Scammers are flooding Fb with teams that purport to supply video streaming of funeral providers for the lately deceased. Family and friends who comply with the hyperlinks for the streaming providers are then requested to cough up their bank card info. Not too long ago, these scammers have branched out into providing pretend streaming providers for practically any sort of occasion marketed on Fb. Right here’s a more in-depth take a look at the scale of this scheme, and a few findings about who could also be accountable.
One of many many rip-off funeral group pages on Fb. Clicking to view the “reside stream” of the funeral takes one to a newly registered web site that requests bank card info.
KrebsOnSecurity lately heard from a reader named George who stated a good friend had simply handed away, and he seen {that a} Fb group had been created in that good friend’s reminiscence. The web page listed the right time and date of the funeral service, which it claimed could possibly be streamed over the Web by following a hyperlink that led to a web page requesting bank card info.
“After I posted in regards to the website, a buddy of mine indicated [the same thing] occurred to her when her good friend handed away two weeks in the past,” George stated.
Looking Fb/Meta for just a few easy key phrases like “funeral” and “stream” reveals numerous funeral group pages on Fb, a few of them for providers up to now and others erected for an upcoming funeral.
All of those teams embody photos of the deceased as their profile picture, and search to funnel customers to a handful of newly-registered video streaming web sites that require a bank card fee earlier than one can proceed. Much more galling, a few of these pages request donations within the title of the deceased.
It’s not clear what number of Fb customers fall for this rip-off, nevertheless it’s value noting that many of those pretend funeral teams appeal to subscribers from no less than a few of the deceased’s followers, suggesting these customers have subscribed to the teams in anticipation of the service being streamed. It’s additionally unclear how many individuals find yourself lacking a good friend or beloved one’s funeral as a result of they mistakenly thought it was being streamed on-line.
Considered one of many look-alike touchdown pages for video streaming providers linked to rip-off Fb funeral teams.
George stated their good friend’s funeral service web page on Fb included a hyperlink to the supposed live-streamed service at livestreamnow[.]xyz, a site registered in November 2023.
In line with DomainTools.com, the group that registered this area is known as “apkdownloadweb,” relies in Rajshahi, Bangladesh, and makes use of the DNS servers of a Website hosting firm in Bangladesh referred to as webhostbd[.]internet.
A search on “apkdownloadweb” in DomainTools exhibits three domains registered to this entity, together with live24sports[.]xyz and onlinestreaming[.]xyz. Each of these domains additionally used webhostbd[.]internet for DNS. Apkdownloadweb has a Fb web page, which exhibits quite a few “reside video” teasers for sports activities occasions which have already occurred, and says its area is apkdownloadweb[.]com.
Livestreamnow[.]xyz is at present hosted at a Bangladeshi webhosting supplier named cloudswebserver[.]com, however historic DNS data present this web site additionally used DNS servers from webhostbd[.]internet.
The Web tackle of livestreamnow[.]xyz is 148.251.54.196, on the internet hosting big Hetzner in Germany. DomainTools exhibits this identical Web tackle is dwelling to practically 6,000 different domains (.CSV), together with lots of that reference video streaming phrases, like watchliveon24[.]com and foxsportsplus[.]com.
There are literally thousands of domains at this IP tackle that embody or finish within the letters “bd,” the nation code top-level area for Bangladesh. Though many domains correspond to web sites for electronics shops or blogs about IT matters, simply as many comprise a good quantity of placeholder content material (assume “lorem ipsum” textual content on the “contact” web page). In different phrases, the websites seem legit at first look, however upon nearer inspection it’s clear they don’t seem to be at present utilized by energetic companies.
The passive DNS data for 148.251.54.196 present a shocking variety of outcomes which can be mainly two domains mushed collectively. For instance, there’s watchliveon24[.]com.playehq4ks[.]com, which shows hyperlinks to a number of funeral service streaming teams on Fb.
One other mixed area on the identical Web tackle — livestreaming24[.]xyz.allsportslivenow[.]com — lists dozens of hyperlinks to Fb teams for funerals, but additionally for nearly all sorts of occasions which can be introduced or posted about by Fb customers, together with graduations, concert events, award ceremonies, weddings, and rodeos.
Even group occasions promoted by state and native police departments on Fb are truthful sport for these scammers. A Fb web page maintained by the police drive in Plympton, Mass. for a city social occasion this summer season referred to as Plympton Night time Out was rapidly made into two totally different Fb teams that knowledgeable guests they might stream the festivities at both espnstreamlive[.]co or skysports[.]reside.
WHO’S BEHIND THE FAKEBOOK FUNERALS?
Recall that the registrant of livestreamnow[.]xyz — the bogus streaming website linked within the Fb group for George’s late good friend — was a company referred to as “Apkdownloadweb.” That entity’s area — apkdownloadweb[.]com — is registered to a Mazidul Islam in Rajshahi, Bangladesh (this area can be utilizing Webhostbd[.]internet DNS servers).
Mazidul Islam’s LinkedIn web page says he’s the organizer of a now defunct IT weblog referred to as gadgetsbiz[.]com, which DomainTools finds was registered to a Mehedi Hasan from Rajshahi, Bangladesh.
To carry this full circle, DomainTools finds the area title for the DNS supplier on all the above-mentioned websites — webhostbd[.]internet — was initially registered to a Md Mehedi, and to the e-mail tackle webhostbd.internet@gmail.com (“MD” is a typical abbreviation for Muhammad/Mohammod/Muhammed).
A search on that e-mail tackle at Constella finds a breached file from the information dealer Apollo.io saying its proprietor’s full title is Mohammod Mehedi Hasan. Sadly, this isn’t a very distinctive title in that area of the world.
However as luck would have it, someday final yr the administrator of apkdownloadweb[.]com managed to contaminate their Home windows PC with password-stealing malware. We all know this as a result of the uncooked logs of information stolen from this administrator’s PC have been listed by the breach monitoring service Constella Intelligence [full disclosure: As of this month, Constella is an advertiser on this website].
These so-called “stealer logs” are principally generated by opportunistic infections from information-stealing trojans which can be offered on cybercrime markets. A typical set of logs for a compromised PC will embody any usernames and passwords saved in any browser on the system, in addition to a listing of latest URLs visited and information downloaded.
Malware purveyors will typically deploy infostealer malware by bundling it with “cracked” or pirated software program titles. Certainly, the stealer logs for the administrator of apkdownloadweb[.]com present this consumer’s PC grew to become contaminated instantly after they downloaded a booby-trapped cellular utility growth toolkit.
These stolen credentials point out Apkdownloadweb[.]com is maintained by a 20-something native of Dhaka, Bangladesh named Mohammod Abdullah Khondokar.
The “browser historical past” folder from the admin of Apkdownloadweb exhibits Khondokar lately left a touch upon the Fb web page of Mohammod Mehedi Hasan, and Khondokar’s Fb profile says the 2 are buddies.
Neither MD Hasan nor MD Abdullah Khondokar responded to requests for remark. KrebsOnSecurity additionally sought remark from Meta.
