The Spamhaus Project🕵♂️ Spamhaus researchers have observed a phishing scam imitating @interpol_hq - the International Criminal Police Organization.
Scammers are using #Instagram, #Facebook, #Messenger and #MetaAudienceNetwork to carry out their malicious activity, luring people with slick videos and directing them to a domain, "int-returnback[.]com."
One telltale sign of the suspicious activity is the presence of a more "official" logo. And there's more....
We've seen this formula before, but this time, the ads directed you to a different domain: "int-returnback[.]org." Except it looks like they forgot to check the name and address: "Ivan Ivanov." Later versions show a "Mr. John Johnson".
So, what else do we know?
🔎 Investigations into "int-returnback[.]com" reveal several similar domains hosted on the same server. Meanwhile, the .org variant of the domain is concealed behind Cloudflare. Unfortunately, this makes it very difficult to conduct further investigations and takedowns for future campaigns.
❗ Numerous Interpol-branded advertisements are circulating, with some falsely claiming to be official.
As always, be vigilant - never follow suspicious links, always use your bookmarked links, and please submit any phishing scams you receive to the Threat Intel Community below:
