Godaddy #PhishMustFall

 Update 2016-03-08

This phish is eventually down. Thanks to all. However a phish that stayed active for 15 days is a red flag that something is amiss with abuse handling procedures. Hopefully this will be a cause for some introspection at Godaddy


The dog has decided to join a must-fall cause and is asking you to support the cause, but with a twist.

You are being asked to report a phish to Godaddy via their form.

Why?

The industry average for a phish take-down is currently something between 48 to 72 hours, that's two to three days.

Of late South Africans have been subjected to ongoing phishing attacks. Many of you have probably seen a notice from some South African bank in your email you probably do not even deal with. The security community has been silently fighting these, reporting them, ensuring a cleanup is done.

However we have hit a snag - Godaddy!

Despite the industry average, Godaddy takes an unacceptable extraordinary long time to actually take down phishing sites.

The nkoliza.com example:

Domain nkoliza.com was registered 5 Feb 2016 and from day zero it was used for phishing. The domain was registered with invalid registration details. Further it was hosted at Godaddy as well. Godaddy was alerted to this abuse on the 5th of Feb as well. This phishing domain was only terminated on the 12th.
Refer:
http://www.phishtank.com/phish_detail.php?phish_id=3811754 
http://www.phishtank.com/phish_detail.php?phish_id=3813729

A week to take down a phishing website is simply not acceptable.  In this time the phisher is spamming users and defrauding victims. This might be your father, mother, aunt, son or whoever receiving this phishing link that may inadvertently believe it, then be phished. It's ScamPup's contention that nobody deserves to be defrauded.

http://crafi.com.mx phishing - up for 14 days so far

If you believe that a week response time for a phish take down is bad, it gets worse - and why your help is needed.

The website at http://crafi.com.mx is currently hosting a phishing website. Once again this website is hosted at Godaddy. To make matters worse, this website has been reported on the 22nd of Feb 2016 already!

Thus far the South African cyber community has been polite with abuse issues and Godaddy. Godaddy's response is that it will be attended to in due course. However it's been 14 days today that this phish has been up. This is simply not acceptable. If Godaddy feels so little for internet users as to expose them to this risk and abuse, we should let them know it's not acceptable.

The actual website appears to be a hacked Wordpress site belonging to a clinic in Mexico, apparently still under development.

The phish is at: hxxp://crafi.com.mx/copyfnb-nopey2016/copyfnb-fred/mainmenu2016/continue1.php
Refer: http://www.phishtank.com/phish_detail.php?phish_id=3850136

Forcing issues a bit reveals the badness:

You are requested to report this phish at https://supportcenter.godaddy.com/AbuseReport by clicking on the Phishing link, then selecting I wish to report a website that is posing as another website and supplying the details for the phishing page.

Let's send a message to Godaddy: we do not wish to be the targets of phishing, they should be more responsive to phishing incidents and we object to this situation having developed in the first place.

Thank you for your support.

#PhishMustFall

CAPONE DISC: community service anti-fraud alert

Have you come here after searching for a CAPONE DISC?

Well, it does not exist. It's a scam!

Somebody is trying to defraud you!

This is what you're going to be offered:

But wait, note the part number 2 608 602 619? Note the vivid brown? Note the smudge mark on the grey inner left label? 

The image has been altered! In reality this is a Bosch disc!

This is a standard item in the Bosch product range, not some rare hard to find expensive item.

By using a unique name for a product, the party that contacted you is trying to defraud you.

Known Scam used details:

Capone Trading PTY LTD.

52 Eastman Road, Capetown, 7405

Telephone: (021) 801 2413
FAX: (086) 558 9559
E-mail: sales@caponetrading.com

caponetrading.com

Now go read up on supplies scams in an earlier post.

And remember - CAPONE DISC does not exist!

This is a community service anti-fraud alert.

TRUCHEN PO-10 MOTOR PUMPS: community service anti-fraud alert

Have you come here after searching for TRUCHEN PO-10 MOTOR PUMPS?

Well, it does not exist. It's a scam!

Somebody is trying to defraud you!

This is what you're going to be offered:

But wait, note the oddly angled p0-10? The image has been altered! In reality this is a LUKAS hydraulic pump.

http://industrial.lukas.com/Products/Pumps/Hydraulic+power+units+PO+6.html

By using a unique name for a product, the party that contacted you is trying to defraud you and is the same party as the fictitious newclimatictrading.co.za (which does not exist either).

Now go read up on supplies scams in an earlier post. 

And remember - TRUCHEN PO-10 MOTOR PUMP does not exist!

This is a community service anti-fraud alert.

GORITAS DISCS: community service anti-fraud alert

Have you come here after searching for GORITAS DISCS?

Well, it does not exist. It's a scam!

Somebody is trying to defraud you!

 

This is what you're going to be offered:

But wait, note the smudging marks around the name "GORITA DISC"? The image has been altered! In reality this is a cutting disc from China called WINONE..

 

By using a unique name for a product, the party that contacted you is trying to defraud you and is the same party as the fictitious newclimatictrading.co.za (which does not exist either).

Now go read up on supplies scams in an earlier post. 

And remember - GORITA DISC disc does not exist!

This is a community service anti-fraud alert.

Scammer impunity

In the previous first post, we looked at what mining supplies scams are. Since then the author has been reporting spans of similar scams for account termination.

But the impunity with with scammers operate in South Africa, could not have been more clearly illustrated than the uncovering of kpvengineeringgroup.com.

This website redirects to http://randwater.co.za/Pages/Home.aspx, the legitimate Rand Water:

--- reading URL kpvengineeringgroup.com
--- contacting host kpvengineeringgroup.com [66.117.4.161] on port 80

HTTP/1.1 301 Moved Permanently
Date: Wed, 03 Feb 2016 21:41:05 GMT
Server: Apache
Location: http://randwater.co.za/Pages/Home.aspx
Content-Length: 246
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://randwater.co.za/Pages/Home.aspx">here</a>.</p>
</body></html>

--- connection closed

What this means, is that any visitor that tries to visit http://kpvengineeringgroup.com ends up at Rand Water's website.

How ironic that Rand Water's homepage warns us of a supplies scam:

So what's going on here? Surely no scammer would redirect to a warning of a scam?

Exactly. Since we are thinking this, we are heading down the wrong rabbit hole. It's not uncommon to receive phishing emails with warnings to not click on links to your bank account. The same principle applies here.

A quick look at the other activities of kpvengineeringgroup.com shows they are merrily selling non-existent cutting blades. We find this telling advertisement on Gumtree:

Also another on Locanto:

 and even more

Digging a bit deeper, we find only the index page is redirected to Rand Water. The actual scam website is intact and can be seen at http://www.kpvengineeringgroup.com/product.html, the scam website.

At this stage the more enthusiastic DIY'ers might say, but that's a Bosch blade! Correct. Here is how the unedited version of the product looks:

Once again a standard easily available product has been taken, the image edited to reflect the unique product names of Px Ovian and Pringer Zt that can only be found at kpvengineeringgroup.com. The trap is set for the unwary supplier.

On a side note, to just illustrate how widely this scam has propagated; while researching some details, I happened to come across this:

No surprise that research shows that kpvengineeringgroup.com previously used fax no 0866011464 and is also associated with MANDLA METAL ENGINEERS  (mandlametalengineers.co.za).

This leads to this Google+ profile, where the scammer is marketing "COLBAN-Q 275mm cutting discs", in reality Dronco cutting disks.

Buyer beware!

Supplies Scams targeting South African Business

The internet is a wonderful place to find hidden things for the internet sleuth. Hindsight is also perfect, once you know what you're looking for.

Enter the mining supplies scam.

This investigation started with a post on http://www.reportacrime.co.za/ where a supplier reported being defrauded. The content of the post explains how the supplier was contacted by a Zimbabwean mine in an attempt at sourcing Penrod and Selik cutting disks. The supplier checked to see if he could source these disks from another supplier. He found such a source on the internet. The final installment of this fraud was the supplier paying for he disks and losing the R30,000.

The loss in this case is relatively small. Businesses have reported losing hundreds of thousands of rands in these scams.

 

So what is the mining supplies scam and how does it work?

A scammer sets up two web sites on different websites.

On is the fictitious company seeking the supplies, a mine. Typically the content on the website is stolen from other sources. Images are stolen from real mines and published as of belonging to that mine. Wording content is stolen from the profiles of other mines. This website is now published.

A second website is configured. This shows a supplier selling certain types of tools and hardware. However here is the con; certain images are taken, perhaps altered, given a different name and unique description. The fictitious supplier may also seed the classifieds pages and other online trading pages with these fictitious items, leading back to the fraudulent website.The trap is set.

The fictitious mine now contacts the target victim business. It's seeking a certain item. The mine is very specific in it's description of what the item should be and it can't be an equivalent.

The supplier, hoping for business, now sees if he can source the item. Indeed, he finds one supplier advertising the item, in no small part assisted by the uniqueness of the item's description. He gets pricing etc and sends a quote to the fictitious mine.

The mine naturally accepts the quote. Here comes the con. The supplier can supply, but upfront payment is required for this item. However this plays out, the business can either walk away from business, or pay the fees upfront. Real South African bank are presented into which payment must be done.  Once the payment has been done, the scammers are quick to break off all contact. All attempts to recover the fund are invariably futile and ends up as another cyber fraud case at some police station.

Analyzing the http://www.reportacrime.co.za/ complaint

Here we see the fictitious mine was PANASTELLA.COM. The domain registration should raise some suspicions.

Domain Name: PANASTELLA.COM
Registry Domain ID: 1913341319_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2015-03-25T13:59:24.00Z
Creation Date: 2015-03-25T20:59:00.00Z
Registrar Registration Expiration Date: 2016-03-25T20:59:00.00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: DENNIS GOCHE
Registrant Organization:
Registrant Street: 28 MANDELA AVE
Registrant City: PRETOREA
Registrant State/Province: GAUTENG
Registrant Postal Code: 0027
Registrant Country: ZA
Registrant Phone: +27.787590661
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: GOCHEDENNIS@GMAIL.COM

The registrant claims to be in Pretorea. Of course the correct spelling is Pretoria. Postal code 0027 is for the Groenkloof area in Pretoria. While there is no Mandela Ave in Groenkloof, there is a Nelson Mandela Drive in Groenkloof. But 28 Nelson Mandela Drive, Pretoria 0027 simply does not exist. Nelson Mandela Drive is a distance of road between Fountains Circle to Monument Park in Pretoria. It's a dual lane main road with no business entrances for obvious reasons.

So obviously we can say this address is as bogus as the mine represented it hosts. The registrant name and email address will be looked at later. But let's review the website hosted on this domain.

Using various tools at out disposal, we quickly uncover a can of worms (more about this later as well). But of note the content has been plagiarized from all over.

The above has been plagiarized from http://integrated-report.com/drdgold/2012/our-business/our-strategy.

More to the point, the main website design has been stolen from Namakwa Diamonds.

This most certainly explains why  Panastella has a diamond as a logo while it claims to be a gold mine. (Namakwa Diamonds have been made aware of this and related issues but did not respond)

 Let us look at the fictitious supplier. The domain name ACCURATESUPPLIES.CO.ZA is used.

    Domain Name:
        accuratesupplies.co.za

    Registrant:
        Dennis Goche
       
        Email: gochedennis@gmail.com
        Tel: +27.0787950661
        Fax: None

    Registrant's Address:
        67 Jan Smat Av e
        Johannesburg
        gauteng
        ZA
        2198

The attentive reader will immediately spot that the registrant name Dennis Goche and associated email address gochedennis@gmail.com appears again linked to this domain registration as in PANASTELLA.COM. But the address is totally different.

Obviously Jan Smat Ave does not exist, it should be Jan Smuts Ave. Our first problem with this address should be that Postal Code 2198 is the Houghton/Berea area in Johannesburg at it's nearest point to Jan Smuts Ave. But the problem is that Jan Smuts Ave never has a postal code of 2198 as it does not go into these areas.It does nto take much searching to see that The Four Seasons Hotel The Westcliff is located at 67 Jan Smuts Ave.

Looking at the actual website of hosted at http://www.accuratesupplies.co.za,  a good place to always start avoiding the eye candy is the company profile:

A nice pretty website looking well designed. But it quickly crumbled once we looked past the aesthetic virtues. The company profile has been plagiarized from http://www.sinodrills.com/About-Us_d1. The following text was taken and the real company name was replaced with the fictitious company name.

Obviously we'd need to ask why a company would need to plagiarize it's identity? But we already know the answer; to defraud.

In this scam the bait is Penrod diamond disk and  Selik Disk. Searching for Penrod diamond shows it to be unique in the supplies context and only available on http://www.accuratesupplies.co.za. The same with Selik Disk. So this is the bait and anybody actually seeking this product in good faith, will be led to http://www.accuratesupplies.co.za.

 

How wide is the problem?

Very wide.  Let's examine our fake mining website. We find similar clones:

http://www.chimanimanidiamonds.com/ 
 http://www.dalnymine.com/ 

http://www.madziwamine.com/  
http://www.makutigold.com/ 

http://www.mazowe.com

But let's not get caught up on one scam template. There are others:

http://jessiemine.com/

Looking at suppliers, we find similar patterns with unique baits, best described via this image search. Consider this image commonly used on scam supplier websites:

 

Scam variations

As always, don't get caught up on the details of the scam as described. Scams differ each time.

A common variation on the above scam play, is to impersonate a legitimate government department. Parties received forged requests for an item, much like described. A search shows this to only be available at one specific company, the scam website.

What can be done?

• This scam needs to be exposed regularly, creating awareness in the business community. South Africans have short memories.
• Businesses should properly research any requests and suppliers. 
• When fraudulent supply attempts are detected, they should immediately be reported. Report to the South African Police Services. 
• Report to anti-abuse websites. One such is http://www.aa419.org/. These folks also investigate scams 
• Before paying any monies to a bank account via EFT, ensure the account holder name matches up with the details you have received. Banks do not verify names when doing EFTs and this loophole is commonly abused.

More references:

http://www.theforumsa.co.za/forums/showthread.php/15731-Mining-Equipment-Supplies-Scam
http://scambuster.co.za/scams/mining-supplies-scam.html
http://www.reportacrime.co.za/CrimeReport.aspx?ID=6832
http://www.iol.co.za/business/companies/wise-up-to-new-fraud-fashions-1546404
http://ewn.co.za/2015/03/07/New-scam-targets-Water-Sanitation-Dept

http://mybroadband.co.za/vb/showthread.php/554187-Scam-Magic-Cellphone-number
(Scammer sets up forwarding ... incorrectly.)