PHISH NETS
Office 365 Password Reminder, Amazon and Apple Accounts

The appearance of this first phish needs some explanation.  Scammers often use various tricks to try to get past anti-spam filters.  The email, which appears to have come from a website in Germany (“.de” = Deutschland = Germany), shows the numerical sequence “389” repeated over and over.  It seems bizarre until you understand that ALL the 389 numbers were white text against a white background to make them appear invisible!  This makes a sentence harder for some anti-spam filters to see through fraud.  What remained to be seen was “Password for [EMAIL REDACTED] expires today.” and “You can change your password or continue using current password.”  The link “Keep Current Password” pointed to a hacked website in Mexico.  ¡Eliminarlo!



 

It’s too easy to quickly misread this next phish as coming from Support at Amazon rather than the reverse!  “Support[.]com” is NOT the same as Amazon.com!  The domain always follows the “@” symbol!  Anyone can create an email with whatever name they want in front of the “@” symbol.  The link in this phish points to a website in the European Union (“.eu” = European Union; this is one of the few exceptions to the rules about 2-letter country codes.  European Union is a regional group of countries.)





This phish may say it is from “iCloud services” but look what follows the “@” symbol!  We’re sure everyone can guess what country this email came from!  As in previous recent newsletters, the link points to a phishing site on Snip[.]ly.  By the way, it’s important to point out that Apple, nor any other service, will ever tell you that your account will be disabled if you don’t unlock it in 24 hours!  This is a behavioral engineering trick.

Deeeeleeeete!
 

YOUR MONEY
"I Need a favor" and USPS Survey

One of our longtime readers received an email from an old friend he knows well.  The man recognized his friend’s email address immediately but, when he clicked to "Reply" he noticed that his answer would have gone to a DIFFERENT email address at a website called macovn.net.  A WHOIS lookup tells us that this domain was registered on August 12. Google sees it but knows nothing about it.

The friend writes “I need a favor from you…”  If you Google the phrase “I need a favor from you” followed by “scam” you’ll find LOTS of websites describing this fraud.  Our biggest concern for the TDS reader’s friend was that it was very likely his email account was hacked.  The hacker probably contacted all of the person’s friends and relatives with the same pitch! (Using his contact list.)

Assuming that the man’s email account was hacked, he should immediately do the following:

1. Change the password to his email (AND on every other account to which he uses that same password)

2. Go through his email account settings to see if the criminal set up a backdoor to get back in or forward emails; this is often done as a forwarding address to send email updates/changes to and it will likely look SIMILAR to his existing email.

3. Put contacts on ALERT!  Send an email to all contacts (friends/family) and inform them that they may have been contacted by someone pretending to be him and asking for money.

4. He should look through his deleted emails to see if anyone manipulated or tried to access other accounts because ALL ROADS lead back to email! If he finds any evidence that someone tried to access another account, he needs to respond accordingly. The criminals try to hide their tracks by deleting emails generated by their activity.

5. He should contact his bank, financial institutions, credit card companies, etc. and put them on alert for suspicious activity.

Dealing with a hacked email account can be a major headache!  If, on the other hand, someone simply spoofed his email address to make it look like it came from his account, then he needs to do #3 above.  Were it me, I would email the scam artist myself using the “Reply-to” address and put him on notice that all my friends and family have been warned!

NO ONE is immune to the malicious clickbait disguised as a quick survey to receive a reward or money.  Not even the United States Postal Service!  Check out this email that was sent from li3wajngadoh[.]com.  This crap domain was registered in Panama anonymously on August 19.  Congratulations!  You’ve been selected to have your computer infected!

Daily Scam Home Page

TOP STORY
Jenzaa Has a Severe Problem

Jenzaa.com claims to be a blog about “Financial Tips,” housing and “government resource programs.”  However, we believe they have a serious credibility problem and it has only been made worse this year by cybercriminals. Since the Spring, cybercriminals have sent out thousands of malicious emails disguised as being sent on behalf of Jenzaa.com.  We also want to point out that the Jenzaa domain was registered in early October, 2019 as a new blog.  However, we can’t find any information about ownership or authorship for any of the dozen articles we visited!  The author is simply “Jenzaa.”  Who is Jenzaa? What gives them the authority to write about the topics they cover?  Is the blog written by a 10th grade high school student who took a class in economics?  Is it written by a savvy business doctoral candidate from Harvard University? Or is it written by a scammer in China? No one can tell... not from the WHOIS registration, nor from the “About Us” page on their website containing just 2 short sentences. (see screenshot below taken 9/6/20.)  It’s like mystery meat. Does this give anyone confidence that they offer sage advice? We are not calling this website a scam site. We’re only pointing out that it is impossible to evaluate their credibility.  ScamFinance.com also says they have a credibility problem because they “lack transparency” and say that “it seems as if the actual creators or owners are trying their best to operate from the shadows and obviously it is not a good sign.”



And making matters so much worse are the VERY malicious emails hitting people’s inboxes.  Other scam-reporting sites have lots of complaints about these emails. Many people think they are coming from Jenzaa.  Check the comments posted on Scampulse.com since the Spring!  One example is this email that came from the domain hillowpatty[.]com but pretending to be from Jenzaa about a $1000 Bank of America offer.  Mousing-over “Start Now” reveals a long link to a website called agntrckr[.]com.  It is a VERY clever ploy to make it seem like this is a market tracking service.  However this domain was registered on July 9 and is being hosted on a server in Western Germany.  It is 100% malicious and our tools have demonstrated multiple times that malware is lying in wait!  (Also, a critical reader will notice that this email is signed as “Affiliate via Jenzaal” instead of Jenzaa!)





 

NOTE: In domain names, the domain appears just before the “.com” in this case.  The “track” that begins this malicious link is a subdomain.  ANYONE can create a subdomain that says anything they want.

Did you notice in the Sucri analysis above that visitors will automatically be redirected to another website called promotionsonlineusa[.]com?  Do not visit this website!  

Here’s another malicious clickbait example that came from brandedgar[.]com, not Jenzaa.com.  Recipients are told they can “earn $750 deposited directly to your Cash App account.”  Total malarky!  Once again, “Start Now” points to the same malicious domain - agntrckr[.]com.  Again, visitors will be redirected but this time to a similar sounding website called surveysandpromoonline[.]com.  SurveysAndPromoOnline[.]com has been found to be a scam phishing site. It was registered on August 3.






Another TDS reader sent us an exact same malicious email as the one above but it came from a different source: trainscharlotte[.]com.




As we said, Jenzaa has some “‘splaining to do!” (And despite what we all may think, that line was never exactly said by Ricky Ricardo to Lucy on the show “I Love Lucy,” according to multiple websites including METV.com.) But more than that, Jenzaa SHOULD post a warning FRONT and CENTER on their website to inform readers about these malicious emails.  Hey, they can take our warning to readers posted on our front page about search engine poisoning as an example!

Daily Scam Home Page