A text message stating that a Stimulus check is coming, promising financial reward to click the URL. This is malicious code running on instrastructure that spans the globe. It is a clever form of malware delivery that evades antivirus and other protections, and is geared to drop malware on your device undetected via a form of delivery called ‘gootloading.’
Full Text
30 Photos Deleted from Gallery — Click here to restore and scan for virus [URL]Do not click the link, report the spam to 7726 (see below).
Yup, This is a Scam.
I’ve been getting a series of spam text messages from various phone numbers, likely compromised devices, all seem to be from AT&T in…
Namecheap, a US-based domain registrar, is allowing scammers to infest their registrations using global infrastructure to attack Americans and Canadians with malware. When this is reported, Namecheap does nothing. Over the course of months, I have been researching a series of text message campaigns that originate from a US domain registrar who both refuse to act , but also refuse to acknowledge there is a problem thus allowing cyber abuse, text message spam and smishing to go unchecked.
There is a Massive Spam Campaign out of Namecheap
Namecheap protects the scammers in the name of profit. The hosting providers keep taking down their infrastructure when reported, but for the scammers, updating the DNS is as easy as selecting three menu items within Namecheap’s bulk update function.
When a Pharma Spammer is ballsy enough to make a home on WebMD, utilize at least five whatsup numbers, traceable voip, a Wikr, Kick, Skype and Twitter account and websites to sell their wares, one must wonder, what are we, in the cyber security community, snoozing through. Some linked sites were up over seven years! This blog post is detailing the research involved to both make it easier to report to authorities and also make terms searchable in a collective spot to help people from getting scammed, or worse, die from fake medication.
Disclaimer
I don’t normally publish emails and phone numbers because often times due to innocent victims, or if these are compromised accounts. Also I don’t want some noob going to the URLS, or responding to the emails, or clicking the links. So, to start with this article, don’t do that.
These…
I’ve been getting a series of spam text messages from various phone numbers, likely compromised devices, all seem to be from AT&T in origin. All of them say, “We will lock your device soon. Please clear your spam messages. Scan now” with a link to click, and let me tell…
US Pipeline Ransomware Attack
In what is described as the “largest successful cyber attack” on fuel infrastructure to date, Colonial Pipeline’s infastructure was hit by a Ransomware attack, which lead to the pipeline ceasing operations. …
When authorities started investigating the murder for an A.J. Eick in 1899, men and their familes started fleeing as if from guilt. One of those men, William Yoder, was indicted and convicted of murder. He and his wife spent 11 years trying to prove that Eick was still alive…
Guilty of Something, but not Murder
William M. Yoder, also known as William Jacob Yoder, was born in Indiana around June, 1855. He married a woman named Nancy, and they had four sons: Everett Allen Yoder, John Max Yoder, James Marion Yoder and the youngest, Purtle Edward Yoder. William Yoder was known as a family man…
They are at again with “craftily” registered domain namespaces, and the luxury of breaking the law to spam your phone with more porn.
Yes, spammers are yet again sending text messages that use code and redirects to forward users to additional pornography sites that manipulate browser state, read browser history to ultimately collect personal and financial information.
The Text Message & Initial Domain
A porn spam smishing link that contains the word teen in it is bad enough, and this is a serious of redirect chains spanning the globe, only this time, managed mostly by US companies.
The Text Message
A text message came in stating: I’m Nicole, also provide 0nline servicesHere4meet>> teen69live.site.+18
The same group has been seen before in other articles I’ve written:
- Scammers using .US TLD to Spam Pornography
- A Single Porn Text Message (spam)
- Obliterated Gross Porn Text Message (spam)
- See auto-updated list here.
This is…
A porn spam smishing link that exposes contact details in registration data, with the intial URL itself is a rotating menu of web redirects usually seen mostly in malvertising. Analysis of and reporting herein.
Spam Porn
Everyone I know usually receives, and also super dislikes, these text messages. Most AV Vendors have already marked some of these domains as malicious, and to work around that scammers are getting clever about not serving the same content, and also, a large redirect chain that usually halts the analysis…
Natural plants to make natural dye in all shades
I am obsessed with the thought of making natural dye, and in ancient times, spinning your own cloth and dying it using natural materials was common-place. I do not have anything of my own to dye currently such as wool or cloth or some kind of linen, but I have…
