1

I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them having my cell phone number is not a surprise. But I didn't expect them to use the bit.ly service, and that triggered my first suspicion.

To be safe, I loaded the actual link (http://bit.ly/1TSvBPm) in a VM on my desktop pc. It triggers the download of an Android app (an APK file), and when I look at what that file contains I see credit card logos and other highly suspicious things. This is definitely not a real notification from the actual postal service!

I'm posting here to get the opinion of more experienced users. I'm mostly interested in hearing what I should do now:

  • I already submitted this to the postal service with the request that they investigate.
  • What else should I do?
  • How can I avoid receiving stuff like this on my phone? Obviously somebody else than the postal service has my cell number, and knows it's an Android phone.
  • I guess I will have to warn other people about this risk. I have pretty gullible relatives.

Thanks in advance for your feedback!

4
  • Nasty looking download, it has now been submitted to several av companies: virustotal.com/en/file/…
    – AstroDan
    Commented May 13, 2016 at 12:44
  • Unshortened link is: http://www.starsfitness.at/posta.apk, which is probably a compromised WordPress site (though it could be a front for illegit stuff). You could report it to them and/or their hosting. Commented May 13, 2016 at 15:02
  • @AlexanderO'Mara: "and/or their hosting" - how do I find out where they are hosted? (The website has a contact form I intend to fill out now.) Commented May 16, 2016 at 12:19
  • Sometimes you can get hints through looking up their registrar, or the ip address of the host: whois.domaintools.com/starsfitness.at The file has already been deleted though. Commented May 16, 2016 at 17:57

1 Answer 1

1

You can't really do much about it yourself , except for reporting it to the police (because it's a scam attempt which is obviously illegal).

Avoiding receiving such messages isn't easy, since the attackers are either using a number database they bought somewhere (with your number in it) or they generate the numbers randomly (spray and pray tactic, hoping someone will bite the bait). They might not even know if you have an Android phone.

Warning relatives and friends is a good idea. Also suggest them blacklisting the number you got the scam message from.

3
  • Thank you! Unfortunately this message doesn't even have a sender number as far as I can tell, so there's nothing to blacklist. And I suspect it would be pretty futile; I expect any number given would be either stolen or false anyway. Commented May 13, 2016 at 13:20
  • Then I can only highly recommend you informing police about the situation. They are in power to take steps that will lead to blocking the phone number and the website / server the malware is loaded from.
    – Jakub
    Commented May 13, 2016 at 13:39
  • The postal service just called me in response to my report through their website. They aren't sending this, and reports like mine are increasing. They already have their staff working on it. -- Given that I don't have any sender information, there's nothing more I can do. Commented May 13, 2016 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .