Today I delved into a bit of Whatsapp spam doing the rounds in the UK.
This junk spreads using a Whatsapp message the same or similar to:
“Hey ! Waitrose celebrates its 113th anniversary and giving away FREE gift voucher worth of £250 to everyone ! click here to get yours : http://www.waıtrose.com/voucher Enjoy .”
The domain involved is an “IDN” (International Domain Name).. a domain name that can have more than just a-z and 0-9 as letters. They can have international symbols which look very much like normal alphabet letters.
(when these were launched people voiced their concerns about attacks like this.. and here they are).
In this instance the i in waitrose has been replaced with a different international letter.
The domain name that people are actually visiting (but is hidden behind the IDN system) is www.xn--watrose-sfb.com . The domain is registered via a whois privacy service but there are still some clues as to who is running the spam site.
The website is served from an Amazon AWS host and the DNS infrastructure doesn’t give any clues away.
However the source of the spam site has one unique bit of information: a Google Analytics / Tag Manager code of “UA-96118136-18”. The first part of this code (“UA-96118136”) is used to identify a specific Google Analytics account. The number at the end identifies the website under that account.
This code leads onto several other similar scam domain names!
waitrose-2018.life – Another Waitrose domain.
freedelta.world – (Delta airlines?) Seen using UA-96118136-23
http://www.xn--lid-xbb.com – Which translates to lidǀ.com (another EU supermarket) seen using UA-96118136-6 (“Lidl célèbre son 42 anniversaire et offre gratuit des chèques-cadeaux d’une valeur de €250 chacun!, Je viens de recevoir le mien, cliquez ici pour obtenir le vôtre : http://www.lidǀ.com/Bon Merci plus tard .”)
http://www.xn--ea-gpa2a.com – Which translates to www.ıĸea.com seen using UA-96118136-31
http://www.xn--costc-yob.com – Which translates to www.costcơ.com (International wholesale supermarket) seen using UA-96118136-46
http://www.southwest-pass.com – (Southwest airlines?) Seen using UA-96118136-38
http://www.xn--asa-wqa.com – Which translates to www.asđa.com (a UK supermarket) seen using UA-96118136-20
The website owner is also quite keen to prevent desktop users from seeing the page. There is some basic javascript to forward any screen resolution above 1000 pixels wide to a 404 page.
When you are using a mobile page you are given a series of supposedly survey questions – none of these question responses are stored anywhere or sent anywhere.
It then asks you to share the page with whatsapp friends – Once you’ve done this 15 times it forwards you to another page. (they don’t verify, just click the button 15 times and back out of sending the message! or (like in my case) don’t have Whatsapp installed so it can’t even attempt to send).
var c = 0;
$(document).ready(function() {
$("#b1").on('click', function() {
++c;
if (c > 15) {
$(this).attr({
href: "http://www.xn--watrose-sfb.com/final.html",
target: "_self"
});
}
});
$("#b2").on('click', function() {
if (c > 15) window.location = "http://www.xn--watrose-sfb.com/final.html";
else window.alert("Share it with friends on WHATSAPP on our anniversary promotion!\n\n You must share to proceed " + c);
});
});
http://www.xn--watrose-sfb.com/final.html is a simple single line page that forwards the user to:
http://track.voltrrk.com/d856c087-0ae9-4cd0-ada6-3c4c50f00857
The above is a host with an instant referral (CNAME) to “bxg1w.voluumtrk2.com” – a statistics tracking service.
This tracking service then redirects visitors to
http://offr.rocks/?a=2149&c=10512&s2=zDTEDITEDEDITEDEDITEDC
The above domain / page is probably the last of the “scammy” pages. The visitor is then redirected to what seems to be a “genuine” “Ocean Cloud” survey and competition:
http://milolead.com/page?country=uk&pub=2&cam=174&r=1XX4-1EDITED73&a=2149
After bombarding you with demands for your name, date of birth, postal address and then telephone number it asks you tens of questions. Within a few minutes of filling in the survey it sends at least 5 e-mails and one text message with all sorts of spam. The emails have been for casinos and bitcoin.
The text message read
“Congrats NAMEEDITEDOUT,
You’ve Won a
Free Bitcoin System
Claim it NOW here:
2018deal.com/l/cryptoa8Hp”
Eventually ends by redirecting you back to (I believe) the scammers controlled page.. whilst also sharing the telephone number with them too:
http://offr.rocks/?a=2511&c=8472&msisdn=07EDITED063&s2=XUJEDITED2BT
Who in turn then redirect you to yet another “offer”:
http://app.trk12.com/campaign/bc65e43d235d6b61464e9f8bc0859e45d90e5ac9?transaction_id=X3X9-15EDITED34&aff_id=2511&msisdn=07EDITED063
On this page “A brand of SB7 Mobile Ltd.” the terms and conditions hidden at the bottom note that you are signing up to a £4.50 a week SMS service. The page already has your number filled in (from the previous spam survey you just completed).
I presume the scammers get paid an affiliate fee each time they refer someone and their method to generate leads and referral fees is to trick people into sending spam Whatsapp messages.
Thoroughly scammy.
On a side note.. the service shown in the last screenshot is called “pinchecker.com”.. This company seem to handle the sign up process to the premium rate reverse charge SMS spam.
They seem to handle sign-ups for the following companies (some are all showing the same postal address):
PrizeHook.com – “SPTwo Ltd” / sptwo.com
PrizeAlerts.co.uk, JuicyWin.com, MintedMobi.com – “SB7 Mobile Ltd” / sb7mobile.com aka “Alerts 4 U”
PrizeNut.com, StarMystics.com – “KPMobTech Ltd” / kpmobtech.com
Associated domains on the pinchecker servers include “tiiny.uk”.. a website that leaks customer telephone numbers! Something that they can be fined for heavily once the EU GDPR comes in to effect.
Update: After just over a week of completing the above I then also got a text:
From: +60441
Free msg: Hi , thanks for completing the telephone survey, now text back YES to confirm your number. vivalavoucher.co.uk Help 03447451791
Part of the same organisation? Or someone they sold their list to who now want me to opt in?
Also
From: +447860064308 / 07860064308
We are contacting you as you could be owed up to £2,442 if you were miss-sold PPI. Reply POST to receive your FREE check or STOP to opt-out, H&H
From: DavidShow
Hi
This new system is
The same one like the one
I’m using:
http://tapl.gq/3bwi
About a month later I get the following “reminder” sms which reveals another domain name associated with it:
From +88222
FreeMsg: Reminder: U are a member of Alerts4U.co.uk for £1.50 per alert (max £4.50 per week) until you send STOP to 88222. Help? 03301340181
From +447520660227
We have been trying to contact you re your PPI Claim. We now have details of how much you are due. Reply POST for your pack or END to OptOut
From Maria
Thats the system u ask me about few times:
http://tapz.ml/19nS
Another bit of crap to the honeypot number only given to them:
From +447418340104
If you have had a 3 hour+ delay for a flight in the last 6 years reply YES to claim compensation of up to £520 per person or?reply?STOP to opt-out,?Airfair?
Email on 7th Feb at 11:27pm which mentions bitcoin and “acmvip.com” and “earnwithbitcoin.co”
Followed by an SMS (grr, that late at night!?) at 11:28pm saying:
From Account Dep
Dear ,
Your Bitcoin account has been activated.
Your current balance is: 10,090.18 Pounds.
Claim your Funds Now:
http://www.acmvip.com/f/
With this latest spam I’ve finally got the name of a person! deani.henderson@gmail.com
Who is also associated with 85 other domains, most of which look suspicious:
acrvip.com
actdep.com
australiawinners.com
iebay.org
wealth2017.com
makemoremoneythisyear.org
itsyourluckyday.net
hotpromotionsforyou.net
bigpromotionsforyou.net
singlemommakesmoney.net
makemoremoneythisyear.net
44waystomakemoremoney.net
tradeongold.net
earningmoney2015.net
makemoremoney2015.net
secondaryjobs2015.net
bestworkathomejobs2015.net
itsyourluckyday.info
hotpromotionsforyou.info
bigpromotionsforyou.info
moneyonline2015.info
bestworkathomejobs.info
yourbonusishere.com
hotpromotionsforyou.com
bigpromotionsforyou.com
boredyo.com
concept-local.com
44waystomakemoremoney.com
additionalincomefromhome.com
tradeongold.com
earningmoney2015.com
makemoremoney2015.com
secondaryjobs2015.com
bestworkathomejobs2015.com
itsyourluckyday.biz
workathome2015.net
moneyonline2015.net
theprintingbee.com
beerpillar.info
bigideafunds.info
born-racing.info
cwsby.info
extrawonderful.info
sarigard.info
bakewithpepper.info
beginster.info
radiotracklistings.com
speedf.info
ulopi.com
nanmoya.com
verogon.com
samrazor.com
ibookselearning.com
photo-monstr.info
pandorartbox.com
loveurway.info
idolgifts.info
smoodze.com
cartuningni.com
modelnora.com
glooub.com
stikabox.com
plactec.com
lockclad.com
mmemode.com
sertele.com
anampara.com
belvantes.com
bestfriendrio.com
hellopicpic.com
shavrea.com
roolty.com
nandoknows.com
ftutti.com
fotopyaart.com
sguiglygames.com
mindkolt.com
rareamateurvideos.com
googclips.com
mistressnui.com
azerofashion.com
utubevideosongs.com
stridelovesrockband.com
hartleyhonda.com
komipontaers.com
I’ve also had calls to my honeypot number from
020 8077 8840 – These people have called 7 times!
01792 272252 – 4 calls
01473 371629 – 3 calls.
1st March 2018 – Another SMS with another domain:
SMS from “Mark C”
Hi
I need you to be my beta tester.
Test my system and get it free:
http://lp.Special2018.com
7th March 2018 – Another SMS with another new domain, registered on 5th March:
SMS from “Robert”
Hi
This system change the world
test it and get it free:
http://tapl.ws/1yZS
10th March 2018 – This time a bit of spam that uses www.myoffers.co.uk as the landing page.
SMS from “FreeCompare”
TestersKeepers needs you to review and KEEP an £18K Audi A3 for FREE – apply by 31/03/18
http://www.gvme.uk/WNAb4Wsx/
*T&Cs
Stop? END to 07860020187
12th March 2018 – Another new domain.
SMS from “Danny”
Hi
Dear VIP member:
enjoy my new system:
http://tapy.ws/5Kfs
16th March 2018 – another new domain “tapv.ws”
22nd March 2018 – another new bit of spam, this time using a google URL shortened service.. hah, google have disabled the url! No sign in any of these text messages on unsubscribe procedures! (Pretty sure that is against sms spam rules).
SMS from Amanda
Hi
IM giving you my new free system.
test it and keep th eprofits:
https://goo.gl/LkFhuA
27th March 2018 12:11am:
SMS from Emma
Hi,
Where have you been? this is your final chance to beta test my amazing software…. Try now:
http://coinsbanc.org/
27th March 2018 13:48am:
SMS from Chris
Hi,
here is that new deal we mentioned last week http://www.r5.ms/s/2joeoo/py
Forwards to http://crypto-unlocked.xyz
28th March 2018:
SMS from David W
Hi
The new upgrade is ready you can have it free now:
http://lp.todaykit.com
29th March 2018:
SMS from Support
Hi
Only 2 spots left for this amazing VIP package…. Collect it now http://coinsbanc.org/
and
SMS from +447491163257
We are contacting you as you could be owed up to £2,442 if you were miss-sold PPI. Reply POST to receive your FREE check or STOP to opt-out, Hall & Hanley
30th March 2018:
SMS from Terence
Hi
I’m going to give you 500$
To test my new system:
http://cryptounlockedpro.com
2nd April 2018:
SMS from Account82
Dear , your scheduled payout needs confirmation. Please verify your account – http://bit.do/account82
SMS from Denis
Hi
your upgrade is ready.
you can start use it now to make profits:
http://www.r5.ms/s/2joeoo/sf
3rd April 2018:
SMS from Stevan
Hi Yes thats the same system im using to make profits daily: http://tapz.ws/8Qv6
5th April 2018:
SMS from Steven
, This is your LAST CHANCE!!! Only 1 Seat left… Collect Here: http://tapf.ws/7DSR
6th April 2018:
SMS from Gorge
Hi
it’s your lucky Easter
you win Free system
http://www.r5.ms/s/2joeoo/vn
9th April 2018:
SMS from Nikos
{“name”:”REDACTED”},
This is your LAST CHANCE!!! Only 1 Seat left… Collect Here:
http://tapz.ws/dSSy
11th April 2018:
SMS from Support
Hi
The upgrade for your system is ready.
Its valid for the next 24hr:
http://www.r5.ms/s/2joeoo/10q
Also associated URL: http://vl.ltfr.xyz/
12th April 2018:
SMS from Jasson
Hi
Its your time to change your life.
Extra 1000¿ income :
http://www.r5.ms/s/2pb1if/11f
13th April 2018:
SMS from Support
Hi {“name”:””}
This is the system I told u about.
I’m making over 500$ every day:
http://tapv.ws/hFuy
17th April 2018:
SMS from Emma
Hi
its your lucky day.
you win my new system:
http://www.r5.ms/s/2pb1if/12n
Associated URLS: http://vl.ltfr.xyz/ and http://peralking-tement.com and cryptounlockedpro.xyz
25th April 2018:
SMS from StevanT
Hi <REDACTED>
This is your lucky day
sign here and get free 1000¿
http://voli.cf/24Qo
Associated URLS http://lp.mymore.info/WfiiZ/ , track.myonlinepayday.co and www.thecryptogenisus.com
14th May 2018:
SMS from VIP CLUB
Are you ready to make over $2500 in the next 24 hours! Click here to learn more: bit.ly/crVIPclub | Opt out: end1.me
Associated URL end1.me doesn’t lead anywhere. Hosted on what looks like shared hosting at Amazon and the domain is registered using a privacy service. This is the first message to contain unsubscribe instructions!
