11 ms·

The short tale of an online scam

123 points by stanislavb 5y ago

6f8986c3 5y ago
Scammers really have stepped up their game in recent years. I keep getting spam emails that say "we have your data, click here to see the list..." Of course, the link wants to authorize against my (nonexistent) gmail. Nice try. The people I feel bad for are the elderly: I know two that have been taken in by these things. They really aren't mentally equipped for the complexities of the modern Internet.
- tialaramex 5y ago
  Lots of scams want your bank details. Unlike with SMS 2FA where the phone company never offered their service as a magic universal authenticator, the scammers want your bank account because it's a bank account. To the extent such scams work, we should be pretty unequivocal that it is your bank's fault. Banks are always reluctant to put their hands in their pockets when it comes to meaningful security. Whereas merchants and customers must upgrade to satisfy PCI DSS rules the banks gave themselves an unlimited free pass to just do whatever they wanted under PCI DSS because hey, those upgrades look expensive, we'd rather not bother. My good bank actually has security. I'm fairly confident that I couldn't sleepwalk into giving bad guys access to the funds in that account by whatever means. I have a physical authenticator device to get into their online banking site, for example, so your scam would need to persuade me that I need to go get the authenticator and use that to sign in, all more chances for me to realise it's a scam. But I have two other bank accounts, which both still think passwords are a pretty good level of security in 2021. One of them even lets me sign in using a numeric PIN, presumably they feel they've done enough to protect against brute force and so this is fine.
  - JadeNB 5y ago
    > My good bank actually has security. Would you be willing to make a recommendation?
    - tialaramex 5y ago
      First Direct However I live in the United Kingdom, so this recommendation won't be much use to people who live elsewhere. My recommendation certainly does not stretch to their parent, HSBC, once the Hongkong and Shanghai Banking Corporation which likely does operate other banks where you live.
  - TheFreim 5y ago
    My bank thinks banning right click on their site and disabling default inspect element is security. I'm sure making it annoying for me to copy the routing numbers is really going to help out.
    - aeorgnoieang 5y ago
      That's weird. I'm pretty sure routing numbers (the bank portion) in the U.S. are all public anyways. I've been routinely looking-up my bank's routing number via Google for a while!
      - TheFreim 5y ago
        They are public, it's just that the easiest way to copy it is to go to the banks website.
- fodmap 5y ago
  >Scammers really have stepped up their game Here's an innovative one. I got an sms impersonating my cell phone provider telling me they're going to change my plan. They'd decided which one is the best for me but I have until next month to chose one 'of the new plans' clicking on a bit.ly link. That links points to an Amazon affiliated link, and it's totally unrelated to my provider.
  - daniellarusso 5y ago
    That is pretty decent for an affiliate scam.
    - fodmap 5y ago
      Yeah imagine what a wonderful world we'd have if all that scammer creativity were put to work for a good cause.
mnd999 5y ago
Namecheap. Surprise. They seem to be the preferred DNS provider for this sort of thing.
- yunohn 5y ago
  In what world can a DNS provider verify every single domain purchaser’s intent and activities post-sale? I don’t understand your argument at all…
  - zinekeller 5y ago
    They're surprisingly lax with verification, even on ccTLDs with requires actual verification of details they just rubber-stamp what you've said is your contact details.
    - TheFreim 5y ago
      I've never had real identity verification on various domain sites, including namecheap.
      - zinekeller 5y ago
        Probably because you're only registering domains within lax TLDs. Certain TLDs (like those under .uk, .cn, .jp, or .sg for example) requires more documents in theory - and at least with other domain name providers like Gandi, they asked for my ID and a letter from my company stating that I indeed was authorised to be a representative for that company, plus proof that the company exists (it's easy in the UK because it's already in a public database anyway, so we just send our company number and proof that we're that company), to verify that it is indeed me, authorised by my company, when registering at .uk (and similar arrangements for ccTLDs with similar requirements). Namecheap on the other hand... well, they just trust you, period.
      - yunohn 5y ago
        Even if they were to verify such details, that doesn’t preclude the purchaser from committing fraud or scamming others. There’s no way for a seller (namecheap) to ensure their product (domain) is not associated with misuse, just like any other real world sales.
frusciante19 5y ago
"Always, always look at the url bar". How will that help the non-tech savvy out there?
3np 5y ago
An obvious red flag for me is always an opening message with "I'm interested in X", where "X" is verbatim copied off the title of the ad.
- Loughla 5y ago
  The problem with that (at least in what I've sold online), is that older/elderly people tend to copy and paste into their messages or type it out verbatim. Again, maybe that's specific to woodworking tools and supplies, because those people tend to skew older, but I have legit asked 4 or 5 buyers, this year alone, if they were bots because that is literally their first line.
  - 3np 5y ago
    I wonder if there is any causality here and if so, what the chicken and egg is here... Do old people mimic the scammers who text them or did scammers start mimicking old people?
- alias_neo 5y ago
  My dad would 100% start a transaction like this. For bonus points he might even write the X in ALL CAPS.
- aeorgnoieang 5y ago
  I think I do that, on the off chance that a person might have multiple listings, and my general preference for precision. I probably also figured it'd be easier for them to know what I was referencing if I used the exact same text.
  - handrous 5y ago
    Prominently featuring the exact text of my listing title has, so far, been a 100% perfect match for scams, for craigslist ads. Doesn't quite catch all of them, but the ones that do that have always been attempted scams.
trinovantes 5y ago
Anecdotally, my SMS scammers have gotten so lazy these days and that they are just sending me IP addresses to click Unsurprisingly, the IP addresses all resolve to Russia
julianlam 5y ago
The only odd thing I noticed was around 4000 requests were sent in perhaps a short time. That would indeed tip off the scammer. Might've been better to send in two or three a day, and ramp it up slowly until you get caught.
- egman_ekki 5y ago
  I thought so as well, but if they generated a new url per each victim, storing the referrer could make it trivial to filter out...
  - alias_neo 5y ago
    Also, more simply perhaps, if the OP was using Python, their User-Agent would indicate it, and that too could be filtered out easily. I'd have at least taken the small additional step of using a real User-Agent cloned from their actual browser.
isolli 5y ago
"always look at the url bar" I remember reading about a scam where the URL seemed legit, and the suspicious part was pushed after so much white space that it was no longer visible in the URL bar. I don't remember the details and I'd be curious to know if anyone remembers it. I remember even sophisticated users saying they might have fallen for it.
- deleted 5y ago
  [deleted]
- paulryanrogers 5y ago
  URL bars should condense whitespace or use an obvious graphic rendering.
- xsmasher 5y ago
  I've seen that with an @ symbol. http://www.amazon.com@192.168.0.1/login http://www.amazon.com@192.168.0.1/login
  - appleiigs 5y ago
    Scam works well since it is assisted by HN truncating the link. Then assisted by Apple because when i long press to see URL on iPhone it loads the website preview before i can see if it’s safe to click.
weinzierl 5y ago
> "Also, (2) if you want to protect other people from falling victims to scams like these: tell them to always look at the url bar. Always." This is good advice, as things stand right now, it is in fact the best advice we can give. In absolute terms it is borderline useless advice. Many companies still communicate from and operate from domains other than their well-known main domain. How is anybody supposed to know that windowsupdate.com is a legit Microsoft domain? What about windowsazure.com? How do you know that fbcdn.net belongs to Facebook, but fbabc.com does not. Why isn't gdynamic.com a Google asset like gstatic.com. lufthansa.com, lufthansa.de, lufthansa.at, lufthansa.ch are all legit, why are lufthansa.li and lufthansa.lu not? Sure, you can check WHOIS, but that just shifts the issue one level lower. "[..] always look at the url bar." - Please do, but don't expect it to be enough to be 100% safe. In the world we live in anyone can be phished.
- deleted 5y ago
  [deleted]
- thereddaikon 5y ago
  There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related.
  - JadeNB 5y ago
    > There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related. Suggesting Google might do anything without ad-related motives is probably too generous, but I've always thought that this was an optimisation in the sense that it's built on optimism: when everything's working well, most of what's in the URL bar is irrelevant. So the bar is built towards working well in the best case, at the expense of becoming much less useful in the worse (and probably more common) case.
ChrisMarshallNY 5y ago
It's a fun story. For myself, I tend to avoid pissing off scammers. I just let the relationship wither on the vine. I had a friend that attacked a forum hacker, and the hacker responded by completely destroying a years-old online community. They probably used a bot to register a scammer login, but the attack got their attention. My friend would have been far better served by deleting the login, and fixing the holes in his forum.
- function_seven 5y ago
  This morning at 5:30AM I got a call from a random HVAC service company. "Hi, [function_seven], this is Paul with ACME Heating and Cooling. You're requesting someone look at your system?" I was barely awake, so I stammered, "huh? No I don't think so..." Paul (Helpfully): "You filled a form out requesting this on our site?" "No...?". Then I started to wake up more and realize it was happening again. I must've pissed someone off somewhere a couple years ago, because I'm getting a lot of this. A hater is filling out online forms with my info. Every month I get a random call from a legitimate company responding to what I only assume is an item in their lead-gen pipeline. This morning was no different. The call came from a legit number for the HVAC company. I looked them up and they're highly-rated. But they're in Florida, I'm in California, so the 5:30am call time made sense. Last month it was a therapist referral service in Ohio. They had my name, phone number, and email. Elsewhere I'm constantly getting emails at an old gmail address for various shopping site "newsletters." From all over the world. A Spanish job search site in the UK. A sporting goods site in Colombia. Athletic wear from Ireland. In each case, the sites themselves are legit, but they don't do an email confirmation loop. Should I keep Unsubscribing from these? Is there anything I can do to figure out who is doing this? I used to mess with scammers; I think I might regret that :)
  - BrandoElFollito 5y ago
    You will not be able to know who did this. It is similar to the dumb teen idea of a prank where they would put your phone number in an ad for a cheap pizza delivery service. My wife had a similar problem and she changed her phone number.
geocrasher 5y ago
This seems relevant: https://phishingquiz.withgoogle.com/ https://phishingquiz.withgoogle.com/
everybodyknows 5y ago
>This little script would send him about 5000 different combinations of the above parameters in a completely random fashion. More work, but with potential to waste more of the scammer’s time, would be to fake up requests corrupted in a way that suggests your browser config exposes some subtle bug, say a race condition, in his scripts. Might keep him busy for days …
- zapt02 5y ago
  cardNumber=[object Object] delightfully devilish!
Cthulhu_ 5y ago
I wonder if browser manufacturers and the companies behind them will work with this - "this site looks like x, but the url does not match with our records".
egman_ekki 5y ago
Since most card transactions these days require strong authentication and this is done in Denmark via NemId, which requires second factor (either an app or a key card sent to individual's officially registered address), I wonder what their game plan is. They could use up all your codes and steal the key card from your mailbox, but otherwise I'm not sure... Maybe they wanted victims to pay for 'shipping' the item, but AFAIK NemId asks you to confirm a specific payment amount, so seems it would be quite small amount of money. That being said, I fell for another shipping scam in DK, seems it's quite common these days. Bank cancelled the card and transactions easily, though.
- pineapple128 5y ago
  The phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attacker can be a man-in-the-middle and make the victim authorize a costly transaction (say $100), with the victim seeing a cost of $1. These is an example video here: https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm... Of course, the real transaction can be seen from the bank.
  - flutas 5y ago
    I'm US based, so not sure on the exact details of the payment system. But since the article mentions confirming the bank balance, couldn't that be basically sending a pay request for the entire bank account balance?
arch-ninja 5y ago
> In an attempt to add some confusion to his operation, I decided to create a little script. This little script would send him about 5000 different combinations of the above parameters in a completely random fashion. Fun. I've done this with college scammers requesting email + passwords, loads of fun. Would highly recommend as it turns an O(1) operation (db full of valid stolen credentials) back into O(n) (randomly guess which credentials you stole are valid).
- Jolter 5y ago
  You’re assuming they don’t store a time stamp with the DB entries. It would be fairly trivial to filter out the 5000 fake entries that all arrived within a minute of each other.
slugiscool99 5y ago
What's going on with .icu domains? Any idea on why they've been so prone to spam?
- willstrafach 5y ago
  .icu, .club, and a few other gTLDs can often be found for sale at $1-2/year, so they are used by entities in need of low cost disposable domains.
  - nemexis 5y ago
    yeah but this guy was already counting 80000+ domains, that is at least the same amount of money, or is there some deal if you buy a large number of domains?
axiosgunnar 5y ago
Hold on! If I wanted to sell some furniture and somebody wanted to use a mover service, that somebody would be paying for it, right? Why did OP ever proceed with a form that wanted HIS payment details?
- jimmaswell 5y ago
  I assumed he knew it was a scam already and put in fake info
bob1029 5y ago
I just had an app idea. I am super busy right now, but maybe someone can run with it - You could build a website verification service+app. Produce a mobile app which uses the camera to scan QR codes, or even watermarked/"invisible" elements placed in reasonable locations on the user interface. Release an API/SDK which allows for any network participant to quickly wire up a security verification front on their webapp (this would be a bit of js). App and API obviously both talk to your back-end, wherein the network participants have submitted substantial business/entity verification documentation prior to being added to the network. The service is pretty damn simple - just cryptographic signatures that rotate every few seconds or something. Keep track of last ~100 to account for clock drift. No need to make it hard. Provide application as free service to users. Monetization possible via a few routes. Ads on the user app itself, B2B contracts with network participants, etc. Use case A: Get to final payment screen on https://www.bhphotovideo.com https://www.bhphotovideo.com. User wants to be 200% sure they are not about to bank wire five figures to Putin due to some UTF8 technicalities. User takes their iPhone out, taps "my magic verification app", points at payment screen, app dings with big green check mark, post verification ad experience, et. al.
nephanth 5y ago
Spamming them with fake info, is already a good idea, but that kind of spam is alsoa good occasion to check whether scammers know how to sanitize their database inputs

123 points by stanislavb 5y ago

Scammers really have stepped up their game in recent years. I keep getting spam emails that say "we have your data, click here to see the list..." Of course, the link wants to authorize against my (nonexistent) gmail. Nice try. The people I feel bad for are the elderly: I know two that have been taken in by these things. They really aren't mentally equipped for the complexities of the modern Internet.

tialaramex 5y ago
Lots of scams want your bank details. Unlike with SMS 2FA where the phone company never offered their service as a magic universal authenticator, the scammers want your bank account because it's a bank account. To the extent such scams work, we should be pretty unequivocal that it is your bank's fault. Banks are always reluctant to put their hands in their pockets when it comes to meaningful security. Whereas merchants and customers must upgrade to satisfy PCI DSS rules the banks gave themselves an unlimited free pass to just do whatever they wanted under PCI DSS because hey, those upgrades look expensive, we'd rather not bother. My good bank actually has security. I'm fairly confident that I couldn't sleepwalk into giving bad guys access to the funds in that account by whatever means. I have a physical authenticator device to get into their online banking site, for example, so your scam would need to persuade me that I need to go get the authenticator and use that to sign in, all more chances for me to realise it's a scam. But I have two other bank accounts, which both still think passwords are a pretty good level of security in 2021. One of them even lets me sign in using a numeric PIN, presumably they feel they've done enough to protect against brute force and so this is fine.
- JadeNB 5y ago
  > My good bank actually has security. Would you be willing to make a recommendation?
  - tialaramex 5y ago
    First Direct However I live in the United Kingdom, so this recommendation won't be much use to people who live elsewhere. My recommendation certainly does not stretch to their parent, HSBC, once the Hongkong and Shanghai Banking Corporation which likely does operate other banks where you live.
- TheFreim 5y ago
  My bank thinks banning right click on their site and disabling default inspect element is security. I'm sure making it annoying for me to copy the routing numbers is really going to help out.
  - aeorgnoieang 5y ago
    That's weird. I'm pretty sure routing numbers (the bank portion) in the U.S. are all public anyways. I've been routinely looking-up my bank's routing number via Google for a while!
    - TheFreim 5y ago
      They are public, it's just that the easiest way to copy it is to go to the banks website.
fodmap 5y ago
>Scammers really have stepped up their game Here's an innovative one. I got an sms impersonating my cell phone provider telling me they're going to change my plan. They'd decided which one is the best for me but I have until next month to chose one 'of the new plans' clicking on a bit.ly link. That links points to an Amazon affiliated link, and it's totally unrelated to my provider.
- daniellarusso 5y ago
  That is pretty decent for an affiliate scam.
  - fodmap 5y ago
    Yeah imagine what a wonderful world we'd have if all that scammer creativity were put to work for a good cause.

mnd999 5y ago

Namecheap. Surprise. They seem to be the preferred DNS provider for this sort of thing.

yunohn 5y ago
In what world can a DNS provider verify every single domain purchaser’s intent and activities post-sale? I don’t understand your argument at all…
- zinekeller 5y ago
  They're surprisingly lax with verification, even on ccTLDs with requires actual verification of details they just rubber-stamp what you've said is your contact details.
  - TheFreim 5y ago
    I've never had real identity verification on various domain sites, including namecheap.
    - zinekeller 5y ago
      Probably because you're only registering domains within lax TLDs. Certain TLDs (like those under .uk, .cn, .jp, or .sg for example) requires more documents in theory - and at least with other domain name providers like Gandi, they asked for my ID and a letter from my company stating that I indeed was authorised to be a representative for that company, plus proof that the company exists (it's easy in the UK because it's already in a public database anyway, so we just send our company number and proof that we're that company), to verify that it is indeed me, authorised by my company, when registering at .uk (and similar arrangements for ccTLDs with similar requirements). Namecheap on the other hand... well, they just trust you, period.
    - yunohn 5y ago
      Even if they were to verify such details, that doesn’t preclude the purchaser from committing fraud or scamming others. There’s no way for a seller (namecheap) to ensure their product (domain) is not associated with misuse, just like any other real world sales.

frusciante19 5y ago

"Always, always look at the url bar". How will that help the non-tech savvy out there?

3np 5y ago

An obvious red flag for me is always an opening message with "I'm interested in X", where "X" is verbatim copied off the title of the ad.

Loughla 5y ago
The problem with that (at least in what I've sold online), is that older/elderly people tend to copy and paste into their messages or type it out verbatim. Again, maybe that's specific to woodworking tools and supplies, because those people tend to skew older, but I have legit asked 4 or 5 buyers, this year alone, if they were bots because that is literally their first line.
- 3np 5y ago
  I wonder if there is any causality here and if so, what the chicken and egg is here... Do old people mimic the scammers who text them or did scammers start mimicking old people?
alias_neo 5y ago
My dad would 100% start a transaction like this. For bonus points he might even write the X in ALL CAPS.
aeorgnoieang 5y ago
I think I do that, on the off chance that a person might have multiple listings, and my general preference for precision. I probably also figured it'd be easier for them to know what I was referencing if I used the exact same text.
- handrous 5y ago
  Prominently featuring the exact text of my listing title has, so far, been a 100% perfect match for scams, for craigslist ads. Doesn't quite catch all of them, but the ones that do that have always been attempted scams.

trinovantes 5y ago

Anecdotally, my SMS scammers have gotten so lazy these days and that they are just sending me IP addresses to click Unsurprisingly, the IP addresses all resolve to Russia

julianlam 5y ago

The only odd thing I noticed was around 4000 requests were sent in perhaps a short time. That would indeed tip off the scammer. Might've been better to send in two or three a day, and ramp it up slowly until you get caught.

egman_ekki 5y ago
I thought so as well, but if they generated a new url per each victim, storing the referrer could make it trivial to filter out...
- alias_neo 5y ago
  Also, more simply perhaps, if the OP was using Python, their User-Agent would indicate it, and that too could be filtered out easily. I'd have at least taken the small additional step of using a real User-Agent cloned from their actual browser.

isolli 5y ago

"always look at the url bar" I remember reading about a scam where the URL seemed legit, and the suspicious part was pushed after so much white space that it was no longer visible in the URL bar. I don't remember the details and I'd be curious to know if anyone remembers it. I remember even sophisticated users saying they might have fallen for it.

deleted 5y ago
[deleted]
paulryanrogers 5y ago
URL bars should condense whitespace or use an obvious graphic rendering.
xsmasher 5y ago
I've seen that with an @ symbol. http://www.amazon.com@192.168.0.1/login http://www.amazon.com@192.168.0.1/login
- appleiigs 5y ago
  Scam works well since it is assisted by HN truncating the link. Then assisted by Apple because when i long press to see URL on iPhone it loads the website preview before i can see if it’s safe to click.

weinzierl 5y ago

> "Also, (2) if you want to protect other people from falling victims to scams like these: tell them to always look at the url bar. Always." This is good advice, as things stand right now, it is in fact the best advice we can give. In absolute terms it is borderline useless advice. Many companies still communicate from and operate from domains other than their well-known main domain. How is anybody supposed to know that windowsupdate.com is a legit Microsoft domain? What about windowsazure.com? How do you know that fbcdn.net belongs to Facebook, but fbabc.com does not. Why isn't gdynamic.com a Google asset like gstatic.com. lufthansa.com, lufthansa.de, lufthansa.at, lufthansa.ch are all legit, why are lufthansa.li and lufthansa.lu not? Sure, you can check WHOIS, but that just shifts the issue one level lower. "[..] always look at the url bar." - Please do, but don't expect it to be enough to be 100% safe. In the world we live in anyone can be phished.

deleted 5y ago
[deleted]
thereddaikon 5y ago
There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related.
- JadeNB 5y ago
  > There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related. Suggesting Google might do anything without ad-related motives is probably too generous, but I've always thought that this was an optimisation in the sense that it's built on optimism: when everything's working well, most of what's in the URL bar is irrelevant. So the bar is built towards working well in the best case, at the expense of becoming much less useful in the worse (and probably more common) case.

ChrisMarshallNY 5y ago

It's a fun story. For myself, I tend to avoid pissing off scammers. I just let the relationship wither on the vine. I had a friend that attacked a forum hacker, and the hacker responded by completely destroying a years-old online community. They probably used a bot to register a scammer login, but the attack got their attention. My friend would have been far better served by deleting the login, and fixing the holes in his forum.

function_seven 5y ago
This morning at 5:30AM I got a call from a random HVAC service company. "Hi, [function_seven], this is Paul with ACME Heating and Cooling. You're requesting someone look at your system?" I was barely awake, so I stammered, "huh? No I don't think so..." Paul (Helpfully): "You filled a form out requesting this on our site?" "No...?". Then I started to wake up more and realize it was happening again. I must've pissed someone off somewhere a couple years ago, because I'm getting a lot of this. A hater is filling out online forms with my info. Every month I get a random call from a legitimate company responding to what I only assume is an item in their lead-gen pipeline. This morning was no different. The call came from a legit number for the HVAC company. I looked them up and they're highly-rated. But they're in Florida, I'm in California, so the 5:30am call time made sense. Last month it was a therapist referral service in Ohio. They had my name, phone number, and email. Elsewhere I'm constantly getting emails at an old gmail address for various shopping site "newsletters." From all over the world. A Spanish job search site in the UK. A sporting goods site in Colombia. Athletic wear from Ireland. In each case, the sites themselves are legit, but they don't do an email confirmation loop. Should I keep Unsubscribing from these? Is there anything I can do to figure out who is doing this? I used to mess with scammers; I think I might regret that :)
- BrandoElFollito 5y ago
  You will not be able to know who did this. It is similar to the dumb teen idea of a prank where they would put your phone number in an ad for a cheap pizza delivery service. My wife had a similar problem and she changed her phone number.

geocrasher 5y ago

This seems relevant: https://phishingquiz.withgoogle.com/ https://phishingquiz.withgoogle.com/

everybodyknows 5y ago

>This little script would send him about 5000 different combinations of the above parameters in a completely random fashion. More work, but with potential to waste more of the scammer’s time, would be to fake up requests corrupted in a way that suggests your browser config exposes some subtle bug, say a race condition, in his scripts. Might keep him busy for days …

zapt02 5y ago
cardNumber=[object Object] delightfully devilish!

Cthulhu_ 5y ago

I wonder if browser manufacturers and the companies behind them will work with this - "this site looks like x, but the url does not match with our records".

egman_ekki 5y ago

Since most card transactions these days require strong authentication and this is done in Denmark via NemId, which requires second factor (either an app or a key card sent to individual's officially registered address), I wonder what their game plan is. They could use up all your codes and steal the key card from your mailbox, but otherwise I'm not sure... Maybe they wanted victims to pay for 'shipping' the item, but AFAIK NemId asks you to confirm a specific payment amount, so seems it would be quite small amount of money. That being said, I fell for another shipping scam in DK, seems it's quite common these days. Bank cancelled the card and transactions easily, though.

pineapple128 5y ago
The phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attacker can be a man-in-the-middle and make the victim authorize a costly transaction (say $100), with the victim seeing a cost of $1. These is an example video here: https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm... Of course, the real transaction can be seen from the bank.
- flutas 5y ago
  I'm US based, so not sure on the exact details of the payment system. But since the article mentions confirming the bank balance, couldn't that be basically sending a pay request for the entire bank account balance?

arch-ninja 5y ago

> In an attempt to add some confusion to his operation, I decided to create a little script. This little script would send him about 5000 different combinations of the above parameters in a completely random fashion. Fun. I've done this with college scammers requesting email + passwords, loads of fun. Would highly recommend as it turns an O(1) operation (db full of valid stolen credentials) back into O(n) (randomly guess which credentials you stole are valid).

Jolter 5y ago
You’re assuming they don’t store a time stamp with the DB entries. It would be fairly trivial to filter out the 5000 fake entries that all arrived within a minute of each other.

slugiscool99 5y ago

What's going on with .icu domains? Any idea on why they've been so prone to spam?

willstrafach 5y ago
.icu, .club, and a few other gTLDs can often be found for sale at $1-2/year, so they are used by entities in need of low cost disposable domains.
- nemexis 5y ago
  yeah but this guy was already counting 80000+ domains, that is at least the same amount of money, or is there some deal if you buy a large number of domains?

axiosgunnar 5y ago

Hold on! If I wanted to sell some furniture and somebody wanted to use a mover service, that somebody would be paying for it, right? Why did OP ever proceed with a form that wanted HIS payment details?

jimmaswell 5y ago
I assumed he knew it was a scam already and put in fake info

bob1029 5y ago

I just had an app idea. I am super busy right now, but maybe someone can run with it - You could build a website verification service+app. Produce a mobile app which uses the camera to scan QR codes, or even watermarked/"invisible" elements placed in reasonable locations on the user interface. Release an API/SDK which allows for any network participant to quickly wire up a security verification front on their webapp (this would be a bit of js). App and API obviously both talk to your back-end, wherein the network participants have submitted substantial business/entity verification documentation prior to being added to the network. The service is pretty damn simple - just cryptographic signatures that rotate every few seconds or something. Keep track of last ~100 to account for clock drift. No need to make it hard. Provide application as free service to users. Monetization possible via a few routes. Ads on the user app itself, B2B contracts with network participants, etc. Use case A: Get to final payment screen on https://www.bhphotovideo.com https://www.bhphotovideo.com. User wants to be 200% sure they are not about to bank wire five figures to Putin due to some UTF8 technicalities. User takes their iPhone out, taps "my magic verification app", points at payment screen, app dings with big green check mark, post verification ad experience, et. al.

nephanth 5y ago

Spamming them with fake info, is already a good idea, but that kind of spam is alsoa good occasion to check whether scammers know how to sanitize their database inputs