July 12, 2017

[hr_invisible]

Phish NETS:  Capital One and Email Important Notice

“Important Notice”  “Because of unusual number of invalid login attempts on you account, we had to believe that, their might be some security problem on you account.”  This email is like nails on a chalkboard to grammar teachers across the U.S.!  The email, of course, didn’t come from citi.com but came from localhost.localdomain.  And the link “Click Here Verification Your Account” points to an Albanian website that we think is for the Democratic Party of Kosovo.  Must be the Russians again.

Delete!

[hr_invisible]

This next phish with subject “Important Notice” tries to target generic Outlook email account users with a bogus scare tactice. “POSSIBLE VIRUS/PHISHING SCAM DETECTED”  Hell, you got that right!  The link points to the domain tripod.com, a free web-hosting service.

[hr_invisible]

YOUR MONEY:  PCShield Inc, Amazon Survey Reward, and Lotto Destroyer

We loved seeing this next old-fashioned, who-uses-fax-anymore scam!  It came to us via a TDS reader with sharp eyes who noticed it was complete bull crap, not a legitimate bill.  The fax arrived at a school on July 4.   That’s our first hint that something isn’t right about this fax.  It’s a bill from PC Shield, Inc in Oklahoma City, OK.   There is one small spot on the entire bill that says “Ad from.”  Everything else about this bogus bill screams fraudulent billing practice.  There’s no phone number and no website to visit.  In fact, a visit to pcshield.com shows a BIG message saying “This Domain Name is Suspended.”  However, you can email your payment to them or fax the payment information.  The school, of course, doesn’t use this service and knows nothing about it.

Deeeeleeete… er, we mean rip it up.

[hr_invisible]

“You have been selected to take part in our anonymous survey” about Amazon!  “Take this 30 second questionnaire and we’ll offer you an exclusive deal worth over $50!”  Notice they aren’t offering you $50, but a deal valued at $50.  Nevermind though, the bottom of the email contains the opt-out address to the most misused scam mailbox in the history of our three years in operation… 2885 Sanford Ave. Grandville, MI.  Even the domain itself was registered to this dropbox address of no particular origin.  According to the Zulu URL Risk Analyzer, the domain leputic33-DOT-com has been blacklisted as malicious.

[hr_invisible]

[hr_invisible]

Want to meet the LOTTO DESTROYER!?  Sounds like the villain from some B-grade movie.  “Winning has never been this easy”  The logic of this email is absurd.  Think about it.  I create a smart robot software able to win lotteries.  Then I post it online and send the link to random people across the Internet?  Wow, what a self-less, benevolent and altruistic person!  Or could it be that I want to infect people’s computers and have malware like ransomware at the end of the link?  Hmmm…. Zulu reports a 91% chance the link is malicious.  The odds of getting an infection are way better than winning the lottery.

Delete!

[hr_invisible]

[hr_invisible]

TOP STORY:  Can You See Deleted Text Messages?

This next effort to engineer your clicking of a malicious link got us thinking about a common question parents ask in their effort to monitor or check on their child’s smartphone use…  Can a child’s text messages be read after being deleted?  First, have a look at this scum email we received with the subject line “How To See Deleted Text Messages.”  It is made to appear as though it is affiliated with CNN but the email was sent from the domain childrenzaler-DOT-com on July 3.  “Over 50% of teenagers experience cyber bullying and are 9 times more likely to consider suicide.”

Sadly, cyber-bullying impacts many kids and the statistics in this scam email appear to come from the i-Safe Foundation (reported on bullyingstatistics.org and nobullying.com from 2013 and 2014.  Of course the numbers are a moving target from year to year and vary by how they are reported.  The point is that the problem is serious.   But this email is not going to lead you to help.  A search in Google for the domain childrenzaler-DOT-com only shows lots of links for the website emailfake.com and other sites reporting fake emails.  The domain was registered to someone named “James Wilson” on July 3^rd and the Zulu URL Risk Analyzer reports that this domain has already been blacklisted and is malicious.

[hr_invisible]

So where does that leave this notion about resurrecting deleted texts?  Is it possible?  Can parents or police use this trick to safeguard, protect, monitor, or track someone?  We think you’ve already guessed the answer…  There’s no such thing as delete when it comes to our online lives.  Doubt us?  Ask Kyle Navin, now in a Connecticut jail for murdering his parents, after police used special software to find and restore his deleted texts. (How Police Can Get Your Deleted Texts, WTNH.com, November, 2015) Or ask a teacher in Florida about the 129,000 deleted text messages found by investigators on her phone and a student’s phone in 2016, leading to the arrest of the teacher. (Florida Teacher Exchanged 129,000 Sexually Explicit Texts with Student, WFLA.com, November, 2016)  Perhaps you remember the tragic death of a Beta Theta Pi fraternity pledge at Penn State U last February.   Eighteen Penn State students are facing charges this summer, in part, due to recovered texts that had been deleted from phones.  (Reported on ABCNews.com: More Details Emerge in Horrific Penn State Fraternity Death, May, 2017).

Even lawyers and parents have access to these tools.  DecipherTools.com is a company based in California and Arizona that offers services, tools, and resources for restoring deleted content including texts.  They even have a blog informing parents how they can undelete texts themselves.  Visit “How to Recover Deleted iPhone Text Messages.”

So, once again, the next time you think that digital content is private or unrecoverable once “deleted,” think again.  Even the professional Russian hackers couldn’t completely hide their tracks.  So why do we think we can?