News items for tag spam - Koos van den Hout

2022-06-23 It seems someone doesn't like it I write about bitcoin extortion scams
Cybercriminal Today I'm seeing bounces of bitcoin scam mail, with about the same text as in the bitcoin extortion scam of about a week ago, but with a different bitcoin wallet.

In the body of the mail the claim is that the criminal hacked the mailbox of the victim and can now send as the victim, but this criminal decided to 'get even' with me at the same time and contradict himself by setting the sender address to my e-mail address.

So I'm now browsing the bounces and see the bitcoin wallet for this scam is 1Mjt2xobFExdZBGfjTVDcgzJWQxRxoHBdA which hasn't scammed anyone yet.

As always: don't fall for these scams.

Earlier items about bitcoin extortion scams: Earlier, earlier, earlier, earlier, earlier, earlier, earlier, earlier, earlier (although I think bitcoin is generally a really bad idea and a huge scam)
Read the rest of It seems someone doesn't like it I write about bitcoin extortion scams

Tags: , ,
2022-06-16 Time for some more bitcoin extortion spam
Cybercriminal I hadn't seen these in my inbox in English for a while, but here we go again.
Hi! You can consider this message as the last warning. We've hacked your
system!
This information can destroy your reputation once and for all in a matter in
minutes. You have the opportunity to prevent irreversible consequences. To do
so you need to:

Transfer 1200 USD (US dollars) to our Bitcoin wallet.
Don't know how to make a transfer? Enter "Buy Bitcoin" into the search box.

Our Bitcoin wallet (BTC Wallet): bc1q4r05c7wdazh87ty9x9968e2r90w72rhtq5jl43

After you make the payment, your video and audio recordings will be
completely destroyed and you can be 100% sure that we won't bother you
again. You have time to think about it and make the transfer - 50 hours!
As always: don't fall for these scams.

Earlier items about bitcoin extortion scams: Earlier, earlier, earlier, earlier, earlier, earlier, earlier, earlier (although I think bitcoin is generally a really bad idea and a huge scam)

Tags: , ,
2022-06-12 And the really annoying block at Microsoft is back
After receiving another mail in the mail exchange that made me note Microsoft outlook.com wasn't blocking my mailserver anymore we're back right in the same spot:
   ----- Transcript of session follows -----
... while talking to outlook-com.olc.protection.outlook.com.:
>>> MAIL From:<***** .at. idefix.net> SIZE=2035 BODY=7BIT
<<< 550 5.7.1 Unfortunately, messages from [45.83.232.134] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [BN8NAM11FT026.eop-nam11.prod.protection.outlook.com]
554 5.0.0 Service unavailable
Aaargh. I thought it wasn't broken anymore. Utterly unreliable stuff at Microsoft.

And I'm back to having to use SMS to explain to very non-technical people why their mail isn't getting through: because they are using outlook.com.

Update 2022-06-13
As a workaround I am now using SMTP2GO to send mail to outlook.com and hotmail.com. SMTP2GO does interesting things (even in a free account) to get the mail delivered and keep their mail 'reputation' in the plus. I hate having to use such a service to get my mail delivered but this is one of those signs that Internet e-mail has been demolished by spammers.

Tags: , ,
2022-06-06 It seems Microsoft doesn't block my mailserver anymore
Recently I tried to contact someone with an outlook.com address and it went fine. So it seems the really annoying block I ran into earlier is gone. I still get enough spam from/via outlook.com so I'm still not convinced the spamfiltering at outlook is working very well but that's a different rant. The incoming block is now gone.

Tags: , ,
2022-03-26 SPF/DKIM/DMARC and mailing lists
One of the founding forms of information exchange and community building on the Internet is the mailing list. A subscriber sends mail to a central mail address and the mail gets redistributed to all members.

As this mechanism has been abused by spammers in lots of ways there has been a lot of work in stopping unwanted mail being distributed by mailing lists.

There has also been a lot of work in publishing the official way in which outgoing mail from organizations is handled: Sender Policy Framework (SPF), documenting the sources from which e-mail can be send, DomainKeys Identified Mail (DKIM) for signing outgoing mail headers and body and Domain-based Message Authentication, Reporting and Conformance (DMARC) for publishing the policies for mails that fail SPF/DKIM and reporting on those. The way mailing lists forward mail isn't really compatible with SPF and DKIM. There is a 'new' source of mail from the original sender and some headers are changed/added when forwarding it with mailing list software.

Yesterday I sent something to a mailing list from an idefix.net address and this morning I see a number of dmarc reports with failures, because the mailing list server isn't authorised to send on behalf of idefix.net. So maybe some people on this mailing list haven't received my reply. In the long run lots of SPF errors from this IP could also hurt its 'reputation score' for outgoing e-mail. Some mailing lists 'fix' this by not allowing domains with strict spf/dmarc policies, others go through interesting adjustments with 'sent on behalf of'.

I have no simple solution for this, I see an example of security measures breaking an existing use case, for which adjustments may have to be made.

Update: The general approach here seems to be 'sender rewriting'. Recently updated mailing list software should support this. But it depends on the mailing list owner to check the settings and update the software.

Tags: , ,
2022-02-25 Fraudepoging "Vergeet niet binnen 2 dagen je belasting te betalen!"
Cybercriminal Ook weer een typisch geval van bitcoin afpersing. De tekst is ook hier behoorlijk goed nederlands. Bekend en berucht bij de fraudehelpdesk: Opnieuw afpersmails over bezoek pornosite - fraudehelpdesk.nl.
Hallo, hoe gaat het met jou? Ik weet het, het is vervelend om een gesprek te beginnen met slecht nieuws, maar ik kan niet anders. Enkele maanden geleden heb ik toegang gekregen tot je apparaten die je gebruikt om op het internet te browsen. Vervolgens heb ik al je internet activiteiten kunnen traceren. Hieronder kun je lezen hoe ik dit voor elkaar heb gekregen: Allereerst heb ik van hackers de toegang tot meerdere e-mail accounts gekocht (tegenwoordig is dat een fluitje van een cent om dat online te doen). Daarna kon ik heel makkelijk op je e-mail account (xxxx@example.com) inloggen. Een week later heb ik een Trojan virus geïnstalleerd in de besturingssystemen van al de apparaten die je gebruikt om je mails te openen en te lezen. Om eerlijk te zijn ging dat vrij simpel (want je opent de links uit je inbox mails).
Het bitcoinadres waar 1790 euro heen mag is 1AJcoDsSGe9teEfzSMicXprJFae7729J5y.

Update 2022-02-26: Nog een keer dezelfde spam gezien met bitcoinadres 1AJcoDsSGe9teEfzSMicXprJFae7729J5y en 1DfSBC5xbeswbXingkkf3i6VyQwYb8kYGh.

Tags: , ,
2021-12-01 Fraudepoging "Je hebt nog een betaalopdracht uitstaan"
Met zo'n onderwerpregel voor een e-mail bericht weet ik al zeker dat het een fraude poging is, maar het bleek dit keer een van de beruchte bitcoin afpersingspogingen te zijn. De tekst is weer behoorlijk goed nederlands:
Hallo! Helaas heb ik slecht nieuws voor je. Enkele maanden geleden heb ik toegang gekregen tot de apparaten waarmee je op het internet surft. Vervolgens heb ik je internetactiviteiten nagetrokken. Hieronder volgt een overzicht van de gebeurtenissen die hiertoe hebben geleid: Eerst heb ik van hackers toegang gekocht tot talrijke e-mail accounts (tegenwoordig is dat een heel simpele klus die gewoon online kan worden gedaan). Zonder enige moeite heb ik vervolgens kunnen inloggen op jouw e-mail account (xxxx @ yyyyyyy). Een week later heb ik het voor elkaar gekregen een Trojaans virus te installeren op besturingssystemen van al je apparaten die voor e-mail toegang gebruikt worden. Eigenlijk was dat heel eenvoudig (want je klikte op de links in je inbox emails).
En zo nog een heleboel tekst verder, maar het belangrijke deel:
Schrijf 1750€ naar mijn rekening (bitcoin equivalent op basis van de wisselkoers tijdens je overschrijving) over
Hieronder staat mijn Bitcoin wallet: 1HvuQda3pzxyCnTJVpb1TpADMF2s3GB6g6 Je krijgt precies 48 uur de tijd nadat je deze e-mail geopend hebt (2 dagen om precies te zijn).
Bitcoin wallet 1HvuQda3pzxyCnTJVpb1TpADMF2s3GB6g6 was al bekend bij bitcoinabuse en heeft zo te zien helaas al een bedrag ontvangen van bijna 4 keer 1750 euro.

Trap hier niet in, het is echt complete onzin wat er beweerd wordt en alleen maar een manier om geld afhandig te maken. Lees ook: Ik word per mail gechanteerd - Fraudehelpdesk.nl
Read the rest of Fraudepoging "Je hebt nog een betaalopdracht uitstaan"

Tags: , ,
2021-11-15 Blocking mail I can't answer
Someone mailed me a few days ago with an interesting question. So I typed a reasonably long answer. But upon sending this answer I received the following error message:
   ----- The following addresses had permanent fatal errors -----
<????????@outlook.com>
    (reason: 550 5.7.1 Unfortunately, messages from [45.83.232.134] weren't sent. Please contact your Internet se...ail.live.com/mail/troubleshooting.aspx#errors. [HE1EUR04FT003.eop-eur04.prod.protection.outlook.com])

   ----- Transcript of session follows -----
... while talking to outlook-com.olc.protection.outlook.com.:
>>> MAIL From:<?????? .at. idefix.net> SIZE=4837 BODY=8BITMIME
<<< 550 5.7.1 Unfortunately, messages from [45.83.232.134] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [HE1EUR04FT003.eop-eur04.prod.protection.outlook.com]
554 5.0.0 Service unavailable
Trying to get my IPv4 address allowed didn't work. The form for getting IP addresses whitelisted did not allow for IPv6 addresses, but then again outlook.com has no IPv6 addresses listed for its MX record. I would think microsoft would do something with IPv6 to support innovations in Internet but I guess they only do that to win contracts.

After a while I got a response with a ticket number and an hour later a response that looked like maybe a person had taken a look at it, with "Our investigation has determined that the above IP(s) do not qualify for mitigation." So that leaves me with possible mails from outlook[.]com that I can't answer, making me look bad because I don't seem to reply at all.

I'm convinced the mail setup is correct on my end. The domain idefix.net has an SPF record and the mail was sent out via the approved route.

The only solution I can think of at the moment is blocking mail from outlook.com at the protocol level with an error message pointing at a webpage what the problem is, so when someone sends an e-mail from outlook[.]com to one of my domains they will get an error message with an embedded hint what they should do, namely We cannot reply to your mail, please send us mail from a different domain, see https://idefix.net/mailreject.html for an explanation. About the same as microsoft does, although the careful reader might have noticed the error code S3150 is not mentioned at http://mail.live.com/mail/troubleshooting.aspx#errors.

Tags: , , , ,
2021-10-23 Woningnet fraude weer
Cybercriminal Uit de inbox, weer een 'WoningNet' verhaal, zie ook Spam/phishing/fraude woningnet. Bekend natuurlijk al bij FraudeHelpdesk: Laatste Herinnering - Fraudehelpdesk.
   U heeft een inschrijving bij WoningNet.
   Over 2 weken verloopt uw inschrijving.
   Uw inschrijving verlengen wij met een jaar als u de verlenginskosten
   van €8,00
   betaalt.
   U kunt betalen via iDEAL.
   Via de onderstaande link word u automatisch doorverwezen naar onze
   betaalpagina

   Als u niet binnen 2 weken betaalt, schrijven wij u uit.
   Uw opgebouwde inschrijfduur en eventuele reacties komen dan te
   vervallen.
Het pad van URLs:
  • hxxps://t9y.me/Q2Su
  • hxxps://rplg.co/d9b377a0
  • hxxps://lucid-wu.45-88-108-231.plesk.page/woningnet
  • hxxps://lucid-wu.45-88-108-231.plesk.page/woningnet/
  • Kies ING → hxxps://lucid-wu.45-88-108-231.plesk.page/ing/ En dan een volle phishing kit voor Mijn ING credentials.
De methode is al bekend (berucht) bij de fraudehelpdesk. Ook even getest met lucid-wu.45-88-108-231.plesk.page - urlscan.io en gemeld bij google safe browsing.

En dan
Take a second to rejoice merrily for doing your part in making the web a safer place.

Tags: , ,
2021-10-09 A long bitcoin extortion scam
Cybercriminal This time the scammer / fraud / criminal tries using a lot of text to convince victims to pay bitcoins.

Using bitcoin address bc1qtzqgwqe3cd4cnv26vawxvfg3kr09r0jv53p8nw where it shows this one is already known and no money has been lost.

A bit of a sample, showing that the scammer has some imagination and a good grasp of English:
During the pandemic outbreak a lot of providers have faced difficulties in
maintaining a huge number of staff in their offices and so they have decided to
use outsourcing instead.
While working remotely from home, I have got unlimited abilities to access the
user databases.

I can easily decrypt passwords of users, access their chat history and online
traffic with help of cookie-files.
I have decided to analyse users traffic related to adult websites and adult
content.

My spyware functions as a driver. Hence, I can fully control your device and
have access to your microphone, camera, cursor and set of symbols.
Generally speaking, your device is some sort of my remote PC.
Since this spyware is driver-based, then I can constantly update its
signatures, so that no antivirus can detect it.
While digging through your hard drive, I have saved your entire contact list,
social media access, chat history and media files.
Earlier items about bitcoin extortion scams: Earlier, earlier, earlier, earlier, earlier, earlier, earlier (although I think bitcoin is generally a really bad idea and a huge scam)

Update 2021-10-13: As not enough money is coming into this wallet the scammer tries again. Same address, demanding an amount equivalent to $1150 (USA Dollars). As the mail comes from some random ISP in Chili I think the criminal is somewhere else on this planet.

Tags: , ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newstag.cgi,v 1.37 2022/02/15 21:48:19 koos Exp $ in 0.024266 seconds.