1421946269_thumb

Blogger Warning: LLT Consulting Banner Ad Scam

In General, Safety, Security by Michael Sheehan87 Comments

I receive a lot of advertising and guest blogger solicitations on my site. To set the record straight, I don’t currently allow guest blogging and the advertisers I choose must be reputable, well-known, and/or part of a network. This morning I received an email via my contact form from a “Josephine Bergson” from “the LLT Consulting company” who said they wanted to place banner ads on my website, stating they could “pay up to $950.00/month.” Wow, I thought, that’s a pretty high rate. But when you get these types of “offers,” as a blogger, you need to be very careful about these things. So I decided to do some investigation.

Ltt Consulting Scam - email

Above is a screen grab of the actual email, with a couple of annotations that sent up warning flags. Below is the text of the email. (Note: I have unlinked the URL and added spaces – please don’t click through on it!).

Hello!
My name is Josephine Bergson representing the advertising department 
of the LLT Consulting company. We are interested to place ads 
(banners), of your choice, on your websites.
Design and sizes can be seen on our website at 
www. lltconsulting . net/id_kmptyvo/ 
Depending on the banner size you choose we can pay up to 
$950.00/month.
If you are interested to become an advertising partner please let me 
hear from you.
Kind Regards, 
Josephine Bergson 
josephine. bergson @ lltconsulting .net

The first thing that jumped out at me is the very high banner payment amount ($950 is a lot). As I was reading on an iPhone (which doesn’t support Java nor Flash), I decided it would be relatively safe to click through on the link. This is what I saw on my mobile browser.

Ltt Consulting Scam - mobile browser

It said:

Welcome to JppConsulting .net !
If you see this message you are accessing the website from a mobile device.
In order to experience this enhanced website you have to use a Computer.

Hmmm. More warning flags. First, the site I was trying to go to was LttConsulting .net and not JppConsulting .net. So, I decided to do some searches on this so-called LttConsulting.net site.

First I searched for “LttConsulting .net” and didn’t really find anything odd. But then I plugged “Ltt Consulting scam” into Google and suddenly more warning flags went up. The mere fact that there were lots of search results related to this site meant to me that this email and website were probably NOT LEGIT.

I know that my Mac has pretty good protection (Safari sandboxing, GateKeeper, tight Java control, etc.) so I decided to go to the link that was in the email. As the website loaded, I received a prompt from Java asking if I wanted to trust the Java applet. (If you test this, DO NOT TRUST THE JAVA APPLET!)

Ltt Consulting Scam - load java applet

I clicked the “Not Now” button so that I knew that the Java applet would not run. Then I decided to poke around the site to see what I could find.

Ltt Consulting Scam - internal links

Every single link on the site was an “internal link” meaning it used a hashtag (“#”) to keep people on the same page. If this were a legitimate site, someone could actually view what is on this page. Instead, the site kept you on the page, seemingly trying to get you to load the Java applet.

I was unable to download the Java applet offline (I wanted to see if I could view the source code) but I had had enough. This is purely speculation on my part as I have not validated this assumption, but I would guess that the Java applet loads malware, a trojan, spyware or some type of virus. So again, don’t load it!

I tried to see if the website was listed on any malware sites, if a malware scan reported anything, or if Google reported any issues with it  but I wasn’t able to find anything out of the ordinary, other that people simply saying they had received similar offers. A quick search of those offers did show different payment amounts being offered, as well as different “banner ad example” URLs (which to me means that the links are/were being tracked).

The domain is registered to:

Advertisement
Registrant Name: PATRIK NOVAK
Registrant Organization: LLT CONSULTING
Registrant Street: SOKOLSK??? 1153
Registrant City: DOKSY
Registrant State/Province: CZ
Registrant Postal Code: 472 01
Registrant Country: CZ
Registrant Phone: +43.326551001
Registrant Phone Ext: 
Registrant Fax: +43.326551046
Registrant Fax Ext:
Registrant Email: [email protected]

So the “organization” is in Czechoslovakia Czech Republic. [edited 03.05.15 – forgive my geographic ignorance.]

The Bottom Line – A Warning to Bloggers

Ltt Consulting Scam - java

If you get an email similar to the one above from Llt Consulting, stay away from it.

  • The site is not valid
  • The site tries to load a Java applet
  • The links on the site go no where and provide no information
  • The Java applet most likely contains malware
  • The email that other sites receive is identical, only the URL changes (for tracking?)
  • Other people have reported this as a scam

This has been a blogger Public Service Announcement from another concerned blogger. Please be sure to share this with your networks!

HTD says: Sometimes these offers are just too good to be true! Be careful!