Friday, December 2, 2016

Phishing Attempts On My Facebook Fan Page

Right about the time my Facebook fan page started blowing up, all the scammers came out of the woodwork. It's pretty much what you'd expect, from the "hey I wired you a bazillion dollars so make me admin and I'll give you the codez" to the "hey i luv ur page make me admin plz,"

This one was novel because it took me a couple glances to read the domain name. There's so new top level domains nowadays that you have to mentally parse the URL, which is good for all the phishing scams.

The message begins with an ominous warning that your page has violated someone's terms.

Wе hаvе rесеivеd mаny rероrts frоm yоur fаn раgе. Plеаsе rеviеw yоur раgе аnd yоur роsts fоr rеаsоns thаt yоu hаvе viоlаtеd оur tеrms.

‌Y‌о‌u‌r‌ ‌c‌a‌s‌е‌ ‌і‌d‌ ‌і‌s‌:‌ ‌59382774


Here's the full URL they linked. I wouldn't advise following it. I sure didn't.

http://110741904325873.review/127351927/

A quick WHOIS search for 110741904325873.review shows it was bought from namecheap and they paid for the "whois guard" which pretty much anonymizes them.

Yeah, it's pretty much a throw-away domain technically registered tomorrow haha! Scammers in different time zones for the win!

Domain Name: 110741904325873.REVIEW
Domain ID: D428254-REVIEW
WHOIS Server: whois.nic.review
Referral URL: http://www.namecheap.com
Updated Date: 2016-08-17T22:05:09Z
Creation Date: 2016-08-17T22:01:41Z
Registry Expiry Date: 2017-08-16T23:59:59Z
Sponsoring Registrar: NameCheap, Inc.
Sponsoring Registrar IANA ID: 1068
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registrant ID: C428250-REVIEW
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.
Registrant Street: P.O. Box 0823-03411
Registrant City: Panama
Registrant State/Province: Panama
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Fax: +51.17057182
Registrant Email: 3fe9b0dba0d64d9a82743c7f23d74bb5.protect@whoisguard.com
Admin ID: C428251-REVIEW
Admin Name: WhoisGuard Protected
Admin Organization: WhoisGuard, Inc.
Admin Street: P.O. Box 0823-03411
Admin City: Panama
Admin State/Province: Panama
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Fax: +51.17057182
Admin Email: 3fe9b0dba0d64d9a82743c7f23d74bb5.protect@whoisguard.com
Tech ID: C428253-REVIEW
Tech Name: WhoisGuard Protected
Tech Organization: WhoisGuard, Inc.
Tech Street: P.O. Box 0823-03411
Tech City: Panama
Tech State/Province: Panama
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Fax: +51.17057182
Tech Email: 3fe9b0dba0d64d9a82743c7f23d74bb5.protect@whoisguard.com
Billing ID: C428252-REVIEW
Billing Name: WhoisGuard Protected
Billing Organization: WhoisGuard, Inc.
Billing Street: P.O. Box 0823-03411
Billing City: Panama
Billing State/Province: Panama
Billing Postal Code: 00000
Billing Country: PA
Billing Phone: +507.8365503
Billing Fax: +51.17057182
Billing Email: 3fe9b0dba0d64d9a82743c7f23d74bb5.protect@whoisguard.com
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM
DNSSEC: unsigned
>>> Last update of WHOIS database: 2016-12-03T02:26:27Z <<<