On August 4th 2015 Comodo has detected a recent phishing attack which tries to deceive receivers into some kind of method for cracking U.S Lotto industry. Original mail comes from email@example.com and reply to field set as firstname.lastname@example.org
Mail content is as following
Did you know that there are S.E.C.R.E.T patterns that exist within every single draw game?…
Or that using them can allow you to W.I.N the lottery multiple times per month, every month?
This CODE, if leaked, could demolish the entire U.S. lotto industry.
The good news is, this is completely honest and ethical… Absolutely nothing illegal…
There is only one link in the mail which refers to: http://migre.me/qSPOm uses migre.me url shortener service and redirects to http://lottocrushercode.me/ website. This website is a 1 page website with a video presentation and its textual presentation as content
Embedded video is hosted on youtube at : https://www.youtube.com/watch?v=pDnAIXwd44M
When we click the Add To Cart button it redirects us to http://preciouscart.com/buy.php? id=55&hash=fc49306d97602c8ed1be1dfbf0835ead which is cart service for easy payment.
If we continue to checkout we’ll see a legit pay-pal payment to the receiver of “RADL Misc Product” which is a fake name or a very well hidden company name since there is no result for this company name. Product that allegedly cracks the lottery system is named like LCCode(LatestVsn)LCCode(LatestVsn) and it is for 97$.
When we look at the whois information of the site we see that it originates from Cebu city in Philippines.
Domain Create Date:21-Mar-2015 09:37:43 UTC
Domain Last Updated Date:10-Jul-2015 12:39:57 UTC
Domain Expiration Date:21-Mar-2016 09:37:43 UTC
Last Transferred Date:
Sponsoring Registrar:eNom Inc R32-ME (48)
Created by:eNom Inc R32-ME (48)
Last Updated by Registrar:eNom Inc R32-ME (48)
Domain Status:CLIENT TRANSFER PROHIBITED
Registrant Name:Radl Promotion
Registrant Address:San Vicente
Registrant Postal Code:6012
Registrant Phone Ext.:
Registrant FAX Ext.:
Admin Name:Radl Promotion
Admin Address:San Vicente
Admin Postal Code:6012
Admin Phone Ext.:
Admin FAX Ext.:
Tech Name:Radl Promotion
Tech Address:San Vicente
Tech Postal Code:6012
Tech Phone Ext.:
Tech FAX Ext.: