PHISH NETS
Paypal and Many New Phone Phish

Uh oh!  Looks like your Paypal account is to be closed, unless you click “Log in here” and confirm some additional information.  This smelly phish came from servicepmail[.]info, NOT from paypal.com!  And the link points to a domain called faithcord[.]com, NOT paypal.com! 

Deeeeeleeeete!


 

This next set of phishing emails are all of the type designed to trick recipients into picking up the phone and calling the scammers directly by pretending to be purchases made!  We call them “phone phish” and there are no links to click. Our Top Story in our January 27 newsletter was about this trick and titled “Thank You For Your Order.” Let’s begin with this email saying “Thank you for choosing Norton Security.” $399 seems pretty steep, don’t you think? But wait, you can call 888-297-1270 to cancel your subscription! There are many people on 800Notes.com talking about this phone number as a scam! This email OBVIOUSLY didn’t come from any legitimate service selling Norton Security 360.



 

This next email starts with “this is a confirmation email regarding your subscription auto renewal” to the tune of… $399 again!  What an odd coincidence, don’t you think?  The email came from a crap domain, wbtechpvtltd[.]online, that was registered in India just hours before this email was sent! The phone number to call, 213-438-9552, has been marked UNSAFE on fraudnumber.com by 5 people in the last week!
 

And finally, we have an email about a charge from Best Buy’s service known as Geek Squad.  Only this email didn’t come from BestBuy.com. It came from someone named BOTH “Carol A Roetzler” AND “Faith Feguson” at the domain uservalidationservice[.]net. You’ve subscribed to GeekSquad’s online support renewal for $299 and it is about to “Debit from your account by Today.” But wait, you can call 609-318-9561 to be victimized by these scammers!  Someone reported this phone number and scam to FindWhoCallsYou.com recently.




Daily Scam Home Page

YOUR MONEY
When is an Austrian Bank a Nigerian Scam?

We have a short story to share with our readers and it comes from a man whom we’ve mentioned several times, but never by name.  He’s given us permission to identify him as Rob L.  Rob LOVES to play with the scammers!  He has the patience of a saint to play their games and feed them false information, playing a dumb person barely able to use email. But quite the opposite!  Rob has been giving us many tips and leads to some scammer’s phony websites and exposing many of the tricks they use.  Rob exposed a clever ruse he recently discovered by scammers, who are likely from Nigeria.  It speaks VOLUMES why it is so important to read CAREFULLY!

Rob has revealed multiple times to us that Nigerian 419 “advance fee” scammers create fake online banks, many looking like legitimate banks, to inform people that money is ready and waiting for them.  They only need to pay the fees needed to release it.  Check out this screenshot of the very real and legitimate Austrian Bank website at Bawagpsk.com:
 

This bank’s domain was registered in Austria back in 2005. However, Rob has been communicating with someone from the Bawagpsk Austrian Bank about a deposit in his name.  This person has used an email address from the domain Bawwagpsk.com!






 

This is what we see when we visit Bawwagpsk.com. You’ll notice it is a wee bit different than the legitimate Austrian Bank site...

As many of our readers know, it is CRITICALLY IMPORTANT to PAY ATTENTION to the details, such as a “W” vs “WW” in a domain name!  Rob also shared another scam domain with us recently, disguised as a Bank of America website.  He’s been communicating with a scammer who used the email address bnkofamerica011@usa.com.  Apparently, Rob was told that he is the beneficiary of a large sum of money in a Bank of America account.  But instead of the BoA account link pointing to BankofAmerica.com, the link points to:

   http://bofamericas-001-site1.itempurl.com/home.htm  

Below is a screenshot showing what this bogus BoA site looks like. Not only does Rob and TDS know it is a fraud, but so does Dr.Web (according to VirusTotal.com) The scammers create this sham, invite a soon-to-be victim to log into and ‘confirm’ the large sum of money.  However, once they are invited to move that bogus pile of money out, they discover there are fees to be paid to the scammers!

Daily Scam Home Page

 

TOP STORY
It's a Numbers Game! IP Addresses

Who the heck will remember a random set of numbers for every website they visit?  No one! That’s why DNS --Domain Name Service-- was invented!  According to this well written article on Cloudflare.com “The Domain Name System (DNS) is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources.”

Without DNS, every website would have to be found by its IP Address (Internet Protocol)  It is this very reason WHY EVERYONE SHOULD BE SUSPICIOUS of a website that is ONLY identified by a set of numbers!  During the last week, at least one cybercriminal gang has been playing a numbers game, sending malicious emails out that contain links showing ONLY IP addresses, not domain names.  Here is an example and how you can learn WHERE in the world you would go if you clicked that link…

“Welcome to UPS Survey” says this email from a crazy gibberish domain. You can get an “exclusive reward” by taking this 30-second survey.  Mousing over the link shows that it points to IP Address: 78[.]108[.]182[.]147.  If you visit the website IPLocation.net, you can enter that IP Address field into their search feature and have several geolocation services tell you where in the world they believe that website is hosted.  We discovered that this UPS survey is hosted on a website in Prague, Czechia!  That’s a sure sign that this is malicious clickbait!






 

Want to earn your TDS Merit Badge for Super-sleuthing IP addresses? You try it… Use IPLocation.net to look up each of the IP addresses revealed by mousing over links in these two recent malicious clickbait TDS readers sent to us. (Don’t include the brackets when using IPLocation. We use them to protect readers from accidental clicks.)

1. Meet Beautiful Latin Singles!
   
   
    

2. Free Medicare Health Insurance
   
   
   
   So…. Where in the world is Waldo if Waldo had clicked those links and infected his computer? To find out, scroll down to the answers below!

Daily Scam Home Page