it.

    Unfortunately, it’s not that simple, since many companies outsource their email newsletters to special companies, so a lot of legitimate emails come from domains not associated with the company. (Ditto for links in emails – those are often routed through the mailing list company, for click tracking purposes so they can see what kind of things work best and adjust their marketing.)

    But it still seemed suspicious, so I googled “mediaresearch.tv skype” and found this blog entry before I would open the email. Thanks for the info.

  9. Richard says:

    GG with the report, also searched for it after a customer reported about it if they should update there skype application.

    Ill report it to Iron port hope thats going to help

  10. Pal says:

    Thanks! Good research. Altough: Skype ís available for the PSP…

  11. Stiofan says:

    McAfee Site Adviser carries this information:

    “The new Russian site http://www.skype-upgrade.com (IP 194.85.61.54) automatically redirects to http://www.new-voip-online-access.com (IP 84.22.98.19), which refers visitors to secureonline.ru (IP 84.22.98.29) on the CB3ROB Ltd network. This domain is registered through RU-CENTER, which has published telephone numbers in the Bahamas and a gmail email account as its contact data.

    Bear in mind the prevalent warnings about trojan downloads of “Skype add ons” and cautiously avoid all three of those sites. Cnet.com would probably be a much safer source for downloads.”

  12. Henk says:

    I got the same mail, but I also got another one, coming from the same “organization”, titled “Upgrade New Adobe Acrobat 2010 PDF Reader Alternative” suggesting in the mail that they deliver a new version of Adobe Reader. The site they use there is http://www.pdf-adobe-download.com linking to some kind of fake adobe editor…..

  13. Maria says:

    Hi, Mr. Carter!

    Thank you so much for posting this. I’m glad I was suspicious, did some investigating, and found you!

    Enjoy your day!

    ~Maria

  14. Paul says:

    Does anybody knows what happens when you accidently come on this site?

  15. Ian says:

    I, too, got this email, and it looked convincing. I actually went onto the website and proceeded to the “existing user upgrade” page.

    Fortunately, I didn’t complete any details, because I spotted a link going to a .ru domain – always a warning signal!

    I suspect that it could be a phishing scam

  16. Chris says:

    I got this email as a result of theft of info from the National Theatre website is this a common thread.

  17. Neil says:

    Thanks for this. Norton identified it as spam but having only just installed Skype, I wondered if it was misclassified, but thought to check here first before actting.

  18. Patty says:

    I received the email today and thought it might have something to do with gmail’s new phone service. Because of that I opened the email, which I normally will not do with spam. I became immediately suspicious reading the address and the errors in spelling, and I checked the “from” field, which confirmed my suspicions to me.

    The greatest consternation was actually in trying to get the email forwarded to Skype so they would know this phishing scheme was happening. I finally just sent the email to abuse@skype.com and .net, figuring it would probably get to them there, since I have reported such scams to other companies using “abuse@”.

    Now, I want to report this email as spam in gmail, but because of the way gmail is set up with the linked conversations I am not sure how to detach the forwarded message and only report the original message.

    Some days I wish life were simpler.

  19. Marc says:

    I too am a UK2 customer! I have little or no spam ever on the email address this was sent to, so I get quite concerned when one comes through. I wonder if we have any other common links?

  20. Dan says:

    I’m based in Australia and received this email. The opt-out button was to a site called vision6.com.au (an Australian mass email company). Did anyone else see this?

    They appear to be a legitimate (cough) mass email company and I’ve sent them an email.

  21. Jonathan says:

    Hi Dan, I work at Vision 6 and we have also responded to your email.

    We noticed unusual activity early this morning and shut down the suspect account immediately. Unfortunately, as it appears to have happened to other ESP’s (from monitoring other blog posts), we were also unaware of the illegitimate nature of this ‘business’.

    We are investigating further remedies and reviewing our security policy to help minimise these occurrences in the future. If you wish any further information from us please contact us at your convenience.

  22. I received the same email simultaneously on 3 different email addresses, another give away that it is a spoof email. I agree with Bart
    As a general rule: NEVER ACT ON INFORMATION YOU RECEIVE THROUGH EMAIL
    And I’ll add always go to the main site before downloading anything.

    That is type the address in your web browsers address bar ie http://www.skype.com

  23. Roger says:

    I have a single dedicated email for Skype alone, and this is what I got the email on. It’s private on Skype, so how did the spammers get this except from inside Skype itself??

  24. Roger says:

    Sorry, but it seems that the ‘dedicated email’ I had was for ccleaner.com – not Skype (sorry)!! Plus I’ve just got one from Adobe to my ccleaner email from the same source.
    So, it looks like ccleaner is the leak of email addresses 😦
    Does that fit in with others?

  25. John says:

    I too had these e-mails arrive this morning, one purporting to be from Adobe and the other from Skype, both of which I am a registered user but not with the e-mail address the messages were sent to today. A similar post on the Piriform users forum( http://forum.piriform.com/index.php?showtopic=29932) appears to confirm the source of the leak as being Piriform.

  26. Casper says:

    I got the mail from this email address yesterday
    “Skype Support ”

    As many of you other ppl I thought it was strange it did not come from skype.com – after having tried to “Check for Updates” within my Skype program and nothing came up I thought I’d just check it out.

    Only reason I’m writing this post though is to make this email address ” Skype Support ” searchable in google too.

    Have a great day everyone!

  27. Mike says:

    It seems like the same company is moving around through its options – I got an email with identical text but linked to http://www.skype-addons.com and with a different address in the US.

  28. Martyn says:

    I got the same email. There’s another giveaway – the reply address has two hyphens in succession: skype–2010.com. It’s easy to miss that but I’d had a similar email from adobe–upgrade.com.

  29. Rod says:

    I got a similar message but with an address of “Skype Support, 1293 Avenue Street, Seatle, CA 28388”. Very convincing, but Seattle is spelt wrong, and it is in Washington, not California (or Canada). Lastly, the Zip Code refers to North Carolina not Washington or California.

  30. Geoff says:

    Hey Richard, seems like they’re starting a new round of scamming… and you’re still the only site that mentions it. Keep up the good work 🙂

  31. Eddie says:

    I got one as well PLUS one supposedly from Adobe. It was worded almost the same as the Skype one but with different signature and address. I’d love to strangle these idiots that send this crap. Thanks for giving everyone a heads up Richard. Newbies to computing are especially susceptible to these scams. Merry Christmas and/or Happy Hannukah to everyone!

  32. Charles says:

    Is just visiting the site enough for them to cipher information? It came up error 404 and I closed the page immediately. I’m not new to computers, but in my defense I was still half asleep…lol.

  33. Liz says:

    Does anybody know if Skype VoIP numbers are portable and if so what is the network that Skype use to host such numbers ?

  34. jocuri flash says:

    Your site is very good! is to be congratulated! keep it up!

  35. Dannie Shean says:

    This is an awesome post. Thanks for sharing this stuff with us.

  36. amin leonord says:

    Hey Richard, like they’re starting a new round of scamming… and you’re still the only site that mentions it. Keep up the good work God alwaz bleesed u

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s