Friday, August 23, 2019

SMS phishing links to my Google Voice

So this was sent to a fake number of mine.
Generally it is one i give recruiters, so at some point this number got sent to some mailing list.

Please update your PayPal account as soon as possible to avoid any interruptions using PayPal,visit: http://paypal-login[.]pawsthenplay[.]com?id=cpje - VT link

This is for all of the non-tech folks out there.

notice how the paypal part is not the main domain.
it is paypal something [dot] paws the play .....????? what ?
This is how I can immediately tell that this is a fake domain, and not legitimately paypal.

pawsthenplay is this accoding to google:
Paws Then Play LLC – Service Dog Awareness Education
My guess is that the domain account has somehow gotten altered. Let's see if we can find out.
Name:    pawsthenplay.com   Address:  74.81.191.214
Name:    paypal-login.pawsthenplay.com   Address:  74.81.191.214
Name:    paypallogin.pawsthenplay.com   Addresses:  23.217.138.110
Name:    paypal.pawsthenplay.com  Addresses:  23.217.138.110

possible, but still seems strange.

Still no way in heck I am clicking on that link. No way to tell where that goes, or what it does.