Anomali Threat Research Warns Consumers: Don’t Use Bitcoin to Buy “Hatched” German Shepherds This Holiday Season

• In early December 2020, Anomali Threat Research identified a website engaging in fraudulent dog sales, specifically for German Shepherds.
• The analysis revealed 17 additional websites also engaging in pet fraud activities for birds and cats, as well as one phone number match for a Facebook page car fraud scheme, and one number for an essential oils scam.
• The actor(s) behind this campaign are not sophisticated, and aim to receive non-refundable deposits for fraudulent pet sales and services; payment methods include Bitcoin, PayPal, Zelle, etc.
• The actor(s) have been active since at least November 2018.

Threat actor(s) engaging in fraudulent pet-selling activities appear to have increased their recent efforts as the Holiday Season continues. The actors are scamming victims into believing that birds, cats, and dogs are available for purchase.

The COVID-19 pandemic has increased pet purchases as stay-at-home policies and remote work makes people seek companionship from their animal friends, a condition that may amplify the bad actors’ ability to run a more successful scam. Furthermore, these scams focus on purebred dogs, which again are increasingly difficult to find.

The fraud scheme works as shown in Figure 1 below.

Figure 1 – Fraud Chain

In early December 2020, Anomali Threat Research discovered a suspicious website (darlinggermanshepherds[.]com) purporting to be selling German Shepherd puppies, shown in Figure 2 below. The website is designed with a modicum of skill where actors took images and text from open sources (Facebook, legitimate websites, Wikipedia) to make their site appear more authentic.

Figure 2 –  darlinggermanshepherds[.]com Homepage

Anomali Threat Research analyzed the website and was able to find 17 additional websites engaging in pet fraud. The websites all share similar and sometimes identical text in their reviews/testimonials pages. There are also numerous typos in the testimonials with one post discussing how a German Shepherd had “hatched” and was available, which is a clear copy-and-paste error from the actors’ bird fraud websites. The analysis revealed a pet fraud campaign spanning multiple websites and shared hosting providers.

Text Analysis

Anomali Threat Research found commonalities amongst the text throughout the websites. Obvious words were incorrect, such as testimonials with extra spaces where the actor changed the type of animal or forgot to change to the appropriate pet as advertised on the site. Table 1 below shows a small sample of how the actors are using identical and modified versions of the same testimonials located on multiple websites.

Table 1 – Re-use of Testimonials / Reviews

The actors appear to have put in slightly more effort when populating their sites with animal images. Most of the images are from old, ancient by technology standards, websites that are no longer maintained by administrators, and from generic locations like Facebook and Wikipedia. This makes some of the images almost unique because they are only located on these old sites and the fraudulent ones.

Figure 3 – Example Fake Puppies for Sale: guardgoldenretriever[.]com, beaglepuppiesforsales.com, gorgeousgentlepuppies[.]com

• Be extremely cautious if the price is too good to be true.
• Be extremely cautious if the site does not provide you with the owner’s names, address, and social pages.
• Pay attention to elaborate testimonials that are too good to be true. They are often copied too, so you may google a part of it to see if it is unique.
• Pay attention to typos and phrases like “Labrador baby had hatched,” scammers often sloppy in their templates and have bad English. 
• If they give you a phone number, try Googling it. Often the fraudsters use the same phone number for different schemes, and it might be already listed on some scam lists.
• Be extremely careful if you are advised to pay for your future pet with Bitcoins or gift cards, which is even more suspicious

For more technical users:

• Check the domain creation date. It is especially suspicious if the domain was registered this year, but has a copyright footnote with a 2015 timestamp.
• Do a reverse image search to see if the images were stolen from another site.
• See if HTML code connects this site with other suspicious domains. Advanced site builders might have matching tags such as Google Analytics ID. Basic fraud sites described here often had meta tags copied from another domain.

Fraud domains

akomplekt.by/oze9s/macaw-rescue-texas.html
beaglepuppiesforsales.com
darlinggermanshepherds.com
darlinglabradors.com
cutepuppiesforsaleonline.com
goldendoodlehomess.com
gorgeousgentlepuppies.com
guardgoldenretriever.com
hermanparrots.com
hyacinthmacawparrotsfarm.com
miniaturedachshundpups.com
parrotsnestbreeders.com
outstandinggoldenretrievers.com
ragdollkittenhomecattery.com
romelsboxerpuppies.com
saparrotsbreeders.com
worleysgoldenretrieverpet.com

Phone Numbers

+1 3025143315
+27 834893640
+27 835885423