Phish: "New_Order_#056253_Hf_Constructions" / "joseph.zhou@hong-kee.com"

I've seen a few of these today, presumably they aren't quite spammy enough to get blocked by our mail filters..

From: Kang Li [mailto:joseph.zhou@hong-kee.com]
Sent: 10. juni 2015 09:35
Subject: New_Order_#056253_Hf_Constructions

Dear,

Please find attached our new order and send P/I against 50% advance payemnt

best regards
kang

The attachment is New_Order_#056253_Hf_Constructions.pdf which looks like a purchase order, but there is a blurred out section.

An examination of the underlying PDF file shows two URLs listed:

[donotclick]designaffair.com.my/js/jss/accesslogin.php
[donotclick]perm.ly/importers-buyers-exporters

In turn these redirect to:

[donotclick]megatrading.hol.es/order/0exbligh0bwwciagica8is0tw2lmielfidhdpia8ahrtbcbk/index.html
[donotclick]tips-and-travel.com/~saulitoo/imgs/0exbligh0bwwciagica8is0tw2lmielfidhdpia8ahrtbcbk/index.html

The second URL listed 404s, but the first one is active. According to the URLquery report, it looks harmless, just leading to a phishing page. But when I tried it in a test environment, the behaviour was somewhat different and it also attempted to load a page at:

[donotclick]guest.lifevericalls.xyz/outlandish_litigant_tuners_nudeness/03737928145651311

This page 404s, but was previously hosted on a bad server at 92.222.42.183 [VT report]. That server has been offline for a few days, but the URL is suggestive of an exploit kit of some sort.

The "megatrading.hol.es" (hosted on 31.220.16.16 by Hostinger - VT report) landing page looks like a straightforward phish:

Entering the username and password always seems to return an error, even if you are absolutely certain the combination are correct..

I suspect that all this portion is doing is collecting email addresses and passwords for use later. Webmail accounts have some value to the bad guys, and of course many people re-use passwords all over the place, so it could be used as a way to get access to other services. Take care.

Recommended blocklist:
31.220.16.16
92.222.42.183

Scam: "brunerinvestment.com" is not The Brunner Investment Trust PLC

This simple spam is backed up by a fairly sophisticated fake website.

From:     brunner investment [investment@brunner.com]
Reply-To:     brunnerinvestment@gmail.com
To:     50
Date:     24 July 2014 12:08

Dear

The Brunner Trust PLC, is working on expanding its international portfolio Globally and financing projects in form of debt financing from the tune of $1million to $500million,
we also offer personal and business loans from the tune of $100,000 USD to $1,000,000.00 USD

We would be happy to receive an Executive summary to see if you have any Viable project we can finance and partner together
by making financial investment in Form of soft loans.

Email your projects summary to us at: info@brunerinvestment.com

Regards,
Stefan Hofrichter
Chief Economist and Head of Global Economics & Strategy

The Brunner Investment Trust PLC is a real organisation with a website at brunner.co.uk - the domain that the spammers are soliciting replies to is brunerinvestment.com (note the missing "n" in "brunner"). It was registered on 31st May 2014 with anonymous WHOIS details.

This is the real Brunner Invesment Trust site:

And this is the fake one:

The differences are subtle:

Of course the main purpose of the web site is to encourage you to think that you are talking to a real person, to which end the contact details are completely fake:

Although the postal address is correct, the rest of the details are fake:

Brunner Investment Trust Plc
199 Bishopsgate,
London, EC2M 3TY
Tel:+44 703 195 6304
Tel/Fax: +44 745 227 1933
Email: info@brunerinvestment.com
brunnerinvestment@gmail.com

The telephone numbers quotes appear to be "follow me anywhere" numbers that forward to another number, which could be anywhere in the world.

So what's the scam? Well, there's probably an up-front fee to even discuss financing.. and if it's like this recent scam it could be tens of thousands of dollars. Of course, there is no financing available (remember that this is a fake site, not the Brunner Investment Trust) and once the scammers have your money they will vanish.

I note as well that the site is fairly well done although somewhat buggy (and it randomly pops up adverts) which looks rather like the same cloned websites I discussed earlier this month.

Some technical details for this - the site is hosted on 93.188.160.4 which is allocated to Hostinger International in Lithunia (although the servers might be in Amsterdam). The spam originates from 168.167.134.124 (Botswana Telecommunications Corporation) via an unknown mail relay on 82.105.253.84 (Telecom Italia, Verona, Italy).

Avoid.