(harmonic:security): January 2013

Update 3/3/2013:
This Facebook spider phishing attack was also reported on the ISC StormCast Daily Network Security Podcast for February 26th, 2013.

Original Post:
Curiously, I have been receiving spam emails from one of my dogs over the last several weeks.

Yep. This dog in fact:

While Ace is a lot of things (protective, overgrown puppy, shedding machine, & more) computer literate is not one of them. And his paws are really too damned big to be able to use the keyboard. Nor do I really have reason to believe he thinks I should lose a few pounds.

Yet here I am getting emails claiming to be from him. All which with a different webpage link in the body. Clearly these are being maliciously spoofed, but then there's the question of how/why some spambot out there knows I have a dog named Ace.

Date: January 24th, 2013 at 7:34 AM
Sending IP: 109.93.128.35 (Serbia) via SMTP

To: christoperj
From: Ace Marcinko

Subject: great

Date: January 27th, 2013 at 4:09 AM
Sending IP: 93.177.224.71 (Latvia) via SMTP

To: christoperj
From: Ace Marcinko

Subject: awesome

Date: January 28th, 2013 at 7:00 AM
Sending IP: 151.239.254.168 (Iran) via SMTP

To: christoperj
From: Ace Marcinko

Subject: awesome

Thank you Facebook!

This isn't the first time I received a spam email from somebody spoofing somebody I know. Most of the other times have been other's address books themselves compromised by the bug of the day. Others have been unexplained.

And then there's Ace.

Ace who has neither the dexterity to use email nor an address book to be hacked. Ace does, however, have a Facebook page. And I am of course connected to him.

Based on this, I'm guessing my Facebook friend list has been spidered and has been added to the spambot's list to boost the legitimacy of the crap email. Also guessing this explains the other emails from John and Phil I've also gotten in the last month which could not be tracked back to a 'compromised address book'.

All emails seem to be coming into my well-published primary email address, so I can't determine if the email address was somehow pulled when my Facebook profile was spidered. Ace's (and the others') were only identified by name in the spoof. None of the source email addresses match the actual ones in use. No help there.

My Facebook connections are not visible unless the visitor is logged into Facebook themselves. Nor is my email address (though it's easily found elsewhere).

However, I do have more than a few connections. And my privacy settings allow everybody to see each other.

Too bad there's no real way to tell if one of the connected profiles was used to spider my contact list once they've logged in. While several of my contact's Facebook accounts have been compromised in the last few months, I can't determine a compromised account that was used to pull my Facebook contact list (or just some crap zombie account I had 'accepted' as a friend.) No help there either. Also the possibility this came through one of the handful of apps authorized to access the Facebook Account. Though these authorized apps are from higher profile providers and not one of the crap surveys or the many "whos viewed your profile" scams. Possible but not necessary a likely entry point.

That said -- Ace only has a handful connections to a handful of immediate family. None of which have had their Facebook accounts hacked lately. He also has no apps allowed on his account. And he's not getting the spam emails either.

Whatever the case, these spam emails had crap links within. None of which look like they're malicious (though this delivery method could very easily be used for such badness).

1) http://indianriverna [DOT] com/disapproveafraidnicholasparker/

2) http://dakini [DOT] tk/blackcopyencounterigarydavies/

3) http://luttu [DOT] com/dropageddanieldavies/

All three end up (after a few redirects) at variations on a somewhat authentic looking weight loss pill scam. This time pushing claims about "Garcinia Cambogia" or "Green Coffee".

(#1) and (#2) http://weightlossthatworkisnotmagicpill [DOT] com/diet/garcinia/index [DOT] html

(#3) http://weightlossthatworkisnotmagicpill [DOT] com/diet/GreenCoffeDiet-c/index [DOT] html

Authentic looking "Consumer Lifestyles" website pushing a Garcinia Cambogia weight loss scam (#1 and #2)

Same "Consumer Lifestyles" website template, but now pushing a Green Coffee weight loss scam. (#3)

The pages themselves look like they rely upon the same template and some quick find/replace about the pill they are pushing. They're also violating trademarks for legitimate news networks and using an embedded youtube video from an episode of Dr. Oz. I particularly liked how they incorporated a simple IP Geolocate script in the Green Coffee page to identify where I was coming coming from (and to point out all my local stores were out of stock of this miracle cure because of whatever demand)

All of the embeded links on either page -- including the "About", "Privacy Policy", Contact Us", the Facebook Like Button, etc -- end up (again after a few redirects) at a similar online order page

(#1) and (#2) https://offer [DOT] my-secure-page.com/fatbuster433/index [DOT] php?PubID=4&ClickID=3959471&SID=237591&SID2=218848&LPID=27&PC=47

(#3) https://offer [DOT] my-secure-page [DOT] com/greencoffeesky2554/index [DOT] php?PubID=4&ClickID=&SID=234895&SID2=218848&LPID=20&PC=27

Online order form for the Garcinia Cambogia scam (#1 and #2)

Online order form for the Garcinia Cambogia scam

Online order form for the Green Coffee scam (#3)

Online order form for the Green Coffee scam

I guess that's the only way they want to be contacted.

I do wonder why the model on the Garcinia Combogia page is sooooo much happier than the one on the Green Coffee page. Perhaps the unhappy model just found out she had to work late and actually wont be able to go to the beach today? Or maybe she misunderstood and thought she was going to provided actual coffee on this shoot and not some crap knock off pill? Or maybe she's annoyed that her pet's name is also being used to send crap emails.

Whatever the case -- at least now I've figured out why I'm now receiving emails from my dog.

Actual emails and text from both scam sites follow. . .

Email 1 -- Sent from 151.239.254.168 (Iran) via SMTP:

Delivered-To: christoperj@
Received: by 10.114.22.8 with SMTP id z8csp87384lde;
Mon, 28 Jan 2013 06:44:02 -0800 (PST)
X-Received: by 10.50.178.10 with SMTP id cu10mr5265682igc.75.1359384241463;
Mon, 28 Jan 2013 06:44:01 -0800 (PST)
Return-Path:
Received: from mailforward (mailforward. [10.10.10.10])
by mx. with ESMTP id j17si6674738igd.9.2013.01.28.06.44.00;
Mon, 28 Jan 2013 06:44:01 -0800 (PST)
Received-SPF: neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of mark.landrum@[MASKED]) client-ip=10.10.10.10;
Authentication-Results: mx.;
spf=neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of mark.landrum@[MASKED]) smtp.mail=mark.landrum@[MASKED];
dkim=pass header.i=@[MASKED]
Received: from mx1 (inbound-us1 [10.10.10.10])
by mailforward (Postfix) with ESMTP id 8A64DC40B13
for ; Mon, 28 Jan 2013 14:44:00 +0000 (GMT)
Received: from nm4.bullet.mail.ne1.[MASKED] (nm4.bullet.mail.ne1.[MASKED] [MASKED])
by mx1 (Postfix) with ESMTP id 59E2E470BC3
for ; Mon, 28 Jan 2013 14:44:00 +0000 (GMT)
Received: from [MASKED] by nm4.bullet.mail.ne1.[MASKED] with NNFMP; 28 Jan 2013 14:43:53 -0000
Received: from [MASKED] by tm9.bullet.mail.ne1.[MASKED] with NNFMP; 28 Jan 2013 14:43:53 -0000
Received: from [127.0.0.1] by smtp113.mail.ne1.[MASKED] with NNFMP; 28 Jan 2013 14:43:53 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=[MASKED]; s=s1024; t=1359384233; bh=PVq+lyXkw9/ZwyZF3FO+ziyIZAbxVMz1vpI5fUrFI90=; h=X-[MASKED]-Newman-Id:Message-ID:X-[MASKED]-Newman-Property:X-[MASKED]-OSG:X-[MASKED]-SMTP:Received:Subject:From:Date:To; b=T1RWE1dyyT/aXBn9faw8DyT0LSeH+X3KBvJCdhXiFGWTx0nw5ZI01fE8uuRUMP2CF4ZBS/nTW23ybafzNkg98XY2JXgx+dKz5xHTscc85A0a2IOgxVg4YyfPnwEwSG8WHF9FscV7jv4PrplffeF6u8QvTu+JTL+4nIcZXU6WTAw=
X-[MASKED]-Newman-Id: 88476.88781.bm@smtp113.mail.ne1.[MASKED]
Message-ID: <88476.88781.bm@smtp113.mail.ne1.[MASKED]>
X-[MASKED]-Newman-Property: ymail-3
X-YMail-OSG: zTSgRDAVM1kLstn0l8UcWZ65XYQuGwm0a2_E.KjLa0lvCiW
URl5dfbDu5EXJ0Szkt46aS41SHLUmplWsRUf5pl1gV0UhLkePDsjoT7rZnW0
1tlQV47uG2JfA0OmxtQDYCFa.eEC0r3wAATHkZk4CIOQrtUuKKFKOSRIbAtp
R7uJTtoAUEKrO8Yr1xhhoM66LHQ32Di8872OEf5A76hEutbCnzKX41LS_.WI
uxy5lMi7BtjsOzPYBO.tFCt37w390qrciheSfusTpVLBrILTl5uyNLRDnick
4QQzc2fSgfc1xt6FF9ig1f8wDjugIUOBQaczyCz.dNbz3w35bQ..iPHdt4np
zmcQEl4uYPaQlenXHUe0S8cT_kxUXP380uZipoFgMMD5i5OwyBlgeQvlpFaj
cY4zagJXRRsHisIaJkI0CBbZQPC9gIiCc6z0SENgMtUPqebRgtp0JzQ0svgv
dej96tUek1QGl1DMiDyXbVq0ulQ_aECkdOrx_SoyLJ5IAADGwCqarXPDAoPM
GyEwxGQa6hnnLpR9xTQ7hSN3wkw--
X-[MASKED]-SMTP: gWNLef2swBDN1xQ1viIi8RqT5JagVywAmA--
Received: from localhost (mark.landrum@[MASKED] with login)
by smtp113.mail.ne1.[MASKED] with SMTP; 28 Jan 2013 06:43:53 -0800 PST
Subject: awesome
From: Ace Marcinko
Date: Mon, 28 Jan 2013 06:00:46 -0700 (PDT)
To: "christoperj@"
X-CTCH-RefID: str=0001.0A0C0209.51068EB0.0136,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
X-CTCH-VOD: Unknown
X-CTCH-Spam: Unknown
X-CTCH-Score: 0.000
X-CTCH-Rules:
X-CTCH-Flags: 0
X-CTCH-ScoreCust: 0.000
X-CTCH-SenderID: mark.landrum@[MASKED]
X-CTCH-SenderID-TotalMessages: 1
X-CTCH-SenderID-TotalSpam: 0
X-CTCH-SenderID-TotalSuspected: 0
X-CTCH-SenderID-TotalBulk: 0
X-CTCH-SenderID-TotalConfirmed: 0
X-CTCH-SenderID-TotalRecipients: 0
X-CTCH-SenderID-TotalVirus: 0
X-CTCH-SenderID-BlueWhiteFlag: 0

http://luttu [DOT] com/dropageddanieldavies/

Email 2 -- Sent from 93.177.224.71 (Latvia) via SMTP:

Delivered-To: christoperj@
Received: by 10.114.22.8 with SMTP id z8csp41454lde;
Sun, 27 Jan 2013 03:52:14 -0800 (PST)
X-Received: by 10.42.67.10 with SMTP id r10mr6826717ici.7.1359287532673;
Sun, 27 Jan 2013 03:52:12 -0800 (PST)
Return-Path:
Received: from mailforward. (mailforward. [10.10.10.10])
by mx. with ESMTP id i9si5746332icv.34.2013.01.27.03.52.11;
Sun, 27 Jan 2013 03:52:12 -0800 (PST)
Received-SPF: neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of mad4bingo467@[MASKED]) client-ip=10.10.10.10;
Authentication-Results: mx.;
spf=neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of mad4bingo467@[MASKED]) smtp.mail=mad4bingo467@[MASKED];
dkim=pass header.i=@[MASKED]
Received: from mx1. (inbound-us1. [10.10.10.10])
by mailforward. (Postfix) with ESMTP id A3AD4C40E68
for ; Sun, 27 Jan 2013 11:52:11 +0000 (GMT)
Received: from nm5.bullet.mail.ird.[MASKED] (nm5.bullet.mail.ird.[MASKED] [MASKED])
by mx1. (Postfix) with SMTP id 3EE316A812C
for ; Sun, 27 Jan 2013 11:52:11 +0000 (GMT)
Received: from [MASKED] by nm5.bullet.mail.ird.[MASKED] with NNFMP; 27 Jan 2013 11:52:10 -0000
Received: from [MASKED] by tm18.bullet.mail.ird.[MASKED] with NNFMP; 27 Jan 2013 11:52:10 -0000
Received: from [127.0.0.1] by smtp105.mail.ird.[MASKED] with NNFMP; 27 Jan 2013 11:52:10 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=[MASKED]; s=s1024; t=1359287530; bh=frdxqFyfjx0ooZExbCowZdte6uVXaX57m0DhyZ0oakI=; h=X-[MASKED]-Newman-Id:Message-ID:X-[MASKED]-Newman-Property:X-[MASKED]-OSG:X-[MASKED]-SMTP:Received:Subject:Date:To:From; b=GmwYg6nd5iGuEnvfRv+t4QtSAuUnElOoQClgRo24KPdpLRPyvbiHwbMNeOUV6tNgNQeD6ySC+vcJLnpPi5btj7z9PweeaBFInGKuWdWhH6F3+YSMKBxbt/FVrgetvMGp6KhJ9N+Cdfmsep6p8mRRzgFNSpDjLW+iNQaf5LrJI/o=
X-[MASKED]-Newman-Id: 519688.98777.bm@smtp105.mail.ird.[MASKED]
Message-ID: <519688.98777.bm@smtp105.mail.ird.[MASKED]>
X-[MASKED]-Newman-Property: [MASKED]-3
X-[MASKED]-OSG: PhS.YJwVM1kjaMTwBwS2.lEgEy3ASEB5RWYthEWfqVy_l09
2LNAJKR0wE4ZUk2yyg69lU_4Ni0uwkgd8AyYOSwCbmjlkTIh_4OF2BeEYs3Y
mm6uFg12b15xY5JD37y0i9sF23bVuht1FMuZLmOD47TI3UAVclMw5sUxt9WX
3YNJSS3lmpvJ0iHdeBEXdj7H3zA5h.qzUo7f8q6QCYiLWrbCBf8QQtPqP1pg
FHgC_ekA1wOWvnl4_elQQrjyLeK89RMdgHHkhWVg9k2PMPZmh7ViY9kvOPu2
axUkBUqxemxixf7zntYRP_dnsDNOIqgCn_QRdndiY6lMs8CsBXazOO4owL78
LGPYQGRQ8PGpJL0Fl0uYA.JGUT9sfVs72czD5lG1tGl40rpc3b2ktGb9p74r
O_a_3IQrSpruaG0iOtJKGDgqNdu9WUIEBvlz9EsShucMHzeNdwTev.1pMDpd
s2ObWHS4ak1QZqCp8cUgngrW8ZWtsPqmrN0XVXjqgoogcuFDBTJQxHPFSln0
sY4mMQkRCOF7FWtK9OZgKuNdtKGLfBbJF6OWWuinFf9dM8yc-
X-[MASKED]-SMTP: YMUXWDKswBDxhgmlUQu2XRMzAq62fvVBYQ--
Received: from localhost (mad4bingo467@93.177.224.71 with login)
by smtp105.mail.ird.[MASKED] with SMTP; 27 Jan 2013 03:52:10 -0800 PST
Subject: awesome
Date: Sun, 27 Jan 2013 03:09:27 -0700 (PDT)
To: "christoperj@"
From: Ace Marcinko
X-CTCH-RefID: str=0001.0A0C0206.510514EB.00D9,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
X-CTCH-VOD: Unknown
X-CTCH-Spam: Unknown
X-CTCH-Score: 0.000
X-CTCH-Rules:
X-CTCH-Flags: 0
X-CTCH-ScoreCust: 0.000
X-CTCH-SenderID: mad4bingo467@[MASKED]
X-CTCH-SenderID-TotalMessages: 1
X-CTCH-SenderID-TotalSpam: 0
X-CTCH-SenderID-TotalSuspected: 0
X-CTCH-SenderID-TotalBulk: 0
X-CTCH-SenderID-TotalConfirmed: 0
X-CTCH-SenderID-TotalRecipients: 0
X-CTCH-SenderID-TotalVirus: 0
X-CTCH-SenderID-BlueWhiteFlag: 0

http://dakini [DOT] tk/blackcopyencounterigarydavies/

Email 3 -- Sent from 109.93.128.35 (Serbia) via SMTP:

Delivered-To: christoperj@
Received: by 10.114.22.8 with SMTP id z8csp72009lde;
Thu, 24 Jan 2013 07:16:25 -0800 (PST)
X-Received: by 10.50.160.137 with SMTP id xk9mr1458533igb.77.1359040584148;
Thu, 24 Jan 2013 07:16:24 -0800 (PST)
Return-Path:
Received: from mailforward. (mailforward. [10.10.10.10])
by mx. with ESMTP id or2si1705280igc.3.2013.01.24.07.16.23;
Thu, 24 Jan 2013 07:16:24 -0800 (PST)
Received-SPF: neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of may_raynaholic@[MASKED]) client-ip=10.10.10.10;
Authentication-Results: mx.;
spf=neutral (: 10.10.10.10 is neither permitted nor denied by best guess record for domain of may_raynaholic@[MASKED]) smtp.mail=may_raynaholic@[MASKED];
dkim=pass header.i=@[MASKED]
Received: from mx1. (inbound-us2. [10.10.10.10])
by mailforward. (Postfix) with ESMTP id 51B34C41AE5
for ; Thu, 24 Jan 2013 15:16:23 +0000 (GMT)
Received: from nm28-vm7.bullet.mail.gq1.[MASKED] (nm28-vm7.bullet.mail.gq1.[MASKED] [MASKED])
by mx1. (Postfix) with ESMTP id 2B0783F01F2
for ; Thu, 24 Jan 2013 15:16:23 +0000 (GMT)
Received: from [MASKED] by nm28.bullet.mail.gq1.[MASKED] with NNFMP; 24 Jan 2013 15:16:17 -0000
Received: from [MASKED] by tm10.bullet.mail.gq1.[MASKED] with NNFMP; 24 Jan 2013 15:16:17 -0000
Received: from [127.0.0.1] by smtp214.mail.gq1.[MASKED] with NNFMP; 24 Jan 2013 15:16:17 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=[MASKED]; s=s1024; t=1359040577; bh=cN14SojoLblKRf6oS1cY473Oc3GiW/F1dba0gHFgGgc=; h=X-[MASKED]-Newman-Id:Message-ID:X-[MASKED]-Newman-Property:X-YMail-OSG:X-[MASKED]-SMTP:Received:Date:To:From:Subject; b=rZMs6Mva2xNpAMZkIjWNk2CiN8dFlAbngq8pbVqI7bnv82/3rZI8nQE/WVCNMUZkHjpu4sI4poKQmxIkIJGj3shcB5o7IU5NYlSdTQfKb09fH93yLn+iHXFJwWYrhkS3t+2/dR3argiMf6LiRMe9uVNVt02gNwmHVBjZ9YfT1rs=
X-[MASKED]-Newman-Id: 590626.21120.bm@smtp214.mail.gq1.[MASKED]
Message-ID: <590626.21120.bm@smtp214.mail.gq1.[MASKED]>
X-[MASKED]-Newman-Property: ymail-3
X-YMail-OSG: VLOtm8cVM1m564kSA6UHHdYlgAnpHlaymFYSz3qUPWp.LVu
vc._XVVwDAjKz5O0cifdkG525d7wF_5IDhJ7SJhcIiY_XQxU9jSCbw1oUoSu
Scmspf.MOcQAWrChR7E503C569BAWKy_q3T2i27avSd_mUqguC8mxsYc9_5w
76WnQk85r6eSESEt6pZi3eQMfvGZztUniRY.USVFP6_thkKydTw6crzAIeS3
LwDCBc0IbMOeFYWYbp7S3iwf7UEz.rklUYzgMjv0fQJZtRN.VZ9w2jSASgpq
H5IbSSvzBxnCfDVlA6Pc5dvW8qbTjITDiyXtBKaBOaZ5NaYHtxCYR.GN83qO
.YpspYeFEko6teoqKC_R2oXFIAZOJaGPkFDsFtwkfg0DRxC8wUQSXrrcfK2s
_6mNwk5ryq6os9AeTTbpXcwsjC7tGGaOPmXUVsTwBb.NBm_Lnxc3ciUdXo2v
VxAFXaG_MxgxVIoBJG5QfguwHG36QbDr.wArnaLgQ4ThyEWrn9R53nrr3ev3
EmGMl6hSb05V0AsFF.1kSd5iEbYAu3HnjJk09Du33yyOKc1HmC0kFA6mLlBq
p
X-[MASKED]-SMTP: sQwBf5iswBAXLY1VLMrSfxDYup3vqrAqJMOs
Received: from localhost (may_raynaholic@109.93.128.35 with login)
by smtp214.mail.gq1.[MASKED] with SMTP; 24 Jan 2013 07:16:17 -0800 PST
Date: Thu, 24 Jan 2013 06:34:33 -0700 (PDT)
To: "christoperj@"
From: Ace Marcinko
Subject: great
X-CTCH-RefID: str=0001.0A0C0209.51015047.00DB,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
X-CTCH-VOD: Unknown
X-CTCH-Spam: Unknown
X-CTCH-Score: 0.000
X-CTCH-Rules:
X-CTCH-Flags: 0
X-CTCH-ScoreCust: 0.000
X-CTCH-SenderID: may_raynaholic@[MASKED]
X-CTCH-SenderID-TotalMessages: 1
X-CTCH-SenderID-TotalSpam: 0
X-CTCH-SenderID-TotalSuspected: 0
X-CTCH-SenderID-TotalBulk: 0
X-CTCH-SenderID-TotalConfirmed: 0
X-CTCH-SenderID-TotalRecipients: 0
X-CTCH-SenderID-TotalVirus: 0
X-CTCH-SenderID-BlueWhiteFlag: 0

http://indianriverna [DOT] com/disapproveafraidnicholasparker/

General Scam Text from (#1) and (#2) http://weightlossthatworkisnotmagicpill [DOT] com/diet/garcinia/index [DOT] html:

Note : Garcinia Cambogia has sold out in most major stores. As of Monday, January 28, 2013 it's still Available Online

FACTUAL STUDY: HYDROXYCITRIC ACID IN GARCINIA CAMBOGIA BURNS FAT. 15 LB. LOSS MONTHLY!

Normally, I don't recommend "weight-loss" supplements, especially weight-loss supplements that claim "easy" weight loss or "fast" weight loss. As a nutritionist, I strongly believe that the key to weight loss is a healthy diet and exercise, but there are some incredible superfoods that can deliver an added boost. One superfood in particular, Garcinia Cambogia, is creating major media buzz, and the research has me truly amazed. What has me and the scientific community so excited about Garcinia Cambogia extract is that people don't have to do anything different when taking this food supplement. They don't need to exercise, and they don't need to diet; they just appear to lose pounds fast.

Garcinia Cambogia Extract, America's Hottest New Way To A Flat Belly:

Let's cut to the chase: The most recent study on Garcinia Cambogia published in the Diabetes, Metabolic Syndrome and Obesity journal followed a group of 16 adults who supplemented with Garcinia Cambogia for only 12 weeks. Over the course of the study, the subjects lost an average of 17 pounds each - this was 10.5% of their overall body weight and 16% of their overall body fat!

There were no side effects reported. This is very exciting information and one reason why I think that Garcinia Cambogia could be an effective weapon against the obesity epidemic in our country.

Garcinia Cambogia stands above other products on the market. Most products on the market get their extract from a different source than that of the clinical studies. They do this to cut down on costs, but at the same time, it cuts down on effectiveness. In addition, they don't give the correct dose. By having a cheaper more inferior product, customers need to buy more in order to have the same results. If they see small weight loss, they buy more of it. It might be good business, but poor practice.

Every order of Garcinia Cambogia is a one-time-only transaction. In other words, there are absolutely no reoccurring charges or hidden offers.

(And so on. . .)

General Scam Text from (#3) http://weightlossthatworkisnotmagicpill [DOT] com/diet/GreenCoffeDiet-c/index [DOT] html:

Note: Green Coffee Extract has sold out in most major stores. As of Monday, January 28, 2013 it's still Available Online

Denton Stores Struggle to Keep the Popular Fat Burner in Stock Normally, I don't recommend "weight-loss" supplements, especially weight-loss supplements that claim "easy" weight loss or "fast" weight loss. As a nutritionist, I strongly believe that the key to weight loss is a healthy diet and exercise, but there are some incredible superfoods that can deliver an added boost. One superfood in particular, the green coffee bean, is creating major media buzz, and the research has me truly amazed.

What has me and the scientific community so excited about green coffee bean extract is that people don't have to do anything different when taking this food supplement. They don't need to exercise, and they don't need to diet; they just appear to lose pounds fast.

How Green Coffee Extract Helps You Burn More Fat:

Let's cut to the chase: The most recent study on green coffee bean published in the Diabetes, Metabolic Syndrome and Obesity journal followed a group of 16 adults who supplemented with green coffee bean for only 12 weeks. Over the course of the study, the subjects lost an average of 17 pounds each - this was 10.5% of their overall body weight and 16% of their overall body fat! There were no side effects reported. This is very exciting information and one reason why I think that green coffee bean could be an effective weapon against the obesity epidemic in our country.

Green Coffee Extract, America's Hottest New Way To A Flat Belly:

Let's cut to the chase: The most recent study on green coffee bean published in the Diabetes, Metabolic Syndrome and Obesity journal followed a group of 16 adults who supplemented with green coffee bean for only 12 weeks. Over the course of the study, the subjects lost an average of 17 pounds each - this was 10.5% of their overall body weight and 16% of their overall body fat!

There were no side effects reported. This is very exciting information and one reason why I think that green coffee bean could be an effective weapon against the obesity epidemic in our country.

What To Expect With Pure Green Coffee:

We're sure you've tried a lot of different weight loss products that all promise to do amazing things then don't deliver. That shouldn't be the case, so we're going to tell you what we experienced when we tried Pure Green Coffee

You may be wondering if you can get the same effects from the coffee you drink with breakfast in the morning - and the truth is that you can't. When you roast coffee beans, you remove the chlorogenic acid. Green coffee beans are unroasted, have little aroma and are extremely bitter - because they contain over 50% chlorogenic acid. Remember, as I've always said, when it comes to your health, "Bitter is better." Because the green coffee bean is so bitter, I recommend taking it in capsule form. I suggest finding 800 mg pure green coffee bean capsules Take one capsule about 30 minutes before meals; I recommend taking them two or three times per day with a full glass of water for the best results. And remember that combining green coffee bean with a healthy diet and exercise can improve your results!

Every order of Pure Green Coffee is a one-time-only transaction. In other words, there are absolutely no reoccurring charges or hidden offers.