Odd SMS phishing attempt, for NZTA

Forums › IT Pro and developers › Odd SMS phishing attempt, for NZTA

1 | 2 | 3 | 4 | 5 | 6

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3122831 2-Sep-2023 08:31

I tried reporting a phishing scam to Bitly. Their web page now says this, basically "we don't care if criminals use our resources":

"Reporting Abuse of Bitly Links

The form Reporting Abuse of Bitly Links is no longer accepting responses.

Try contacting the owner of the form if you think that this is a mistake."

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3124820 7-Sep-2023 21:57

Might want to cite that. Not that i've tried using it, but their website is clear:

https://bitly.com/pages/trust/report-abuse

Please fill out this form if you’ve encountered a harmful link, QR Code scan, or Link-in-bio. Bitly takes these reports very seriously and will review and take action accordingly. Our Acceptable Use Policy, which governs our moderation, can be found here.

The form link is https://bitlyteam.formstack.com/forms/reporting_abuse

I myself would be quite interested if Bitly change their posture on abuse reporting, as it'll influence where it's used...

No signature to see here, move along...

alasta

6891 posts

Uber Geek
+1 received by user: 3365

Trusted

Subscriber

#3124888 8-Sep-2023 07:54

I received one of these yesterday on an email address that I have only given out to friends and a very select number of businesses that I trust. It is extremely rare for me to get nuisance emails at this address.

I am guessing that one of my friends has probably leaked their contacts list.

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3124924 8-Sep-2023 09:22

BlakJak: Might want to cite that. Not that i've tried using it, but their website is clear:https://bitly.com/pages/trust/report-abuse

Blacklash? Every time I get a link with any URL obfuscator (AKA URL shortener), I report it the company doing the to Google and Microsoft.

I hope getting blacklisted will make the companies rethink their monitoring, or at least geo-fence the redirect for any China, or Russian site.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3124962 8-Sep-2023 12:09

I agree with the reasoning. I do similar. I was concerned about bitly no longer doing their part.

No signature to see here, move along...

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3171952 15-Dec-2023 10:51

Fourth Netflix scam this month from Zoho mail campaigns.

The scam uses images to hide the email text from junk mail reader. Bottom image shown below.

The company name, complaint email address was not easy to find: abuse@zohocampaigns.com

It has the domain, which you might consider black-listing. I've been getting various emails for months.
maillist-manage.com

"Update your payment details"

"Things went wrong with your payment, so please remember that. Do not be scared, bad things do happen. Everything will be fine again once it's fixed, so you can watch Netflix again.

Plan: premium

Dell

Shop now for Dell laptops and other devices (affiliate link).

Handsomedan

7770 posts

Uber Geek
+1 received by user: 7406

ID Verified

Trusted

Subscriber

#3171953 15-Dec-2023 10:53

kingdragonfly: Fourth Netflix scam this month from Zoho mail campaigns.

The scam uses images to hide the email text from junk mail reader. Bottom image shown below.

The company name, complaint email address was not easy to find: abuse@zohocampaigns.com

It has the domain, which you might consider black-listing. I've been getting various emails for months.
maillist-manage.com

"Update your payment details"

"Things went wrong with your payment, so please remember that. Do not be scared, bad things do happen. Everything will be fine again once it's fixed, so you can watch Netflix again.

Plan: premium

I have had this one three times this week alone.

Handsome Dan Has Spoken.
Handsome Dan needs to stop adding three dots to every sentence...

Handsome Dan does not currently have a side hustle as the mascot for Yale

*Gladly accepting donations...

alasta

6891 posts

Uber Geek
+1 received by user: 3365

Trusted

Subscriber

#3172034 15-Dec-2023 12:06

kingdragonfly: Fourth Netflix scam this month from Zoho mail campaigns.

Yes, I have been getting frequent nuisance emails from this source. As I noted in my previous post, they're coming through to an address that is not normally susceptible to this sort of thing.

I complained to Zoho campaigns about a week ago and they told me that they had taken action against their client and added me to a "don't send" list, but I have since received another one. They're clearly not making a lot of effort to manage the problem at their end which is surprising considering that the service is probably being paid for using stolen credit cards.

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3213098 2-Apr-2024 07:27

The second Paypal scam I've seen with a New Zealand phone number.

It's a PDF.

using phone number 64 9 889 8374

Looks like "64 9 889" is used by scammers.

Sent to Paypal phishing report addresses, and reported to DIA.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3213302 2-Apr-2024 18:42

According to the NAD +64 9 889 is Symbio Wholesale, who are notorious for hosting/enabling malicious activity. Ensure you are notifying your own telco.

No signature to see here, move along...

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3213309 2-Apr-2024 19:19

Sounds accurate. Here's what they say on their well hidden page titled "Fight scam calls and texts with Symbio"

When they say "it's team effort" they mean "we're deflecting; it's a 'you' problem"

"Fighting scams is a team effort. If you are receiving scam calls or messages, please lodge a report with the anti-scam agency in your country.

We’ll then work with this agency to investigate, trace and block any scam calls:"

Dyson

Shop now for Dyson appliances (affiliate link).

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3213348 2-Apr-2024 21:39

That is the process that has to be followed, unfortunately (see: TCF Code) but we of course have little assurance around what it is exactly that they do...

No signature to see here, move along...

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3213700 3-Apr-2024 14:23

Another Symbio Wholesale 889 number, Paypal scam, via an attached PDF

Reported to DIA and Paypal

============================

From Payment Confirmation

Your order is confirmed

Thanks for shopping your order I phone 13pro (Mystic Green, 8GB RAM, 256GB Storage) with No Cost
EMI/Additional Exchange Offers has shipped. And the amount was Auto Debited fromyour account. We'll
send you an email when it will arrive.

Sub Total $ 889.37 NZD
Tax $ 0.00
Total $ 889.37 NZD
Note- For any query about the order call us at +64 9 889 1128
If you don’t want to continue with these services then ask for refund and you can call on this
mentioned no: - +64 9 889 1128
Thank you for purchase!
Team PayPal
Help & contact | Security | Terms & Conditions
Order No. 8705-58210076565
Item quantity - 02
Date: April 03, 2024
====================

kingdragonfly

11992 posts

Uber Geek
+1 received by user: 12884

Subscriber

#3213863 3-Apr-2024 19:29

A SMS phishing attempt using a Web URL.

In this case, it's claiming to be the New Zealand Post office, and trying to get the mobile phone user to click a link.

I've reported to DIA, Microsoft, Google, and the host provider RackNerd.

----------------------

"New Zealand Post Office: Your package has arrived at the warehouse and has been suspended for delivery due to a missing home number in the package.

Please update: [h]ttps://nzpost-cde.top/i

(Please answer with Y. Exit and stop SMS, reopen the SMS activation link, or copy the link to Safari and open it)"

----------------------

I've added brackets to the link, to de-tooth it.

[h]ttps://nzpost-cde.top/i&data=05|02||c24d2970fa8f4abc1dee08dc538bfc8e|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638477107911674906|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|0|||&sdata=+eeWoS8lDsOAZ3zf63PedNvnbHKsTAFAU5s4mTl3gw4=&reserved=0

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3213864 3-Apr-2024 19:33

NZ Post need to know too. Google 'report phish nzpost' and the contact email is the first hit.

No signature to see here, move along...

1 | 2 | 3 | 4 | 5 | 6