Special offer

Where does that TinyURL link go to and how to spot a potential attack

By
Real Estate Broker/Owner with https://HugginsHomes.com 01234617

All,

 

Today I received the listing agent's dream email!  An over full price CASH offer on a new listing with no inspection contingencies!  Most agents would say "Time to break out the champagne!" then why am I saying "Something doesn't smell right here"?

 

Let's take a look at the email, shall we?  I've blacked out some identifing information.

First off, I receive a contact yesterday from "HomeSeekers", one of the syndication partners our MLS sends our listings to without our knowledge, consent or ability to control.  It was simply the default "I have questions" box filled in.  I replied with an email asking to setup a time to talk and I got this email back today.  So that has me a little suspicious, afterall why is a BROKER using this website instead of the MLS? 

In reviewing the email, the english is great, however half of the email (where agents typically try to sell me on their clients) is all about how great and trustworthy Google Docs and Dropbox are.  Ok, I'm a former IT guy of 15 years... with 10 of those working for Fortune 100 (and Fortune 50) companies doing their Information Security.  I don't need to be sold on Dropbox/Google Docs, however the convention (since emails and PDFs were common) is to attach the offer as a PDF, but who am I to question the forward progress of technology?  Of course, it is right to question why a Broker with a company is using an ADPPaySheet.net domain (which goes to the ADP payroll company).

 

So now I check the links by hovering over them.  I expect to find links to "Docs.Google.com" and "Dropbox.com" however I find TinyURL.com links instead!!  Now what are the two main reasons to use a link shortener?  I know!  The primary reason is to make links that fit easily into social media posts and riders for signs or advertising.  Ok, that's legit... but what about the second reason?  The second reason for using these is to OBFUSCATE (hide) the end URL from the person clicking the link!  The last five years finishing out my IT career, I taught information security basics to all new hires for several local hospitals.  One of the topics was expanding these URLs before clicking on them.  Using "GetLinkInfo.com" I expanded the two links and found the below information:


First, how to use the site:

Go to the GetLinkInfo.com website and put the shortened URL in question into the box below the logo and click the "Get Link Info" button.



The results I got from the Google Docs link:

YIKES!  Not only does the URL point to some really bizzare website that definitely ISN'T Google Docs, it has four "Unsafe" warnings, including the TinyURL links themselves!  That is four more than I like to see at all!


Ok now, I go back to the home page and try the Dropbox link:

WOW!!  This one is EVEN WORSE!  This time the TinyURL links themselves were safe, but what they pointed to was no and even threw up a suspected phishing page warning!

Talk about your RED FLAGS!!!


So what's a Realtor to do now?  I need to keep my client's best interests at heart here.  Well, what I've always taught is to contact the sender through another means to verify the legitimacy of the email.  So I went onto our state's licensing site and verified that the Broker in the email was in fact licensed and was in charge of the agency listed, had a good number of agents under him and that the address of the office matched the address listed in the email.  Please keep in mind that the office is in Orange County CA and I'm in Ventura County, CA.  There are two to three counties between us and it's a good three hour drive in light traffic to get to his county (not neccessarily his office).  I then went and independently Googled the office and called them directly, leaving a message for the Broker to validate the email (or to inform him of someone using his name illegally, if the email is not legit).

 

I hope that this blog helps you if you ever find yourself in a similar situation.

 

My best,

Ryan

Save

Posted by

Ryan Huggins
Broker, Huggins Homes
CICP, CRISC, CISA, TLO
805.905.4000
Ryan@HugginsHomes.com
HugginsHomes.com

Serving your Real Estate needs in Ventura and Los Angeles Counties

DRE# 01234617

All information is deemed reliable but not guaranteed.

Comments (78)

Mark Robinson
Geneva Financial, LLC - Beachwood, NJ
Honesty, Integrity, Service

Thank you for the warning and the tips Ryan. I get a lot of emails with attachments. This is another way, which I didn't know about previously, to check their validity. 

Oct 25, 2016 06:25 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Mark Robinson 

Oct 26, 2016 02:50 AM
M.C. Dwyer
Melody Russell Team at eXp Realty of California, Inc. - Felton, CA
MC Dwyer-Santa Cruz Mountains Property Specialist

Great blog - and you got to use the word OBFUSCATE     Bookmarked!

I got one of these recently too, and it felt fishy.    Plus the agent didn't have a phone number in her signature line - don't we ALWAYS put one in our e-mails?

BUT - we can't rule out e-mails based on lack of command of English or grammar here in CA.   We have many agents from all over the world.

Oct 25, 2016 06:52 AM
Ryan Huggins - Thousand Oaks, CA

Thanks M.C. Dwyer!  I should get a tripple word score for finding a way to use obfuscate!  :)


Agreed on the English or grammar, that's why I thought it was "good".  I'm about 12 miles NW of Malibu, so I deal with a lot of people in general who are non-native speakers (and in this day of texting and shorthand, even some native speakers have bad grammar).  It was definitely better than the old Nigerian 419 scams we used to see or what the Chinese military first put out.

Oct 26, 2016 02:54 AM
Beth Atalay
Cam Realty and Property Management - Clermont, FL
Cam Realty of Clermont FL

Hi Ryan Huggins - Thousand Oaks, CA, great information, thank you! I do not open files if they're in dropbox and received similar emails in the past.

Oct 25, 2016 08:14 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Beth Atalay.

Oct 26, 2016 02:54 AM
Maureen Bray Portland OR Home Stager ~ Room Solutions Staging
Room Solutions Staging, Portland OR - Portland, OR
"Staging Consultations that Sell Portland Homes"

Wow, the verbiage in that email is full of grammatical errors, and if you look at the sender's email address there's a huge red flag right there: 

"sothebysrealty@adpaysheet.net"

You can be sure that's not a valid email address for this multi-national real estate firm.

How quickly can we say "Delele!!"

Oct 25, 2016 10:11 AM
Ryan Huggins - Thousand Oaks, CA

Agreed Maureen Bray Portland OR Home Stager ~ Room Solutions Staging!  I remember looking at that when it came in through the website contact form and thinking "really?"

Oct 26, 2016 02:55 AM
Greg Mona
West USA Realty - Scottsdale, AZ
Professional Real Estate Representation for YOU!

Thanks for this heads up Ryan Huggins - Thousand Oaks, CA !  It is just amazing how diligent we all need to be at all times.  It's those times when you let your guard down when it can really bite you.  I've sadly already fallen for this scam once, as I "thought" it was legit!

Oct 25, 2016 10:34 AM
Ryan Huggins - Thousand Oaks, CA

So sorry to hear you've been hit by this type of scam.  Hopefully the damage wasn't too bad.

Oct 26, 2016 02:56 AM
Georgie Hunter R(S) 58089
Hawai'i Life Real Estate Brokers - Haiku, HI
Maui Real Estate sales and lifestyle info

That's a lot of good information for researching where links might take us... and beware!

Oct 25, 2016 10:59 AM
Ryan Huggins - Thousand Oaks, CA

Thanks Georgie Hunter R(S) 

Oct 26, 2016 02:56 AM
Victoria Ray Henderson
HomeBuyer Brokerage - Washington, DC
Washington DC Real Estate

Wow is right Ryan Huggins - Thousand Oaks, CA You did everything right and I would like to know what the legit Broker has to say about this email. Maybe you could do a follow up with that story

Oct 26, 2016 12:50 AM
Ryan Huggins - Thousand Oaks, CA

Victoria Henderson Marshall Henderson, thank you very much.  So far I have not received a return call from the broker.  I suspect it's low on his priority list (or he thought I was a spam caller, LOL!)

Oct 26, 2016 02:58 AM
Sally K. & David L. Hanson
EXP Realty 414-525-0563 - Brookfield, WI
WI Real Estate Agents - Luxury - Divorce

Good to keep your antenna up....if it sounds, reads, feels ....different...you have every clue you need to be suspicious.

Oct 26, 2016 07:51 PM
Ryan Huggins - Thousand Oaks, CA

Agreed Sally K. & David L. Hanson!  I learned a long time ago to read and trust my instincts.

Oct 27, 2016 07:05 AM
Brian DeYoung
also affiliated with Berkshire Hathaway Home Services Heritage Realty - Ithaca, NY
The Realtor with personal investment background

wow,  great information, thank you very much. You opened my eyes.

 

Oct 27, 2016 02:20 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Brian DeYoung.

Oct 27, 2016 07:05 AM
Liane Thomas, Top Listing Agent
Professional Realty Services® - Corona, CA
Bringing you Home!

Thank you, I wasn't familiar with GetLinkInfo, nor did I know you could hover over the link! Good tips all the way around. Thank you!

Oct 27, 2016 06:55 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Liane Thomas - Corona & Riverside Real Estate 

Oct 27, 2016 07:05 AM
Jan Green - Scottsdale, AZ
Value Added Service, 602-620-2699 - Scottsdale, AZ
HomeSmart Elite Group, REALTOR®, EcoBroker, GREEN

Very crafty of them to hide their URL in a tinyurl!  Crazy what we get these days. Thanks to your background you sniffed that right out!

Oct 28, 2016 05:58 AM
Ryan Huggins - Thousand Oaks, CA

Agreed Jan!  If these people just put half that effort into a legitimate job, they could have a good career.

Oct 28, 2016 07:49 AM
Michael Jacobs
Pasadena, CA
Pasadena And Southern California 818.516.4393

Hi Ryan -  red flags were waving.  I'm not too surprised you have yet to receive a call from the "selling agent".    

Oct 29, 2016 11:23 PM
Ryan Huggins - Thousand Oaks, CA

Agreed!  SO many red flags here, I thought I was at a bull fight!  TORO!!

Oct 30, 2016 04:13 AM
Nina Hollander, Broker
Coldwell Banker Realty - Charlotte, NC
Your Greater Charlotte Realtor

I received a similar letter not that long ago and just "got that feeling." Deleted it. Never heard about this getlinkinfo.com before now, but will use it in the future.

Oct 29, 2016 11:54 PM
Ryan Huggins - Thousand Oaks, CA

Happy to add another tool to your toolbelt.

Oct 30, 2016 04:14 AM
Patricia Kennedy
RLAH@properties - Washington, DC
Home in the Capital

Hi, Ryan!  I included this post in today's Last Week's FavoritesEnjoy your new week!

  

   

Oct 30, 2016 11:37 AM
Ryan Huggins - Thousand Oaks, CA

Thank you very much!!!!!

Oct 31, 2016 03:28 AM
Sharon Parisi
United Real Estate Dallas - Dallas, TX
Dallas Homes

Although I love to hover, I did not know about getlinkinfo.com.  Thanks for sharing this valuable information.

Nov 06, 2016 01:12 PM
Ryan Huggins - Thousand Oaks, CA

My pleasure Sharon.

Nov 07, 2016 01:28 AM
Anonymous
Debbie K

I received an almost identical email today. It too started with an email from a syndication partner to our MLS, austinhomesearch.com to which I responded. The email address was an @adppaysheet.net address, but the request for info did not identify the request or as an agent(or broker). I found it odd that an agent would go through Austin home search and the grammar, capitalization, differing fonts, and punctuation sent up some pretty good flags. The first thing I did was check to see if the agent was an agent in Texas (some of the designations indicated that). Nope. Not now or previously. I've also never received an email from an agent that did not include a phone number (or two) in the signature, an address, or website address. All the signature had was certifications. I haven't even bothered to hover over the links. I searched "@adppaysheet.net scam" and found this page. Now to get the word out to other agents that I know. Thank you for posting this.

Nov 07, 2016 09:53 AM
#74
Anna Hatridge
R Gilliam Real Estate LLC - Farmington, MO
Missouri Realtor with R Gilliam Real Estate LLC

Thank you for this blog.  I did not know there was a way to check the link.

 

Dec 13, 2016 03:04 PM
Ryan Huggins - Thousand Oaks, CA
https://HugginsHomes.com - Thousand Oaks, CA
Residential Real Estate and Investment Properties

My pleasure Anna Hatridge 

Dec 13, 2016 04:33 PM
Jane Chaulklin-Schott
TEAMCONNECT REALTY - (407) 394-9766 - Orlando, FL
TeamConnect Luxury Homes - Orlando, Florida, 32836

Important to 'read and trust' one's instincts.

Dec 13, 2016 07:16 PM
Ryan Huggins - Thousand Oaks, CA
https://HugginsHomes.com - Thousand Oaks, CA
Residential Real Estate and Investment Properties

Agreed Jane Chaulklin-Schott 

Dec 14, 2016 10:07 AM