Long lost friends asking you to do IQ tests? Just say NO!

Started noticing a trend where people I've not spoken to in years, seemingly limited to Yahoo! Messenger so far, message me saying I should go do an IQ test whilst they go have a shower.

I figured something was afoot, and sure enough by the third or fourth time I'd figured out the pattern...

(05:09:41) Bot: hey its been a long time :p
(05:10:44) Me: Don't tell me.. you want me to do an IQ test?
(05:11:01) Bot: I just took an IQ test here.. pretty cool :P
(05:11:10) Me: You got 113, right?
(05:11:30) Bot: got a 113 lol... I thought I was smarter than that
(05:11:46) Me: I'm thinking your next comment will be the link?
(05:12:07) Bot: its http://iqscorechallenger.com/?invitecode=..........
(05:12:20) Me: Thought so.. I reckon you're full of shit to be honest
(05:12:44) Bot: you should see if you can do better than me... if you can ill buy you a drink
(05:12:59) Me: Mrrmm.. alcohol.. I'd need a lot of that to fall for this :)
(05:13:20) Bot: try it... http://iqscorecalc.com/?invitecode=.......... I bet you cant lol
(05:13:32) Me: I'm waiting for the comment that says you have to go and you'll be right back..
(05:13:40) Me: Funny how that link changed..
(05:13:45) Bot: take it now while I take a shower lol
(05:13:52) Me: ... and there we go :)
(05:14:07) Bot: ill be back in a few after im all fresh
(05:14:19) Me: Sure... with a new script... I wonder how long it is :)
(05:14:36) Bot: brb, let me know your score when im back!
(05:14:47) Me: Hrrmm.. must be getting towards the end of it..

Appears to be a very unintelligent, automated process that simply spews forth the same script on a timed basis with different URLs with different ID codes pointing to the same IP address, listed as part of a Russian range, registered to an address in the Seychelles. Oh, and who puts a smiley in the description of a AS number/route?

$ host iqscorechallenger.com
iqscorechallenger.com has address 92.241.168.102
$ host iqscorecalc.com
iqscorecalc.com has address 92.241.168.102
$ host 92.241.168.102
102.168.241.92.in-addr.arpa domain name pointer 2x4u175.2x4.ru.
$ whois 92.241.168.102
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '92.241.168.0 - 92.241.169.254'

inetnum:        92.241.168.0 - 92.241.169.254
netname:        NET-2X4
descr:          2x4.ru network
country:        RU
admin-c:        UDF667-RIPE
tech-c:         UDF667-RIPE
status:         ASSIGNED PA
mnt-by:         RU-WEBALTA-MNT
source:         RIPE # Filtered

person:         Pavel Ivanov
address:        Sound & Vision House, Francis Rachel Str.
address:        Victoria, Mahe, Seychelles
remarks:        ***************************************
remarks:        Virtual and shared hosting, Windows Linux FreeBSD
remarks:        Virtual private Servers (VPS/VDS), Dedicated Servers
remarks:        Protected managed hosting solutions, DDOS protection systems
remarks:        Satellite CPC/VSAT telecomunications
remarks:        Wireless links services.
remarks:        English and Russian Sales contact: ICQ 758291
remarks:        ***************************************
abuse-mailbox:  abuse@2x4.ru
remarks:        West Europe customers office & NOC
phone:          +44 20 3286 6617
remarks:        East Europe customers office & NOC
phone:          +7 495 657-90-57
mnt-by:         IDEAL-MNT
nic-hdl:        UDF667-RIPE
source:         RIPE # Filtered

% Information related to '92.241.160.0/19AS41947'

route:          92.241.160.0/19
descr:          Wahome IP's =)
origin:         AS41947
mnt-by:         RU-WEBALTA-MNT
mnt-routes:     GIGABASE-MNT
mnt-routes:     RU-WEBALTA-MNT
source:         RIPE # Filtered

I decided to follow one of the links... from a text only browser that doesn't support scripting! Enter.. elinks!

If you attempt to load a URL without a valid ID code, it'll return a 404 (Not Found error) advising you that the page doesn't exist. Give it a valid code and you immediately get redirected to another page:

IQ Friend Challenge

Refresh: http://spacetrk.com/aff_c?offer_id=74&aff_id=60

If you view the source of the page, you'll see there's some framesets at work:
<!-- make <3, not war -->
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">
<html>
<head>
<title>IQ Friend Challenge</title>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<script type="text/javascript">
setInterval("window.status='';", 50);
</script>
</head>
<frameset cols="100%,0%">
<frame marginwidth=0 marginheight=0 frameborder=0 name="topframe" src="/index.php?test=ff27fb0739&redirect=1" noresize>
<frame id="waitframe" name="waitframe" src="wait.php?n=0">
</frameset>
</html>
... and a sense of humour.. Make love not war?

Anyway, spacetrk.com page then redirects off to affiliate.a4dtracker.com which then advises that www.test-my-iq.net/au/?p_id=..... can't be found. Awww, and I so wanted some half ar...baked website to make some stab in the dark as to what my IQ is :(...

No doubt if I'd used a more modern browser I would have been hit by some drive-by download.

The moral of the story here, folks, is not to click on anything that doesn't sound right. If someone appears out of the blue to get you to click on something and then has to vanish conveniently, something is NOT RIGHT.