I requested a call from “Support” on a Saturday morning, and Zakk from The Technical Department called me from a spoofed New Jersey cellphone number. Upon pressing Zakk he said “we are a turd party support company.” What is the name of your Third Party Company, I asked? “Web Infotech.” Zakk developed a sour attitude and hung up shortly thereafter without providing any “support.”
They don’t serve anything on the default/index.html location. You have to point to a specific subdirectory, and if you want the phishing payload instead of the dummy “info” page, you have to have the correct referrer (from ww0.us) and a normal desktop or mobile user-agent.
Hey, if anyone here has access to a “backlink checker” could you run a report on sites that link to ww0.us? I’m using this one here https://www.seoreviewtools.com/valuable-backlinks-checker/ and it’s giving me 100 sites, but it says there are over 1700 websites linking to ww0.us – I just don’t feel like signing up for an account to look at the whole dataset.
And now a new phishing domain, with the same content and the same phone number. Jack from Amazon called me on request from a spoofed New Jersey Verizon number.
I spoke to Mr. Senell himself, or someone claiming to be him.
His favorite color is green.
At the same Radix Rd., Williamstown, NJ [residential] address is https://globitude.us/ , a travel agency. It claims to also have addresses in London and Gurugram.
More poking at the subdomain parsing: Take for example the fake Microsoft error at Error : OF0740E .
Error : OF0740E produces the same result. But
https://i_am_a_scammer.activeprod.pro/ms/error-found.php returns “Invalid subdomain.” So it checks for underscores? But not, for example, dashes: Error : OF0740E. Which I guess is consistent with RFC 952 for hostnames.
Seems like a major update to me: over the past week or so, the “ww0.us” redirector site seemed to be in “hiding” mode, redirecting to the legitimate/official website instead of a phishing imitation. And when I checked today, ww0.us seems to be out of service! Finally!
I have no idea what this could mean or why, but for the time being it looks like the feeder pages, e.g. Activate my Capital One card online at Activate.capitalone.com , continue to link to the non-functioning ww0.us. So if there is a new redirector site for this gang, they haven’t updated their hundreds of SEO spamming feeder pages. The most recent fake Turbotax redirector, ts.remdos.com, also fails after multiple redirections which end unsuccessfully.
Is this the end for Web Infotech?
Update: not so fast. As of 26 May, ww0.us is up again although it seems to be buggy and not redirecting as intended. It’s been moved to a new IP address and nameserver(s): 5.101.140.80 , hostmaza.co.in .
