THE NEWSLETTER | 09.16.26 | V06N32
Co-Founder/Content: Doug Fodeman | Co-Founder/Creative: David Deutsch | Scambaiter: Rob M
Scheduling a Vaccine Shot Almost Launched a Nasty Fraud!
According to many, including this article from the CDC, September and October are ideal times to be vaccinated in anticipation of the winter flu season. And one of the most important ways that people schedule their vaccines in this digital age is to go online and look up available vaccine opportunities at local pharmacies, such as CVS and Walgreens. This is, of course what motivated a Massachusetts man a couple of weeks ago. He decided it was time to schedule his early Fall vaccine. This particular man has a sensible concern for privacy. According to various sources again, such as this article on VDigital Services, DuckDuckGo is considered to be a better tool to protect your privacy online when compared to using Google to conduct searches. One of the ways to take advantage of this extra privacy is to install a Chrome extension for DuckDuckGo, which the man had done. He didn’t give it a second thought after he launched DuckDuckGo and looked up “schedule vaccine Walgreens.” But he should have! If you assume that any of these products are always able to protect you, you set yourself up to be targeted. That’s what happened to him! Your digital health is our concern so please continue reading to make sure this infection, and subsequent sickness, never happens to you!
To protect this man’s identity, we’ll call him Randy. Randy trusted Google Chrome and the privacy protections afforded him by using DuckDuckGo. He never thought that these tools could be poisoned or misused by scammers. Search engine poisoning (also called SEO Poisoning), however, is a serious issue. Though it has happened infrequently, is has happened many times over the years. Randy also never considered that scammers can pretend to be companies and businesses they are not. Then, under this pretense, the scammers might purchase Advertizing on Google, known as “Sponsored links.” Just because these links are “sponsored” doesn’t mean they are all legitimate! Check out this news piece on YouTube from the CBS News station in Chicago posted in 2025 about scam Ads.. According to Google’s own safety reporting for 2025, they were able to identify and remove “over 8.3 billion ads and suspended 24.9 million accounts, including 602 million ads and 4 million accounts associated with scams.” This volume is insane and tells you how much Google users are being targeted by cybercriminals! This report said that Google was able to remove over 99% of “policy-violating ads.” But suppose, for a moment, that just 0.5% of those 8.3 Billion ads that violate Google’s policy get through. That means that over 41 Million potentially fraudulent ads make it past their filters and protections to land on your screen! The Sponsored Link,( i.e. Advertisement) that showed up at the top of Randy’s search for “schedule vaccine Walgreens” was one of these 41+ Million. And without looking carefully at the link, he clicked it. Look closely at this screenshot that he sent us and see if you can spot a very serious red flag why he shouldn’t have clicked that link…
We sincerely hope you noticed that this Ad for Walgreens Vaccine Appointments was NOT associated with Walgreens.com. The links pointed to a website called allaboutfinance[.]org (DO NOT VISIT THIS SITE!) Unfortunately, Randy didn’t notice this. He focused his attention on the information presented in the Ad. He then clicked the link and arrived at a fake Walgreens webpage. As you can imagine, the fake vaccine appointment webpage asked for lots of personal information, which Randy started to enter. But several steps into filling out the requested data, he felt that the information he was being asked seemed excessive and unnecessary. That’s when he noticed he was not on the Walgreens website! He told us that the fake site “quickly collects your name, address, date of birth, and phone number from what you type, then immediately asks for additional personal information that’s totally irrelevant to your vaccine. It asks for Medicare information, whether you are disabled, where you work, if you work, if you have a Medicare Advantage Plan, if you have Medicaid. And when I became wise and shut it off, it flooded my PC with multiple warnings that my PC had become unsafe. [i.e. infected with malware] Each time I close the warnings, more come back. Be forewarned!” On top of gathering his personal information, it turned out that the allaboutfinance[.]org website also hit him with a malicious trick that caused these many fake pop-ups about virus infections! (A similar experience recently hit a School Director of Finance & Operations. Check out her popups below and how she was able to resolve the issue!) After realizing his mistake not clicking on a real Walgreens link and dealing with the nasty popups installed on his device, he reported his experience in a post to community members on NextDoor.
We safely visited the “All About Finance” website at allaboutfinance[.]org and discovered some very concerning things about this and another website related to it….
- The domain allaboutfinance[.]org was registered on 9/24/2024 by a Network Administrator in Costa Rica representing a company called internetequity[.]com (DO NOT VISIT THIS SECOND WEBSITE!) Why would a company that clearly seems to focus on financial concerns in the USA be registered in Costa Rica, a country in Central America?
- There is also an email address to contact for support on the allaboutfinance[.]org website. But it points to internetequity[.]com. Though there is only one security service on VirusTotal.com that finds allaboutfinance[.]org to be suspicious, there are ELEVEN security services on VirusTotal.com that find internetequity[.]com to be very malicious, including finding malware on the site!
3. Also, the security service Gridinsoft rates allaboutfinance[.]org as 30/100, which is a low trust rating.
As we stated, cybercriminals periodically poison search engines to return their malicious links when you search for something. Also, search engines like Google miss millions of malicious Ads pretending to be something they are not. This means that it is critically important that you always look at the domain underneath, or on top of the clickable blue link words, in a search result BEFORE clicking! And never assume that “Sponsored Ads” are safe to click. Look for the domain. Is it what you expect? If you don’t see the expected domain, DO NOT CLICK! In this case, Randy also discovered that the malicious Ad link to allaboutfinance[.]org only appeared for Walgreens when the DuckDuckGo extension is activated! It does not show up when this extension is shut off. This suggests to us that this malicious sponsored link is through DuckDuckGo, not Chrome. This is one more piece of evidence to say that you cannot trust tech companies to always prevent their tools from becoming corrupted by cybercriminals!
On September 4, Randy sent us an email with the last bit of information about this fake Walgreen’s “sponsored Ad”…. “I can only say that DuckDuckGo has done a half-hearted removal of the Malicious website: allaboutfinance[.]org. What I mean by that is that the browser extension offers half a dozen ways it can search, as I did for “scheduling vaccines at Walgreens,” which happen to be the terms I used in a DuckDuckGo search to bring me to the malicious site. I can either put the same terms I originally did or click on any of the alternative ways that search for basically the same thing, and the very first website that shows up first happens to be allaboutfinance[.]org, but it disappears half a second later. It is now a couple of nights after I was infected. Just out of curiosity I tried to see if I could be certain DuckDuckGo got rid of it. The answer certainly is yes, but they’ve done it rather poorly. I would give them a grade of D-.”
So what, exactly, happened to Randy’s computer that caused these malicious popups? We have a theory and this theory is supported by something that was reported to us by someone else about a week and a half ago. Randy told us that he has Malwarebytes on his device, but the subscription ended 2 days before this event with the fake Walgreens vaccine link. Not only did his newly expired Malwarebytes not stop this malicious trick, but neither did Windows Defender. So what did fix this malicious popup? Simply resetting his Google Chrome browser and clearing the browser cached files removed it! Since doing these things, he said he hasn’t seen the popups. This tells us that this malicious popup trick is coded into the website he visited, allaboutfinance[.]org.
Oddly, the next day while Randy tried to investigate further what happened to him, he thought he would revisit the allaboutfinance[.]org website. This time he received the following message from his Malwarebytes software showing him that this website was blocked from initiating 3 fake security warnings. And if you look closely at the information in this block, you’ll see that these popups were coming from a website called pushclk[.]com. Pushclk[.]com was registered back in 2019 but has a horrible reputation! Pushclk[.]com is a suspicious domain associated with unwanted web ads, browser redirects, and potential adware or notification spam behavior. (e.g. 1 of many sources: Malwaretips.com)
Why Randy’s Malwarebytes missed this popup trick the first time, but caught it the next day is a mystery to all of us. This malicious popup trick is experienced by millions of people around the world! A few days after hearing from Randy, a school’s Director of Finance & Operations (DFO) contacted us and shared the screenshots you see below. They were taken from her Windows PC. She was savvy enough to know that this wasn’t a real threat and never clicked any of the links she was pressured to click. (And there were many!) Most importantly, she realized that these alerts and warnings were fake because many of them contained English grammar and spelling errors! Can you spot any grammar errors or odd usage of English in these warnings? Also, can you see any signs in these details that they are generated from a website located in India?!
Let’s take a closer look at some of these popups that happened on this woman’s PC, over and over! Can you spot the things that should tell you these messages are NOT REAL?! Look below and you’ll find bad grammar, awkward English and a misspelled word in the message supposedly coming from McAfee and the Google messages on the right! And if you are wondering what is the source of these messages, it is also staring you in the face! The DFO had just visited a Yahoo sports webpage that had been infected. The cybercriminals had likely succeeded in some type of “injection” attack on that Yahoo webpage. Their successful injection meant that anyone who visited that Yahoo page was redirected to a website that was causing all of these many popups! Look at the top of the next screenshot. The DFO had been redirected from Yahoo to a website called fusionboostlabs[.]com! According to a security service on VirusTotal.com, malware is on this fusion boost website! (Also, the domain fusionboostlabs[.]com was registered earlier in the Spring on March 12, 2026.)
It is critically important never to click on any of those buttons to scan, or Install, or block, or backup or remove or delete! These buttons will likely trigger your browser to install much more serious malware that will be used to infect your computer. Right now, what these cybercriminals had managed to infect was the DFO’s web browser! Though the woman knew that these popups were fake and malicious tricks, she couldn’t get them to stop! She didn’t know how to deal with this threat but thankfully, we did! (We normally do not provide this type of assistance but we happened to know how to deal with this threat.)
The DFO had more than a dozen of these popups on her PC. Randy also had many! The solution for both was simple. Both of them cleared their web browser’s cached files “for all time.” Not just the previous hour or day. This removed the injection that had managed to cause these popups. After clearing their browser cache, we advised both of them to open their browser settings and check their installed extensions to look for anything unusual. Sometimes injection malware can install a nasty browser extension. They both then quit all applications and restarted their computers. Finally, it is critically important NOT TO REVISIT the last couple of links you visited because they were likely responsible for these popups. Once their computers were back up, their popups had disappeared!
Before we leave this story behind, we want to show you a small, but important “breadcrumb” that suggests who may be behind the nasty threat that targeted the School’s DFO. As we said, she was hit with popup after popup! She noticed that some of these popups included a long, nonsensical group of letters, followed by a domain that ended with “.in” (for India!) This nonsensical group of letters was actually a subdomain, followed by a domain that included a country code. If you look in 2 of the screenshots below, you’ll see a long subdomain that begins with dae. But the end of that nonsense is a fully qualified domain registered in India called dynamtechboost[.]co[.]in. The Zulu URL Risk Analyzer also found malware lying in wait on this website in India! (Also, that domain was registered recently, on 6/12/2026 using Namecheap!)
If you ever see an avalanche of popups like this, don’t panic, and don’t click on them! Just clear your browser cache, check for any odd extensions installed on your browser and remove them. Then quit and restart your device. Now turn your attention back to considering whether or not you should get a flu vaccination because that season is just ahead.
Targeting Americans Through Their Health Concerns
During the last couple of weeks we’ve seen a new type of fraud, both in our own email inboxes, and reported to us by many American readers across the US! The email pretends to be from MyChart, a secure online patient portal and mobile app that lets you manage your personal health information and communicate with your health care providers. From what we’ve seen, this fraud primarily targets Medicare holders using MyChart. Below are just two of many recent examples we’ve seen. The first one came from a free Gmail account called lee71884064 and using the name “harmony blair.” It begins with “Dear MyChart Customer.” Most importantly, the link in it is HIGHLY MALICIOUS! Don’t “start the survey” and don’t “Claim Kit Now!” The Zulu URL Risk Analyzer discovered that the link points to malware!
This second example of the MyChart fraud offering a “new Medicare Kit” came from a server in the European Union called fervonix[.]eu. The links point back to this site in the EU. And don’t believe these lies when they ask you to take a brief, anonymous survey in exchange for a Medicare Kit! Lunge for the delete key!
There are many other malicious clickbait we’ve seen that pretend to be health related lately, such as this email with the absurd subject line “Diabetes gone in 2 days?” According to the CDC from 2023 data, about 40 million Americans (about 12% of adults) battle diabetes. That also makes them a significantly important target for cybercriminals. The email below claims to be about an “unusual discovery” about diabetes that helped thousands impacted by this condition. But it is all a lie! The fact that the link points to an IP address (172.187.129.139) instead of a domain name is highly suspicious! That IP address is located in London, England and identified as malicious. Never, ever take these claims for granted. Do your due diligence to verify, Verify, VERIFY!
If you had to guess what two tricks scammers often use to try to earn your trust, what would you guess they are? Are you ready for it?….. God and Compassion! Check out these two scammy emails to see what we mean. This first email begins with “Greetings may the peace of almighty God rest upon you and your household.” Yeah, total BS! “Mrs. Jennifer Stain” representing an unnamed Charity Foundation from Ashkelon, Israel sent her email from a hacked/misused student account at the Poznan University of Medical Sciences in Poland. (“.pl” = Poland)
As for compassion, scammers often tell a sob story (like last week’s story about a woman who desperately needed dialysis but couldn’t afford it.) in an effort to pull on your heartstrings and appeal to your humanity. They hope to engage your compassion to help others, which is the EXACT OPPOSITE of who they are! Take this sob story as an example. The email came from “Cancer lady Usa.” If you read her story, we think it will bring tears to your eyes, but most likely from laughter…
And now for some recent news….
Cambodia claims that they have no more scam compounds that are enslaving people to run scams worldwide. However, others are not so sure that is the truth! Check out…
Good news! The Myanmar Government claims to have repatriated more than 72,000 enslaved people who were forced to commit fraud.
Two men have been arrested for defrauding women in romance fraud while pretending to be a San Francisco 49er wide receiver…
https://www.sfgate.com/49ers/article/alleged-49ers-romance-scam-22406754.php
We have reported many times about fake “task sites” that steal your money as you do your “job.” Here’s another such article from Scamadviser.com….
https://www.scamadviser.com/articles/pay-to-click-scams-how-fake-task-sites-steal-your-money
The posting of fake jobs online has been increasing, even at Indeed!
https://www.scamadviser.com/articles/does-indeed-have-scams
Here is a description of several scams that are targeting people via WhatsApp…
https://www.scamadviser.com/articles/whatsapp-scams-targeting-people-right-now
Important IRS Document Posted & Facebook Invitation to Pay Your Bill!
This very clever fraud targeted one of our readers recently. But he recognized that it didn’t come from irs.gov. This phishing fraud was likely spoofed, but it looks like it came from a commercial website at irs[.]com. The link to “Download Document” is malicious and points to a misused service at Github. However, we did have a good laugh at the top directory on that misused Github website. The directory is labelled BodyBebo4-Crypto! (NOTE: It is not likely a coincidence that the domain irs.com was spoofed for this fraud AND so was the Social Security fraud below in our For Your Safety column! Spoofing is not easy and both concern US Government websites. We believe the same foreign cybercriminal gang is behind these threats.)
We’ve seen a bump in people reporting this next crazy phishing fraud. Why would anyone believe that any business would use a Facebook invitation as a real method to deliver an invoice for services? This is nuts! “Dui Gui” has invited you to pay a Norton bill through this Facebook invitation! What?! From our perspective, “Dui Gui” is a colloquial term for D-U-I, as in “drunk and under the influence.” Clearly, anyone willing to respond to this fraud and call these scammers at 865-283-6212 must be drunk, and under the influence! Remember to report your smelly phish to us and Google! https://safebrowsing.google.com/safebrowsing/report_phish/
This verified sponsor shows phishing statistics from around the world
Student Loan Debt Department
Many people get those scam calls from the “Student Loan Debt Department.” This fraud is so bad that there is even a US Government web page about this fraud and how to deal with it. But this fraud also targets people via our inboxes, such as this lovely email from Maggie below. Notice that her message came from a bizarre free Hotmail account, not any real business or company! Nor does she mention any business or company name. Just “Student Loan Debt Department.” As this DC Government article states, there is NO SUCH department as the “Student Loan Debt Department.” If you are ever bored and looking for some fun, call Maggie at 833-549-6991 and ask her to name her business, its physical address and website! Then send it to us to investigate, assuming you get a response.
Social Security Malware & Your Lab Results are Ready!
The email below is very clever because it has successfully spoofed a domain name that does not exist! This requires skill and sophistication, and maybe a little stupidity too. The email appears to come from a US Government domain called ssa-mail.gov. However, this domain does not exist! Any WHOIS tool can tell you that, and that the REAL domain used by the US Social Security Administration is ssa.gov. The email states that your account statement is available. But the link points to a website in Turkey (“.tr”) called ultmateking[.]com[.]tr. When we used a tool to safely visit this website we discovered that this Turkish website, appearing as the Social Security Administration, starting downloading software! We guarantee it is malware! Please share this with any friends and family who may be receiving, or soon to receive, social security checks!
One of our longtime readers shared this next threat with us. Apparently, Your lab results are ready. But look closely at the Subject line! “Please Review the Attached Lap Report.” “Lap” Seriously? This malicious clickbait also had a spoofed domain. The email shows that it came from costumer_service[.]com. Costumer?! Last time we checked, a costumer was a person or business that makes, sells, or rents costumes, typically for theater, movies, or Halloween. Also, the underscore symbol _ cannot be used in any domain name! No exceptions! The man who received this clickbait noticed that the link to download his report pointed to a website in Russia. He said “Our comrades in Russia where this email click points must be getting sloppy with spell check. Maybe they are more worried about getting a Ukrainian drone through one of their building’s windows.” Good point! We can only hope!
I am so excited about a text I recently received from Sophia from Amazon’s staffing office! Her text concerned a current job opportunity and she said that my background may fit a flexible online role with Amazon. How awesome is that?! And it pays really, really well! $5,300 for 30 working days BUT each working day is no more than 60-90 minutes! Even at 90 minutes per day, that works out to be 45 working hours per month, making my hourly pay nearly $118/hour! I just need to reply by texting her at 516-585-1537. But the only odd thing about Sophia’s offer is that it came from a free iCloud email account called yukselshala. Hmmm…..
Oh My Gosh! These texts are non-stop, and nearly as annoying as political texts asking for donations! Andy claims to represent MA Home Pros but I can’t find any specific business with that name, or phone number! And when I asked Andy for his business address and website, he ghosted me. That says everything you need to know about this fraud. Again.
Until next week, surf safely!
Copyright © 2026 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com
Marblehead, MA 01945