Odd SMS phishing attempt, for NZTA

Forums › IT Pro and developers › Odd SMS phishing attempt, for NZTA

1 | 2 | 3 | 4 | 5 | 6

kingdragonfly

11092 posts

Uber Geek

Subscriber

#3256220 4-Jul-2024 12:10

This one's unusual because it had a local phone number, and it's in NZ dollars. Asking to call this "complaint" number NZ based phone number 09 889 3894

It was a PDF file attachment, with Paypal and Norton logos. I forwarded

phishpond@ops.cert.govt.nz
spoof@paypal.com
spam@nortonlifelock.com

Thank You,
Customer Desk

Norton_369_Life_Lock_Plan

Paid on: July-07-2024

Total: 339.99NZD

Deduction of amount for order confirmation will appear on your account within 24 hours.

Assuming you have any inquiries, concerns, or ideas, you could get to us at

Note: If you do Not authorized this Charge you have 24 hours to cancel and get an instant refund of
your annual subscription by contacting our customer support team :

For Complain and Refund request Call +64 9 889 3894

Thank You,
Customer Desk

Oblivian

7284 posts

Uber Geek

ID Verified

#3256222 4-Jul-2024 12:23

Look at YouTube for scambait norton refund scam.

They're most popular and all the same, just different distribution mediums. Normally email or browser popup.

Intl voip providers with local endpoint number. It will redirect to India where they'll 'refund you' far too much and ask for the difference back.

Goes into the too big to combat bucket.

kingdragonfly

11092 posts

Uber Geek

Subscriber

#3256312 4-Jul-2024 18:39

And it appears the same company switched local phone numbers
from
09 889 3894
to
09 889 5647

amanzi

Amanzi
1288 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3266808 1-Aug-2024 09:23

For those still following this thread, I received a really interesting twist on this whole "PayPal invoice scam". The scammers had actually set up a Xero account and emailed me a fake invoice using Xero's invoicing platform. This wasn't just a site made to look like Xero - the invoice was sent from Xero, so it looked legit.

I'm well aware of the scam, but I could see this catching out others. I have reported it to Xero so they can investigate the account and close it down.

The phone number will look familiar to those following this thread - it seems like any number that starts with "09-889..." is a scam.

kingdragonfly

11092 posts

Uber Geek

Subscriber

#3375926 23-May-2025 12:59

Phishing attempt, imitating NZ post. It is fake.

===============

From

+63 951 772 9551

New Zealand Parcel: Your parcel has arrived, but your shipment has been suspended due to missing house number. Check and update your address details.

h t t p : / / mynparcel.life/nns

=========

It ties to well known domain abuser
aliyun.com
which ties to alibaba cloud services

I sent an email to DomainAbuse@service.aliyun.com

I got a "bounced" email in Chinese, saying their mailbox is full.

The US government, FTC, has complained to this provider about a fake FTC website previously.

wellygary

8261 posts

Uber Geek

#3375984 23-May-2025 13:32

kingdragonfly: Phishing attempt, imitating NZ post. It is fake.

===============
From
+63 951 772 9551

Why people would put any trust in a message from a Philippines number claiming to be NZ post is beyond me..

. but I guess as long a people keep clicking links, scammers are gonna scam

1 | 2 | 3 | 4 | 5 | 6