{"id":10364,"date":"2017-11-08T11:10:14","date_gmt":"2017-11-08T19:10:14","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/08\/news-4137\/"},"modified":"2017-11-08T11:10:14","modified_gmt":"2017-11-08T19:10:14","slug":"news-4137","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/11\/08\/news-4137\/","title":{"rendered":"Of scammers and cute puppies"},"content":{"rendered":"<p><strong>Credit to Author: William Tsing| Date: Wed, 08 Nov 2017 18:37:11 +0000<\/strong><\/p>\n<p>We\u2019ve followed <a href=\"https:\/\/blog.malwarebytes.com\/tech-support-scams\/\" target=\"_blank\" rel=\"noopener\">tech support scammers<\/a> for quite a while at Malwarebytes. They\u2019ve been of particular interest because of their preference for scamming the poor, the elderly, and the developmentally disabled.\u00a0 But there\u2019s a diverse spectrum of online scams a criminal can profit from, and today we\u2019re going to take a look at one of the more despicable ones: puppy scams.<\/p>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Advance-fee_scam#Pet_scams\" target=\"_blank\" rel=\"noopener\">The basic gist<\/a> of the scam is that the crook will find photos of beautiful purebred dogs, put them up on Craigslist or a private website, and advertise them for adoption. Once a buyer is found, they\u2019re on the hook for fees including fake vet bills, registration, kennel fees, and transport to the victim\u2019s location. Suffice it to say: there is no dog. Average losses for this scam run from US$800 to $5,000.<\/p>\n<h3>Shopping for a fake dog<\/h3>\n<p>For our investigation, we started with\u00a0<em>pomeranianhouse[.]com<\/em>. Clicking on puppies for sale, we get Paulie, an unbelievably cute dog that looks happy to see us.<\/p>\n<div id=\"attachment_20379\" style=\"width: 384px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-20379 size-large\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-599x960-374x600.jpg\" alt=\"\" width=\"374\" height=\"600\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-599x960-374x600.jpg 374w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-599x960-187x300.jpg 187w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-599x960.jpg 599w\" sizes=\"auto, (max-width: 374px) 100vw, 374px\" \/><\/p>\n<p class=\"wp-caption-text\">This dog is not actually for sale.<\/p>\n<\/div>\n<p>The &#8220;About us&#8221; page has extensive copy on the care and upkeep of these beautiful dogs designed to make your heart melt. But when we reverse image search on Paulie, we get another site entirely:\u00a0<em>www.thebombpoms.com<\/em>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-large wp-image-20380 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/reverseimg-600x140.png\" alt=\"\" width=\"600\" height=\"140\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/reverseimg-600x140.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/reverseimg-300x70.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/reverseimg.png 1350w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>This site has the same dog:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-20383 size-medium aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-1-300x144.png\" alt=\"\" width=\"300\" height=\"144\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-1-300x144.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/paulie2-1-600x287.png 600w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<p>It includes the same copy, but contains identifying details of the breeder, along with a lengthy diatribe against scammers who steal her photos.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-large wp-image-20381 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/scamwarn-600x179.png\" alt=\"\" width=\"600\" height=\"179\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/scamwarn-600x179.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/scamwarn-300x90.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Having confirmed that the first site is a huge scam, we decided to give them a call and see what happens.<\/p>\n<p><iframe  src='https:\/\/www.youtube.com\/embed\/k87ew_FinF4?version=3&#038;rel=1&#038;fs=1&#038;autohide=2&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;wmode=transparent' width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/p>\n<p>&nbsp;<\/p>\n<p>Unsurprisingly, instead of a woman from Oklahoma, we get a man with a south Asian accent requesting a Walmart-2-Walmart money transfer. If you\u2019re unfamiliar,\u00a0<a href=\"https:\/\/corporate.walmart.com\/_news_\/news-archive\/2014\/04\/17\/walmart-introduces-exclusive-money-transfer-service-cuts-fees-by-up-to-50-percent-for-customers\" target=\"_blank\" rel=\"noopener\">Walmart-2-Walmart<\/a> is a money transfer that allows a recipient to collect funds with an ID and a reference number. Most commonly, scammers will recruit money mules to do the collections as part of a work from home scheme. This particular scammer wanted to take us for $850 for the non-existent dog, but that probably would have gone up over time with assorted \u201cunforeseen\u201d costs.<\/p>\n<p>So what about the perpetrator? Pomeranianhouse.com is WHOIS protected, with no significant pDNS, but the email they used with us,\u00a0<em>dydydav849@gmail[.]com,<\/em> was partially reused on their last scam iteration in July, as seen below on a scam information website:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-large wp-image-20385 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/oldsite-600x160.png\" alt=\"\" width=\"600\" height=\"160\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/oldsite-600x160.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/oldsite-300x80.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/oldsite.png 1172w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Once <em>pomeranianhouse[.]com<\/em> is taken down for fraud, the scammer will most likely set up a new site with fresh stolen pictures in another three months.<\/p>\n<h3>How to stay safe<\/h3>\n<p>Please do not use unconventional payment methods with people you do not know, or cannot find a reputable history on. Money wire, ACH transfer, and any sort of gift card should all be enormous red flags for \u201cmaybe I should not do business with this person.\u201d You can also decrease your chances of getting scammed by buying pets locally from shelters or breeders who allow you to meet the dog first (to make sure it exists). Stay safe, and stay suspicious\u2014no matter how cute the puppy is.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/11\/of-scammers-and-cute-puppies\/\">Of scammers and cute puppies<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/11\/of-scammers-and-cute-puppies\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: William Tsing| Date: Wed, 08 Nov 2017 18:37:11 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/11\/of-scammers-and-cute-puppies\/' title='Of scammers and cute puppies'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/11\/shutterstock_688527661.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>We take a look at a cute puppy scam, in which criminals seek money for adorable dogs that don&#8217;t exist.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/social-engineering-cybercrime\/\" rel=\"category tag\">Social engineering<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/419\/\" rel=\"tag\">419<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/advance-fee-fraud\/\" rel=\"tag\">advance fee fraud<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/money-mule\/\" rel=\"tag\">money mule<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/scam\/\" rel=\"tag\">scam<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/11\/of-scammers-and-cute-puppies\/' title='Of scammers and cute puppies'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/11\/of-scammers-and-cute-puppies\/\">Of scammers and cute puppies<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10593,16490,4503,16491,3985,10510],"class_list":["post-10364","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-10593","tag-advance-fee-fraud","tag-cybercrime","tag-money-mule","tag-scam","tag-social-engineering"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10364"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10364\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}