July 26, 2017

[hr_invisible]

Phish NETS:  PayPal Account and Email Alert

We saw several emails pretending to be from Paypal.com stating that your account has been closed.  You are asked to log in again to confirm your information in order to reopen the account.  But the emails don’t come from Paypal.  This one came from mteams.net and the link for “confirm now” points to a secure, but hacked, website called ataamz.com that also hosts malware just waiting to infect your computer.

This is what the web page looks like from the link in this phishing email

[hr_invisible]

Here is a similar phish that was sent from a different email account and points to a different secure, but hacked webserver in Chile.  No doubt, it was created by the same criminal who created the one above…

[hr_invisible]

And then we found this phish targeting faculty at a school.  The link points to a Vietnamese website.  Another big, fat delete!

[hr_invisible]

[hr_invisible]

YOUR MONEY:  Home Depot Windows Center, Looking to Rebuild Your Credit, and Best PC Game of  2017

Want an e-voucher from Home Depot Windows Center?  Don’t go clicking these links!  They lead to the domain anywaydemo-DOT-date.  This domain was registered by someone named David Payne from California just minutes before the email was sent.  It’s odd that David listed his email address as “evan.sharb” using a Yahoo service in the United Arab Emerites.  This certainly isn’t Home Depot.

[hr_invisible]

Are you looking to rebuild your credit?  “You have been approved for a Platinum Visa Card”  It looks like you are applying for a Capital One Visa Card but hold on just a moment!  The links in the email point to the webserver company1fit.party.  That’s right, DOT-party.  That oddball domain was registered the same day the email was sent and the website is being hosted in Hessen, Germany.  Sound like anyone you want to hand over your personal credit information to, or even trust enough to click the link?  Next….

[hr_invisible]

Do you know anyone who enjoys flight simulator games?  Supposedly this one is the Best PC game in 2017.  “The perfect most realisitc flight sim you ever tried.”  Except for the fact that it’s a lie.  The email came from, and links point back to the domain wyartz-DOT-date.   This domain was also registered on the same day the email was sent.  This time it was registered to someone from Texas named Owen Patterson who also happened to use an email address from the United Arab Emerites.

Delete!

 [hr_invisible]

[hr_invisible]

TOP STORY:  Venus Fly Traps of the Internet: Fake Reward Domains

The Venus Fly Trap is a carnivorous plant that tricks unsuspecting insects to land in it’s trap.  Criminals have been sending click bait for malicious domains that sound a lot like consumer reward websites associated with familiar brands.  Such as this email that appears to be associated with Sam’s Club.  “Your Sam’s Club Weekend reward” is now ready to use.  The email came from, and has links to the domain ussamzclub-DOT-com.  As in “US Samz Club.”  Sounds kinda like it could be associated with the real Sam’s Club.  But of course it’s not.

[hr_invisible]

The domain ussamzclub-DOT-com was registered to someone named James Wilson from Dallas, Georgia on the day this email was sent.  James has been busy.  Since January, 2017 we’ve reported five times on malicious domains registered to James Wilson.  He now has nearly 2000 domains registered in his name and we’ll bet every one of them is meant to hurt people.

Criminals routinely look for ways to make their venus fly traps seem more believable and convincing so you’ll click.  Recognizable brands are targeted all the time for this purpose.  Like this next scam that feels like a message from CVS pharmacy with subject line “CVS Pharmacy bonus: Redeem your $50-voucher by Sunday.”  The scammers were so quick to produce this crap that they didn’t notice their silly spelling error in the word certificate.

[hr_invisible]

Once again, they use domain names that seem as though they are legitimate. In this case, pharmacvsusa-DOT-com.  As in “pharma CVS USA.”   In this case it was “Darrell Lemley” who registered the bogus website on the day this email was sent.  We’ve also reported on Darrell’s malicious streak several times this summer.  “Darrell” has registered more than 1,140 malicious websites.

No doubt, both of these men are fictitious but the fact remains that at least two thousand one hundred malicious websites have been registered by these two aliases alone!   And yet, the Internet police can’t stop them.  Oh yah, there are no Internet police, only the governing body of Internet Names known as ICANNs. And ICANNs, that bloated, gutless body of people who manage Internet rules and regulations, continue to do nothing to stop the fraud and criminal misuse of the Internet.  These brand-name wannabe domains litter the Internet.  In the last week alone we found the following…

giiftfromprime-DOT-com

zonamareward-DOT-com

rewardwithpriime-DOT-com

givefromamaazon-DOT-com

cvsextrakares-DOT-com

extrakarecvs-DOT-com

freemacyscard-DOT-com

rewardskardz-DOT-com

“James Wilson” registered every one of the bogus reward domains listed above except for the last domain in the list.  That was registered by “Darrell Lemley.”  So the next time you get a promotional deal in your inbox or posted through your social media, look carefully at the domain.  Try doing a simple look up using a WHOIS tool and save yourself a lot of heartache down the road.  (Watch our short video, “How to Use a WHOIS tool”)

[hr_invisible]