A huge batch of scam text messages with links going to onlinehome.us have been going out, phishing for your Amazon, Netflix, Venmo, and other credentials. Many of them appear to include the strings “membershpspprt” or “mailspprtaccnt” in the ‘from’ field, suggesting that they are all part of a bot effort using the same script or scripts.

Of course, if you read the messages, they all reveal the fact that they are scams in one way or another (usually in several ways), from the very bizarre “from” addresses, such as “appx.rstrt-membershpspprt-servsstandarscons.hbxsaems8197-621fiie@wisaktifkuh.com” (although you will almost certainly only see the first part of that address), to the poor English, and to the misspelled words.

And then, of course, there are the links. Nearly all of them that we have seen so far are hosted at the domain “onlinehome.us”. According to [destination content has been removed at other end :~( ], “Onlinehome.us is a phishing site that is commonly used by cybercriminals to host phishing websites and steal personal and financial information from unsuspecting victims.” Not that we needed the confirmation of course, given all of the evidence, but it’s nice to have our own conclusions supported by others in the industry.

The messages, all scam text messages with a link for you to follow, read like some of the following, which are real examples from some of the recent scam messages:

“Your A‌m‌az‌on Acc‌o‌unt has been locked. We recently received multiple failed login attempts to your acc‌o‌unt. Re͏͏c͏͏‌o͏͏‌v͏͏e͏͏r͏͏y͏͏ y͏͏‌o͏͏‌u͏͏r͏͏ a͏͏c͏͏c͏͏‌o͏͏u͏͏‌n͏͏t͏͏ i͏͏‌m͏͏m͏͏e͏͏d͏͏‌i͏͏a͏͏‌t͏͏e͏͏l͏͏y͏͏ c͏͏‌l͏͏i͏͏‌c͏͏k͏͏ l͏͏i͏͏‌n͏͏k͏͏ b͏͏‌e͏͏l͏͏‌‌l͏͏o͏͏w͏͏: https://www.theinternetpatrol.com/brick-wall/ P͏l͏e͏‌‌a͏s͏e͏ t͏a͏‌k͏e͏ a͏c͏t͏i͏‌o͏n͏ o͏n͏ y͏o͏u͏r͏ a͏c͏‌c͏o͏‌u͏n͏t͏ w͏i͏t͏‌‌h͏‌‌i͏n͏ 4͏‌8͏ h͏‌o͏u͏r͏s͏ t͏‌o͏ a͏v͏‌o͏‌i͏d͏ p͏‌e͏r͏m͏‌a͏n͏‌e͏n͏t͏ s͏u͏‌s͏p͏e͏‌n͏s͏i͏‌o͏n͏. Regards, Ama‌z‌on Ser‌v‌ice”

“Your A‌m‌az‌on Acc‌o‌unt has been locked. We recently received multiple failed login attempts to your acc‌o‌unt. Re͏͏c͏͏‌o͏͏‌v͏e͏͏r͏͏ y͏͏o͏͏u͏͏r͏͏ a͏͏c͏͏c͏͏‌o͏͏u͏͏‌n͏͏t͏͏ i͏͏‌m͏͏m͏͏e͏͏d͏͏‌i͏͏a͏͏t͏͏e͏͏l͏͏y͏͏ c͏͏‌l͏͏i͏͏‌c͏͏k͏͏ l͏͏i͏͏‌n͏͏k͏͏ b͏͏‌e͏͏l͏͏‌‌l͏͏o͏͏w͏͏: https://www.theinternetpatrol.com/brick-wall/ P͏l͏e͏‌‌a͏s͏e͏ t͏a͏‌k͏e͏ a͏c͏t͏i͏‌o͏n͏ o͏n͏ y͏o͏u͏r͏ a͏c͏‌c͏o͏‌u͏n͏t͏ w͏i͏t͏‌‌h͏‌‌i͏n͏ 4͏‌8͏ h͏‌o͏u͏r͏s͏ t͏‌o͏ a͏v͏‌o͏‌i͏d͏ p͏‌e͏r͏m͏‌a͏n͏‌e͏n͏t͏ s͏u͏‌s͏p͏e͏‌n͏s͏i͏‌o͏n͏. Regards, Ama‌z‌on Ser‌v‌ice”

(At least that second one corrected ‘recovery’ to ‘recover’, but still misspelled ‘below’ as ‘bellow’.)

“Your Venmo Acc‌o‌unt has been locked. We recently received multiple failed login attempts to your acc‌o‌unt. Re͏͏c͏͏‌o͏͏‌v͏͏e͏͏r͏͏y͏͏ y͏͏‌o͏͏‌u͏͏r͏͏ a͏͏c͏͏c͏͏‌o͏͏u͏͏‌n͏͏t͏͏ i͏͏‌m͏͏m͏͏e͏͏d͏͏‌i͏͏a͏͏‌t͏͏e͏͏l͏͏y͏͏ c͏͏‌l͏͏i͏͏‌c͏͏k͏͏ l͏͏i͏͏‌n͏͏k͏͏ b͏͏‌e͏͏l͏͏‌‌l͏͏o͏͏w͏͏: https://www.theinternetpatrol.com/brick-wall/ P͏l͏e͏‌‌a͏s͏e͏ t͏a͏‌k͏e͏ a͏c͏t͏i͏‌o͏n͏ o͏n͏ y͏o͏‌u͏r͏ a͏c͏‌c͏o͏‌u͏n͏t͏ w͏i͏t͏‌‌h͏‌‌i͏n͏ 4͏‌8͏ h͏‌o͏u͏r͏s͏ t͏‌o͏ a͏v͏‌o͏‌i͏d͏ p͏‌e͏r͏m͏‌a͏n͏‌e͏n͏t͏ s͏u͏‌s͏p͏e͏‌n͏s͏i͏‌o͏n͏. Regards, Venmo Ser‌v‌ice”

“Your Membership is on ho‌ld. To using your ac‌co‌unt as normally, you need to up‌date some t‌ro‌u‌ble with your current bi‌ll‌ing in‌for‌mat‌ion. Cl͏͏‌i͏͏c͏͏‌k͏͏ l͏͏i͏͏‌n͏͏k͏͏ b͏͏e͏͏l͏͏‌l͏͏o͏͏w͏͏ to upd‌ate your ac‌c‌ou‌nt : https://www.theinternetpatrol.com/brick-wall/ Regards,
N‌et‌fli‌x P‌te. Lt‌d.”

So far the ‘from’ addresses that we have seen include these:

appx.rstrt-membershpspprt-servsstandarscons.hbxsaems8197-621fiie@wisaktifkuh.com
appsx.custs-mailspprtaccnt-ntflxnetregard.jhgzulwpth4298-111uqea@jossgaes6.es
appx.rstrt-membershpspprt-servsstandarscons.hbxsaems8197-621fiie@wisaktifkuh.com
authrpf.custs-mailspprtaccnt-vnmo447-06957orr@parismanagehostingz02.name
appsx.custs-mailspprtaccnt-venmoidregards.ibnngbuahy9986-034ckhv@wisdetek.es
act.custm-mailspprtaccnt-auth619-22886-09773@webspageaws05.com
authvrfy.cust-mailspprtaccnt-amzco-14504-06911@infoadamsverify03.com
authplr.cust-mailspprtaccnt-amzco-72484-08698@newupdatedams01.it
authentication.supportissue-customer-22001-06621@accntrcvry03.cloud
noreply.whilethey-investigate-situation-22474-07860tka@italkerongkewebspace.cloud

Of course, generally our readers know to not follow any link that arrives in their text messages or email out of the blue, and to instead go directly to the website of the service that has supposedly sent the message, and to log into their account directly. So hopefully this is just confirmation of what you already know if you receive one of these text messages.

We’ve had reports of people receiving 4, 5, even 6 of these messages a day. How many have you received?