In the past week, I have received texts asking to update my Netflix account information. It is obvious the URL listed in the text isn’t Netflix. The text looks like this:
I downloaded the URL to see what the website look like using wget nfca03-novm19-h13[.]com which resolves to 126.96.36.199 located in the Netherlands. The webpage looks interesting but it is obvious it doesn’t look like the real website. The inbound phone number is located in Canada and their real goal is to obtain fraudulent credit card information.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.