November 1, 2017

[hr_invisible]

Phish NETS: Netflix and Bank of America

“Your Netflix Membership is on hold” says an email from “netflix.mail.com.”  Notice that this is not the same as an email from netflix.com.  “We recently failed to validate your payment information we hold on record for your account, therefore we need to ask you to complete a brief validation process in order to verify your billing and payment details.”  You’re asked to click the link “Click here to verify your account.”  It points to a website that is trying sooooo hard to look official:

neflixuser-support.validate-user.membership-netflixid-DOT-com

[hr_invisible]

The actual domain (versus subdomain) you are directed to is membership-netflixid-DOT-com and it was registered the day the email was sent by someone named “Jamie Wilson” from London, England.  The domain is being hosted in Panama.  Does this sound like Netflix to you?  Yet here’s what the webpage looks like if you were to click that link:

“Online Banking Alert: Action Required”  This phish even correctly spoofs the from address of BankofAmerica.com.   But don’t be fooled by this!  If you read the email carefully you’ll find several grammatical and capitalization errors that should make anyone suspicious.  Also, no bank will send you a verification file!  They’ll ask you to visit their website and log in.  The attached file is a web document meant to trick you into logging into a fake page and handing over your banking credentials.

Delete!

[hr_invisible]

[hr_invisible]

[hr_invisible]

YOUR MONEY: Convert YouTube Videos and Amazon Consumer Survey

Though VidMate is a real app for Android phone users that claims to download YouTube videos, this email is not from the real VidMate!  The from email suggests that it came from AmazonNews.com but we doubt that.  Most importantly, mousing over any of the links, such as “INSTALL NOW FOR FREE” reveal that they point to the domain TipTopLoan-DOT-US. This domain was registered at the end of August to someone named “Marshall Davis” from Tanger, Morocco.  This isn’t the domain of the real VidMate app.  (And Spamhaus.org has identified this domain as a spam source.)

A big fat delete.

[hr_invisible]

We wish we had a dollar for every scam that pretended to be Amazon!  We could retire quite nicely!  But we don’t so…  This “Amazon consumer survey” is just click bait.  But we love their opening line… “Dear You have been a kind person and people around you have noticed that.”  Awwww…. Isn’t that sweet?  And so we’ve been sent a prize.  The link for that lovely surprise points to the domain giftzoness-DOT-bid.  Google can’t find anything at all about this domain.  A WHOIS look up tells us that it was registered the day the email was sent through a private proxy service in Panama.  Are you thinking about writing that address in Staten Island to have your email removed from their lists?   The Suite 702 address is used by the Platinum Elevator Group, an elevator service company.  We’re sure they would be happy to take you off their Amazon consumer survey list. 😉

[hr_invisible]

[hr_invisible]

TOP STORY: Even Criminal Gangs Are Frugal

In the good old days of the Internet there were just six top level domains that are now so familiar to all of us.  They are DOT com, org, gov, net, mil and edu.  ICANN, the governing body of all Internet names, has been expanding this list aggressively during the last few years.  We checked recently and there are now more than 1500 top level domains.  (Visit ICANN to see the list.) Based on our experiences, the vast majority of the newest domains are used exclusively by criminal gangs to target netizens with malicious software.  Unfortunately for the criminals, their use of any domain has a short lifespan before security services discover the risks and put it on their blacklists.  It may be a few hours, days or if they are lucky, weeks.  Therefore they are constantly registering lots of domains every day and that costs money!  Like any good business, they take steps to reduce their costs.

Two newer top level domains favored by the most active Internet criminal gang are DOT-review and DOT-date.  Take a look at these three recent malicious fake emails as an example…

• Must Have Christmas Gift – Personal Letter From Santa
• Saving You More – Term Life Coverage – $0.50/Day! From Fidelity Life
• Piano Lessons – You Get to Sound Like A Pro Right From the Start

[hr_invisible]

To host their malicious software, the criminals purchased these respective domain names:

• offisanlopiyui-DOT-date
• fidelvbnmkio-DOT-review
• vbfhde-DOT-date

All three of these domains were registered through a service called NameCheap.com. Though we cannot see what the criminals paid for these exact domain names, we can deduce how much they paid for them, versus the cost of more familiar top level domain names.  We asked NameCheap.com to quote us a price to purchase the exact same domains used in these malicious emails but dropped the last letter before the DOT-date or DOT-review.  NameCheap quoted us a price of 48 cents for a 1-year lease!  However, look at the prices we found if we used more familiar top level domains.

Even other obscure top level domain names such as DOT-club ($0.77/yr), DOT-life ($1.88/yr), and DOT-world ($1.88/yr) are more expensive than DOT-date and DOT-review.  These are clearly the cheapest domain purchases that can be made.  Also, criminals purchase them by the THOUSANDS every year so they might even be able to buy them in bulk at a lower cost, thereby saving themselves even more money!  How very frugal of them.  And this also explains WHY we all need to recognize the top level domain in the from address of an email, or in the link revealed by a mouse-over!  If you see DOT-date or DOT-review, you need to DOT-DELETE!  Below are a few more of their frugal choice malicious emails.

Enjoy!

IMPORTANT FOOTNOTE: According to Wikipedia, “Namecheap, Inc. is an ICANN accredited registrar, which provide services on domain name registration, and offer for sale domain names that are registered to third parties.”  And according to their own website, NameCheap is owned by Richard Kirkendall. Do you think Mr. Kirkendall or his key administration know that criminals are purchasing thousands of domain names through them to target millions of people across the world?  We think the answer is very likely yes, they know.  Do they care?  Do they work with the FBI, Interpol or other agency to report the misuse of their services to make it harder for the criminals to operate?  We HIGHLY doubt it!  And it isn’t just NameCheap.  We’ve found other Registrars that have been heavily used by criminal gangs.  There is NO incentive for them to do the right thing.  Neither does ICANN have any moral backbone to help the average Internet user.  In fact, the entire system of Registrars and ICANN seems rigged to enrich their pockets at our expense.

Additional note: There is a good article titled “How to Register a Domain Name” found at Cloudwards.net to learn about the proper way to register a domain.

[hr_invisible]