On the hook: phishing trap World Wide Web

Phishing lures. Where else are they lurking?

In addition to sending phishing emails, attackers use fake adverts and fake shops to entice unknowing/unneeded users to click. Mimikama reported in July of this year on how easily and quickly fake adverts can be placed - even if the company does not actually exist.

The principle is similar to phishing emails. The adverts look like legitimate adverts and it is almost impossible to tell that they are fake.

The plot of the following story is based on a true story. The name of the person is fictitious.

How it all began...

While searching for a particular brand of hoover, Mrs M. used a well-known search engine to look for cheap offers. It didn't have to be the latest model, an older version would be perfectly adequate. The only criteria were: bagless, light weight, easy cleaning and cordless.

Among the many adverts, one immediately caught her eye as the price was cheaper than many other providers - allegedly due to the special color. Mrs M quickly clicked on the link and was taken to the provider's website. The process was quick: she added the item to her shopping basket - as she had done with hundreds of online purchases in the past - filled in all the relevant fields and sent the order.

An email confirming the purchase followed and the anticipation was great. What was missing from the email, however, were the bank details to make the transfer. Mrs M. decided to be patient and wait to see if these were emailed separately.

However, when no further email was received from the provider after a few days, Mrs M. wrote an email asking for the bank details. However, when she tried to reply to the first email from the shop, the anti-virus programme blocked the email from being sent.

"At that moment I realised: something is wrong here!"

Max Mustermann

And now?

Mrs M. searched the internet for the online shop. However, it could not be found again. A single hint from the confirmation e-mail gave hope. Apparently the online shop was run by an electrician. So I went back to the search engine. And indeed, the electrician's website appeared among the first search results.

After opening the page, it was clear that Mrs M. had fallen for the scam. On the homepage there was a text that could not be overlooked: "Dear visitors to our website. We do not operate an online shop. Our name is being used incorrectly. We are unable to help you. Please contact the police or the consumer advice centre and refrain from calling or emailing us with questions about this issue."

After Mrs M. had digested this shock, she assumed that nothing had happened yet. Fortunately, no money has been transferred yet!

What happened next?

No more emails came from the fake shop, so the issue was forgotten. Meanwhile, the hoover was ordered from a well-known and reputable supplier at the regular price.

It took a while for Mrs M. to connect the flood of spam emails in her inbox with the order from the fake shop at the time.

The similar structure of the emails is striking

The basic principle is similar for all of them. Mails are sent in the same style, but with different topics. The attackers hope that the recipient will at some point feel addressed by some topic and click on the link.

At first glance, the emails all look the same. On closer inspection, however, you can recognise a pattern in some of them, giving you the feeling that they "belong together".

3 variants as an example

In the first variant, only one name is ever used as the sender and the sender addresses differ from each other. The text structure is identical, only a different topic is advertised.

In the second variant, the sender name always consists of two words and in the sender address the commonality is indicated by ppobbris.com.

In the third variant, the subject and the text area of the emails are identical. The sender's name is different, but there is a similarity in the sender's address. In contrast to the other emails, the recipient here is not the victim's email address, but the English translation for recipient "Recipients".

Many more identical patterns could be shown, but that would go beyond the scope of this article. It seems likely that the attackers have since resold the stolen access to Mrs M.'s email address on the darknet. Several attackers are apparently trying their luck here.

Recognising fake shops

Identifying fake shops from the adverts is almost impossible.

Source: Watchlist Internet, "The first three adverts in our test led to fraudulent websites."

Don't be impressed by the shop's appearance. Fake shops are usually copies of real websites and have a professional appearance.

The following conspicuous features may indicate a fake shop:

Internet address: Often the internet address does not match the content of the website and several domain extensions are used.
Payment terms: You should be able to choose from several payment methods. If you can only pay in advance, don't bother!
Price: They often advertise particularly favourable prices and extremely inviting offers.
Seals of approval: Seals of approval can also be falsified. To be on the safe side, you can click on the seal to check whether it is linked to a certificate from the operator.
Reviews: If the website only has extremely positive reviews or a large number of reviews that differ greatly from others, this may be an indication of a fake shop.
GTC: The general terms and conditions are mandatory for every online shop. If they are missing or written in broken German, it may not be a real site.
Imprint: Just like the terms and conditions, the imprint is also mandatory. If there is none, this is a clear indication of a fake page. An imprint must include the address, an authorised representative, an e-mail address and, if available, a reference to the commercial register. This can also be checked in case of doubt.

Fooled! What can you do?

If money has already been transferred, the Verbraucherzentrale to contact the bank immediately and have the payment stopped. All receipts, emails and other evidence of the purchase and the fake shop should be kept.

As this is a legal case of fraud, the documents can be checked by the consumer advice centres of the consumer advice centre. In this case, a criminal complaint can also be filed with the police.

Conclusion: always be vigilant when surfing the vast ocean of the World Wide Web!

Max Mustermann

On the hook: Phishing trap World Wide Web