I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them having my cell phone number is not a surprise. But I didn't expect them to use the bit.ly service, and that triggered my first suspicion.

To be safe, I loaded the actual link (http://bit.ly/1TSvBPm) in a VM on my desktop pc. It triggers the download of an Android app (an APK file), and when I look at what that file contains I see credit card logos and other highly suspicious things. This is definitely not a real notification from the actual postal service!

I'm posting here to get the opinion of more experienced users. I'm mostly interested in hearing what I should do now:

  • I already submitted this to the postal service with the request that they investigate.
  • What else should I do?
  • How can I avoid receiving stuff like this on my phone? Obviously somebody else than the postal service has my cell number, and knows it's an Android phone.
  • I guess I will have to warn other people about this risk. I have pretty gullible relatives.

Thanks in advance for your feedback!

  • Nasty looking download, it has now been submitted to several av companies: virustotal.com/en/file/… – AstroDan May 13 '16 at 12:44
  • Unshortened link is: http://www.starsfitness.at/posta.apk, which is probably a compromised WordPress site (though it could be a front for illegit stuff). You could report it to them and/or their hosting. – Alexander O'Mara May 13 '16 at 15:02
  • @AlexanderO'Mara: "and/or their hosting" - how do I find out where they are hosted? (The website has a contact form I intend to fill out now.) – Torben Gundtofte-Bruun May 16 '16 at 12:19
  • Sometimes you can get hints through looking up their registrar, or the ip address of the host: whois.domaintools.com/starsfitness.at The file has already been deleted though. – Alexander O'Mara May 16 '16 at 17:57

You can't really do much about it yourself , except for reporting it to the police (because it's a scam attempt which is obviously illegal).

Avoiding receiving such messages isn't easy, since the attackers are either using a number database they bought somewhere (with your number in it) or they generate the numbers randomly (spray and pray tactic, hoping someone will bite the bait). They might not even know if you have an Android phone.

Warning relatives and friends is a good idea. Also suggest them blacklisting the number you got the scam message from.

  • Thank you! Unfortunately this message doesn't even have a sender number as far as I can tell, so there's nothing to blacklist. And I suspect it would be pretty futile; I expect any number given would be either stolen or false anyway. – Torben Gundtofte-Bruun May 13 '16 at 13:20
  • Then I can only highly recommend you informing police about the situation. They are in power to take steps that will lead to blocking the phone number and the website / server the malware is loaded from. – Jakub May 13 '16 at 13:39
  • The postal service just called me in response to my report through their website. They aren't sending this, and reports like mine are increasing. They already have their staff working on it. -- Given that I don't have any sender information, there's nothing more I can do. – Torben Gundtofte-Bruun May 13 '16 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.