Threat Actor Update: Land Lordz

On April 14 2019, Krebs on Security published a report of a scam website targeting AirBnB. The website, "Land Lordz", charges customers in a SaaS-like model where you pay for different plans. This service allows users to create and manage multiple fake AirBnB Web sites and create fraudulent listings in order to run multiple scams at once. Starting at $550 per month, a scammer can create up to 500 scam properties and maintain interactions with 100 "customers" who are falling victim to these attacks. The fraudulent listings are displayed as regular AirBnB properties, but when the customer asks about the property, the attacker sends a link that looks exactly like the AirBnB page to either skim their credit card information or phish their credentials.

Recommendations:

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Enable 2-factor authentication to protect against phishing attacks
• Never put your personal information or credentials on a website where you're not sure it's legitimate

Details

The website is now down, but screenshots from the report yield a surprisingly professional website. A basic plan is $550 per month, a pro plan is $900 and a team plan is $1600. The site has integrations with SMS services for spamming, as well as phishing site generators that offload credentials via email, text file and jabber. The report listed 4 domains, which are all now removed:

airbnb.longterm-airbnb[.]co.uk
airbnb.pt-anuncio[.]com
airbnb.request-online[.]com
airbnb-invoice[.]com

The listings in the report were found on Gumtree. AirBnB scams of this type are especially bad for victims - policies on AirBnB's website dictate that they cannot help victims who travel off the official website. This is difficult for users, as AirBnB does not have 2-factor authentication support, but will sometimes send a verification email or text if they detect unusual logins.