FYI...
'Free' AV coupon leads to tech support scam
- https://blog.malware...h-support-scam/
Mar 3, 2017 - "... This scheme is actually hosted on the same domain that was running the fake Windows support we described before and our assumption is that users are -redirected- to this coupon page via a similar malvertising campaign. It plays on special offers, discounts and time-limited deals to entice you to claim your product now, choosing between Norton or McAfee. After filling in your personal details (which are actually sent off to the crooks), a page simulates the offer being processed only to fail with an error message. Victims are mislead into thinking that their offer was redeemed, but that they -must- perform a final call to get it completed... This is where the tech support scam comes in. Once you call that number, you are routed to an Indian boiler room where one of many agents will take remote control of your computer to figure out what went wrong. (Un)shockingly, the -bogus- technician will identify severe problems that need an immediate fix... Despite the scam being about Norton, the technician brushes it off as useless when it comes to the real deal: “Junk is a kind of virus which is the most harmful virus“. With his technical expertise, he proceeds to highly recommend the most expensive plan, for a lifetime low price of $400. Of course, there is nothing there, it’s a pure rip-off where once they have your money, they couldn’t care less about helping you out (for a problem you didn’t have in the first place anyway)...There are other scam domains also hosted on this IP (166.62.1.15)... Instantpccare .com is familiar and related to a previous investigation* where the owner of that tech support company incriminated himself by posting a comment on our blog which shared the same IP address as the remote technician who had just scammed us. As always, please stay vigilant online when you see 'free coupons' or other similar offers. They often are the gateway to a whole of trouble..."
* https://blog.malware...pport-scammers/
> https://blog.malware...-support-scams/
166.62.1.15: https://www.virustot...15/information/
Related:
166.62.1.1: https://www.virustot....1/information/
___
Fake 'IRS Urgent' SPAM - delivers ransomware
- https://myonlinesecu...ers-ransomware/
3 Mar 2017 - "... an email with the subject of 'IRS Urgent Notification' pretending to come from Dick Richardson who pretends to be an IRS Tax Officer. I have seen dozens of these and they all come from random email addresses. Dick Richardson changes his job in different emails. Sometimes he is a tax officer or a Tax Specialist or Tax department manager as well as an official representative...
Update: I am reliably informed[1] this is Shade/Troldesh ransomware...
1] https://id-ransomwar...ea894b2e24d5e47
Other subjects include:
Realty Tax Arrears – IRS
Please Note – IRS Urgent Message
IRS Urgent Message
Overdue on Realty Tax ...
One of the emails looks like:
From: Dick Richardson <electric@ oceanicresources .co.uk>
Date: Thu 01/09/2016 19:22
Subject: IRS Urgent Notification
Attachment: link-in-email
Dear Citizen,
My name is Dick Richardson, I am the official representative of the Internal Revenue Service, Realty Tax Department.
My office is responsible for notification of citizens, description of the tax system for them, supporting citizens on issues related to tax procedures, arrears, and payments, etc.
In the present case, I have to notify you that you have the considerable tax arrears pertaining to your property. More specifically, there is the tax debt for your realty – the realty tax. Generally, we make no actions in case of such delays for 4-6 months, but in your context, the overdue period comes to 7 months. Thereby, we must take relevant measures to remedy the situation.
Particularly for your convenience, our specialists have made the full and comprehensive report for you. It contains the full information regarding realty tax accrual, your debt (including the total amount), and the chart of overdue payments for each month of the arrears period.
Please download the report directly from the official server of the IRS, going to the link:
http ://radiotunes .co.uk/wp-content/plugins/simple-social-icons/index0.html
Please study the document at the earliest possible moment. Actually, after receiving this message, you have only 1 day to contact your taxmanager and provide them with the information you get in the report in order to resolve the problem. Differently, significant charges and fines may apply.
Best Regards,
Dick Richardson,
Realty Tax Division
Internal Revenue Service ...
Realty.tax.division.xls.zip: Extracts to: Realty.tax.division.xls.js - Current Virus total detections 5/56*
Payload Security** shows a download from
www .metropolisbangkok .com/assets/70958ae0/fonts/gcdf/templates/winscr.exe (VirusTotal 14/58***)...
There are loads of -other- sites in the body of alternative emails downloading the .js file...
The basic rule is NEVER open any attachment -or- link-in-an-email, unless you are expecting it..."
* https://www.virustot...sis/1488549054/
** https://www.hybrid-a...vironmentId=100
Contacted Hosts (15)
*** https://www.virustot...4efab/analysis/
radiotunes .co.uk: 192.138.189.151: https://www.virustot...51/information/
> https://www.virustot...cf70f/analysis/
metropolisbangkok .com: 27.254.96.21: https://www.virustot...21/information/
> https://www.virustot...833c2/analysis/
Edited by AplusWebMaster, 03 March 2017 - 04:09 PM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
