Over the last couple of days, multi-tasking cybercriminals have been spreading a “Facebook Profile Spy” campaign across Facebook, enticing users into installing a rogue Chrome extension, next to monetizing the campaign through an unethical pseudo-mobile marketing agency, known as Prizerally.
Sample redirection chain:
hxxps://www.facebook.com/pages/Hajmc1rnjr/172683159561584?sk=app_190322544333196&9DyG45 -> hxxp://horribleapps.com -> hxxp://terribleapps.com -> hxxps://chrome.google.com/webstore/detail/oacggeibdmjpmecojanlbbngabkincif -> hxxp://www.picapplication.com/profile/last.html?1 -> hxxp://flightdealsrome.net/?subid=4563 -> hxxp://lp.prizerally.com
Domain names reconnaissance:
horribleapps.com – 66.150.99.179 (picovator.com) – Email: [email protected]
terribleapps.com – 66.150.99.21 (puzzledapps.com; testyapps.com) – Email: [email protected]
picapplication.com – 66.150.99.179 – Email: [email protected]
flightdealsrome.net – 174.140.17.100
prizerally.com – 46.19.35.207 – Email: [email protected]
We also got the following fraudulent and typosqutted domains known to have responded to the same IP (174.140.17.100) in the past:
0418490819.com
20.tv
2020testing.net
aaacomtests.net
aaacontests.net
aaamathtests.net
accordput.net
aceonlinetest.com
activetester.com
adjustfit.net
adjustpair.net
adjusttie.net
adslim.com
adventuretester.com
aidonlinesurveys.com
airplanetester.com
alignhang.net
alignmake.net
aliketester.com
allosurvey.net
amatuercumshots.org
analyzequiz.net
animalplanet.net
animereak.tv
answeringonlinesurveys.com
apptitudeonlinetest.com
arcosurvey.net
attuneeven.net
attunefix.net
attunehang.net
attunemake.net
attunepair.net
attunetune.net
avizoon.com
azdes.org
bajarvideo.com
balanceattune.net
balancecollate.net
balanceconnect.net
balancecounteract.net
balanceeven-steven.net
balancefocus.net
balancelevel.net
balanceneutralize.net
balancenullify.net
balanceoverhaul.net
balancerectify.net
balancesymmetry.net
balancetighten.net
bargainonlinetest.com
bensurvey.net
bestgetpaidonlinesurveys.com
bestonlinesurveysformoney.com
bestonlinesurveysforpay.com
bestonlinesurveyswebsite.com
bestprizedraw.com
bestratedonlinesurveys.com
bestwebquiz.net
bigpaidonlinesurveys.com
bitsonlinetest.com
blackgaygalleries.com
bletsurvey.net
blosurvey.net
bobmarly.com
bollywoodringtonessite.com
bret.com
bringgrind.net
bringtie.net
builbabear.com
buildonlinesurveys.com
cancelfix.net
cansafelist.com
carquestionswebsite.com
censurvey.net
challengequizonline.net
cheaponlinetests.com
chinabestlink.com
clickbusinessinfo.net
coinsurvey.net
collegeonlinetests.com
commercenetweb.com
compeitionstowinprizes.com
coolfreequizzes.com
cooponmom.net
countest.net
couponso.net
crazyonlinequizzes.com
creativelinkusa.com
cuteonlinequizzes.com
descargapeliculas.com
dfedex.com
didiwinaprize.net
discountonlinetests.com
dogquizzes.net
dotnetlink.com
downloadsmovies.com
easyonlinetesting.com
eicosurvey.net
employersonlinetest.com
englishonlinetest.com
etestonlinetesting.com
examxonlinetesting.com
exposurvey.net
farbestsurvey.net
fastrackonlinesurveys.com
fastsurveyworld.net
fbso.com
findonlinesurveysforcash.com
fletsurvey.net
fnnyvideo.com
fontest.net
free-live-xxx-cams.com
friendsonlinequiz.com
fuck-me-now.com
funonlinequizsurvey.com
funonlinequizteen.com
funonlinequizzesforkids.com
gay-sex-pics-porn-pictures-gay-sex-porn-gay-sex-pics-gay.com
generalonlinequiz.com
generatest.net
geocites.com
getpageranks.com
googledark.com
googlemx.com
googletraductor.com
googleunclesam.com
googllemaps.com
gooyoutube.com
granny.ca
gsd.com
gyoutube.com
hack-facebook.com
hkatb.adsldns.org
hohotmail.com
holder.me
holidaytravelpassport.net
hotmailm.com
hotmauil.com
hpforsale.org
internet-questions.net
ioutube.com
jkert.com
joinsurvey.net
kemert.com
kerosurvey.net
kogregate.com
kurosurvey.net
landminesurvey.net
latinswomen.com
letsurvey.net
lolita.org
loveonlinequiz.com
marilyn.com
medialinksite.com
mensurvey.net
mfacebook.com
miniclip.cl
minsurvey.net
mobiasbank.com
monicatubes.com
movietickits.com
msdip.com
mycosurvey.net
myford.com
notyoutube.com
ohotmail.com
oijwef.com
onlinemedsforall.net.in
onlinequizze.com
outsurvey.net
pharmaonline.net.in
pina.com
pollings.net
pollinois.net
pollinoise.net
pollison.net
pollist.net
pollower.net
pollquestionsitewhdh.com
pollustry.net
pollutan.net
poutsurvey.net
question-answer-website.com
questionansweringwebsites.com
questionanswerstudy.net
questionexams.net
questionforthequiz.com
questionnairesamplesurvey.com
questionpersonalityquiz.net
questionpollguide.net
questionquizsite.net
questionquizworld.net
questionsforasurvey.com
questionsitesell.com
questionssurveys.com
questionsurveyfriend.com
quicksurveydirect.net
quizbull.net
quizbulla.net
quizbullah.net
quizbullen.net
quizbulles.net
quizbust.net
quizbustav.net
quizbustin.net
quizbustle.net
quizbustom.net
quizbustry.net
quizin.net
quizingles.net
quizingly.net
quizquestionsite.net
quizzeri.net
quizzerial.net
quizzeris.net
quizzerish.net
redirectofferpage.com
reinsurvey.net
rentube.com
rep.ppmate.com
repeatest.net
ruralaresdubai.net.in
sappygirls.com
scensurvey.net
securitytube.com
seehomevids.com
stratest.net
sumotorrents.com
sunsurvey.net
superquestionquiz.net
supersurveygroup.net
supersurveysite.net
survey-masters.net
2surveyablsoute.net
surveyaboutyou.net
surveyacout.net
surveyalot.net
surveyanyone.net
surveyask.net
surveyassistant.net
surveylatest.net
surveyorster.net
susan.com
testabled.net
testables.net
testabling.net
testand.net
testants.net
testatus.net
testaura.net
testaustralia.com
testeradjective.com
testeradvice.com
testeraid.com
testic.net
testical.net
testige.net
testigious.net
testingacacdemy.net
testingadvantage.net
testingadvice.net
testingadwords.net
testingagainagain.net
testingame.net
testion.net
testivate.net
testself.net
tetsurvey.net
thegreatanswer.com
thenamequiz.net
thequestionpoll.net
thesurveyresearch.net
thosurvey.net
tmobilw.com
toutsurvey.net
toyotest.net
tsurvey.net
tube99.com
tunehang.net
tunelevel.net
tunemake.net
tuneoppose.net
tuneparity.net
tuneservice.net
tuneset.net
tunesteady.net
tunetie.net
twittee.com
unionbank.org
unsurvey.net
update.ppmate.com
usagreatlink.com
vacationcellular.net
vintagetownbazar.co.in
watchyoutube.com
webwordquiz.net
weighfit.net
weighmake.net
weighmend.net
weighparity.net
weighpolish.net
weightighten.net
wesurvey.net
wickapidea.com
wickepidia.com
worldcityonline.com
wuizforcash.com
www-yuotube.com
www.ammoneta.com
www.downloadsmovies.com
www.foxchannel.com
www.hack-facebook.com
www.securitytube.com
www.tmobilw.com
www.windycitywatchdog.com
www.youtrube.com
www.youtubemobile.com
www.youtuve.com
wwwquestionnairesurveys.com
wwwtoutube.com
yahoomailk.com
yaotube.com
yautube.com
yootube.com
yotobe.com
youbube.com
yourhomesurvey.net
yourownsurvey.net
yoursurveysite.net
yourtopsite.com
youtsurvey.net
youtubemobile.com
youtubi.com
youtuhe.com
youtuve.com
ypoutube.com
yuvuty.com
zerosurvey.net
As well as the following malicious MD5s phoning back to the same IP in the past:
MD5: e315a877c58773ce82cc32fc192bdfa5
MD5: 1cd4c2a2b2143689b185e064dc6c331c
MD5: 26c5102e75daf3d3c696ad719bc55ad4
Prizerally’s scheme is fairly simple:
Service costs £3 per question played and a £4,50 sign up fee applies. You will receive an additional £1.50 charge for a reminder message tomorrow. Winners will be contacted every first businessweek of the month, all question entries must be received before 00.00 on the last day of the month. This is not a subscription service. Minimum age 18+ with bill payer’s permission. One prize available per service per month. Customer service: call 0800 408 0796, email [email protected] or visit the website: www.prizerally.com. Play the game on your mobile. The winner will be selected among all participants in the first business week of every month. When participating you acknowledge that you agree to the terms & conditions, you are a resident of the UK, 18 years or older and authorized account holder and/or that you have the consent of the accountholder. £3 per question. This service is a product of Mypengo Mobile. Free entry method: send an email with your name, phonenumber, and prize you want to win to [email protected]. Prizerally is not affiliated with, sponsored by or endorsed by any of the listed products or retailers. Trademarks, service marks, logos (including, without limitation, the individual names of products and retailers) are the property of their respective owners. When you see one of our Products on the Internet, you can start receiving our content via SMS (i.e. text message). You can enter your mobile telephone number on the landing pages via the Internet and confirm your registration. You hereby agree to the Terms and Conditions. Prizerally charges you £3,00 per question played. Each sent answer will be followed by a new question. If you stop sending answers you will not receive any more messages. Once stopped you will receive one extra £1,50 reminder message. To stop this message, simply text STOP to 85150. From this moment on you have to decide on your own if you will continue to play for more points. By answering a question, you will receive a new messages containing a new puzzel/question also chargeble at £ 1,50 per text message received. When you stop sending answers the game will end. O2 and Orange customers can only spend the maximum amount of £ 30.00 a day. This spending cap applies for one day, so the next day these customers are eligble to play again. The maximum amount you can spend on our Prizerally service is £ 99.00.
Facebook has been notified. The rogue Chrome extension has already been removed.
This post has been reproduced from Dancho Danchev’s blog. Follow him on Twitter.
Leave a reply
