New DMV Texting Scam. Don't get tricked by it

[Shalom_Karr]

Someone just tried scamming me by texting me this image - It looks real, don’t fall for it

[Shalom_Karr]

Apparently its going around and a lot of people are getting this.

I spoke to someone in the local police department and the detective bearau is aware of it and investigating

[Techgen]

If you check the link the QR code sends you to its tio.usamotortoys.com/public/9Qw5OZ which could be a giveaway, that sends you to http://ohio.lcrsz.life/bmv/ . Which although looks like a convincing website, there are a few points that are suspicious if you’re looking, starting from the non government extension of .life

For some reason the links come up clean in virustotal’s url checker, I tried a few anti-phishing extensions and none of them flagged it. This is quite obviously a phishing website, I’m not sure why no one is picking it up. maybe its too new? If anyone had good AI detections it should pick up flags like the fake buttons/links on the website etc…

[Flippy]

Here is the site they’re redirecting to
https://tio.usamotortoys.com/public/9Qw5OZ -> https://ohio.lcrsz.life/bmv/

Real Website:
https://www.bmv.ohio.gov/index.aspx

I have to say I’m actually impressed when they do the smart thing make a 1:1 copy instead of their own horrible website.

[Techgen]

Update: ESET and checkphish.ai say its fine, easydmarc.com BitDefender and Trend Micro say its not. At least some are flagging it

[Techgen]

Yeah, looks not bad, this part cracked me up

they’re betting you don’t click on it because nothing happens, just like all the links on the site.

It’s also a little interesting that the original letter looks quite threatening, but over here its just $6.99 for a parking violation. Pretty sure that wont get you suspended license etc…

[Techgen]

Also interesting, if you check the URL in the scam example from the real website its https://hin.obediencegb.xyz/r/ohbb Which is flagged by google safe browsing, which means its blocked by default on many browsers, but still its only 2/95 on Virustotal

Malwarebytes extension picked this one up

[Shalom_Karr]

I reported this to the Local Police and to Google and Microsoft and FTC and IC3 and Cloudflare

[Flippy]

I reported to Dynadot

@Techgen

the URL in the scam example from the real website

Where is that?

[Techgen]

[Shalom_Karr]

I got a different version

[Shalom_Karr]

Reported to Ohio Attorney General’s office

[Shalom_Karr]

Here is a summary of what happened

Post · Shalom Karr

Obviously assisted by AI

[Techgen]

Thanks for taking care of it. And thanks for the shout out! Or was that just AI reading this thread?

[Shalom_Karr]

No, I changed the AI write up manually to give it to you

[Shalom_Karr]

Does this mean that its hosted somewhere else? what is the source?

[Shalom_Karr]

[AyilMeshilesh]

Similar, but more local.
Two people asked me last week about that one.
A quick Google search on the case no., and I knew it’s a scam. but many people out there did not ask from me…

[Nooch]

Yes many people are saying they are getting these texts/emails and it’s a scam

[Shalom_Karr]

Follow the qr code on a VM and give me the URL and we can report it