June 14, 2017

[hr_invisible]

Phish NETS:  Signin for Amazon Promotional Gift and Apple ID Locked

Would you think this next email is really from Amazon about an iPhone promotional gift? “Use your $50 Amazon gift card by Friday” is the subject line, but this is smelly phish for sure! “Thank you for visiting Amazon.com.  Your last iPhone purchase entitles you to a promotional gift” SIGN IN.  But a mouse-over of SIGN IN and the other Amazon links show that they point to the domain rewardingyous-DOT-com.  You think you’re logging into Amazon?  Think again.  This oddball domain, sounding like a 1950’s Brooklynite addressing a group of people, was registered on June 7, the day the email was sent.

Delete!

[hr_invisible]

This phish is easy to spot if you pay attention to the from address and mouse-over the link “resolve now.”  “For your protection, your Apple ID is automatically locked.”  Horse manure!  Don’t be fooled by seeing the secure link (httpS) in the mouse-over.  That’s just a secure shortening service used by the criminals who crafted this phish.   We unshortened it using Urlex.org The link points to apple-id.case-accounts-DOT-com.  In this link “apple-id” is a sub-domain.  Sub-domains can say anything one wants.  Focus on what appears immediately in front of “.com” separated by a period from the sub-domain and you’ll see case-accounts.  This domain was registered on June 9 using a privacy proxy service in Ontario, Canada.

Now delete!

[hr_invisible]

[hr_invisible]

YOUR MONEY:  Free Sample Offer, Magic of African Safari and Digitize Home Movies

“ATTENTION you have been selected for a Free Sample Offer!” says an email sent from Peru (.pe = country code for Peru).  The sender goes on to say that it was a friend of yours who anonymously sent the email.  Right, and we have land to sell you in Atlantis. The link for “Follow the URL to read more information…” points to a hacked website for a clothing store in Peru that specializes in “Amahra Wool.

[hr_invisible]

We would love to take an African safari!  We’ve talked about it for years.  But this isn’t the way to go about it.  The email came from Insider_Travel_Deals @ agleg.us with the subject line “Experience the magic of an African Safari (Save up to 70% today)”  Notice the urgency to engineer your clicking behavior.  Google can’t find any website at agleg.us and that’s because the domain was registered the day this email was sent by a “Bary Mifflin” from Trondheim, Norway.  The site is hosted in England.  Does any of this sound like Dunhill Travel Deals in Fort Lauderdale, Florida, whom they claim to represent?

[hr_invisible]

We’ve seen these bogus emails before that pretend to represent the website iMemories.com in Scottsdale, Arizona.  But all the links in this scam email point to a sub-domain on the website forumdirectory.net, a website registered to a man from Bucharest, Romania.  However, we absolutely loved that photo of Dean Martin!

Now delete.

[hr_invisible]

[hr_invisible]

TOP STORY: Get Leaked Snaps – Sketchy at Best!

There is a very suspicious game afoot targeting users of Snapchat and we’re not quite sure what it is.  However, we wanted to bring this to everyone’s attention since Snapchat is so popular.  This story actually came to us from a teen asking if the website GetLeakedSnaps-DOT-com was legitimate.  He reported to us that after he entered a username the site asked him to download an app and use it for thirty seconds.  This sounds like classic social engineering for malware installation to us.  We started to do some digging beginning with this screenshot pulled up by ScreenshotMachine.com.  After using several tools to be certain that malware wasn’t waiting for us when we arrived, we also visited the top page of the website.  We found several enticing photos of scantily clad young women, suggesting that the site would give you access to these types of leaked snaps…

[hr_invisible]

Before we continue, let’s be very clear about Snapchat, a company that has made many millions of dollars primarily by telling its users they can send photos to friends via smartphones and these photos will self-delete in ten seconds or less, based on the sender’s preferences.  It was all a lie and ultimately the FTC fined Snapchat millions of dollars.  Here are links to two articles about this sham privacy pitch:

Government Tells Snapchat to Stop Lying  About Photos Disappearing (Forbes.com, May, 2014)

Snapchat Settles FTC Charges That Promises of Disappearing Messages Were False (FTC.gov, May, 2014)

“Online privacy” is an oxymoron.  Tens of thousands of Snaps have been hacked and exposed from Snapchat servers.  They were made available on the Internet.  As of this month, there are at least 7 apps that automatically capture snaps the moment they are opened on a smartphone, and without informing the sender.  And all those “deleted” snaps are still sitting on user’s smartphones and are simply disguised and hidden from view.  But we digress….

Could getleakedsnaps-DOT-com actually have, and provide. any leaked snaps that users have sent while thinking they will be deleted in 10 seconds or less?  The domain getleakedsnaps-DOT-com was registered on May 21, using a WHOIS privacy service in Panama.  That new registration through Panama is enough for us to be suspicious about this site.   We visited the site and arbitrarily entered the usernames ssmith and amiller.  In both instances we received the response “Tap ‘OK’ and verify to search the database” and we did.  This is what came up next…

[hr_invisible]

We had a good feeling where this was leading and we stopped here.  Most likely these offers would ask us for a whole lot of personal information that we were not willing to give, and taking us to a variety of websites.  So ultimately, we cannot say whether or not this site actually delivers leaked snaps, is malicious, or a clever marketing pitch.  However, we do have more information about this suspicious and clever pitch to attract people to possible leaked snaps.  We also found two more recently registered domains with active websites allegedly offering leaked snaps.  They are:

Snapleak-DOT-online  Registered April 19, 2016 (and updated on March 11, 2017)

Snapleaks-DOT-wiki Registered March 5, 2017

Both of these sites were registered through the Panamanian privacy service and are hosted in Amsterdam, Holland.  They contain the same exact top page as getleakedsnaps-DOT-com you see above, all suggesting they were created by the same owner.   These tactics are similar to scam tactics we’ve seen many times before to socially engineer clicking behavior, drive traffic and collect personal information.  We cannot say for certain that is what is going on with these three sites but we are very suspicious. Here’s another example of the very suspicious nature of these sites.  A user named “SnapChatHack” posted this completely inappropriate message on the MIT website supporting the children’s programming language called Scratch. (We’ve informed MIT.)  In the instructions field, the user posted 48 strings of words to attract search engines who are asked about leaked snaps, including “leaked gay snaps,” “leaked snaps hot,” and “leaked snaps dirty.”

[hr_invisible]

The more we dig into this story, the worse it feels.  Our assessment is clear…. TDS DOES NOT recommend using these websites that claim to give access to stolen/leaked Snapchat snaps!

If any of our readers have already used these sites and have more information to update or clarify this story, please contact us at snapleakstory@thedailyscam.com

[hr_invisible]