We see a lot of highly questionable pitches for student or career-change scholarships and financial aid services. We also see scholarship and aid offers that are obviously poisonous. Can you spot the obvious scams from the highly questionable? We’ll show you our recent collection and you can draw your own conclusions.
PS. We would like to thank the Cornell students who sent us some of the emails used in our article. If you think you’ve received some questionable or scam pitches for scholarships and financial aid, send them to us! spoofs@thedailyscam.com.
StudentResourcePage[dot]Com
Let’s start with this email from student@studentresourcepage.com with the subject line “Don’t Procrastinate Your Scholarship Search.” “Hello there! We’ve compiled some of the most exciting scholarships on the web, updated daily for your convenience.” And they list four bulleted items in their mission to help students. How kind! Let’s look deeper…
1. Google cannot find a website at studentresourcepage.com and a WHOIS lookup shows that the domain was registered last November 24 through WHOISGuard, a proxy service in Panama. The domain is currently being hosted in Quebec, Canada through OVH. We have often found OVH to have really low standards in the past, letting anyone host anything without much of a background check. Why would a US Scholarship site be registered through a privacy service in Panama and hosted in Canada? Visit: http://whois.domaintools.com/studentresourcepage.com
2. The email says that this service is located at 304 S. Jones Blvd, #123 in Las Vegas. Zillow.com shows this to be a single family home and Google shows this address occupied by the Frank Sorrentino law office:
www.zillow.com/homedetails/a304-S-Jones-Blvd-Las-Vegas-NV-89107/6979654_zpid/
3. A search of the domain studentresourcepage.com turns up nothing on a website at this domain but it does turn up a link to a fake email generator site: http://uk.email-fake.com/jetable.pp.ua/sokote3ekabk1/d5ae88f5a48e6a39d6da761c16032d0c
We also found this complaint on Yahoo from someone calling these emails spam and identifying other domain names as well.
https://answers.yahoo.com/question/index?qid=20160430121928AAEsHyL
4. Finally, the biggest nail in this coffin is what we learned after submitting the full link found in the email to the Zulu URL Risk Analyzer. Though Zulu scored the link as “benign” with 29 out of 100 possible points (Zulu isn’t perfect but it is good) look carefully at the screenshot. Zulu informs us that the website is hosted in Bulgaria.
Do these attributes inspire confidence in turning over a great deal of personal information in your scholarship application?
ScholarshipMate[dot]Com
In early June a student received this email from updates@scholarshipmate.com with the subject line “Lighten Your Tuition Load With A Scholarship.” “Dear Student, Have you searched for scholarships today? Start looking now and maximize your opportunities for finding a scholarship…” A mouse-over of the link shows that it points to the domain (with subdomain “tracking”) tracking.scholarshipmate.com. So what do you think? Legit? Afterall, the fine print says “Just a reminder that you have opted in to our Scholarship Listing Newsletter.” And if they said you opted in, it must be true, right?
Once again, let’s look a bit deeper at this great offer from ScholarshipMate.com. We strongly believe that this is a scam that was created by the same criminals who created the scam at StudentResourcePage.com…
1. The link in the Scholarshipmate.com email you are meant to click is coded very uniquely to include a redirects to subdomains “tracking” and “alpha.” This is EXACTLY like the first scam above. This is not a coincidence.
2. The domain was registered on November 11, 2015 through the same WHOISGuard privacy service in Panama. There IS a website at this domain Scholarshipmate.com but I wouldn’t visit it with a 100 foot pole!
3. The email is coded/constructed the same as the first email from StudentResourcePage.com even though the domain is different and even though the second email identifies itself with an address in Grandville, MI. Funny thing about emails that list an address in Grandville, MI… We found an article by Garret Ellison of the local Michigan news company, Mlive.com, about the misuse of this address. Read through the initial scam topic of their news story and then see the comment from the Better Business Bureau. #35748 appears to be little more than a mailbox drop. Apparently, many others have complained for years about spam scams being associated with this Michigan address, including this August, 2011 post from an Anti-spam blog called blog.onlymyemail.com, this personal blog post from February, 2012 and this Apple Discussion about spam in July, 2013.
4. We found more fake emails that were created at email-fake.com containing the exact same address and mailbox number as the above scholarship scam. Here is a link to one: http://uk.email-fake.com/jetable.pp.ua/sokote3ekabk1/c34a9346a845b94ed058235b94fca656
5. The domain scholarshipmate.com comes from an IP address that was also associated with the VERY scammy domain “systemupgra.xyz” back in December, 2015 though that domain has been removed from the server as of June, 2016. (http://scholarshipmate.com.ipaddress.com/)
6. Like the first domain, Zulu finds that this domain is associated with Bulgaria.
FinancAid[dot]date
Finally is this email from exploreoptions@financaid.date with the subject line “Get funded by a scholarship.” “Open up a world of opportunities through higher education. Explore Courses…” Does this feel legit to you? Let’s start with the strange domain FinancAid.date.
According to a WHOIS look up (http://whois.domaintools.com/financaid.date) the domain FinancAid.date was registered by someone named Ajit Tamraker on June 24, the day the email was sent. And the domain is being hosted on a server in Picassent, Spain. As you might expect, Google can’t find a thing about this domain.
And if this wasn’t convincing enough, the Zulu URL Risk Analyzer scored the link in the email as 100% malicious with malware waiting at the other end. See for yourself:
http://zulu.zscaler.com/submission/show/0c54059d11e11d66f5bd58a1f91c8c97-1467247770
So how can you tell the good from the bad and ugly? Hopefully you can run your own tests just like the tests we’ve done above. Start with a WHOIS look up of the domain and check on the ownership information. Also, try using Google to search for the scholarship site or the person/organization who registered it. And finally, here are some tips from other websites that appear to be helpful…
Identifying College Scholarships Scams By Peterson’s Staff on Thursday, June 09, 2016
Don’t Get Conned Paying for College: Five Scholarship and Financial Aid Scams to Watch Out for this College Application Season Updated by Huffington Post staff on September 29, 2015
Avoid Scams When Paying for School, Posted on November 24, 2015