The Daily Scam Newsletter (November 30, 2019)

THE DAILY SCAM NEWSLETTER - NOVEMBER 30, 2019
Executive Editor : Doug Fodeman | Designed by Deutsch Creative

When you spend years studying the malicious texts and emails that cybercriminal gangs use to target people, you can’t help but notice patterns. One of these patterns concerns the purchase of domain names. (And we believe this criminal gang is in India, based on “bread crumbs” that point there.) We think that a cybercriminal gang purchases hundreds of domain names ending in the same single “global top level domain” (gTLD) because buying in bulk is cheaper for them. A gTLD always appears at the end of a domain name, after a period. Everyone recognizes the gTLDs “.com” “.edu” and “.org.” We’ve reported many times over the years that criminals bulk buy domain names with the same global top level domain and use them for their malicious purposes. For example, read our May 22 Top Story “Stay Away from the Pro.” It cautioned people against clicking on any domain name that ended in “.pro” like “mydomain.pro.”

During the last few weeks we’ve found hundreds of malicious websites that use the gTLD “.info.” Here are just a handful of examples taken from the FROM address of malicious emails we’ve seen. The malicious domain can be found after the “@” symbol. ALL of these DOT-info domains were registered in Maharashtra, India on November 20, 2019:

Slimming Recipes <soupdetox@inframild[.]info>

Carbine Shooting System <selfdefense@pekintein[.]info>

Regain Lost Memories <memoryloss@hollantau[.]info>

Reduce Electricity Consumption <energysystem@curectuser[.]info>

Chord Piano <music@banksharce[.]info>

Woodworking Shop Layout <woodwork@scherstag[.]info>

Joseph Wilkinson <energydevice@nascalostr[.]info>

Natural Gout Remedies <gouttherapy@imporgate[.]info>

Instant Pain Relief <killpain@glycomisys[.]info>

Sprinkle This Spice <newsletter@bigbytery[.]info>

Neuropathy Foot Pain <nervepain@herbient[.]info>

Jake Mayers <wealthsecret@enrafilor[.]info>

And now we are seeing an uptick in malicious domains ending with “.icu.” Stay clear of them! For example...

20/20 without glasses <20/20withoutglasses@visiotwittw.icu> (11/20/19)

Hip Arthritis <Polyarthritis@curearthritis.icu> (11/20/19)

The holidays are fast approaching and you will certainly see an increase in advertisements with holiday themes. This is also a time when can expect to see increasing holiday-themed malicious emails, texts and fake ads, like this clickbait with the subject line “Best gift for holidays.” And yes, it points to a DOT-icu! You can see below that the Zulu URL Risk Analyzer had no problem identifying it as malicious.

We’re recently learned of a very interesting marketing ploy which feels soooo scammy, and some are saying is a scam because of the quality of merchandise sold. Women across the U.S. are getting congratulatory notices on their pregnancy from someone named Jenny B! But they aren’t pregnant and they don’t know anyone named Jenny B! Read about this on TheLily.com.

To all of our American and Candadian readers... we wish you a very warm, safe, and wonderful Thanksgiving holiday with friends and family.

Doug and David

Recently, one of our TDS readers opened her spam folder to discover that she had received three very strange emails asking her to confirm her request to subscribe or unsubscribe from applications, newsletters and “the start of something awesome.” She sent them to us for a look. Let’s start with “something awesome” that came from “Ericka” via the domain lochamp[.]com, which was registered in He Nan, China in 2013. Oddly, the email also shows a “TO” address to another email at the domain itlgopk[.]uk (as in the United Kingdom) which was registered in June, 2019. The woman is asked if she wishes to unsubscribe. But unsubscribe from what?

Unfortunately, the links were not working when we received the email and we didn’t find any when we dug into the under-the-hood code of this email.

About 12 hours earlier on that same day, the woman received this email from the domain imwmas57cqww[.]net which hasn’t been registered yet, according to our WHOIS lookup. But notice that this email also seems to have been sent to an oddball address at the same domain itlgopk[.]uk! By the way, the moment we spotted the phrase “This message is from a trusted sender” we think EXACTLY THE OPPOSITE and treat it as malicious!

The recipient is asked to confirm her request (She made no such request!) to receive 13 different newsletters. (What a lucky number!) We were able to confirm that clicking EITHER “CONFIRM” or “Unsubscribe” would open an email to be sent to both of the strange email addresses listed below at the domain itlgopk[.]uk and the domain lochamp[.]com. By the way, that domain LoChamp[.]com points to a website for an Animal Feed business in He Nan, China. Clearly, both of these emails were sent by the same person.

Now, fast forward a week later and this same TDS reader received another email from Lochamp[.]com with the subject line “We need your confirmation to stop sending you emails !!!!” If you read this last email, you can see that English is not likely the sender’s first language due to several subtle mistakes. This time, were she to click the links to unsubscribe, her email program will send an email to MULTIPLE oddball email addresses...

Each of these five email addresses has no website set up on the server on which it is registered. (Bni Salah happens to be a small town in Morocco.) So what’s going on here? The woman who sent these emails to us didn’t sign up for any of these newsletters, and she didn’t tell us that she had unsubscribed from anything recently either.

We think that these fraudulent emails may be an effort to gather information from her. It may be as simple as confirming her email address, and that she will open and click a link. This alone can greatly increase her risk of being a target. It is also possible that she may be asked for additional information to “unsubscribe” such as confirming her address or phone number. In today’s cyber-world, that could be dangerous. Our advice is simple and you’ve all heard many times before.

DEEEELEEEETE!!!!