Category: Security

  • Facebook friend scammer

    Facebook friend scammer

    How scammers use facebook to scam – an example

    Received a friend request from a friend which I thought may have accidentally deleted the friend link or started a new account, we where already friends. Didn’t really think much more of it though.

    A couple days later got a message from him via facebook which was unusual as we’d never spoken on that medium before. The message was

    Hello buddy how are you doing

    Doing good, how about you?

    I’m good how’s your family ?? And I guess you haven’t heard about the good news

    By this point I knew I had a scammer. The part the scammer didn’t know, I knew my friend personally, we’d worked together for a while. You get to know manerisms. But I wanted to find out more so I responded

    All good. No I haven’t heard

    Haven’t you heard about the Federal government grant??

    No

    Are you for real ??

    This is a specific place to assist and support people in starting their own businesses, buying a house, etc. they also support they retired, disabled, young, old, workers and semi workers etc I got $150,000 delivered to me from them after paying for me delivery fee

    Wow. What’s it called?

    Have you heard about Attorney General chip ?

    what is that? How do I get the grant?

    I wanted to get on with the fun and get to how much it was going to cost me and how to pay it etc. What accounts are they using. What email addresses and any other good info I can get. The scammer replied:

    He’s the Attorney who helped me get my grant delivered to me within 48 hours after paying my delivery fee. Would you like to apply so that I forward he’s email address to you to contact him

    Why not

    Chipblanchard589@gmail.com. Are you going to send him an email now ?

    Haha a gmail address for the Attorney General? I better come across a little suspicious.

    I thought you said it was the Attorney General. How come it’s a gmail account instead of a .gov.au email?

    Yes that’s he’s private email address. Did you read my message Beth well? Once you send a mail to her private email he will add your details to their database So always get back to me so that I can put you through

    I am emailing him now. or is it her? which is it?

    Ok him Just get back to me so that I can put you through always

    So off I went to set up an email account for Sgt Hans Schultz. I like using him because he played the gullible character so well in Hogans Heroes 🙂 I sent:

    Hi, Al gave me you email address and sayed you can help get the $150,000 government grant really quickly.

    Then I jumped back to facebook and sent

    I just sent him email

    Has he responded?

    No. Can you tell him to hurry up? Why has he not responded yet?

    Nothing like putting a bit of pressure on the scammers even though it had been less than a minute since sending the email 🙂 I got a response from Chip via email

    Okay i think he was one of our grant beneficiary too, do you want to apply?And were you informed that you are to pay for the delivery fee only and nothing else

    Yes I would

    Great. Done with the facebook scammer so report the profile as a fake. FB will have plenty to read as evidence in the chat message too to verify it’s a fake and should close the account fairly quick. Chip responded via email:

    You have to be honest with me so that i can help you to get your grant and you will have to fill some information so that we can proceed. Reply back to me with the information below so as to verify and approved your grant.

    Full Name: Address: State: City: Zipcode: Sex: Text number: DOB: Mother’s maiden name:  Occupation: Personal email: Monthly income.

    Get back to me now with the information request from you, so that we can proceed.

    Classic scammers Phishing email. Great, I had the first part, now go for the financial info. So responded as the character Sgt Hans Schultz.

    Hans Schultz, PO Box 70385, SA, St Agnes, 5097, M, 041637xxxx, 19Feb1959, Meyer, Retired army sergeant, hs1877291@gmail.com, $12529.85

    The phone number I used is a real number. It’s one of my electronics dev boards so I can see what other stuff this leads me to 🙂

    Okay you have to hold on for 5 minutes because your information will be save on our database now so  that we did not deliver the grant to the wrong person..

    Well make it quick. I don’t have all day to do this.  

    We have verify your information’s and it shows that you are qualify to receive the grant,We congratulate you for being among the grant winner of the year. Now you are to choose the amount you wish to claim from us .. And you will pay for the delivery fees… your order as soon as possible.You are to choose below amount you want to claim.

    You pay $1500 and get $100,000.00, You pay $2000 and get $150,000.00, You pay $3000 and get $250,000.00, You pay $4000 and get $400,000.00

    Choose the exact amount you want now so that we can proceed for the next step.  Chosen amount has been approved and it will be forwarded to the delivery department for delivery, so let me know if you are ready to pay for the fee

    I jump back to facebook to see what fee I get told there:

    How much was the fee to get the grant?

    I paid $2000 to get that $150,000 equivalent to 2,921.86 Australian Dollar. You don’t really have to tell. Just let me know there is anything you don’t understand so I can put you through. Congrats in advance Its so good to be secretive about things like this till you get delivered to that’s how i did mine until I got delivered to

    I always pushed for cheaper – ie don’t pay what they ask so sent an email back to Chip with:

    I will pay $1,000 via PayPal for the $100,000.00 grant. Send me you paypal address and make it quick.

    You will pay $1500 to that $100,000. Thanks 

    What is your paypal address?   Why does this take so long to arrange?

    Haha it had only been a couple minutes 🙂

    Please wait while i check our available cashier for pick up 

    Here is our available cashier ready for pick up. You need to make a cash deposit or a wire transfer 

    Account Number : 815053199; Account name : Rosanna Bub; Account type : checking; Bank name:  Chase Bank;  Routing number : 021000021; Swift Code : CHASUS33; Bank Address : 615 Grand Blvd, Deer Park, New York 11729

    Great. Got bank details they are using.

    ATTENTION CHASE BANK: The above details are exactly what I was provided. I tried to call your fraud dept a couple of times and was told that you only talk to the account holder. The only method of contact you have is phone. If the account holder is innocent, you better act to protect her. If she is part of the scam, then you better hand over the info to local authorities. Either way – your on the hook and this info will stay so it can be found in search engines to protect others.

    Now lets see what else we can trip Chip up with

    What is your position in the government?

    I’m a lawyer/Attorney. Get back to me with the payment receipt. I hope to hear from you soon with the payment details. Thank you

    Between messages I’d already used google to find who Chip is and found he’s using the name and image of a School Principal in Tennessee.

    I’m confused. You say your the lawyer yet you have the picture of a teacher at a school.  Who is Rosanna Bub?  And you must be stupid, I told you to send me your paypal address. Please hurry up and do that so I can send you the money.

    Please you’re not insult or make violence. Otherwise you’ll be disqualified. I have my picture on my email and Rosanna Bud is a cashier presently available for pick up.

    Haha got a reaction 🙂

    That’s why I insult because you insult me!

    Here is the PayPal information: Mtexas55@yahoo.com. Get back to me with the payment details as soon as possible 

    My day is finished now. Will attend to this in the morning. You where to slow.  Please make sure everything is ready tomorrow to make this payment quick and smooth.

    Anyway, I thought I’d add some more the the facebook scammer as his account was still active (it had only been 30 mins).

    Did you unfriend me ? Why ?? I guess you get approved

    That Chip person is stupid I tell him to send paypal address

    You need to be patient when you’re doing things like this

    The part that is strange is Chip Blanchard is a teacher at a school in Tennessee. He is not the attorney general.

    He’s a lawyer. And such a honest man. I guess he must have once been a teacher or something but Chip is a honest man.

    No he isn’t. He says he is, but the profile on gmail he is using is a teacher at Rossville Christian Academy in Tennessee

    Chip is presently a lawyer and Attorney I got cash delivered within just 48hours. Trust me Chip is honest He could be once a teacher. And I don’t think that should bother you He’s presently a lawyer/Attorney who helped me get my grant. You can get your grant within 48 hours after paying your delivery. Dhl will deliver to you

    So he then sent me a picture which he downloaded from https://qz.com/545994/the-design-behind-a-bag-for-transporting-million-dollars-in-cash-undetected/ . It was a big bag which showed packs of $100 bills. I love how you can use Google to find anything you want on the Internet including images. I responded with

    Hey how come you said $150,000 but the picture you show is $1,000,000? https://qz.com/545994/the-design-behind-a-bag-for-transporting-million-dollars-in-cash-undetected/

    What ?

    The picture you sent. the picture of your cash?

    That’s how they deliver

    The picture is from the James Bond movie Spectre

    They deliver with cash

    To transport $1 million undetected

    Anyway it did spur on Chip as well. I had a couple more emails from him to which I sent him the link where they got the name and image for the gmail account from. No further response from him either.

    Scammers email address: chipblanchard589@gmail.com

    The gmail profile name of the scammer: Chip Blanchard. (NOTE: This is someone else’s identity)

  • Scam SMS from legitimate Qantas SMS number

    Scam SMS from legitimate Qantas SMS number

    Just received a scam message from what appeared to be Qantas (as the same number had legitimate boarding messages from previous flights). The message read:

    , you’ve won our mystery box this week – please use the link to schedule the delivery. http://www.b7.ai/s/2xl0lc/4uf BBL.

    Using a tool that sniffs these sorts of links to see if they are harmful before actually clicking on them results in a number of re-directions and finally a page that asks you to do a survey first which requires entering your details.

    WARNING: If it’s really Qantas, they already know who you are. Why do they need any of your details again for the survey? DONT PARTICIPATE!

    Anyway here is the log of where it goes along with the contents of the file it finally downloads.

    log showing what it does

    --2018-11-07 11:56:53--  http://www.b7.ai/s/2xl0lc/4uf
    Resolving www.b7.ai (www.b7.ai)... 109.207.77.88
    Connecting to www.b7.ai (www.b7.ai)|109.207.77.88|:80... connected.
    HTTP request sent, awaiting response... 302 Found
    Location: http://go.batophor.com/ts3089-sms-qantas-au-5 [following]
    --2018-11-07 11:56:54--  http://go.batophor.com/ts3089-sms-qantas-au-5
    Resolving go.batophor.com (go.batophor.com)... 198.13.62.193
    Connecting to go.batophor.com (go.batophor.com)|198.13.62.193|:80... connected.
    HTTP request sent, awaiting response... 302 Found
    Location: http://go.batophor.com/ts3089-sms-qantas-revs-au [following]
    --2018-11-07 11:56:54--  http://go.batophor.com/ts3089-sms-qantas-revs-au
    Connecting to go.batophor.com (go.batophor.com)|198.13.62.193|:80... connected.
    HTTP request sent, awaiting response... 302 Found
    Location: https://x.newsmouse.club/go/f65a8fd5-383d-47dc-8ed0-59450453dbb5?cpv=&clickid=1541554015.53-153741405-24909&camp=XX684&keyword=ts3089-sms-qantas-revs-au&category=&systarget=ts3089-sms-qantas-revs-au&sid=153741405&cid=&geo=AU&source=HT-EC [following]
    --2018-11-07 11:56:55--  https://x.newsmouse.club/go/f65a8fd5-383d-47dc-8ed0-59450453dbb5?cpv=&clickid=1541554015.53-153741405-24909&camp=XX684&keyword=ts3089-sms-qantas-revs-au&category=&systarget=ts3089-sms-qantas-revs-au&sid=153741405&cid=&geo=AU&source=HT-EC
    Resolving x.newsmouse.club (x.newsmouse.club)... 104.27.166.1, 104.27.167.1, 2606:4700:30::681b:a601, ...
    Connecting to x.newsmouse.club (x.newsmouse.club)|104.27.166.1|:443... connected.
    HTTP request sent, awaiting response... 302 Found
    Location: https://talongo.com/go/run-gojs.php?url=https://talongo.com/in-v8-au-bem-go.php&tracker=x.newsmouse.club&keyword=ts3089-sms-qantas-revs-au&region=&carrier=%7Bcarrier%7D&model=%7Bmodel%7D&brand=%7Bbrand%7D&camp=XX684&cc=au&wid=genx01-au&sound=silent&xid=eyJ0aW1lc3RhbXAiOiIxNTQxNTU0MDE3IiwiaGFzaCI6IjdlMzVmY2IzM2NkNDVkMDY1OTMyZGViMTBhOTEzN2NjMjE5ZmU1NmQifQ%3D%3D&bemobdata=c%3Df65a8fd5-383d-47dc-8ed0-59450453dbb5..f%3D14fde457-a775-4548-b5e1-bd449e0afc95..a%3D0..b%3D0..e%3D1541554015.53-153741405-24909..c1%3DXX684..c2%3Dts3089-sms-qantas-revs-au..c4%3Dts3089-sms-qantas-revs-au..c5%3D153741405..c7%3DAU..c8%3DHT-EC..c10%3Dx.newsmouse.club [following]
    --2018-11-07 11:56:57--  https://talongo.com/go/run-gojs.php?url=https://talongo.com/in-v8-au-bem-go.php&tracker=x.newsmouse.club&keyword=ts3089-sms-qantas-revs-au&region=&carrier=%7Bcarrier%7D&model=%7Bmodel%7D&brand=%7Bbrand%7D&camp=XX684&cc=au&wid=genx01-au&sound=silent&xid=eyJ0aW1lc3RhbXAiOiIxNTQxNTU0MDE3IiwiaGFzaCI6IjdlMzVmY2IzM2NkNDVkMDY1OTMyZGViMTBhOTEzN2NjMjE5ZmU1NmQifQ%3D%3D&bemobdata=c%3Df65a8fd5-383d-47dc-8ed0-59450453dbb5..f%3D14fde457-a775-4548-b5e1-bd449e0afc95..a%3D0..b%3D0..e%3D1541554015.53-153741405-24909..c1%3DXX684..c2%3Dts3089-sms-qantas-revs-au..c4%3Dts3089-sms-qantas-revs-au..c5%3D153741405..c7%3DAU..c8%3DHT-EC..c10%3Dx.newsmouse.club
    Resolving talongo.com (talongo.com)... 104.24.119.246, 104.24.118.246, 2606:4700:30::6818:76f6, ...
    Connecting to talongo.com (talongo.com)|104.24.119.246|:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: unspecified [text/html]
    Saving to: ‘4uf’
    
    4uf                     [ <=>                ]   1.13K  --.-KB/s    in 0s     
    
    2018-11-07 11:56:58 (3.94 MB/s) - ‘4uf’ saved [1154]

    Contents of the file ‘4uf’:

    <head>
    <script type='text/javascript'>
    function forward(){
    window.location.replace('https://talongo.com/in-v8-au-bem-go.php?eps=8mgsTi6ekAuQ70TL7yZEd7dc6BxvuGCISTUX9vp0%2BqX2PSdhDuk4koSXd%2FHX4h9luAH%2BvvaKHmwAE1Je2%2BxWrB4ors1vKP%2F95MZhdgsQDvbSFG66C8%2BQgi27V76YW9qZbrcRJHgb1ywOhR1A2xU%2F5%2FxzYIni7EqFJ7eW0Pbe22TEpCPCIysOhDz8d3u4dUpDIQpCJ%2FSJX%2FmKCQJJ0lbyhgzix%2FpHXzYcRlwx9AaWOmAX1hv1XRYRoce5288Kh9kfjY5THMCexvncqYNGiABXNcrPEPvJtivFrhm956MBGwMQro%2B905SGjRkNfmR42QfnoTVp9SrqHQUm2%2BLnMR9llKivTAVbyVMdi9QLBw18fHrK5IRSRKDsyftDZWCVuCypqxbtTL0lmB3XEquKarGGU28qW%2F36boQu7T2EJg0XEJ9EsG%2FwCqJ2t0GPPljsuv4RFDIqVsiNvrHSZ08m9DWUg4oH4n2%2FTTVcteEXd0BgZkyB3S06Y%2FoIzrEj6CG4%2FhwZkWX7nNoTtZjTSjyqHQx2uSoW6fyzD8g2%2BGWqLJRxRhBVC2qRtPfy8NoCd2LhxwG6%2B2W6PTaPsqJxmWGMsCGfv5%2BowXbez9f%2Bca4f4q6tbNhb2nNvJltUmC%2FFGeaf1JcLPJGT0T12c1dkMYoyAISIxBo%2FFj0NRcqA6o9r0mZEFsPUPTurWW7bYyCtvuuvGzJZN2YEq2fO7IhmMmgITNdz%2FARKd16N3puAGmUXLCWSnb%2BWdESTpcdd6h0eBz6ARPBcH3m9QYYfOZVoyBiXwVQQtOzxCtxVmD1igyChXOR2SU%2B3IybUx0sU6UYdcl7ONYBKgRGUeBJTEPKwuJYSKqrOQM3S%2FVBFgs%2F6CEyRNCDBojM9olfSjn6dYqlNfMYGHSBd');
    }
    </script>
    </head>
    <body onload='setTimeout(forward, 0);'>
    </body>

    Qantas logo