September 13, 2017

[hr_invisible]

Phish NETS:  Capital One Bank, Apple ID, DCU Credit Union, PayPal, and DiscordApp

The big jump in phish targeting U.S. citizens continues.  Starting with this email from mobile “@” mansoft-DOT-com, not Capital One if you look closely.  “Account Restriction Notification”  “We’re restricting your Capital One account(s) until we can verify your recent activity.”  A mouse-over of the link “VERIFY YOUR ACCOUNT” reveals that it points to the crap domain drucuqw-DOT-xyz, not capitalone.com.

Delete!

[hr_invisible]

It is so easy to distinguish real from fraud if one looks carefully at this junk.  Here’s another example that tries to fool you into thinking it came from Apple ID but the email came from nyweightloss.org.  “Account Info Change”  “Hello  The following information for your Apple ID was updated on….”  We found dozens of these phish.  This one says your Phone number was changed.  Others say your Street Address was changed.  None of them point to Apple.com.  This one pointed to a hacked website for vacation cottages in South Carolina.  Even Google informed us that their website had been hacked.  We’ve notified the site owner and hosting service.

Now delete.

Do you recognize the from email address used in this next phishing scam?  It is the same as the Captial One phish above.  Seems likely to us that the same criminal group pushing out the Capital One scam is targeting many institutions, like this phish against Digital Federal Credit Union (DCU) of Massachusetts and New Hampshire.  “ACCOUNT SUSPENDED”  “Our security team prevented suspicious sign in attempts on your online account.”  Mousing-over “REACTIVATE NOW” shows that it points to another DOT-xyz crap domain.

[hr_invisible]

This next phish that seems to be from PayPal Support is a bit more clever.  The email was sent from a generic-looking domain ppl3-DOT-net.  But that domain is no longer in use, according to a WHOIS lookup.  Instead of a link, this email comes with a very dangerous html web document identified as CompleteThisForm.  When we attempted to download and crack open this form, our virus protection software stopped us saying that it contained a trojan malware called Phish-AHB. (This malware is described here at Sophos.com)

Ouch!

[hr_invisible]

And lastly, we found dozens of these very odd phish in our Internet sea.  They seem to be phishing the login credentials for an app associated with gaming accounts called DiscordApp.   “Expired Password”  “Please update your information.”  We’re not quite sure how they can make money from this phish or what games are being targeted but… whatever.

[hr_invisible]

[hr_invisible]

YOUR MONEY:   Target Promotion, Find TV, Internet & Phone Package

If you look carefully at the from address you’ll notice that “Rewards For Surveys” actually comes from another crap domain called squation-DOT-stream.  By the way, we have ICANN to thank for authorizing hundreds of crap domains in the last few years.  Honestly…. We believe that ICANN, the governing body of Internet names, dramatically increased crap domains (which are used almost exclusively by criminal gangs) so they can earn more money from the purchase of these domains.  Even though they likely know that these domains are overwhelming used as bullets to shoot at netizens around the world.  We have often protested loudly against ICANN, including our feature article How to Make the Internet Safer For Everyone. But we digress…  “Get A $50 Target Gift-Card, Participation Required.”  Just another survey click-bait to a computer infection.

Move on folks…

[hr_invisible]

We live in the northeast and the two biggest providers of TV, phone and Internet are Comcast and Verizon.  Both have notoriously bad customer service and other issues that consumers often complain about.  So this next email certainly got our attention….  “Find TV, Internet And Phone-Packages”  But our hopes were quickly dashed after seeing where it came from… Another crap domain!  Fontember-DOT-stream. This domain was registered at the end of April of this year by an organization identified as Monolith One Holdings, LLC in Saint Kitts & Nevis (Caribbean).  This company doesn’t seem to exist on the Internet though BigDomainData.com tells us that it has a post office box in Nevis and is associated with someone named Larry Dawes.  Larry owns 17 other domains, including palacialpromos-DOT-info.  Monolith One Holdings also owns the crap domain used in the Target email above.  Sound trustworthy to you?

[hr_invisible]

[hr_invisible]

TOP STORY:  DHL Tracking – Another Rabbit Hole

We have shown readers many times that emails disguised as package delivery services are often used to target them.  They are used most frequently to deliver malware directly as attached files (usually zip files) or by containing links to malware, situated like landmines on web servers around the world.  This DHL-wannabe email is different than any we’ve seen before.

“Dear [email address],  Your shipment arrived our regional Office on Wednesday, 06 September 2017, However the details provided for dispatch are incomplete / incorrect.  Kindly Download Shipment Receipt, Track on our webpage link www.dhl.com/dl/tracking and also correct address to enable us proceed with Dispatch.”

[hr_invisible]

Obviously, English is not the sender’s first language and the scammer doesn’t live in the United States.  We say this with confidence because scammers often reveal a “tell” (Wikipedia “poker tell”)   in their scams.  The “tell” in this email is listing the date as “06 September.”  Though common around the world, this is a very uncommon in the U.S.  We wrote about a “tell” frequently revealed by African scammers in the Top Story of our August 16 newsletter titled “Dearest One.” 

Let’s break down the red flags in this cleverly crafted email…

1. Though the from address begins with DHL WORLDWIDE INTL you can see that the sending domain name is bringtree-DOT-cn. “.cn” is the 2-letter country code for China.  A Google search for this Chinese domain only finds this same bogus email listed on the website TrashCanMail.com.
2. A mouse-over of the blue link dhl.com/dl/tracking shows that it points to the web site dailyexpresslogistics-DOT-com. This domain sounds official but it isn’t dhl.com!  Google can’t find any business at this domain.  This official sounding domain was registered through GoDaddy.com on June 2, 2017 to someone named “majemu temituro” from Mexico City, Mexico with an email address majezie1 “@” gmail.com.
3. Finally, we asked Screenshot Machine to follow the link in this email to its destination and show us what waited for us there. We found a login screen containing the email address that was targeted by the scammers in the DHL email.  This doesn’t even look like DHL.

[hr_invisible]

Bottom line: In the world of online deception, a critical eye is increasingly important.  If something feels wrong or “off” about an email, ad post, social media message, text….you name it…. Then do some investigation.  If things don’t add up, don’t click.

[hr_invisible]