Copy
THE DAILY SCAM NEWSLETTER — APRIL 21, 2021
Content Director Doug Fodeman | Creative Director David Deutsch | Issue 348


THE WEEK IN REVIEW

Despite the improving unemployment numbers, about 9.7 million Americans were still out of work in March, and many others are underemployed.  (Source: Statista.com) This likely explains why job scams have been the most highly reported scams to TDS during the last six to eight months..  We’ve also found dozens of fake online businesses looking to hire employees, as well as fake job search and recruitment companies.  We urge all of our readers to spread the news to friends and families who are looking for employment to be extremely careful and thoughtful about jobs they find or jobs that find them, especially via social media, email or random text.  Criminals also use many well-known, legitimate job services like Indeed.com, Careerbuilder.com and Ziprecruiter.com to gather information and target potential victims.

Any critical eye can see several major red flags in this email that was sent to us by one of our readers. Though the email begins with “Our Company,” no company name is mentioned. The email came from a generic Gmail address, not a company domain, and you’re asked to send your resume to a generic email address at Yahoo.  The English used in the email is also poor and awkward in places.  Finally, for an unnamed company offering a “home based” job, the salary range of $92,000 to $118,300 seems remarkable!

Caveat emptor!
 

 

Daily Scam Home Page

 

PHISH NETS
Paypal, Auto Renewal Notice, and Order Confirmation

We’ve seen similar phishing emails like this one sent from “googlegroups.com” before.  It pretends to be from Paypal and uses links that have a hidden redirect buried in the link itself.  You’ll be sent to an oddball website named smkyadika[.]education. Fortunately, many security services have already identified this website as malicious!





The next two phishing emails continue the theme of behavioral engineering to trick consumers into picking up their phones and calling the scammers.  The first email came from someone’s Gmail account and says “thank  you for your automatic renewal” of your Windows Defender Advanced Threat Protection for $205. But, if you didn’t place this charge, you have “22 hours to refund this charge” by calling the scammers directly at 717-820-7361.



This next email also came from a generic Gmail account. It was named “paypal72626” as if that will give it legitimacy!  “We notice some unusual activity on your Paypal account.”  You are asked to call the scammers at 612-787-9448. That is NOT Paypal’s customer service phone number!

Daily Scam Home Page

 

YOUR MONEY
Pfizer COVID Vaccine Survey, Congratulations on Your Brand New iPhone 12, and Southwest Airlines Flight Survey

This is a first of its kind email we have seen and is terribly troubling if you consider the content.  The recipient sees “Urgent Notification” along with a subject line “We have been trying to reach you - please-respond!” (Notice the misuse of the hyphen in the subject line.)  The FROM email source domain is complete gibberish and spoofed.  Most recipients are not likely to notice that.  As vaccination has significantly ramped up around the world, what will likely catch people’s eyes is “Right now, we are offering a rewards program for adults who offer their opinion about Pfizer’s COVID -19 Vaccine.”  The reward is valued at $90 for this bogus survey.  Anyone mousing over the link will only see an IP Address instead of a domain name.  This USUALLY means that the sender chooses to hide the domain name and source.  IPLocation.net shows us that this IP address sits on a server in Berlin, Germany.  This email is nothing more than malicious clickbait! 

Deeeeleeeeete!





 

Speaking of malicious clickbait, who wouldn’t want to be given a brand new iPhone 12! “Congratulations! You’ve been chosen to participate in our Loyalty Program” says an email sent to a TDS Reader from wedos[.]net, an Internet service located in the Czech Republic.  The malicious link in this email is designed to look like a marketing service using trk.klclick[.]com. Thankfully, at least one security service has identified this link as malicious.



 



Another TDS Reader sent us this email disguised as a “Southwest Airlines flight survey (from a third party).”  The questions are posted in the email and all links point to the same destination on a website called “PutYourThoughts[.]com.”  But if you take off with this link, you’ll be redirected to land on a malicious domain we’ve identified in the past called surrealresult[.]com, giving you a bizarre fantastical malware experience!








Daily Scam Home Page

 
 

TOP STORY
The Story Behind the Story - What's Real Anymore?

Get ready for an unsuspecting journey as you read this story.  It begins with an email landing in one of our honeypot accounts from a Digital Marketing company called UC Digitals. At first, we were struck by the fact that this company was selling fake reviews to post on Yelp, Trustpilot, Google, and Facebook, reinforcing our claim that it is hard to believe anything online anymore because content is so easily manipulated! (Even the most reputable news sources have had advertising content manipulated for malicious purposes. And don’t get us started about the ads, services or posts that appear on social media! They have included malicious ads and fake businesses.)

However, as we looked at this email we noticed suspicious things that didn’t add up, such as…

  1. Why did the email come from an oddball domain called knitlit[.]com instead of ucdigitals[.]com, the business domain of the website?

  2. The links pointed to a shortening link created at Bit.ly, and yet when we unshortened these links they pointed to the business domain represented in the email, ucdigitals[.]com

  3. And of course, we’re told we received this email because we signed up on their website and we knew that wasn’t true!
     





After making sure ucdigitals[.]com was safe to visit, we did.  The first thing we noticed on their About Us page was the fact that they twice said that they have been “optimising websites for many years” “At UC Digitals, we have been making websites appear at the top of major search engines for many years…” If this were the case, why was it, we wondered, that their domain ucdigitals[.]com was registered less than a year ago in June, 2020?








Now our ‘spidey senses’ were tingling and we wondered if this company, which claimed it could sell you fake reviews to fool the best services online, was real at all.  When we visited the “Contact us” page we saw that the  office address for this company was listed in Pakistan.  The web page also showed a set of 9 reviews that scrolled across it, such as the one from Eugene Lawson in this screenshot.  And looking closer, we noticed that this web page referred to their business as “Brisk SEO,” instead of UC Digitals!  Furthermore, a Google search for this street address listed for this company turned up nothing.  No such address!







If this company were questionable, we wondered about the reviews that were listed on it.  We Googled (in quotes) the review by Eugene Lawson and discovered that someone identified as “Ben King” had posted an identical review on Trustpilot.com for a company called SEO Shark in Australia. SEO Shark appears to be a legitimate company, so far as we can tell, but clearly the review is in question since we’ve found two different names associated with it.





Once again, we went back to UCDigitals[.]com and grabbed a quote by a CEO named Jessica Olson and searched for it in Google.  And again, we found this identical, word-for-word quote, on Trustpilot.com but written about the business SEO Shark by someone named Jennifer Macrae.




We began this peek into a rabbit hole simply because we wanted to make the point that it is so hard to trust anything online, such as reviews on Google, Trustpilot, Yelp and Facebook.  Instead, we fell deeply into another alternate reality. In all likelihood, UCDigitals, or perhaps Brisk SEO, are not what they appear to be at all.  Our best guess is that the reviews of SEO Shark are more likely legitimate and were plagiarized and pasted onto UC Digitals.  Like we said, don’t believe everything you see online!

Daily Scam Home Page

 

FOR YOUR SAFETY
$729 Charge on Your Amazon Account

One of our friends received not one, but four phone calls within a couple of hours from 4 different phone numbers.  All of the calls were informing her that there was a $729 charge on her amazon account from Dayton, Ohio. If she wanted to dispute this charge she should press 1 to connect with a scammer pretending to be an amazon customer care representative!

Click to listen:




Daily Scam Home Page

TEXTPLOSION
McDonald's Promo Gift Voucher

Doug received a text from 770-637-9965 offering “an exciting McDonald’s Promo gift voucher.” All he had to do was click a link to a domain that was registered a few hours earlier in Iceland and now sitting on a server in Amsterdam. It is called awa2d[.]com.  No thanks, he prefers Five Guys!







Until next week, surf safely!

Forward to Friends

About Us
Contact Support
Manage Subscription
Unsubscribe


SUBSCRIBE


Produced by:
Deutsch Creative
 
Copyright © 2021 The Daily Scam, All rights reserved.


Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

Email Marketing Powered by Mailchimp