December 6, 2017

[hr_invisible]

Phish NETS: PayPal, AppleID, Chase Bank and Wells Fargo Bank

Phishers have been very busy targeting Americans!  Let’s begin with this extremely dangerous phish disguised as an email from PayPal but sent from staff “@” secureinfo-DOT-us.  “It’s unfortunate for us to inform you that we may restrict or suspect your account if you refuse to update some of your information that are out of date.”  The English in the email is awkward.  The recipient is sent an “update form” but the attached document is actually an html web document asking for extremely personal and financial information! (See below.)  This html form was coded by a real pro!  It was one of the best we’ve ever seen.  The author included coding that hid the real destination of your personal information and then redirected you to the real PayPal.com site after you provide it.  Your data appears to go to PayPal.com but the behind-the-scenes code dynamically assembles a URL and will send your precious data to “user5836” at secure.safe-platform-DOT-net.  A WHOIS look up for the domain safe-platform-DOT-net shows that it was registered on November 30 to someone identified as Mark Ingrid from Kuala Lumpur, Malaysia.

Ouch!

[hr_invisible]

[hr_invisible]

By contrast, this next phish for your AppleID was soooo lame that the inept criminal senders coded it incorrectly.  The email was supposed to pull all email addresses and a time/date stamps into the body of the email and it didn’t work.  Also, look at their English language skills.  Why bother sending this scam when you can barely write a sentence correctly?

Deeeeleeeeete!

[hr_invisible]

This next phish pretends to be from Chase Bank and is also pretty lame.  “Unthorize sign in to your chase account from an unrecognized device.”  You don’t say?!  A close look at the from address and mouse-over of the link for Chase.com easily reveals the fraud.

Delete.

[hr_invisible]

“Important Security Notification  Dear Customer, Please log into your  Wells Fargo account immediately to review and verify recent activity on your account.”  That link may appear to be a secure link for wellsfargo.com but it actually points to a shortened link using the service ow.ly.  We unshortened the link to find that you’ll be sent to a website in Spain! (2-letter country code “.es” = España = Spain)

Borrar esta mensaje!

[hr_invisible]

[hr_invisible]

[hr_invisible]

YOUR MONEY: Amazon Customer Survey and Keysmart Organizer Holiday Gift

This email appears to come from a domain that doesn’t exist as of December 2.  “Amazonscard-DOT-com” was never registered.  However, clicking the links in this email don’t send you there anyway.  They will send you to a malicious domain called amazngofr-DOT-site. (Confirmed by the Zulu URL Risk Analyzer.) Don’t believe this “Amazon Consumer Survey” offering a chance to win something.  We wrote an article about the criminal gang in India whom we believe is responsible for this malicious email and thousands more.  Check out Criminals in India Target Americans.

There is a real company that makes the “key smart organizer” but this next email is not from them.  It is, however, an important reminder that American consumers will be getting lots of malicious emails disguised as holiday promotions.   This email came from the domain keysmardhc.trade, and the links point to it as well.  It was registered the day this email came out (November 28) by someone named Albert Reyes from Minnesota.  We wonder why Albert listed his email as Yandex-DOT-com, an email service located in Russia.

This is a big, fat holiday delete!

[hr_invisible]

[hr_invisible]

TOP STORY: Beware Amazon Mimics

Undeniably, Amazon.com is probably one of the largest retailers in the world today.  With the holiday season in high gear, millions of people will be excited to get emails, texts, social media posts, and online coupons for products at Amazon.  But many of these are fraudulent tricks designed to infect computers, tablets and phones with malware.  We always see malicious emails and fake domains pretending to represent Amazon.com, among others.  But, in the last week we have seen a four-fold increase in the number of fake domains and malicious emails pretending to be from or about Amazon products and promotions.  Such as this one with the subject line “Your Amazon.com Gift Card is on the way” sent from amazoncom “@” amznreward-DOT-com.

Or this next email with subject line “Rewards worth over $50 from Amazon – Get yours” and sent from amazon.prime “@” amazionusa-DOT-com.

If you didn’t already notice, look back at the scam email addresses listed at the top of this newsletter.  There are eight different domains (and email addresses) pretending to be from or about Amazon.  In addition, here are six more that we found…

Amazon <amazon@novembergift-DOT-com>

“Amazon Certificates” <amazon-certificates@newyeargiftz-DOT-com>

“Amazon Prime Rewards” <amazon_prime_rewards@shopnvouch-DOT-com>

“Amazon Customer Center” <amazon_customer_center @ primeonlines-DOT-com>

“Amazon Prime” <amazon.prime@amazionusa-DOT-com>

“Consumer Survey” <amazonscard @ amazonscard-DOT-com>

Our honeypot email servers saw hundreds of emails from these fourteen different domains wanting us to believe they were for Amazon.   Whatever is written in front of the “@” symbol is unimportant as far as determining who was responsible for these malicious domains. The only important information is what follows the “@” symbol. Using a WHOIS tool, here’s a quick look at who we found, or didn’t find, was behind the registration of these domains…

We have written about “Cammie Macpherson” several times this fall.  Every WHOIS lookup lists her email, phone number, fax and home address, which is shown as an apartment complex in Pompano Beach, Florida.  Of course we don’t believe that this is real, or if real, that Cammie ever registered these domains.  “Cammie” has registered more than one hundred malicious domains since October, 2016 according to DomainBigData.com Domains in her name include curediiabetes-DOT-com, curediiiabetes-DOT-com, starrbuckss-DOT-com, candidatesecretzz.com (on 9/29/16 close to election day), costcoreward-DOT-com and costcowholesale-DOT-com.  All of these scam domains were registered using either NameCheap.com or Enom.com.  We have seen these two registrars misused by criminals for years!

Cammie Macpherson is the perfect example of everything that is wrong with ICANN, Registrars (sellers of domains) and the entire domain naming system.   Cammie’s malicious efforts raise questions…

1. According to ICANN, there are at least 2500 Registrars worldwide. Why is it that criminals overwhelmingly use just two of these many registrars?  Has this been investigated?  If not, why not?
2. How is it possible that anyone can register a domain with fraudulent information? Why isn’t there a better system in place to verify identity, or follow the money trail the moment fraud is detected?  And why are proxy services allowed to purchase domains in someone else’s name, allowing identity to be hidden, without any accountability for the proxy services?
3. Why is Cammie allowed to purchase so many fraudulent domains? Why didn’t she get black-listed after initial domains were found to be fraudulent?  Some of her domain names clearly raise alarms about copyright infringement.  Do the registrars pay attention to the domain names purchased?  Shouldn’t they be held accountable and show due diligence?
4. Why are there no Internet police? The Internet is probably the largest single economic, social thriving entity in the world.  Yet, there are so few protections of citizens who use the Internet and reporting Internet crime is a joke.

All of this lack of accountability and responsibility to world’s citizens means that fraud is easy and rampant.  It is us, users of the Internet who suffer the effects daily.  The Daily Scam has made six specific recommendations on how to make the Internet safer for everyone. You can read about them here. Finally, we leave you with one more malicious Amazon-mimic in this losing battle for safety online…

[hr_invisible]