Bank of America phishing site

Question

A text message was sent to my phone stating that my Bank of America account had been suspended due to suspicious activity. It then provided a link to reactivate it. Obvious phishing scam. The URL they provided was through tinyurl.com. I was curious so I went to the site.

I was surprised to find that the domain of the actual URL pointed to what seems to be a legitimate business @ http://griffinconstruction.com.au. If desired, I can provide the path to the malicious page as well. I thought it probably best to not include it here.

Doing a little research I discovered this is a wordpress site. And doing a little more research I discovered that many wordpress sites have been hacked before. On the main website page there is a Contact Us link. I have attempted to contact the owner. But I would think attempting to contact the owner of a hacked website through the website itself would be an exercise in futility.

I have reported it to Google but that seems a bit like reporting a burglary to the NSA. I don't expect much if anything to come from it. I have also contacted Bank of America to inform them.

Is there anything else I should do?

Update

A little more than 24 hours later and I just received a 2nd text message. The phone number is slightly different. But it's the same country code and area code as the first message. The message itself is the same except now they're using bit.do to shorten the URL. After reading the comments I decided to check this one using an online link expander.

The bit.do URL expanded to http://deichelmauspics.de/

Yet another hacked Wordpress site. The path of the URL leading to the phishing page is exactly the same as before.

Update #2

http://griffinconstruction.com.au now shows:

This Account has been suspended. Contact your hosting provider for more information.

I guess that explains the 2nd message :)

Thank you to everyone who contributed their thoughts on this

I suppose there is no real way to know exactly what caused the website to be taken offline. But at the end of the day, the important thing is that it is in fact offline. And in my opinion, that would not have happened without the contributions from the people of Information Security Stack Exchange. That's pretty awesome.

Update #3 So it's been 8 months. I was looking at another Wordpress site today and it made me wonder what had become of the site mentioned in this question. So I went to their website and... nothing has changed. There is still a fake Bank of America page buried deep down within folders that shouldn't be publicly accessible but are. And that's just stupid and careless. I doubt that most people would fall for the Bank of America scam as it was presented in this case. But still, someone might. See for yourself.

MALICIOUS LINK (no longer works)

http://griffinconstruction.com.au/wp-includes/SimplePie/XML/Declaration/1

MALICIOUS LINK

Answer 1

I would contact the business in question. They are the ones who are most directly affected and can also shut it down quickest. Of course, the phishers will probably just move on to another server to host their requests, but if the site owners act quickly, it will at least immediately invalidate any past phishing messages that have gone out, potentially saving a lot of people a lot of trouble.

Contacting them through the website is not as bad of an idea as it seems. Such hacks inevitably like to keep a low profile (which is to say that the website itself usually continues to work), because if they break anything the infection is more likely to be found and fixed, ending their phishing campaign. Having previously helped people pick up the pieces after a wordpress site gets hacked, often times the "infection" can go on unnoticed for quite a while before someone finally notices. Usually it is unintended side-effects that finally ring the alarm bells: I saw one site on a VPS where every email sent out by the spammers resulted in a small log file stored on the servers disk. The logs weren't being monitored, but after a few million emails got sent out the server ran out of inodes and crashed.

All that to say that if you submit a contact through the contact form there is a very good chance that it will actually goes to the owners. There are such a wide-variety of ways to manage contact forms on wordpress sites, there isn't an easy way for hackers to just turn it off or intercept it after breaking in. I doubt they bother trying. That being said, you can always try to find some public contact information for the company and contact them directly: you might not call them (unless you are in australia), but you can probably find an email.

Answer 2

Multiple carriers in the USA allow you can forward the text message to 7726 (SPAM).

Answer 3

I would think attempting to contact the owner of a hacked website through the website itself would be an exercise in futility.

Think about the possible outcomes:

1. the message is not read be either the attacker or site operator - in this scenario, there is no net benefit to anyone

2. the message is intercepted by the attacker - the attacker now knows the address from which you sent your message (i.e. you might consider doing this from a low value account, e.g. hotmail, gmail etc if it's not an anonymous web form). But no benefit to other potential victims nor the site operator

3. the message is sent to the site operator - they are likely to take action. Whether that action will be effective or not...? but there is a good chance that at least temporarily, fewer victims will access the phishing

4. the message goes to both the site operator and the attacker. The phishing site is now essentially burnt - while you could argue that this allows the attacker to cover his tracks before moving the site elsewhere, its more likely that the attacker has already done everything they can to hide their connection to the phishing site, hence the outcome is the same as 3

On balance, I think there's a net benefit to sending the notification.

I have reported it to Google but that seems a bit like reporting a burglary to the NSA.

Not really - IME they do seem to take some action on these. Although they also monitor sites like phishtank - reporting it there too would be a good idea.