Approved Advertisement

At the time that Nancy reported this fraud to us, we thought this was a single, one-time threat. But clearly, the cybercriminals behind this threat had much broader and more sophisticated plans in mind! A few days later, on May 22, Nancy saw another post in her community group on NextDoor about a dog. But this time, the post was made by someone named Parker Yates. Parker posted a horrifying experience about her daughter’s recent scare after she was attacked by a dog while playing outside! Parker went on to describe how an “ultrasonic device I was carrying became our only defense” and “it stopped the attack before things got worse.” Parker Yates included a photo of her child’s injured leg. At the bottom of Parker’s post, she included a link to the ultrasonic device she had used to save her daughter from further harm. She was recommending this device to others. But Nancy immediately thought this link was suspicious because it pointed to an odd domain called petcare15[.]xyz. We confirmed for Nancy that any domain ending in DOT-xyz is 100% malicious and fraudulent, based on our many years of experience investigating online fraud! (A WHOIS look up for the domain petcare15[.]xyz has confirmed our suspicions. It was registered just hours earlier on May 22 and the website was hosted on a server in Australia.)

Who wouldn’t continue to read that full post and look at the photo! It’s heartbreaking to see and many community members started posting supportive and caring remarks and emojis. But when Nancy saw this post she was immediately suspicious of it. When we asked her why, she said “I can’t say for sure but it seemed like a long sales pitch. I also admin 5 Facebook groups and I’ve become quite adept at recognizing fake talk. All the previous scam Nextdoor posts (blogspot) were also made by new profile accounts. Plus all the comments on this post seemed so … homogeneous. They are ALL fakes, and all were reported.” What Nancy was referring to was the fact that immediately following this post about a dog attacking a child, there were three sympathetic responses that were completely fake! Nancy posted a “SPAM ALERT” warning other community members that this post was a fraud. She also investigated the accounts of the three very supportive replies that quickly appeared in response to Parker’s post. It turned out that the accounts for these posts, by Donnell, Ally, and Sophia had all been registered five days earlier on NextDoor! Nancy also reported these accounts and posts as fake user profiles used to support this threat.

Though we did not confirm that a visit to petcare15[.]xyz will result in scam popups telling visitors they have viruses on their device (and to call a scammer’s phone number for assistance), we can confirm that a leading cybersecurity company, called Trustwave, finds this domain to be suspicious. Also, keep in mind that nearly 14 years of experience exposing online fraud has taught us that a domain just a few hours old is absolutely malicious! These circumstances began to make us wonder if this fraud was more widespread than we first thought. From our perspective, it’s no coincidence that two malicious posts appeared on NextDoor just days apart and the subjects were related to dogs. We wondered, were there more of them? And so we asked Google to look for some of the exact, or similar, sentences that had appeared in these two posts. Google informed us that there were 3 other identical, or nearly identical NextDoor posts about a dog biting a child made in Florida (2) and Virginia. In each of these posts, the person also mentioned the ultrasonic device “I was carrying” or “I carried.”

We also found, and screenshot, an identical post to the one made by Parker Yates in Massachusetts, but on another Virginia NextDoor community page, in Portsmouth. This other post was made on May 4 by someone identified as Joseph Jarvis. It shouldn’t surprise anyone when NextDoor showed us that Joseph Jarvis had just joined this community about 3 weeks earlier! The post, about a dog that bit his daughter and his immediate use of an ultrasonic device to stop the attack from getting worse, was nearly word for word what Parker Yates had posted. Except that the recommended link at the end of this post pointed to a different website. The website was petcare14[.]my[.]canva[.]site. Canva is a service that offers people the ability to create free webpages. By the time we found this post, it had already received 51 heart emojis from neighbors and 56 comments. (NOTE: Parker Yates’ post on May 22 was called “petcare15” and this post by Joseph Jarvis was labelled “petcare14.” Were there, perhaps, fifteen of these malicious posts in total by May 22? We had only found evidence of five, so far.) And the photo included in each of these posts was the same photo!

When we (safely) visited the petcare14[.]my[.]canva[.]site web page we discovered that it advertized for a pet-training product called “Barks No More” and included two buttons to “Shop Now.” But instead of pointing to the BarksNoMore.com website, the entire webpage (including LOTS of whitespace around it) was linked to a website called glstrck[.]com. This domain was registered on October 31, 2024 and it was found to be malicious by two security services on VirusTotal.com!

Clearly, the thought and attention that a cybercriminal gang was putting into this fraud was far greater than what we anticipated when Nancy brought these two posts about dogs to our attention. And what about that very first post that Nancy reported to us about “a lot of dogs sick across the country?” We discovered that this post was also linked to much more fraud as well! When we Googled the exact sentence ““there’s a sickness going around that’s been making a lot of dogs sick across the country” we discovered yet another identical post on a Germantown, PA NextDoor community page! And before Blogspot removed the scammer’s webpage at pethealthdaily0[.]blogspot[.]com, we visited it to discover an article called “Viral Disease is Spiking Among Dogs. It Can Be Deadly.” (We took a screenshot of the article.) Using Google for further analysis of this article, we discovered several more identical articles posted on blogspot webpages, including at these locations….

• Pethealthdaily00[.]blogspot[.]com

• Pethealthdailly1[.]blogspot[.]com (Notice the misspelled “dailly”)

• And yet another post on a Houston, Texas NextDoor community webpage!

These bogus articles all appear to show the author as “Dr. Sarah Johnson” and they include a quote from a “Dr. Michael Chen, an infectious disease specialist at the National Veterinary School.” Exactly what National Veterinary School? An additional Google search tells us that there is no such infectious disease specialist named “Dr. Michael Chen” or a “National Veterinary School.” (We did find several veterinarians named Dr. Sarah Johnson.) The article also includes the sentence “The AVMA is working with state veterinary associations to track the outbreak and provide updated guidance.” When we searched for this exact sentence as written, Google returned only one link to another identical article located at a free webpage creation service called Neocities[.]org. The link is: dfhgh[.]neocities[.]org. Upon exploring this other scammer’s article, we learned that Neocities provides publicly available statistical analysis of its web pages. This scam article was viewed more than 15,910 times in just 3 weeks! In our research of this fraud, we did find one hysterically funny mistake made by these scammers. It was found in the information included in the last paragraph of the article about the virus spreading in dogs. It said “The AVMA is working with state veterinary associations to track the outbreak and provide updated guidance. They’ve also established a hotline for veterinarians dealing with unusual cases at 1-800-VET-HELP.” But the 800-VET-HELP number is a hotline for the National Coalition for Homeless Veterans, and not for veterinarians! Once again, misinformation and disinformation are rampant online in social media services! Don’t assume that what you read is true!

Approved Advertisement

One of the ways that cybercriminals frequently target the public is through emails and texts disguised as delivery notices. Considering how many purchases are conducted online today, requiring a delivery of merchandise, it’s easy to understand scammer’s reasons for using these kinds of threats. Below is a perfect example that landed in an inbox in mid-May from “DHL Express.” But this email was sent from a domain called camreonind[.]com. This domain was registered less than a month ago by someone from Nigeria and it is hosted on a server in Romania! Most importantly, we want readers to look closely at the email address shown twice to represent Customer Service. It appears as admin.arrivalnotice “@” dhl .com. However, when we mouse-over each of these emails we discovered that they actually pointed to a free email service in Russia!

We feel it’s important to seriously take note of the unusual evidence that you may find about an email, website domain, or social media post that points to other countries in unexpected ways, such as Nigeria or Russia. Here are another couple examples of this unexpected evidence that screams of fraud! Scambaiter Rob shared these with us and he’s amazing at exposing this type of fraud! The first is an email from Mr. Andrew Caswell, contacting Rob to say that he qualified for a very large sum of money because he had been a scam victim. The payment is funded by an organization called Camelot National Lottery Group United Kingdom. The domain for this group is cnlgroup[.]co[.]uk. But Rob easily discovered that this domain is hosted with a service in Africa! Why would a real UK company do this? It wouldn’t, of course.

Here’s another example of an unexpected country appearance related to an email. Rob received an email from Elite Bank informing him of an account in his name that contains $465 Million dollars! (Congrats, Rob!) Of course the email provided Rob with the link to the bank, the account number and password to access the bank account. How helpful and just what you would expect a bank to do, right? But this nonsense email was sent from a free Gmail account and was filled with many capitalization and grammar errors! Most notably, when a banker has to tell you that his bank is “in the United States of America” you can be absolutely certain that this is total BS! REAL banks in the US don’t need to tell you this. It’s obvious by an address that can easily be fact-checked. The domain name of this bank is fed-resv[.]com, and also suggests it is a Federal Reserve Bank. If that’s the case, and it is located “in the United States of America” WHY was the domain fed-resv[.]com registered in Reyjavick, Iceland?

We love putting a smile on our reader’s faces by illustrating scammer stupidity! Here’s another example of the opposite of “clever.” And, quite shocking to us, this email also contains a threat made against Rob! You see, Rob has been playing wtih this scammer, err….we mean this Representative of the Federal Ministry of Finance in Benin, for some months now. Mrs. Angelina Haejue has finally had enough of his inaction! She has now threatened Rob, saying “IF YOU FAIL TO SEND THE $25 TODAY YOU WILL DIE IN PRISON AND YOUR $2,500,000.00 WILL BE GONE FOREVER.” You see, originally Rob’s fee to receive his millions of dollars had been $490 but Mrs. Angelina Haujue kept reducing it when Rob didn’t pay it. She’s even conveniently sent Rob all the payment information he needs, including the recipient’s name, David Obu, and the security question/answer needed to send money to his account. You’ll love the question and answer! (Also, Mrs. Angelina Haujue has a creative email name that says everything you need to know about her: peleo ladi pupu! Do you think it’s OK if we just call her “Pupu” for short?)

We have a recent and excellent article from the Harvard Gazette titled “You’d never fall for an online scam, right?” Of course the answer is WRONG! Anyone, and everyone can fall for scams, regardless of socioeconomic or educational level. Check out…

https://news.harvard.edu/gazette/story/2024/09/youd-never-fall-for-an-online-scam-right/

If you have a pet dog or cat, you may want to read about this scam that targets people whose pets have been lost.  Visit…

https://bobsullivan.net/podcasts/podcast/new-scam-alert-families-searching-for-lost-pets-targeted/#google_vignette

And finally, from MoneyTalksNews.com, here is an interesting article about 7 red flags that reveal a remote job posting could be a scam!

Approved Advertisement