Click If You Enjoy a Good Drink!

My partner, David, is a whisky collector and enjoys a great bourbon or rye, usually “neat,” but will make cocktails under duress. His current favorite is a Sazerac 18-year old Kentucky straight rye. (On September 17, BusinessInsider.com published an interesting article about the best rye whiskeys of 2024 and according to this 2019 Forbes article, rye actually predates bourbon by more than a century! The Forbes article also had many more interesting facts about the history and development of Rye.) However, high-end, quality liquors can be very expensive! Especially the Whistlepig Rye Boss Hog bottles. The average price for a single bottle can be upwards of $500! So it shouldn’t be a surprise at all that David turned to one of his favorite hobbies, searching the internet with his good friend “Google” to locate an affordable bottle. Most times searching for one thing leads to another. For example, often you start looking for whale sounds and end up looking for bourbon or rye as well.  (Actually, David says most searches end up looking for bourbon or rye.) Some would say here lies the problem as Google will offer sponsored links. Others just embrace the love for collecting regardless of the source. David’s search morphed into one for a Whistle Pig Rye Piggie Bank. And when he clicked a Google Sponsored link he saw that the seller was a company widely known for very discounted merchandise. Costco! David is a Costco member and has often found unicorns like this at their MSRP. He immediately, and happily, started to make the online purchase. Can you see where this story is going? Well, we have a surprise for you because the amount of fraud involved was far more than we would have predicted!

Overjoyed at finding his favorite bottle for an affordable price, David completed his purchase. But just moments later he received a phone call from the fraud department of his local bank. The bank representative asked David “did you try to make a payment of $59.91 at a store called ‘Bed to Dream’ in Hong Kong?” Of course David said no! In fact, the amount he had just spent at Costco for the Bourbon didn’t even match the $59.91 charged from Hong Kong. He still had his Costco purchase window open on his computer and now he leaned in and looked closely at the website domain name at the top of his screen. The link said he was on a website called ElephantBody[.]com, and not Costco.com! Fortunately for David, his bank blocked the charge because he had used his debit card for the purchase!

Quite honestly, David was dumfounded that he fell for this fraud. And then he wondered, had Google been fooled to show more than one fake liquor store in it’s list of sponsored links?  He went back to his Google search and reviewed all the sponsored links carefully. This is where things go crazy as he discovered multiple fake liquor stores displayed as Google sponsored sites! In all, David found 10 of the 48 sponsored links were completely fraudulent and offering absurdly low prices for this specialty liquor! That’s more than 20% of the sponsored sites!

It wasn’t just elephantbody[.]com that pretended to be the wholesale retailer Costco either. Two other sites were also malicious mimics. One mimic used a nonsensical domain name, ntgcfdrt[.]shop that was registered two days before David found it.

Another costco-wanna-be used a domain registered in the UK called TrendyThreadStales[.]co[.]uk. But in addition to these two malicious mimics, we found other Google Sponsored links that appeared to be online stores for other products like kitchen-ware and camping gear, but they were also selling the same specialty liquor at crazy discounted prices! They included the domains GoldenGarlics[.]com, BiddleFlowers[.]com, tibilog[.]com, and Viconchic[.]com. Also, most of these bogus sales included high pressure tactics to lead potential buyers into believing that these deals would soon disappear!

Whomever is behind this fraud was extremely good at manipulating Google to display their many scam sites as Sponsored links! Not only that, but when we evaluated these sites using threat-assessment tools and WHOIS tools to learn about their origin and registration, we discovered that most of these domains had been registered anywhere from two to six years ago! We imagine that most security services would have identified these threats by now, but they didn’t!  Only ElephantBody[.]com was clearly found to be malicious….

(MalwareTips.com also found ElephantBody to be malicious. This YouTube reviewer details major red flags about the fraud found in their online store at ElephantBody.)

All the other websites came up as not risky on VirusTotal, though some sites were considered minor risks as identified by Scam-Detector. For example, GoldenGarlics[.]com came up as a “low risk” on Scam-Detector.com, which isn’t ideal. It also seems that some of these sites may have once been legitimate but have since been hacked and misused.  Clearly, David was not the only person to fall for these fake stores! We found this 1-star review posted on TrustPilot.com about the fake store at ALineAbove[.]com. The person who posted on October 29 was scammed out of $178 for his supposed purchase. What makes this even more interesting is that if you visit the top page of Alineabove[.]com, you will see that it is a poorly designed website that claims to sell ceramic tableware, not alcohol. Alineabove[.]com also lists their phone number as 785-802-6405, and their address as 512 DUDLEY AVE GEORGETOWN KY 40324. Google cannot find anything about this phone number at all and that Kentucky address is a small 840 square foot home, not a business.

So who might be behind these many fake liquor sales stores? Our best guess is Chinese cybercriminals. During our investigation we found a small clue. The misused domain viconchic[.]com was registered in 2018 in Beijing, China.  Also, many cybercrminal gangs tend to specialize in certain types of fraud. Chinese cybercriminals, in particular, often focus on consumer-related retail fraud.  Regardless of who is behind these scams, one thing is crystal clear.  You cannot trust sponsored links that Google presents to you! Do your due diligence to assess the business before making a purchase! David certainly will!

However, the person who got this email was suspicious. Afterall, the email didn’t include the correct name of his hotel. When we looked up that domain, GuestPreCheckin[.]com, using a WHOIS tool, we discovered that it was registered one week earlier in Malaysia! And, even though the domain was one week old, six security companies had already identified it as malicious on VirusTotal.com!

The second example of a very clever fraud just targeted David a few days ago. He received this text from an unrecognized phone number telling him that one of his apps was misusing an account to send out emails in his name and without his permission! To disable this app he was invited to click a link to a domain that had been registered hours earlier in the Netherlands! Yikes!

Last week we also heard about a type of fraud that many people call the “Muse Scam.” A muse is defined as someone who is a source of inspiration to an artist. This Muse scam targeted a Reddit member via her TikTok account. This scam is a clever variant of the fake check scam in which the scammer will contact the victim over social media and claim to want to use their image for an art project. The scammer will sometimes use a stolen social media account to increase their credibility as well. They will offer the victim a generous sum of money to do so and offer to pay via check. Once deposited, the victim is then instructed to send money for “materials” but it goes back to the scammer via an irreversible method. The victim is under the illusion that the funds are cleared when the bank makes the money available. But the fake check will be rejected in a few weeks and the victim will have lost the money they sent for “materials” as well as get hit with bank fees for a bounced check!

Once again, our friend and professional scambaiter, Rob, has helped us expose a lot of fraud. He notified us about another fake bank last week that was likely being used by Nigerian 419 scammers. After noticing some oddities about the fake bank website, we did some investigations and discovered 87 more fake banks that we had not previously found! That brings our list of fake online banks to more than 1050 since 2020! You can see the recently added list of banks on Page 2 of our fake bank list. Rob also shared another scam with us that reveals a very clever trick used by many scammers and we think our readers should know about. Check out the email below that claims to represent a USAID Solidarity Fund Award Program. This email came to Rob from the organization’s website at UNOCB[.]org. However, this domain was registered in late March, just over 7 months ago and is already known to VirusTotal as malicious.  But, more importantly, the scammers who orchestrated this fraud use two email addresses that APPEAR to some as very legitimate, official addresses! One email uses the domain Diplomats.com and another uses the domain USA.com.  To many people, these may appear as official email addresses of the US Government. However, they are FREE email domains that can be set up using a variety of email services, such as Mailspring. But scammers use domains like this often in their scams! By the way, both Scamadviser and Scam-Detector have given very low trust ratings to the domain UNOCB.org and VirusTotal has classified it as malicious.

As we’ve mentioned, scammers can be very clever. They are also opportunists! Here’s perfect example of this. Scammers saw an opportunity recently to trick a cheese manufacturer in the UK to send them a delivery of very expensive cheese. These scammers in the UK stole nearly $400K worth of cheese!

https://www.nytimes.com/2024/10/28/world/europe/uk-cheese-theft-scam.html?ogrp=dpl&unlocked_article_code=1.Vk4.cgm8.weQwVLELJb72&smid=url-share

Another recent article of interest describes how con artists stole all of the money left to two different men…

https://www.nytimes.com/2024/10/31/business/scam-con-artist-family-savings.html?unlocked_article_code=1.WU4.SFtB.we-fTUNEH-Qo&smid=url-share

Wal Mart Family, Office365 Account, and Norton Subscription

Did you know that the retail store Walmart is owned and operated by the “Wall mart” family? According to this lovely email from Wereburga Mikkelson, it is! Oh, and thanks for purchasing an “apple gift” for $575.56. That must have paid for a LOT of apples! There are soooooo many things wrong with this phishing scam email but we found it too funny NOT to show you! Like the fact that they claim this apple payment will appear in many of your bank accounts. Seriously? Enjoy some scammer stupidity….

We had never heard of the Isle of Man until a reader sent us this phishing threat. As is obvious, it pretends to be a notice from Office365 telling you that your password has expired. Never mind that the email didn’t come from Microsoft.com or Office.com. But the link pointed to Google! It turns out that it resulted in a redirect to a phishing website called Entandque[.]com hosted in the Isle of Man, near Ireland! Fortunately, VirusTotal is very aware that this website is malicious.

Deeeeeeleeeeete!

Finally, this last phish was sent to LOTS of people from an account at Sacred Heart College, in Lucena City, Philippines. Anytime you see an email sent to “undisclosed-recipients” it’s important to understand that the email was sent to many people! Why would many people receive the same email using the same Customer ID? Lunge for the delete key! And remember to report your smelly phish to us and Google:

  https://safebrowsing.google.com/safebrowsing/report_phish/

Court Records Show You Own an Annuity! Seriously?

We would never have expected online fraud to come in the form of a text claiming that court records show you that you have money. Do REAL courts operate this way? Hell, no!  Courts will send official letters in the mail, sometimes requiring a signature to indicate you’ve received them. They won’t contact you from random numbers via text. But just last week a Reddit member posted an interesting text he had received.  This led us to discover a very suspicious financial service. On October 25, this Reddit Member posted this text, claiming that the man had an investment opened in his name at birth. The text came from someone named Ed, and using the phone number: 484-845-4468. Check out the crazy story that Ed pitched to the fellow…

However, a Google search for Ed’s phone number, 484-845-4468, clearly shows us a business called IBuyAnnuities[.]com as well as their social media account called “Best Annuity Buyers.” (There was nothing from Google or the IBuyAnnuities website referencing Robin Hood Funding services. (According to their website, Robin Hood Funding is a grant provider fighting poverty in New York and has nothing to do with the Annuities website.) Google also showed us the address associated with the IBuyAnnuities[.]com website and phone number 484-845-4468 is 992 Old Easgle School Rd, Wayne, PA. However, we could not find this business when conducting a search for that address in Google.

An annuity is a monthly or annual payment made to someone, usually for life. A visit to IBuyAnnuities[.]com says that they pride themselves on “paying top dollar for your future payments.” They also pay a single sum of money for “structured settlements” and lottery winnings that are set to pay out over time. Though this is kind of an odd business, it appears to be a business nonetheless. But the fact that we couldn’t find it at the address they list makes us suspicious. Also the fact that the text sender lied about the name of the business is another critical reason to be suspicious! We visited both of the links to the Facebook page for IBuyAnnuities[.]com  and saw that one of these links showed us the Facebook page written in Frisian language, a language spoken by about 500,000 people in Western Germany and the Netherlands. But more importantly, it appears that this Facebook account “bestannuitybuyer” was created on January 24, 2020 and the creator identifies him/herself as a “Financial Consultant.” The creator changed the profile photo a few times in early 2020 but no posts or modifications have been added up to the time we published this newsletter, nearly 5 years later. The account has no likes and 1 follower at the time we found it. No posts, other than the profile photo changes 4 years ago. Also, the address posted on Facebook for this supposed legitimate business was simply listed as “19064” (If that is a left-over zip code, it is for somewhere in Southest Pennsylvania. But it is different than the zip code shown by Google, though still in Pennsylvania.)

The lure of a large lump sum of money, as shown by the $30,000 in the profile photo, is enticing. However, we find so many things sketchy about this business that we would never, ever recommend contacting them! Anyone can create a website or social media account and say anything they want. That doesn’t mean it is real or true. As for the $80,637 annuity that Ed claims is remaining to the person he sent the text to, we have but two words… HELL NO!

Social Security Email & a Call from Medicare Advisor

Last Friday, one of our longtime readers received this email below claiming to be about his social security statement. The email even appeared to have come from an email address at the Social Security Administration, ssa.gov. But did it?!  It is important to notice that this legitimate email address was actually typed into the TEXT field and NOT the email field! The email field in the FROM address shows that this email came from a domain called room69[.]ng. This domain is a sketchy dating site in Nigeria and we do NOT recommend visiting it! Moreover, you are asked to review your attached SS statement but this SHOULD BE a pdf file (or more appropriately a link to your SSA account to find the pdf file.) But when we moused-over the attached file, WITHOUT clicking, we saw that the file ended in html, not pdf! Once again, we put on our hazmat suites, crawled into our bunker and opened this attached file in a safe manner. We discovered coding that was beyond our comprehension to figure out! HOWEVER, within that code we also found a call request for a tracking pixel from the dating site in Nigeria, room69[.]ng.  This told us that, in addition to forcing your web browser to do whatever the sender wanted, the tracking pixel would notify some account at this dating site when and where you opened the attached file. Hmmmm….No thanks! We’re going to leave that trip-wire alone.

Last week Scambaiter Rob received a phone call from a number he didn’t recognize, 212-784-6427. Immediately, he released the Kraken (Reference: 2010 movie “Clash of the Titans”) against this scam caller! That is to say, he quickly turned on his AI Bot Man and started recording. The caller identified himself as “Paul Joseph,” a Medicare Supplement Advisor. As you’ll hear, Mr. Paul Joseph has a very heavy Indian accent which is a bit interesting for someone with such an English-sounding name made from 2 typical first names! This scammer had Rob’s full name and address, which we’ve removed from the recording. The scammer becomes increasingly frustrated with Rob’s bot but keeps pitching his fraud until finally, Rob hangs up on him after wasting his time! The man had no idea he was talking to a Kraken Chatterbox. To us, five minutes of smiling over an obvious threat like this was time well spent. (By the way, 212-784-6427 is not associated with Medicare or anything related to it. In fact, Google can’t find that number at all!)

Your USPS Parcel is Detained & Gift for Handling Bills Promptly

Once again, we’re beginning to see a return of the very malicious texts disguised as problems associated with your delivery. With Thanksgiving a few weeks away and the Christmas holidays less than two months away, we’re likely to see many more of these again. This malicious text told a woman that her parcel was being held because of an invalid address. What she didn’t notice is that the text came from the “+63” international country code for the Philippines! And the link in the text pointed to a bogus domain USDelayli[.]top. This domain was registered hours before this text was sent and that is NEVER a good sign!

Another reader sent us this absurd text he received thanking him, Christine,  for handling his device bills promptly. Of course, his name is not Christine. The link to his supposed gift was to a nonsensical website called Lbrjqy[.]info. It, too, was registered just hours before the man received this text. Yikes! Swipe left!

Until next week, surf safely!

Copyright © 2024 The Daily Scam. All rights reserved.
You are receiving this email because you have subscribed to thedailyscam.com

Marblehead, MA 01945

Contact Webmaster