Odd SMS phishing attempt, for NZTA

Forums › IT Pro and developers › Odd SMS phishing attempt, for NZTA

1 | 2 | 3 | 4 | 5 | 6

Amanzi
1288 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3093551 22-Jun-2023 15:58

I get a lot of these spams too - Google Messages catches them all as spam. Some of the recent domain names in the spams are: etcnz dot com, s dot id, and a weird one: web dot nz-t dot cyou

I haven't had any with is dot gd

BlakJak

1253 posts

Uber Geek

Trusted

#3093559 22-Jun-2023 16:04

kingdragonfly: NZTA spam still continues

Now it's

https[:]//is.gd/nz_govtt1

which redirect to

https[:]//nzsxdell.buzz

which is domain provider namesilo.com

I'm making the usual complaints to companies.

Thanks NZ mobile phone companies. You're really doing a great job. It must be hard to spot the exact same text, and these well known shortened URL.

You want them to be spamfiltering (content reading) our text messages now?

No signature to see here, move along...

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3093688 22-Jun-2023 20:12

Of course the DNS provider NameSilo.com is dragging their feet on investigating these phishing cybercriminals

They didn't respond an email to abuse@NameSilo.com

I filled out the complaint form, and it asked if it was for phishing. When I hit "submit" it said

"Please direct your complaint to the network/provider(s) used to deliver the email. It is too easy to spoof domain names or otherwise incorrectly implicate a domain name related to spam/UCE for us to investigate complaints. Do you really want to submit?"

When I clicked yes, the slightly different form popped up, and of course blanked out some the fields I just filled out, and when I hit submit a second time, it finally submitted.

Then I got an email saying

"In order to ensure that all abuse requests are investigated, please submit abuse report(s) via the Report Phishing Form found at: new.namesilo.com/phishing_report

Please understand that we require evidence of the illegal activity prior to deactivation. Unfortunately, we cannot simply take reports at face value as there are often fake or inaccurate reports filed with us.

Otherwise, please contact the host of the website who has control over the website content or the registrant of the domain directly."

This is a new unpublished web page, and it required a photo, plus additional information.

So yeah, they really want to keep the money flowing in from criminals, and don't want to investigate.

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3094180 23-Jun-2023 17:41

I found that it's Tencent, the Chinese media company, is the one actually hosting the fake NZTA website. They won't accept complaints from individuals.

I guess phisher and scammer will always find the companies who don't give a damn about most crimes.

They do seem to care just a little bit about some mega-corporate intellectual property crimes, but scamming elderly from fake government web sites seem to be fair game.

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3098895 3-Jul-2023 10:18

Another round of NZTA scam messages.

The scammers keep coming up with new variations of URL shorteners from "is.gd"

The domain provider, Gname.com, really makes the complaint process as complex, hidden, pedantic and annoying as possible.

Criminal must love the Singapore based business.

Here's the well-hidden web-page https://www.gname.com/abuse/category/2.

Make sure you have one image, that's less than 5MB, because that's one of the pointless requirements to dissuade you from complaining.

The website's being hosted by quadranet.com, out of Los Angeles who has ignored my complaint.

You can only complain by email, which says a lot for a website hosting company.

If you use their online chatbot, it's only interested in selling you a service, not in complaints.

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3099145 3-Jul-2023 17:01

Just got a Bank of New Zealand, BNZ, scam SMS message. Leaving it here, in case someone wants to verify.

I forwarded to BNZ, "phishing@bnz.co.nz", and reported to Google and Microsoft

SMS scam from +64 21 027 12844

"BNZ: You have successfully paired a NEW DEVICE to your online banking. Recognise this? If NOT visit: https:[//]deviceremoval-bnz.com/"

michaelmurfy

meow
13218 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#3099155 3-Jul-2023 17:38

@kingdragonfly I got the same message from the same number. Reported it too.

A bit of a tip - when you get an URL enter it into https://virustotal.com also. This gets picked up by multiple security companies and will get flagged really quickly then. That is what I personally do too.

It was actually a tip I got from somebody who works for a big AV company.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Sharesies kids

Free kids accounts - trade shares and funds (NZ, US) with Sharesies (affiliate link).

boosacnoodle

961 posts

Ultimate Geek

#3099226 3-Jul-2023 21:22

Telcos still doing nothing to stop this. Incredible.

rugrat

3100 posts

Uber Geek

Lifetime subscriber

#3099394 3-Jul-2023 23:24

In the last two weeks have had a BNZ fraud on account one and an IRD one.

Reported both to the internal affairs number.

On the second one, IRD one internal affairs reply message took over 5 minutes to reply with text asking for phone number of text message, when sent phone number reply came back as though I was reporting a new scam, asking for phone number again?? I just left it at that, maybe a time limit to send phone number and as their request took ages time had run out.

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3102995 12-Jul-2023 09:26

Handy link "Who is hosting this web site?": https://digital.com/who-is-hosting-this/

The website "my-ird-nzd.line.pm/ret/GovttNz" is imitating the government of New Zealand tax refund website.

After further review, you are due a tax refund.

Please visit and enter your details to process your payment at:

https[colon]//my-ird-nzd.line.pm/ret/GovttNz

from Australian mobile phone +64 21 041 9644

Dnsexit.com is the website host and domain name provider.

It's always a bad sign when a DNS provider uses a Gmail email account as their contact: dnsexit@gmail.com

A well-hidden email address for DNSExit.com email address is "abuse@dnsexit.com"

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3107587 24-Jul-2023 14:33

SMS text. I reported to ASB directly by phone. 0800 ASB FRAUD (0800 272 372), or +64 9 306 3000

Also sent email to phishing@asb.co.nz

From +64 21 029 63697

Sms text

A'S'B- Your payment of $399.99 has been paid from your account successfully to 'JB HIFI'. If this was NOT you, please call us on 098893219

BlakJak

1253 posts

Uber Geek

Trusted

#3110209 31-Jul-2023 19:31

Always forward text spam to 7726. This is the Department of Internal Affairs aggregator and the single-view-of-things is useful.

No signature to see here, move along...

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3114454 11-Aug-2023 10:48

This SMS message is a bit clever, because BNZ uses netguard

From +64 21 083 66395

BNZ: We have limited your access due to multiple payment attempts on 10/08/23 7:16pm NZDT. If this wasn't you, visit: https[:]//netguard-bnz.com

kingdragonfly

11102 posts

Uber Geek

Subscriber

#3117070 17-Aug-2023 10:49

Reported to NZTA, Google, and Microsoft, and the Indian newspaper where it lives.

links to https[://]rewatimes.co.in/wp-content/uploads/tellingonline/nzwakarego/
and https[://]://rewatimes.co.in/wp-content/uploads/tellingonline/nzwakarego/VehicleLicenceEntry

From: NZ Transport Agency
Subject: Reminder: Renew Your Licence

WAKA KOTAHI
NZ TRANSPORT AGENCY

You've received this email because you signed up to receive notifications and communications from the NZ Transport Agency by email. Add us to your contacts or safe senders list to be sure you get our emails.

Kia ora,

If you've already renewed within the last 24 hours, please ignore this reminder.

It costs $103.95 for 12 months if you renew online. Your reminder number is 805273.

Renew now
Don't forget to renew your licence or exemption.

If you're not going to use your vehicle on the road for the next three months or more, [[my_link]]put it on hold instead.
Check the full reminder to see:

how the fees are made up
other licence periods and costs
more details about your vehicle.
Thank you,

Tinkerer

7 posts

Wannabe Geek

#3117104 17-Aug-2023 11:40

I use a dual SIM phone. The longer Skinny number has a prepay plan, which I only give to friends and family, or anyone important, like doctors and banks. The other is a Warehouse Mobile SIM with no plan, minimal credit on it, which only costs $5 a year to wake-up. I use it mostly for less important incoming calls, and for the likes of all the retail, online shopping, and other stuff.

Interestingly, I mostly only get spammed on the second number; which means that the scammers got that number from a list leaked from somewhere. Thank goodness, my phone correctly blocks most of them anyway.

If I want, I can actually set up forwarding from WMOB number to Skinny. However, each incoming minute will then use up the existing credit on the WMOB SIM. Skinny does not support Call Forwarding. Forwarding only works for voice calls, not SMS.

1 | 2 | 3 | 4 | 5 | 6