#irsf — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #irsf, aggregated by home.social.
-
One tap to continue watching. Also: one tap to charge your phone bill €4.50. Click2SMS, what good are you, anyway?
A redirect chain took us from a compromised legitimate site, through help_tds, then through a familiar Germany-based commercial TDS, to hmtraff[.]com where we finally arrived at d[.]gosmartdecision[.]com — part of an IRSF ecosystem we've been tracking since our fake CAPTCHA report.
The landing page shows a fake video player. A large "Continue" button sits in front of it. That button is <a href="sms:81183?body=360 *CWZQ...">. One tap opens the SMS app, pre-loaded with a message to a premium-rate French shortcode. 4.50 EUR per code.
Where the fake CAPTCHA required four separate actions to maintain a verification illusion, the video player needs one. Simpler, faster, probably more effective. The legal disclosure with the price is below the fold in 10pt text, while the large "Continue" button is in the middle of the screen.
There's a second bonus layer: the page runs device fingerprinting and injects a credit card collection form for non-mobile visitors — cardholder name, number, CVV, expiry. Mobile French users see the Click2SMS flow. Others may get card phishing. Two modes. One domain. DNS-visible delivery chain throughout.
hmtraff[.]com
d[.]gosmartdecision[.]comFinal landing page: https://urlscan.io/result/019f14b2-c99e-7677-a742-61f7c814b545/
Prior report: https://www.infoblox.com/blog/threat-intelligence/hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #smishing #tds #irsf
-
One tap to continue watching. Also: one tap to charge your phone bill €4.50. Click2SMS, what good are you, anyway?
A redirect chain took us from a compromised legitimate site, through help_tds, then through a familiar Germany-based commercial TDS, to hmtraff[.]com where we finally arrived at d[.]gosmartdecision[.]com — part of an IRSF ecosystem we've been tracking since our fake CAPTCHA report.
The landing page shows a fake video player. A large "Continue" button sits in front of it. That button is <a href="sms:81183?body=360 *CWZQ...">. One tap opens the SMS app, pre-loaded with a message to a premium-rate French shortcode. 4.50 EUR per code.
Where the fake CAPTCHA required four separate actions to maintain a verification illusion, the video player needs one. Simpler, faster, probably more effective. The legal disclosure with the price is below the fold in 10pt text, while the large "Continue" button is in the middle of the screen.
There's a second bonus layer: the page runs device fingerprinting and injects a credit card collection form for non-mobile visitors — cardholder name, number, CVV, expiry. Mobile French users see the Click2SMS flow. Others may get card phishing. Two modes. One domain. DNS-visible delivery chain throughout.
hmtraff[.]com
d[.]gosmartdecision[.]comFinal landing page: https://urlscan.io/result/019f14b2-c99e-7677-a742-61f7c814b545/
Prior report: https://www.infoblox.com/blog/threat-intelligence/hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #smishing #tds #irsf
-
Czy da się zarobić na mechanizmie CAPTCHA? Atakujący znaleźli sposób. Kulisy kampanii IRSF
Mechanizm CAPTCHA to nic innego jak proste zadania polegające na przepisaniu zniekształconych wyrazów, zaznaczeniu niepasujących elementów lub odpowiednim ustawieniu brakującego obrazka. Stał się na tyle popularny i powszechny, że wykonujemy go niemal mechanicznie bez większego zastanowienia. Rozwiązujemy zadanie, zaznaczamy checkbox (o ile taki istnieje), że “jesteśmy człowiekiem” i czekamy na...
-
Czy da się zarobić na mechanizmie CAPTCHA? Atakujący znaleźli sposób. Kulisy kampanii IRSF
Mechanizm CAPTCHA to nic innego jak proste zadania polegające na przepisaniu zniekształconych wyrazów, zaznaczeniu niepasujących elementów lub odpowiednim ustawieniu brakującego obrazka. Stał się na tyle popularny i powszechny, że wykonujemy go niemal mechanicznie bez większego zastanowienia. Rozwiązujemy zadanie, zaznaczamy checkbox (o ile taki istnieje), że “jesteśmy człowiekiem” i czekamy na...
-
Send an SMS to confirm you're a human? That's strange. How about dozens of SMS, to locations all over the world? That sounds more like a hot take on International Revenue Share Fraud (IRSF). Infoblox Threat Intel has come across an operation that defrauds both individuals and telecoms by way of social engineering victims through the use of a fake CAPTCHA process.
With IRSF, fraudsters generate their revenue by driving call or SMS traffic to numbers to which they have revenue sharing agreements with the local telecoms. Historically, this has been done by methods like hacking an organization's PBX system, or using bots to abuse services that generate one-time-passwords, and directing that call or SMS traffic to numbers under their control.
This operation, however, takes advantage of individuals' familiarity with the CAPTCHA process, by adding a multi-stage requirement to send bulk SMS to get access to games, videos, or adult content - because of course, these things are so hard to access online otherwise.
In this case, the victims are two-fold. First, it impacts the people who get unexpected international SMS charges on their bill, and then the telecoms who both pay termination fees to the international destinations telecom, and who also possibly absorb the cost of the chargeback.Read more about our investigation into this new flavour of scam, including the specific domains and infrastructure we uncovered, here: https://www.infoblox.com/blog/threat-intelligence/hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas/
#threatintel #cybercrime #threatintelligence #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #IRSF #telecom #captcha
-
Send an SMS to confirm you're a human? That's strange. How about dozens of SMS, to locations all over the world? That sounds more like a hot take on International Revenue Share Fraud (IRSF). Infoblox Threat Intel has come across an operation that defrauds both individuals and telecoms by way of social engineering victims through the use of a fake CAPTCHA process.
With IRSF, fraudsters generate their revenue by driving call or SMS traffic to numbers to which they have revenue sharing agreements with the local telecoms. Historically, this has been done by methods like hacking an organization's PBX system, or using bots to abuse services that generate one-time-passwords, and directing that call or SMS traffic to numbers under their control.
This operation, however, takes advantage of individuals' familiarity with the CAPTCHA process, by adding a multi-stage requirement to send bulk SMS to get access to games, videos, or adult content - because of course, these things are so hard to access online otherwise.
In this case, the victims are two-fold. First, it impacts the people who get unexpected international SMS charges on their bill, and then the telecoms who both pay termination fees to the international destinations telecom, and who also possibly absorb the cost of the chargeback.Read more about our investigation into this new flavour of scam, including the specific domains and infrastructure we uncovered, here: https://www.infoblox.com/blog/threat-intelligence/hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas/
#threatintel #cybercrime #threatintelligence #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #IRSF #telecom #captcha
-
Die IRSF International Refugee Sports Foundation bedankt sich für die erste Laptopspende von Labdoo Germany. Bald werdet ihr übrigens vom IRSF betreute Sportler bei den Olympischen Spielen in Paris treffen. Das Video zeigt Beispiele, wo die IRSF weltweit aktiv ist.
#labdoo #irsf #refugee #sport #foundation -
Die IRSF International Refugee Sports Federation in Frankfurt am Main und @Labdoo_D kooperieren.
Zunächst erhalten einige nach Deutschland geflüchtete Sportler und Sportlerinnen zu Lernzwecken einen Leihlaptop. Später folgen gemeinsame Projekte im Ausland.
https://platform.labdoo.org/de/edoovillage?e=202999
#labdoo #irsf #refugee #sport #federation #frankfurt #sportler #flüchtlinge #support