Copy
THE DAILY SCAM NEWSLETTER — JUNE 16, 2021
Content Director Doug Fodeman | Creative Director David Deutsch | Issue 356


THE WEEK IN REVIEW

Like last week, we wanted to share with our readers some resources created by good people who fight back against scammers. The first is a fellow named Paul who created a remarkable resource in 2016 for those who have and love pets.  It’s called PetScams.com.  Yes, believe it or not, there are scams that target people who want to adopt/own pets!

Paul tells us that “these scams work on a temporary suspension of disbelief. People who find a “great deal” or someone who is willing to sell them exactly what they are looking for. [The victims] are willing to put aside the thought that something is not right. People will read the scammer’s reviews on their scam website [about pets.] We aim to publish a report/warning about the scam website as soon after it is created as possible in order to be there to take advantage of that initial doubt. Ideally we want our reports to appear on search engines before the actual scam website.”

Paul also told us that pet-related scams work primarily because people fall in love with cute pictures, for example, of puppies, or that the price for a pet is really low. After paying a down payment, victims are then hit with shipping or other costs, and never get their pet. (Paul also created another website in 2017 that collects and posts Nigerian 419 email scams.  Visit:  https://419.email

And then there is Nichole Dennis.  She is the Program Director for the Cybercrime Support Network (CSN). 

The Cybercrime Support Network (CSN) is a 501(c)(3) nonprofit organization created to meet the challenges facing individuals and small businesses affected by cybercrime. In addition to CybercrimeSupport.org, it’s a public-private collaboration supporting individuals and small businesses through FightCybercrime.org, a resource database for those affected by cybercrime and online fraud, and ScamSpotter.org, a website to help identify scams and stop fraudsters. Additional support is also provided through three programs focused on romance scam survivors, the military and veteran community, and those who are less tech-savvy.

According to the FTC, United States adults reported losing over $304M to romance scams in 2020; but the true losses are likely over $1B. In response, CSN has launched a virtual peer support program and a private Facebook group to help survivors. Led by a licensed mental health counselor, these measures combat feelings of embarrassment and isolation while teaching cybercrime awareness and education.  The program provides educational information to support the participants’ mental well-being and increase their ability to recognize cybercrime.

Nichole tells us that at CSN “there's so much we aspire to do for those we serve who have encountered cybercrime and are trying to recover their sense of security and, in some cases, rebuild their lives.  Our ultimate goal is to reduce rates of revictimization through education and empowerment.”

The Cybercrime Support Network has a newsletter and a presence on social media. We hope our readers will check out all the websites above. Spread the word! These are good resources to share with your friends on social media!

cybercrimesupport.org | fightcybercrime.org  (2019 CSN Year in Review)

CSN Newsletter: Sign-up // YouTube - Facebook - LinkedIn

Twitter @cybersupportnet & @fightcybercrime

While we’re taking a moment to feel good, this recent article from Cyberscoop also put a smile on our collective faces. “Latvian National charged with writing malware used by Trickbot hackers.” (6/4/2021) What surprised us most about this is the fact that the Latvian National who was charged is a woman! She’s not the only woman breaking stereotypes about scammers. Our Scam-baiting friend Rob received a phone call telling him that there was a warrant out for his arrest and he needed to call law enforcement (via the scammer’s phone number) immediately. Most people delete this junk, but not Rob! He called the scammer and pretended he was legitimately concerned. The scammer he spoke most with was also a woman! You can listen to a few minutes of their conversation in this audio file, until Rob ran out of patience and called her out as a scammer! (Warning: Rob drops the F-bomb in this audio file.)

Click to listen

 

Finally, we also couldn’t help but smile when we got this CLASSIC Nigerian 419 scam email from “Advocate Gordon Taylor.” Apparently, we have the same last name as his “deceased client” who died without heirs, leaving more than $14 Million dollars to no one! Can you see where this is going? Enjoy...

Daily Scam Home Page

 

PHISH NETS
Zelle Pay, Amazon Alert, and McAfee Renewal

We don’t often see phishing emails disguised as the digital payment service called Zelle Pay. So when this email from “kecta bart”’s iCloud account was sent to us, we took notice!  Imagine being told that your Zelle pay account was charged $499.99.  We especially loved the line “if you don’t recognize the payment or have been victim of a fraudulent transaction, in that case call our Customer Service Number +1 812-316-9765.”  Another piece of social engineering to trick people into making that call is the sentence “this is system generated mail, replying to this email will not cancel the payment, you have to call our customer support Number.”

Instead of calling, just hit the delete key!
 


 

Here is another phish disguised as an Amazon charge.  What a surprise! (Said “tongue in cheek”)  At least these scammers tried to get creative by making a Gmail account called “order assent amazon.”  WHY CAN’T GOOGLE RECOGNIZE THIS FRAUD AND PREVENT SUCH EMAIL ACCOUNTS?  The email says that they’ve noticed unusual activity on your account and want you to call the scammers at 844-206-2086.

Ah, no thanks!
 



This next fish also came from a Gmail account rather than Mcafee.com.  What REALLY caught our attention was the way that the phone number was written in this scam.  When we clicked and dragged through it we discovered hidden characters and numbers in white.  We think this was done to help prevent anti-spam filters from identifying this number as a scammer’s phone number.  Also, anyone who copies and pastes that number into Google might not realize all the extra characters that will throw off Google’s search UNLESS they look closely at it!

Deeeleeeete!



Daily Scam Home Page

 

YOUR MONEY
Survey to Win iPhone 12 and You've won!

Oh yes, we’re winners!  Yes, thank you very much!  We’re strutting around like a male peacock displaying full plumage, or like George Jefferson from the 70’s-80’s sitcom called The Jeffersons! We’re winning stuff left and right! Like this iPhone 12! Ok, technically, we haven’t yet WON that iPhone but we might if we just take this 1-minute survey sent to us from SaksOFF5th[.]com. The links in this clickbait LOOK LIKE any old marketing domain and lead to a web page design that we’ve seen dozens of times from scammers. (See the screenshot below.) They create fake reviews that are meant to trick people into believing that this junk is legitimate. At least one online service calls it malicious. By the way, the domain saksoff5th[.]com is up for sale and no longer owned by Saks Fifth Ave (assuming it ever was!)
 








 

Ok, maybe we didn’t win that iPhone after all but we did win….ah, 99 free spins on ‘fat cat’ video slot. We just have to join this newsletter to get our new online slot spins. However, we couldn’t help but notice several VERY suspicious characteristics about this email as well as something remarkably similar to another scam email we talked about last week. This email came from the domain jhonwicks[.]com, which is extremely similar to the movie character “John Wicks” played by Keanu Reeves. Google can’t find any such website. One WHOIS tool tells us that it was registered last September, 2020, and another WHOIS tool tells us that this website is sitting on a server in Milan, Italy.

Most importantly, we noticed that links in this suspicious email pointed to a LONG link created with the shortening service at Bit.ly. When we unshortened the link using Unshorten.it, so we could see where the link will redirect us after clicking it, we were surprised to see that it will send us to this same misspelled “John Wicks” website! Why hide that with a shortened link through bit.ly?
 


 

Look CAREFULLY at the unshortened link to which a visitor will be redirected.  Following the domain jhonwicks[.]com, you’ll see a directory named “rd.”  What struck us odd about that directory is the fact that we received a malicious email last week from the domain called marvilons[.]com that was identical in design.  The links in last week’s malicious email ALSO pointed to a long link created through the service Bit.ly.  And Unshorten.it also showed that the bit.ly links will send visitors back to a directory named “rd” at marvilons[.]com!  We don’t believe this is an odd coincidence.  It confirms for us that this email, and the accompanying website jhonwicks[.]com is as malicious as last week’s marvilons[.]com website!

Deeeeeleeeeete!
 



Daily Scam Home Page

 
 

TOP STORY
Explosion of Package Shipping Scams!

For three years we have exposed eighteen fake shipping businesses as fraudulent and very likely created by the same Russian-speaking criminal gang based on LOTS of similarities we have documented between their methods of operation and website designs.  These criminals are thorough, professional, and highly skilled at tricking Americans to receive merchandise purchased with stolen credit cards, repackage it, and reship it elsewhere.  Essentially, they turn Americans into “mules.”  And while they promise a high salary, ranging from $2000 - $3000/month PLUS $40-$50 per box processed for reshipping, NO ONE gets paid! (This is what we’ve been told by about 2 dozen people who were tricked by these criminals.) After 4-6 weeks (or however long they can string someone along without paying him/her), the newly hired employee is ghosted.  Eventually, the website is taken down and a new website appears under a different name on another Internet server. 

We also have breadcrumbs showing that these criminals read our articles about their scams and make improvements to their websites as a result. However, they still make mistakes, as you’ll see. Back in mid-May we posted a new article about 2 new fake businesses created by this gang. They were fake business #17 and #18. The first was called Ship Site Post LLC, or “SSP LLC” with the website “SiteShipPost.com.”  The second business was called Savers Post International , or “SPI LLC” and its website called SaversPostIntl.com. During the last week, we heard from 8 men and women who were “hired” by these scammers and now realize that they have been tricked! Many of these men and women are concerned because they now realize that they have been tricked into shipping stolen merchandise. Two of them have told us that police have come knocking on their doors to investigate the stolen merchandise. 

We mention all this again because someone just recently notified us of yet another fake business created very recently by these same criminals. The scam business is called PackageChef.com. The website at PackageChef.com is IDENTICAL to several of the other websites used by these criminals, including SiteShipPost.com and WishDeliverys.com (which are still up and running on the Internet as of 6/13/21.)
 

 



One of the ways we know these bogus businesses are fraudulent is the fact that they were registered just a few weeks earlier but the website ALWAYS says they’ve been in business for months or years. In the screenshot below you can see that it says “since 2020.” If that’s the case, why is it that their website wasn’t  registered until May 19, 2021? These scammers have lately been registering their fake businesses in the state where they claim to operate. They use a third party vendor to register for them and soon afterwards their legal entity name shows up on a website like OpenCorporates.com. If you visit this link you’ll see that OpenCorporates.com shows that this bogus business (Package Chef Logistics) didn’t even get incorporated until April 7, 2021!


 

Don’t assume that being legally “incorporated” makes these bastards legitimate! It doesn’t! They are still scammers who speak Russian, meaning they are likely from Russia, Ukraine or another eartern block country where Russia is spoken.  Why do we keep saying this?  The answer lies in the pdf files created by these criminals and sent to victims.  These documents are meant to help train employees how to do their new job and use the “dashboard” tools to communicate with their supervisors (i.e. scammers.)  Recent documents have included these 3 pdf files sent by the “supervisors” of PackageChef.com to new hires:

• Dashboard Manual
• How to Upload Documents to Your Dashboard
• Package Chef Logistics LLC Employment agreement

When you open a pdf file, most pdf readers will provide access to hidden information about the pdf file that is stored by the program used to create the file.  When we open pdf files created by this group of cybercriminals, they typically include the word “User” written in Russian in the field for “Author.”  This strongly suggests that the program used to make these files was a Russian language version.


 

The screenshot above was taken from the “Employment Contract” that PackageChef.com sent to a new hire.  In addition to the Russian word hidden in the file information, Package Chef Logistics LLC provides their Federal Employer ID number as 86-3156355.  We used a website called “Employer Identification Number Search” to see what we could learn about the EIN 86-3156355. Not only did NOTHING turn up for this EIN, but nothing turned up when we searched this database for the Legal name “Package Chef Logistics.”

This is now the 19th business we can trace to this gang of criminals.  In addition, just two days ago a TDS reader told us she was invited to apply for a package shipping “work from home” job with another scam company called SlogisticsUSA.com.   If you visit their “About Us” page, you’ll see that they claim to have been in business for 5 years.  And yet, their domain, slogisticsusa.com, was JUST registered 8 days ago! Not only that, but it was registered through a Registrar located in Russia called Webnames.ru.

Also on their “About Us” page are 3 Team members, including their Founder and CEO named David Ferguson. Except that this man’s real name is Gavin Butler, as shown in his LinkedIn profile below. Mr. Butler worked as Director of Engineering for many years at a California company called Shippo. Each of the other people shown in this Team photo are also from stolen images using fake names!




 

Adding insult to injury is the fact that our exploration of these recent sites for today’s Top Story, took us to complaints on Scampulse.com by people who claimed that yet another company called Skyway Global Inspect is another scam package shipping company using Americans as mules to move stolen merchandise. If you visit their website, you’ll discover some familiar faces!

BOTTOM LINE: If you are looking for a job and someone has a “work from home” position for you, DON’T TAKE IT unless you can have an in-person interview or video chat AND can verify that a business has been IN BUSINESS for years!

 


Daily Scam Home Page


 

For Your Safety
Inbox Inner Circle Clickbait

We recently received the following email twice. The subject line to “Learn more about Inbox Inner Circle” intrigued us because a Google search for “Inbox Inner Circle System Review” pulls up LOTS of links that say this is a scam and most people don’t make money in this effort. Here is one review about “Inbox Inner Circle System” that makes it very clear why it shouldn’t be trusted. However, what we found most interesting about this email is that it came from a bizarre email address, susan “@” nunseducated[.]com AND the links pointed to an equally oddball domain called “airreducation.slrcdn[.]com.” Susan is asking us to confirm our new account. The critical question is… account for what?

This looks like a rabbit hole to us. No thanks. We’re good!
 



Daily Scam Home Page

Textplosion
Payroll Assistant Job Offer

Why would anyone believe a text randomly sent to him/her from a stranger using an unrecognizable phone number, such as 425-330-6434?  In this text “William Adams” invites 5 people to apply for a position as a Payroll Assistant.  Just click the link to a domain called zfrmz[.]com.  We found the online job description at the end of that link to be VERY INTERESTING!  If you read it, you might agree that this job sounds like you are being asked to print fake checks to send to people being targeted by scammers!  This and the fact that the domain zfrmz[.]com was registered in India tells us to step away from this precipice!
 







Until next week, surf safely!

Forward to Friends

About Us
Contact Support
Manage Subscription
Unsubscribe


SUBSCRIBE


Produced by:
Deutsch Creative
 
Copyright © 2021 The Daily Scam, All rights reserved.


Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

Email Marketing Powered by Mailchimp