PHISH NETS
Spear Phishing a School and Amazon Account Information

Spear phishers are phishermen who target a specific person, company or organization.  Lately, they’ve been targeting schools and we’ve been reporting on several of these attacks orchestrated in 2020.  Here’s the latest one that pretended to be an email from the Head of a school.  This email hit about a dozen school employees.  This type of scam ALWAYS asks for a favor because the boss is tied up.  This one begins innocently enough with “Do you have a moment I have a request I need you to handle discreetly.”

Typically, what follows a response is something like “I need you to go and buy gift cards that I want to give to some of the teachers as a surprise.”  The victim will be told she/he will be reimbursed at school and asked to give the “boss” the ID numbers on the gift cards.  That’s the same as sending untraceable cash to someone ANYWHERE in the world!

We think this next email is a phish but it could also be malicious clickbait to malware.  The TDS reader who sent it was not able to send a working link for that “pdf” file.  The email may say it is from Amazon Service but the domain at the end of that email address is clearly the coo-coo name gopxl-fullgass3[.]com.  This domain was registered on December 4, the same day the email was sent.  “We received your ticket Billing information that was been update…” 

Deeeeleeeeete and relieve yourself of that full gass feeling!
 

Daily Scam Home Page

YOUR MONEY
Your Grant Application

There are SO MANY things wrong with this email from info @ ingramchris[.]com about “Your Grant Application.”  Let’s start with the fact that the TDS reader who sent it to us never applied for a grant, but it sure was sweet of the sender to tell her that she doesn’t have to repay the $6,345 grant if she qualifies for it!  The email appears to have come from a very questionable website called ingramchris[.]com, which was registered anonymously in early July and is being hosted on a server in Cologne, Germany.  There are several famous people named “Chris Ingram” but we doubt this website belongs to any of them!  The meta tags for this website inform Google that “ingramchris[.]com is your first and best source for all of the information you're looking for. From general topics to more of what you would expect to find here…” but a screenshot of the top page shows a handful of oddball links written in German and that’s it.” (NOTE: This exact same meta information has been found associated with several other scam websites recently, including the domain cited in the “For Your Safety” section of today’s newsletter.)



Perhaps most importantly, mousing over the link to “View Available Funds Now” shows that you’ll be sent to a web page of the domain agktrckr[.]com.  This domain may LOOK LIKE a marketing service source but it isn’t!  This domain was registered anonymously in mid-June and is also hosted on a server in Cologne, Germany.  But that’s not your final landing point!  The destination of this link contains a redirect that will send you on to a website called ResourceFinder[.]info.  The security service McAfee has blacklisted this final destination website.


 

We took a screenshot of the top page on resourcefinder[.]info and were told that “you may qualify for up to a $6,345* grant!”  However, what struck us as MOST IMPORTANT was that the asterix pointed to a link about Pell grants on a U.S. Government website at studentaid.gov.  This legitimate US Government website about Pell Grants seems to have all the information you’ll need so why bother with a sketchy, questionable website with ties to a foreign country?  And to illustrate that this “resource finder” is even more questionable as a reliable tool is the fact that a Google search for their address, 215 West Ohio Street, Suite 610, Chicago, IL 60654, shows ONLY a website called JobsInYourArea[.]co.

Don’t go down this rabbit hole!

Daily Scam Home Page

TOP STORY
Using TDS for Malicious Purposes!

During our 6-plus years in operation, cybercriminals have tried thousands of times to shut us down, hack our site, malign our content, or target us and our family members with malware tricks and scams.  Their collective effort has never shut us down longer than a day and nothing they do will ever deter us from our mission to help netizens of the world recognize fraud and malicious tricks that target them daily!

Cybercriminals are “at it” once again in a way that is very public and misleading.  We recently noticed that Google searches during the previous 24 hours or week for “The Daily Scam” are turning up links that reference us and our content.  However, other than two legitimate links about us, (found on DigitalGuardian.com and SusieAndSecurity.com) all of these other links point to VERY suspicious websites, or websites with confirmed malware traps lying in wait for visitors. Between December 1 and 6 we found 22 such links poisoning Google’s search results.  Here are two screenshot examples of what we mean…






The fact that we have identified malware lying in wait on several of these sites leads us to believe that every single one of these links likely has a malware trap set up for it. Our tools also detected that several of these links showed “no web content found” on the page in the link.  This fact is simply confirmation to us that it is also malicious or was malicious (assuming the site owner or host service found the malware and removed it.)  Again, here are screenshots of just a few results confirming this...











 

Some of these malicious websites citing us are meant to poison Google searches for brief periods of time.  They appear to be up for one to two days and then they disappear.  Others linger longer.  Some are crap domains registered for malicious purposes, while others appear to be legitimate websites that have been hacked and maligned.

The “headlines” used in the meta data collected by Google vary somewhat but they are generally centered around the theme of fake phone and text numbers.  Headlines include: 

• 500 Fake Ids Seized
• Amazon Prime video customer service phone number
• Amazon Toll Free Number
• Fake Amazon Customer Service Number
• Fake Emergency Alert app
• Fake German Phone Number for Sms
• Fake Microsoft Tech Support Numbers
• Fake Numbers to Text
• Fake Saudi Number Sms
• Fake Utility Bill for Amazon
• France Fake Phone Number
• Is 999 a prime number
• Money Numbers
• Text Bot Numbers

Of course we have no evidence who is behind this poisoning attack but we can speculate.  Since most of the bogus content seems to be about fake phone numbers such as for Amazon and Microsoft, it feels like we’ve pissed off cybercriminals who are most responsible for these scams.  It is our experience that these crimes are most perpetrated by cybercriminal gangs in India.  And so we wonder.  This has happened to us in the past and we also suspected cybercriminals in India.  

Below is a list of the 22 websites where we found references to us in early December.  We have posted links below to some of the WHOIS records for domains that were newly registered.  All other domains were either hacked or not “newly” registered.  We’ve also informed some domain hosting services and domain owners of the fraud using their websites.  In at least 2 cases, cybercriminals were using content from MANY other websites to poison Google, including content about a funeral home!  Never a dull moment in this business.

MALWARE LADEN WEBSITES THAT CITE TDS between 12/1 - 12/6

1. ledap.skymovie[.]site/888-phone-number.html (skymovie[.]site registered in Russia 11/2)
2. ihfi.greenwoodteatro[.]it/france-fake-phone-number.html (greenwoodteatro[.]it registered 12/2)
3. prakashelectricals[.]org/federal-9mm-hi4ei/fake-microsoft-tech-support-numbers-2020.html
4. limpeza.antoniomendes[.]net/probability-and-iuuf4/money-numbers.html
5. aaronroeauthor.editygroup[.]com/bluetooth-hidden-2angg/fake-numbers-to-text.html
6. hspwdm.txshore[.]tech/xczmhu/6934 (txshore[.]tech registered 11/23; updated 12/1)
7. ivolthi.pageantvoteph8[.]online/amazon-prime-video-customer-service-phone-number.html (pageantvoteph8[.]online registered in Russia 11/27)
8. lalbu.pageantvoteph10[.]online/amazon-video-help-phone-number.html (pageantvoteph10[.]online registered in Russia 11/27)
   Also: lalbu.pageantvoteph10[.]online/amazon-video-help-phone-number.html
9. raphaartlifetv[.]com/nmfta-login-ywdyi/fake-emergency-alert-app.html (raphaartlifetv[.]com registered 10/14)
10. shopsafer[.]net/rav4-android-7wdxy/fake-utility-bill-for-amazon.html
11. enpge.norrmio[.]site/888-phone-number.html (norrmio[.]site registered in Russia 11/2)
12. kqfz.falegnameriaparcesepe[.]it/malaysia-phone-number-search.html
13. protocolit[.]com[.]au/windows-8-ts5gm/fake-utility-bill-for-amazon.html
14. namasteyouga[.]com/drive-shaft-0d2vz/fake-numbers-to-use.html
15. rtio.studiodentisticocabras[.]it/fake-amazon-customer-service-number.html
    Also: srdg.studiodentisticocabras[.]it/fake-utility-bill-for-amazon.html
16. ogif.funlearning[.]it/500-fake-ids-seized.html (funlearning[.]it registered 12/2)
17. eezo.rolandosignorini[.]it/fake-german-phone-number-for-sms.html
18. mico.qualitywines[.]it/fake-amazon-customer-service-number.html (qualitywines[.]it registered 12/3)
19. bax.perfectfamily[.]life/xs/35115 (perfectfamily[.]life registered 11/23)
20. bpsars.shoplag[.]site/amazon-customer-service-number.html (shoplag[.]site registered in Russia 11/2)
21. yaranelevator[.]com/list-of-sbybs/fake-emergency-alert-app.html
22. eww.webfutura[.]it/text-bot-numbers.html

Daily Scam Home Page