October 18, 2017

[hr_invisible]

Phish NETS: PayPal, American Express, and Bank of America

There are so many clues in this email from “PayPal Update” that should make the recipient suspicious!  Like the fact that it was sent from “paypal @ reviewer.com” not paypal.com. Also, many of the text characters in the email itself are odd, mis-matched and difficult to read. And how about the fact that you are not addressed by name in the email or given a portion of your account number!  Finally, the attached file, “FormAttached-DOT-html, “ is a web document and very dangerous to open!  When we tried to download it our anti-spyware software immediately recognized that it contained dangerous code and deleted the file!

Ouch.

[hr_invisible]

Once again, there are so many signs in this American Express notification that should make you suspicious.  How about the fact that it was sent from a domain that looks like it is for the Navy Federal Credit Union! (notifications @ navyfederal-DOT-yy)  “Your Account Requires Immediate Attention”  The email starts “Hello,” but doesn’t list your name.  Most importantly, it doesn’t give you the last 4 digits of your account number in the upper right corner of the email.  Finally, the button “Continue” points to the hacked website of an architectural college in Madrid, Spain.

Deeeeleeeete!

Language and grammar are critically important to evaluate the legitimacy of information you receive online or via your smartphone.   You can be certain that real messages from the companies that provide your services will be flawless in grammar, punctuation and use of language.  Read this email carefully and you’ll see what we mean that it can’t possibly be legitimate!  Even though this next email seems like it came from Bank of America via boa.com, you may be surprised to learn that boa.com has nothing to do with Bank of America.  In fact, boa.com appears to be some type of consulting service with a domain set up through a privacy service.   Of course, mousing-over “Verify” reveals that it points to a hacked domain swedishcareerfair.com, not bankofamerica.com.

Delete!

[hr_invisible]

[hr_invisible]

[hr_invisible]

YOUR MONEY: Get A CVS Gift Card, Become a Kroger Secret Shopper, and Expose Cheaters

The subject line reads “Consumer News: Get an CVS Gift Card!” Does this seem like correct grammar to you? That’s the first tip off. The email goes on to invite you to get a $50 giftcard but then offers a $100 gift card further down the email.  Again, if you read the small paragraph undernearth the text “We want to hear your opinion!” you’ll notice more grammar errors. These errors should be enough to keep you from accepting their invitation!  The link leads to a shortened URL at bit.do.   We used Unshorten.it to discover that you will be redirected to a file on the website firedag-DOT-com, located in Bulgaria. The Zulu URL Risk Analyzer tells us that this website in Bulgaria is 100% malicious.

Ouch!

[hr_invisible]

[hr_invisible]

[hr_invisible]

In the Top Story of our September 20 newsletter, called Pain by the Numbers, we revealed a scam disguised to look like recruitment efforts for secret shoppers at Krogers stores.  It appears that these scams are back.  Check out this email with the spoofed address made to look like it came from Kroger.com for an “Employment Opportunity.”  However, the link for “Sign Up” points to a drilling company in Canada! (2-letter country code of .ca = Canada)  We asked Screenshot Machine to follow that link and tell us what it found.  Look below at the personal information you will be asked to provide to these criminals.

 Best to delete!

[hr_invisible]

“Is your partner cheating? Find out today” says an email from beatacheat @ beatacheat-DOT-com.  All links in the email point to the odd domain newchetr-DOT-bid.   This domain was registered using a private proxy service in Panama on the day the email was sent.  Even beatacheat.com, a site first registered in 2003, has no known functional website and no information that Google can find on it.  But, as you’ll see below, a Google search of beatacheat.com located several links of fake emails being generated through fakemailgenerator.com.  This email is nothing more than malicious click bait!

Now delete.

[hr_invisible]

[hr_invisible]

[hr_invisible]

[hr_invisible]

TOP STORY: Malicious and Spam Texts

We’ve asked groups of people, in very unofficial surveys, if they had ever received random texts from people, phone numbers, bots, or services.  The overwhelming majority of people say yes!  The question that follows is simple.  Are these unsolicited texts safe or legitimate?  Here are two recent examples TDS readers sent to us…

“Hi [name], Receive a $50 Amazon Gift Card or Reward – Just complete a short consumer survey from Amazon.”  The recipient was presented with a link to a website called Magnumseven-DOT-com.

[hr_invisible]

We asked the Zulu URL Risk Analyzer to check out Magnumseven-DOT-com and it told us that this website was harmless.  BUT it also told us that this website held a redirect that will forward visitors to another site called dutyperiuse-DOT-com.  When we asked VirusTotal to tell us about dutyperiuse-DOT-com we learned that the site is hosting malware waiting to infect our smartphone.  Nasty!

[hr_invisible]

[hr_invisible]

Considering how much personal information is now on consumer’s smartphones and how we use these devices to live our lives, criminals want access and control of them to make money.

What about this odd, random text from 619-821-2511 that was sent to one of our readers? “You have been invited! Your friends want to hang 🙂 Check it out” followed by a shortened link using Google’s shortening service…

[hr_invisible]

Let’s start with the phone number 619-821-2511.  The TDS reader tells us that she doesn’t know that phone number and has no idea who the sender is.  We don’t know why, but this phone number was marked as “negative” two months ago at SpyOnCaller.net without any explanation.  Otherwise, there is precious little information about this phone number we can find.

Once again, we used Unshorten.it to see where the link will send you and discovered that you’ll be taken to a website called GatherWith.US.   The actual redirected link from Goo.gl is also rather short… gatherwith.us/dl.   Why would such a short link need to use a shortening service to send people to it?  It’s as if it wanted to hide who they really are.   Apparently, Gatherwith-DOT-US “is an app that let’s you send and receive invites to hang out with friends in real life.”  Sounds innocent enough.  Perhaps our TDS reader got this invitation from a friend’s phone afterall?  Or perhaps she simply got spammed by an app that seems to have built a reputation of spamming it’s users without asking permission.  Read this scathing article posted last April in TechCrunch.com called “Don’t’ Get Played By This Spammy App Like I Did.” Apparently, this app’s misuse of people’s smartphone contacts is so common that it has led to a class-action lawsuit filed against the company for violating FTC rules.  Check out the article at TopClassActions.com. Though “Gather” may not be malicious, does it seem like an application you would want to install on your phone and trust with your contact lists?

The next time you get a text from an unknown source or with a questionable link or content.  Don’t assume it is legitimate, safe, or worth your time to click.  Do a bit of investigation first or simply delete it!  The last thing you want is your phone corrupted with malware or your personal data stolen and misused.

[hr_invisible]