THE NEWSLETTER | 02.11.26 | V06N01
Co-Founder/Content: Doug Fodeman | Co-Founder/Creative: David Deutsch | Scambaiter: Rob M
Approved Advertisement
How Fraudsters Use Birth & Death to Scam You
If nothing else, scammers are certainly low-life, despicable opportunists. We’ve seen this thousands of times over. But one of the ways we’ve never, or only rarely, seen this concerns birthdays and deaths. Recently, one of our readers received a Paperless Post birthday punchbowl invitation from a woman named Melissa Lucius. But our reader didn’t know anyone by that name! We think you can see where this is headed. Coincidentally, at about the same time, a friend of my partner, David, received a news story on Facebook that seemed to suggest he and another friend of theirs had died in a fatal car accident! She immediately called David and he reassured her that neither he nor the other friend were dead. Digging into that Facebook post, we discovered that the exact same claim can be found on hundreds of Facebook accounts over the last year! Like we said, birth and death is being used as malicious clickbait. Read on and we’ll show you the details of our investigation…
How sweet that Melissa Lucius sent this invitation to someone she doesn’t even know. Awww….what a lovely gesture! But is it? If you look at this screenshot below, everything about it looks 100% legitimate, except for one obvious thing, and one hidden thing. The obvious thing is that mousing over any of the links (without clicking), or the image of the birthday card, shows that they do not point to paperlesspost.com. They point to a website called fiozafrai[.]biz[.]id. (When you look at the screenshot below, be sure to look at the Paperless Post security message underneath the image of the card!)
There are several very serious issues about this email from Melissa that need your attention!
- The security message at the bottom of the email states that all email from Paperless Post will come only from their domain, paperlesspost.com. This email came from Melissa’s Gmail account. This information is hidden from you unless you hover your mouse over Melissa’s name or click the small drop-down arrow just below her name.
- The links point to a domain, fiozafrai[.]biz[.]id, that was registered a month and half ago and is being hosted on a server in Indonesia! (“id” = 2-letter country code for Indonesia.)
- A security service on VirusTotal has identified fiozafrai[.]biz[.]id as a phishing domain. But even worse than that, the Zulu URL Risk Analyzer found malware lying in wait at the end of that link! Yikes!
But what exactly was this particular malicious link pointing to? We’ve learned over the years that scammers will often use, and reuse, websites for all kinds of fraud. They’ll also hide malicious content in someone else’s website if they can gain access to it. We couldn’t help but notice that when we moused over this malicious birthday link it pointed to a top level directory that was simply labelled “e.” This was followed by an exclamation mark and some coding nonsense. Being the curious fellows we are, we used a tool to visit the above link (safely) after removing the exclamation mark and code that followed it. Look below at what we discovered! Below on the left is a partial screenshot of a website for a plant nursery business called GreenLeaf Nursery. It was found in top directories labelled e, c and f. On the right is a partial screenshot of an auto-parts business called AutoParts Pro! It was found in directories labelled a, b and d. Now our spidey senses were on fire! We removed those letter directories and all other code to see what was simply sitting at the top of this malicious website link. And there we found a third fake business called “ElectroMax – Advanced Electronics and Industrial Machinery.” Wow! These scammers have been busy!
Thankfully, the recipient of this birthday invitation knew enough not to click the link. Instead, he sent it to us to share with our readers. At the other end of the spectrum for celebrating life is an announcement of death. (Actually, hundreds of them!) David’s friend told him that she didn’t post this Facebook message! Unfortunately, David had to inform her that her Facebook account was likely hacked and used to send this clickbait. If you look at this clickbait message, there are two critically important things to notice…
- The post strongly implies that it is found on NBC News, but the link associated with this news story instead points to WEWEB-PRODUCTION[.]S3[.]AMAZONAWS[.]COM.
- The story title about this fatal accident includes a misspelling for the word “accident.” “Fatal traffic acciden on the highway claims several lives of families.” NO LEGITIMATE news service would make that mistake!
And then underneath the post, the author of the post wrote “R.I.P. Why did it have to be you.” What makes all of this such clever clickbait is that you have no exact idea WHO she’s talking about unless you click that link! When we Googled that link, and the words fatal traffic, we weren’t surprised by the response. Even Google’s AI replied that this link “is currently associated with malicious clickbait posts on Facebook.” Below is another one from an account by a woman named Shirley. Everything Shirly posted is identical to Gina’s post! (We really liked what Bryan had to say to Shirley and others!)
Our search above turned up 79 links. We thought that the “acciden” spelling error was so odd that we also tried Googling it and other phrases we found in these posts. These searches led us to HUNDREDS of these malicious posts on Facebook in the last year!
We found other similar clickbait posts that used the phrase “he is at peace now, just moments ago” at the top of the photo and found more than 200 more identical posts about a “fatal acciden” with links to WEWEB-PRODUCTION[.]S3[.]AMAZONAWS[.]COM. Clearly this fraud is SIGNIFICANT not only because of the malicious effort to trick people to click that link, but also because it means that all of the Facebook accounts that posted it are either real compromised accounts or fake accounts created by scammers!
Scammers really SUCK! In every way, they are despicalble sub-human beings, unless of course, they are enslaved by despicable sub-human beings and being forced to scam others or risk torture and death. The bottom line is that these low-life creatures will use anything, including birthday celebrations and death notices to manipulate you to click malicious links! Please keep a healthy dose of spepticism and verify before you click! Case in point…. We’ve been finding a lot of malicious clickbait on Facebook, and other social media, disguised as news stories about Savannah Guthries’ mother’s kidnapping. (See below.)
Approved Advertisement
Scamming the Scammers, Suspicious Social Media Posts, and More!
Last week, a longtime reader named Mike told us an amazingly wonderful story, and he gave us permission to share it with our readers! Mike is in the tech field and was being overwhelmingly inundated with scam tech support phone calls. Trust us, you are going to love this! “A few years ago, I was being inundated with “Microsoft” calling me about errors on my PC. I was getting 10+ calls a day for many months. I finally had enough and wanted to waste their time. I setup a virtual Windows machine using Virtual Box on an old Mac I had in my office that I really was not using anyway. I set the specs for the virtual machine as low as I could and then waited for the next call. When the next call came in, I played dumb and pretended to be an elderly person and I did what they asked. I downloaded their remote desktop app so they could control the virtual desktop. It was excruciatingly slow for them, but they persisted. They finally got Windows Event Viewer pulled up to show me the “Critical” system errors that they could “fix”, but I had to pay them in gift cards. I told them my phone was a landline phone, and I would go to the store to buy the gift cards, but please don’t hang up as I was very worried and wanted it fixed.”
“I put the phone down, muted it and went about my day (this was over the summer at school so I was not supper busy and was not getting many real calls). About 2 hours later, they were still on the line! I told them I had the gift cards. I did actually buy gift cards, as I needed to give some gifts anyway. However, when I read them the numbers, I intentionally messed up so that when they tried to verify the balance, it would say invalid number. I told them that maybe I was reading the numbers wrong as I could not find my glasses. I told them to hold on so I could find my glasses and again I put the phone down and went about my day. An hour later, they were still on the line. I told them I remember leaving them at the store I bought the gift cards at, so please wait while I go back to the store to get them. An hour later, they were still on the line.”
“At that point I had had enough so I used my real voice, and I told them I knew they were scammers and that I was just wasting their time. They were livid and I got cursed at in multiple languages. It was glorious! For the next few weeks, if I got a call and had the time I would do the same thing, however none of the other calls waited for me to go get the gift cards, but I tried to waste as much of their time as possible with the slow virtual machine and asking lots of dumb questions. Eventually the calls from “Microsoft” stopped, but it was fun while it lasted.” Thank you, Mike! You put a much-needed smile on our collective faces!
We continue to find lots of evidence of Asian scammers behind suspicious/malicious posts on social media, especially Facebook! For example, the Facebook group called “Host News Life” has more than 20,000 followers! They claim to be a “news & media website” telling the “untold side of your favorite hosts.” But they use this group as a disguise to post suspicious/malicious links, such as the recent post below. The group is run by scammers primarily in Vietnam! (We were able to verify this and then these scammers removed that information.) DO NOT BELIEVE ANYTHING you read on social media unless you can verify it on legitimate news sources. Also, don’t click links to websites you don’t recognize and trust without verifying the site through other tools, like a WHOIS tool! (NOTE: No tool is 100% perfect either, not even VirusTotal.)
The Facebook group called “Musical Meadow” is another example of a group created by scammers. It has more than 102,000 followers! They posted malicious clickbait about Nancy Guthrie’s disappearance, such as this post saying that Savannah Guthrie’s sister is a “primary suspect.” Links point to a website called newsngay[.]com that has ZERO credibility. For example, it has no information about who owns it or is behind it. Scam-Detector scores the newsngay[.]com website as “questionable” giving it a 51/100 rating. This suspicious website domain was registered through Namecheap on July 25, 2024.
We have one more malicious social media post to share with you this week as an example of the incredible abuse of these services to target people around the world. In late January, a woman named Jane Giardi posted on NextDoor that she was looking for an “errand runner to assist with various tasks.” Her post was suspicious for several reasons, including…
- Jane had recently joined the NextDoor community in October and had barely posted anything else beforehand.
- If you read her post carefully in the screenshot, you’ll notice some very awkward English that no native English speaker would use. (We don’t want to point this out to the scammers.)
- This IDENTICAL, or nearly identical post, turned up recently in NextDoor communities in Florida and Illinois.
Need we say more?
NOTE: In our January 28 newsletter, we condoned the actions of the Trump Administration publishing an AI-manipulated image of the arrest of Attorney Nekima Levy Armstrong at a protest. On February 3, White House Correspondent Erica Green published an article in the New York Times about this fraud and the damaging impact it has when our own government perpetrates it. It is worth reading!
Here’s an interesting scam story that begins when someone who was contacted and told that a similar profile on X had scammed him/her. But this IS THE SCAMMER! Check out the post…
https://www.reddit.com/r/Scams/comments/1qri6cl/us_scammed_here_on_x_by_someone_with_a_profile/
KSL TV in Salt Lake City, Utah recently tested and evaluated 4 Apps designed to detect and guard against scams. Though none of the apps came out with a perfect score, some were better than others. You can read their report at… https://ksltv.com/ksl-investigates/scam-detection-apps/872145/
We’ve seen all kinds of fraud but never, ever have we seen something like this… In Nepal, at the end of January, several people were arrested for defrauding international insurance companies out of millions of dollars by orchestrating helicopter rescues of Mount Everest hikers who didn’t need it! Check out… https://www.nytimes.com/2026/02/03/world/asia/mount-everest-helicopter-insurance-fraud.html?unlocked_article_code=1.JVA.730q.cbVasZhUhMHP&smid=url-share
Gold bars, crypto and cash are fueling new scams, says this article. What a surprise!
Idiot Spearphishers and Your Seller’s Verification Process
We loved hearing recently from a school’s business office to report this fraud! The scammer impersonated the head of a school and sent an email to the wrong school’s business office to ask that his payment processing information be changed! The Principal who is named in the email is at a school in Georgia. But there is a school by the same name in Massachusetts and that’s where they sent this spear-phishing email! Can you hear our applause?!
Our next smelly phish is another clever fraud posted on NextDoor. Someone named Steven Harris contacted someone else selling items on this community website. He claimed to represent NextDoor Support (which was a fraud) and said that “a buyer has successfully placed an order and paid for one of your designs.” Steven Harris then asked the seller to verify his payment details for NextDoor before the funds could be transferred. This is a very obvious fraud just by looking at the link that Steven provided. It points to the domain check17021[.]sbs. This domain was registered just hours earlier and was already identified as malicious by four security services! Remember to report your smelly phish to us and Google! https://safebrowsing.google.com/safebrowsing/report_phish/
Super Bowl Ticket Fraud and Used Items for Sale
We hope you enjoyed watching the Super Bowl on Sunday and were not amongst the people who were defrauded by scam posts like this one last week on NextDoor.com. A man whose first name was “Click” claimed to have a “sudden family emergency” and therefore unable to use 2 “verified digital tickets” to the game. He was offering these tickets for sale, saying market rates showed them valued at $6000+! The type of digital transfer he’s offering is HIGHLY SUSPICIOUS! If you ever come across this type of offer, we strongly recommend that you meet the seller IN PERSON and do the transfer IN PERSON! If that is not possible, at the very least have more than one video chat with the seller before you transfer money to him or her! Caveat emptor!
Lots of hugs and support go out to Carol Evan for “some big changes” happening in her family! She recently reported that, due to her sister-in-law’s devastating cancer diagnosis, the family needs to sell lots of family items to cover the cost of her treatment. This is incredibly sad to read, right? But is it true? It turns out that Carol Evan just joined Next Door an hour earlier, and then dropped this post. But more importantly, neighbors in the area commented that this seemed odd since her address was listed as an apartment in Greenwich Village, New York City! Does this family really have a camper, a truck, a golf cart, a trampoline and soooo much more in their Greenwich Village apartment? WOW! Where do they have room to sleep?
Google Can’t Protect You! And Failed Incoming Messages!
One of our Massachusetts readers recently had an eye appointment scheduled but forgot the exact address of the clinic. So of course she Googled it. Below is a screenshot of Google’s 2 returns. She clicked the top link for “Website” without even evaluating it because she trusts Google. BIG MISTAKE! Look carefully at the website domain associated with this link for the eye care clinic on Google’s returns! It is linked to a crap domain called rymaps[.]xyz.
Suddenly, the woman’s web browser was redirected away from rymaps[.]xyz and she was hit with a browser popup inviting her to “Accept and Continue” the installation of an extension called Ad Block Wonder. The links to accept and continue pointed to the website wonderblockoffer[.]com. This extension has been described as Adware, meaning that it actually injects unwanted popups, sleazy ads and collects your personal data, etc. The domain rymaps[.]xyz was registered about 5 months ago and considered suspicious by security services. Wonderblockoffer[.]com was registered on November 11, 2025 by someone in Lithuania! If this ever happens to you, immediately quit your web browser. Then relaunch it and clear your browser’s cache of all cookies. Once cleared, check the list of extensions installed in it and remove any that you do not recognize and trust! (NOTE: PCrisk.com also thinks that Ad Block Wonder is adware. They also have directions for removing Ad Block Wonder if you’ve already installed it.)
David Plays with Pig Butchers
I am not the only one who has fun playing with pig butchering scammers! David also enjoys it and here is a recent perfect example of his effort. He received a random text from 647-473-4865 about an interview. He knew neither the phone number or what this interview was about but that didn’t stop him! Notice that the next day David received more texts from this number. It appears that David has a new bestie! The scammer is asking if he’s going to be spending time with his family, followed by the very weird statement “I hope you can create amazing things in the evening.” Uhhhhhh, like what, exactly? Dinner?
Until next week, surf safely!
Copyright © 2026 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com
Marblehead, MA 01945