Since it’s an .html file virus scanners would claim it was not infected since the file isn’t infected with a virus or trojan. This is just a phishing attempt which starts when a user opens the fake internet page.

So I viewed the source code of the file in notepad ++ and this is what I found.

<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
.container {
  position: relative;
  width: 100%;
  max-width: 400px;
}

.container img {
  width: 100%;
  height: auto;
}

.container .btn {
  position: absolute;
  top: 50%;
  left: 50%;
  transform: translate(-50%, -50%);
  -ms-transform: translate(-50%, -50%);
  background-color: #228B22;
  color: white;
  font-size: 16px;
  padding: 12px 24px;
  border: none;
  cursor: pointer;
  border-radius: 5px;
  text-align: center;
}

.container .btn:hover {
  background-color: black;
}
</style>
</head>
<body>

<h2><font face="arial"><u>D<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>ocu<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>ment is sec<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>ured</u></font></h2><br>
<p><b><font face="sans serif">Cl<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>ic<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>k be<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>low to v<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>iew com<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>ple<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>te fi<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>le</font></b></p>

<div class="container">
  <img src="https://i.ibb.co/qghx6vy/b.jpg" alt="invoice" style="width:100%;height:100%">
  <button class="btn" onclick="window.location.href='https://ingenioxicotencatl.com/adk/wamp.php?warp=020202'" >Vie<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>w Fi<span style="font-size: 0px">jgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugk</span>le</button>
</div>

</body>
</html>

If you actually look through the code you will quickly learn that all that gibberish and random letters will not show up on the page due to it being between the tags shown below.

<span style="font-size: 0px"> </span>

Instead anybody viewing the page would simply see the following words.

Document is secured

Click below to view complete file

View File

The words “View File” are actually a button which goes to the url shown in the code above.

Aka this is just a lame phishing attempt that somebody is trying to confuse the average person with however I’m no average person and simply do not fall for tricks like this.

Check out the links below for more information regarding phishing.

• Why we fall for phishing e-mails
• 6 sure signs somebody is phishing you
• What to do after a phishing attack.
• What are the latest phishing scams in 2020

Leave me a comment below if you enjoyed this article!

Since Coronavirus has spread most people are hording:

• Toilet paper
• Soap
• Cleaning products
• Hand Sanitizer
• Masks
• Food

Since Coronavirus has spread many nations & companies are:

• shutting down stores
• closing schools
• closing jobs or pushing working from home
• canceling sporting events
• canceling concerts, festivals, parades, etc
• offering free remote tools to work from home

Essentially the entire world is “shutdown” until further notice.

I urge everybody to take precautions but remain calm during this Coronavirus pandemic since freaking out will only cause added stress and chaos in an already crazy world.

Follow the steps at the CDC Website to take steps to protect yourself.

While the Coronavirus pandemic may be a very serious threat to the well being of people, I believe it’s also a great way for the government to control people in each nation & confine us all to our homes or take away other freedoms.

The Earn It Act

For example while the Coronavirus pandemic is going on congress is trying to pass “The EARN IT Act” which will do away with encryption and give the government the backdoor they have long wanted into your data. Read about it here.

If you haven’t yet please subscribe to my blog to keep on up my posts!

Today I’m going to show u some ways to figure out exactly what Google knows about you aside from just googling your name in a google search.

AdSettings

First login to your google account and then go to: adssettings.google.com. On this page you will see what google thinks you like along with your age and sex. Chances are google has you pegged correctly.

Activity Tracking

Next, this is where this gets scary. You can actually see all the activity that google is tracking on you. Who knows what they do with this data. Go to myactivity.google.com & check out the activity. It might just scare you!

Location Tracking

Even more scary, Google knows everywhere you have been to or searched for on Google maps! To see that data go to google.com/maps/timeline & you will see that Google tracks you everywhere & has for years!

What I found?

I was able to find that google knows my name, gender, birth date, personal cell number, websites I visited, exactly where I’ve been for years and even knows when I have used google voice. If I had Google Home it would know exactly when I used that to turn on a light for example.

And this folks is why I have been trying to limit myself from smart devices, IOT home devices, and big brother services such as Google, Google Chrome, Google Home, Alexa, Amazon, Microsoft and other big brother names. They all track you in similar ways that google does.

In the space of hours, Ukraine’s government, top energy companies, private and state banks, main airport, and Kyiv’s metro system all reported hits on their systems. The attacker was not immediately clear—Wired, in a recent story, described Russia as using its neighbor as a “test lab for cyber war,” but Moscow denies any part in past attacks. Its own state oil giant Rosneft also reported being hit by a cyberattack today; Rosneft’s website was unresponsive at time of writing. It’s unclear if the attacks are linked. Another Russian oil firm, Bashneft, has been hit too.

More at QZ.com

I noticed they also attempted to gain access into my personal linux servers from several different IPs as well but failed according to the logs.

Apr 3 06:41:58 localhost sshd[13237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95-37-149-222.dynamic.mts-nn.ru
Apr 3 06:42:01 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:01 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:03 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:03 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:05 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:05 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:06 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:06 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:08 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:09 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:11 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:11 localhost sshd[13237]: Disconnecting: Too many authentication failures for invalid user testuser from 95.37.149.222 port 35504 ssh2 [preauth]
Apr 3 06:42:11 localhost sshd[13237]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=95-37-149-222.dynamic.mts-nn.ru

Apr 3 07:59:06 localhost sshd[15373]: reverse mapping checking getaddrinfo for host-77-41-104-93.qwerty.ru [77.41.104.93] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 3 07:59:06 localhost sshd[15373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.41.104.93 user=root
Apr 3 07:59:08 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:10 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:13 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:15 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:17 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:19 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:19 localhost sshd[15373]: Disconnecting: Too many authentication failures for root from 77.41.104.93 port 27391 ssh2 [preauth]

Apr 3 08:17:05 localhost sshd[15940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dd5760a8f.access.telenet.be
Apr 3 08:17:08 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:08 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:10 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:10 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:12 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:12 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:14 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:14 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:16 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:16 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:18 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:18 localhost sshd[15940]: Disconnecting: Too many authentication failures for invalid user bananapi from 213.118.10.143 port 42883 ssh2 [preauth]

Apr 3 08:21:36 localhost sshd[16105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.130.111.209
Apr 3 08:21:37 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:38 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:38 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:39 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:40 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:40 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:43 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:43 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:43 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:45 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:46 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:47 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:48 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:48 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:50 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:50 localhost sshd[16099]: Disconnecting: Too many authentication failures for root from 186.130.111.209 port 47246 ssh2 [preauth]

The list just goes on and on where they guess usernames and passwords to brute force their way into my systems, the above is only a few attempts I shared.

Bottom line it just looks like some script kiddies were trying to have some fun at my expensive but failed which is great on my part but just makes me that much more aware of potential pitfalls in my network and why it is important to secure them and monitoring them closely.

If you run servers or even have a home network then I suggest you closely monitor yours as well!

If you weren’t worried about privacy before then you should be now!

Read the full details here at WikiLeaks

Please leave us a comment at the bottom if you might of fallen for one of these phishing e-mails!

Colorful Language!

This first one is from somebody claiming to be “Cadwalader, Wickersham and Taft LLP” using colorful language and trying to trick you into clicking on a fake link to what is likely a phishing website or virus/malware.

Apple Phishing

This 2nd one is claiming to be from Apple & is trying to trick you to click a link and login to your apple account.

Were you to actually click the link and login to your apple account they likely would capture your real apple password through the fake website!

Upgrade your Account!

This is a phishing e-mail trying to trick you into clicking on a link to “Upgrade” your account to see your “missing e-mails”

Here’s another one trying to trick you into clicking a link to upgrade your account.

Print This

This one is trying to trick the user into clicking a link so they can help somebody out by “printing” a document for them. Quite a weird phishing e-mail if u ask me!

You’ve been selected!

Phishing scam from “Amazon” trying to get you to complete some survey. It’s not really from amazon and u won’t actually get anything but maybe some malware or a virus if you do anything this says!

Would you of fallen for any of these phishing e-mails?! Leave us a comment below!

According to web security firm Sucuri, who detected the attacks after details of the vulnerability became public last Monday, the attacks have been slowly growing, reaching almost 3,000 defacements per day.

Attackers are exploiting a vulnerability in the WordPress REST API, which the WordPress team fixed almost two weeks ago, but for which they published public details last Monday.

The vulnerability allows a remote attacker to craft an HTTP request that pings a REST API endpoint and alters titles and content on the user’s website.

Exploiting the flaw is trivial, and according to Sucuri, a few public exploits have been published online since last week.

Over 67,000 websites defaced already

Even if the vulnerability affects only WordPress 4.7.0 and 4.7.1 and the CMS has a built-in auto-update feature for security issues, many websites haven’t been updated.

Based on data collected from Sucuri’s honeypot test servers, four attackers have been busy in the past week trying to exploit the flaw.

Since the attacks have been going on for some days, Google has already started to index some of these defacements.

Currently, the groups using the REST API flaw to deface websites are only doing it for public brand exposure, only altering page titles and their content by adding their own name.
One of the defaced sites

Sucuri’s CTO, Daniel Cid, expects to see professional defacers enter the fold, such as SEO spam groups that will utilize the vulnerability to post more complex content, such as links and images.

This types of defacements are used to boost the SEO ranking of other sites or promote shady products. Websites that suffer from SEO-targeted defacements also have their SERP (Search Engine Result Page) indicator affected and risk losing their reputation on search engines, which in turns drives down traffic to their site.

Website owners are advised to update to WordPress 4.7.2. as soon as possible in order to avoid losing visibility on Google due to this REST API security issue.

Source: Bleeping Computer

Palo Alto Networks threat intelligence analyst Brad Duncan reported that “Spora”, a powerful new ransomware strain that is able to encrypt files without communicating to a command-and-control server, is using a social engineering attack vector using fake “Chrome Font Pack” pop-ups.

Most ransomware spreads either through spam and email attachments or “malvertising”—fake ads that contain malware or malware links. Spora exploits unpatched vulnerabilities in both browsers and operating systems.

Spora’s evil geniuses have compromised multiple websites and turned the website pages into an unreadable font.  They tell visitors that the “HoeflerText” font is missing from the user’s browser and that they can fix this by downloading the “Chrome Font Pack.”

People then download and install the malicious code by double-clicking the “update.exe” file which kicks off the malicious code. The bad guys even provide help by showing where the victims can find the install file.

The moral of the story is this:  Be vigilant, be aware, and be prepared.   Keep your computer’s browsers updated to the latest versions, and make sure your operating systems are updated with the latest security patches.

And as always, “Think Before You Click”!

There was controversy earlier this month when news broke about how Adobe took the opportunity on Patch Tuesday of using its regular security updates to force Adobe Acrobat DC users into silently installing a Google Chrome extension.

As Bleeping Computer reports, most people first found out about the extension, which offers the ability to easily convert webpages into PDF files, when they saw a prompt asking them to approve the following permissions:

• Read and change all your data on the websites you visit
• Manage your downloads
• Communicate with cooperating native applications

Read more on: TripWire