{"id":15325,"date":"2013-12-18T09:00:53","date_gmt":"2013-12-18T16:00:53","guid":{"rendered":"https://www.webroot.com/blog/?p=15325"},"modified":"2018-10-05T16:27:56","modified_gmt":"2018-10-05T22:27:56","slug":"fake-whatsapp-missed-voicemail-themed-emails-lead-pharmaceutical-scams","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/12\/18\/fake-whatsapp-missed-voicemail-themed-emails-lead-pharmaceutical-scams\/","title":{"rendered":"Fake ‘WhatsApp Missed Voicemail’ themed emails lead to pharmaceutical scams"},"content":{"rendered":"

WhatsApp<\/strong><\/a> users, watch what you click on! A currently circulating fraudulent spam campaign is brand-jacking WhatsApp in an attempt to trick its users into clicking on links found in the email. Once socially engineered users fall victim to the scam, they’re automatically exposed to a fraudulent pharmaceutical site, offering them pseudo bargain deals. Let’s assess the fraudulent campaign, and expose the fraudulent infrastructure supporting it.<\/p>\n

<\/p>\n

Sample screenshot of the spamvertised email:<\/strong><\/p>\n

\"WhatsApp_Fake_Rogue_Fraudulent_Email_Spam_Pharma_Pharmaceutical_Scam_01\"<\/a><\/p>\n

Sample screenshot of the landing pharmaceutical scam page:<\/strong><\/p>\n

\"WhatsApp_Fake_Rogue_Fraudulent_Email_Spam_Pharma_Pharmaceutical_Scam\"<\/a><\/p>\n

Redirection chain:<\/strong>\u00a0hxxp:\/\/203.78.110.20\/horizontally.html<\/em> -> hxxp:\/\/viagraphysician.com<\/em> (109.201.133.58)<\/p>\n

We’re also aware of the following fraudulent domains that are known to have phoned back to the same IP (109.201.133.58):<\/strong>
\n67157d.pharmahimoft.pl
\nalbertacanadatab.in
\nasaletabla.at
\nbaruchelmedicine.in
\nbioportfoliotablet.com
\nbiotechviagrahealthcare.com
\nbuygenericspills.com
\ncanadascanadarx.com
\ncanadatab.in
\ncanadaviagras.com
\ncanadawelnesstoronto.com
\ncarehealthtabletspills.ru
\ncareteachers.com
\ncialismed.com
\ncialispharmdrone.com
\ncontabdiet.com
\ndietpharmediterranean.com
\ndietviagraweight.com
\ndocherbal.in
\ndrugrxmedicine.be<\/p>\n

Name servers:<\/strong>
\nns1.viagraphysician.com – 178.88.64.149
\nns2.viagraphysician.com – 200.185.230.32<\/p>\n

The following fraudulent name servers are also known to have participated in the campaign’s infrastructure at 178.88.64.149:<\/strong>
\nns1.wpdsasya.com
\nns1.bioportfoliohealthcaretab.com
\nns1.viagraphysician.com
\nns1.androidherbaltablet.com
\nns1.viagracialalec.in
\nns2.viagracialalec.in
\nns1.kgvghatm.eu
\nns2.kgvghatm.eu
\nns1.zwsxfwqn.eu
\nns1.worgad.ru
\nns1.iald.ru
\nns2.iald.ru
\nns1.fivere.ru
\nns1.gabrue.ru
\nns1.nagh.ru
\nns1.lonoci.ru
\nns1.menono.ru
\nns1.xior.ru
\nns1.uptras.ru
\nns2.uptras.ru
\nns1.qatt.ru
\nns1.aprpharmacyrx.ru
\nns2.aprpharmacyrx.ru
\nns1.swoltz.ru<\/p>\n

The following fraudulent name servers are also known to have participated in the campaign’s infrastructure at 200.185.230.32:<\/strong>
\nns2.medicarepillmedicaid.com
\nns1.tabdietmediterranean.com
\nns2.viagraphysician.com
\nns2.pharmacylevitrapharmacist.com
\nns2.viagracialalec.in
\nns2.kgvghatm.eu
\nns1.zwsxfwqn.eu
\nns2.worgad.ru
\nns2.fivere.ru
\nns1.gabrue.ru
\nns2.nagh.ru
\nns1.tabletsmedshealth.ru
\nns2.menono.ru
\nns2.xior.ru
\nns2.uptras.ru
\nns2.swoltz.ru<\/p>\n

We expect that more legitimate brands will continue getting targeted in such a way<\/strong><\/a>, with the fraudsters behind the campaign continuing to earn revenue through pharmaceutical affiliate programs<\/strong><\/a>.<\/p>\n

Webroot\u00a0SecureAnywhere<\/a><\/strong>\u00a0users are protected from these scams.<\/p>\n","protected":false},"excerpt":{"rendered":"

WhatsApp users, watch what you click on! A currently circulating fraudulent spam campaign is brand-jacking WhatsApp in an attempt to trick its users into clicking on links found in the email. Once socially engineered users fall victim to the scam, they’re automatically exposed to a fraudulent pharmaceutical site, offering them pseudo bargain deals. Let’s assess […]<\/p>\n","protected":false},"author":65,"featured_media":17051,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[23407,3881,23411,5609,5611,5607,5601,5019,4047,5247,4027,23143,23409,5603,5599,5613,3875,5605,4417,3529],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/15325"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=15325"}],"version-history":[{"count":7,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/15325\/revisions"}],"predecessor-version":[{"id":26145,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/15325\/revisions\/26145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17051"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=15325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=15325"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=15325"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=15325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}