Scammers are flooding Facebook with groups that purport to offer video streaming of funeral services for the recently deceased. Friends and family who follow the links for the streaming services are then asked to cough up their credit card information. Recently, these scammers have branched out into offering fake streaming services for nearly any kind of event advertised on Facebook. Here’s a closer look at the size of this scheme, and some findings about who may be responsible.
One of the many scam funeral group pages on Facebook. Clicking to view the “live stream” of the funeral takes one to a newly registered website that requests credit card information.
KrebsOnSecurity recently heard from a reader named George who said a friend had just passed away, and he noticed that a Facebook group had been created in that friend’s memory. The page listed the correct time and date of the funeral service, which it claimed could be streamed over the Internet by following a link that led to a page requesting credit card information.
“After I posted about the site, a buddy of mine indicated [the same thing] happened to her when her friend passed away two weeks ago,” George said.
Searching Facebook/Meta for a few simple keywords like “funeral” and “stream” reveals countless funeral group pages on Facebook, some of them for services in the past and others erected for an upcoming funeral.
All of these groups include images of the deceased as their profile photo, and seek to funnel users to a handful of newly-registered video streaming websites that require a credit card payment before one can continue. Even more galling, some of these pages request donations in the name of the deceased.
It’s not clear how many Facebook users fall for this scam, but it’s worth noting that many of these fake funeral groups attract subscribers from at least some of the deceased’s followers, suggesting those users have subscribed to the groups in anticipation of the service being streamed. It’s also unclear how many people end up missing a friend or loved one’s funeral because they mistakenly thought it was being streamed online.
One of many look-alike landing pages for video streaming services linked to scam Facebook funeral groups.
George said their friend’s funeral service page on Facebook included a link to the supposed live-streamed service at livestreamnow[.]xyz, a domain registered in November 2023.
According to DomainTools.com, the organization that registered this domain is called “apkdownloadweb,” is based in Rajshahi, Bangladesh, and uses the DNS servers of a Web hosting company in Bangladesh called webhostbd[.]net.
A search on “apkdownloadweb” in DomainTools shows three domains registered to this entity, including live24sports[.]xyz and onlinestreaming[.]xyz. Both of those domains also used webhostbd[.]net for DNS. Apkdownloadweb has a Facebook page, which shows a number of “live video” teasers for sports events that have already happened, and says its domain is apkdownloadweb[.]com.
Livestreamnow[.]xyz is currently hosted at a Bangladeshi web hosting provider named cloudswebserver[.]com, but historical DNS records show this website also used DNS servers from webhostbd[.]net.
The Internet address of livestreamnow[.]xyz is 148.251.54.196, at the hosting giant Hetzner in Germany. DomainTools shows this same Internet address is home to nearly 6,000 other domains (.CSV), including hundreds that reference video streaming terms, like watchliveon24[.]com and foxsportsplus[.]com.
There are thousands of domains at this IP address that include or end in the letters “bd,” the country code top-level domain for Bangladesh. Although many domains correspond to websites for electronics stores or blogs about IT topics, just as many contain a fair amount of placeholder content (think “lorem ipsum” text on the “contact” page). In other words, the sites appear legitimate at first glance, but upon closer inspection it is clear they are not currently used by active businesses.
The passive DNS records for 148.251.54.196 show a surprising number of results that are basically two domain names mushed together. For example, there is watchliveon24[.]com.playehq4ks[.]com, which displays links to multiple funeral service streaming groups on Facebook.
Another combined domain on the same Internet address — livestreaming24[.]xyz.allsportslivenow[.]com — lists dozens of links to Facebook groups for funerals, but also for virtually all types of events that are announced or posted about by Facebook users, including graduations, concerts, award ceremonies, weddings, and rodeos.
Even community events promoted by state and local police departments on Facebook are fair game for these scammers. A Facebook page maintained by the police force in Plympton, Mass. for a town social event this summer called Plympton Night Out was quickly made into two different Facebook groups that informed visitors they could stream the festivities at either espnstreamlive[.]co or skysports[.]live.
WHO’S BEHIND THE FAKEBOOK FUNERALS?
Recall that the registrant of livestreamnow[.]xyz — the bogus streaming site linked in the Facebook group for George’s late friend — was an organization called “Apkdownloadweb.” That entity’s domain — apkdownloadweb[.]com — is registered to a Mazidul Islam in Rajshahi, Bangladesh (this domain is also using Webhostbd[.]net DNS servers).
Mazidul Islam’s LinkedIn page says he is the organizer of a now defunct IT blog called gadgetsbiz[.]com, which DomainTools finds was registered to a Mehedi Hasan from Rajshahi, Bangladesh.
To bring this full circle, DomainTools finds the domain name for the DNS provider on all of the above-mentioned sites — webhostbd[.]net — was originally registered to a Md Mehedi, and to the email address webhostbd.net@gmail.com (“MD” is a common abbreviation for Muhammad/Mohammod/Muhammed).
A search on that email address at Constella finds a breached record from the data broker Apollo.io saying its owner’s full name is Mohammod Mehedi Hasan. Unfortunately, this is not a particularly unique name in that region of the world.
But as luck would have it, sometime last year the administrator of apkdownloadweb[.]com managed to infect their Windows PC with password-stealing malware. We know this because the raw logs of data stolen from this administrator’s PC were indexed by the breach tracking service Constella Intelligence [full disclosure: As of this month, Constella is an advertiser on this website].
These so-called “stealer logs” are mostly generated by opportunistic infections from information-stealing trojans that are sold on cybercrime markets. A typical set of logs for a compromised PC will include any usernames and passwords stored in any browser on the system, as well as a list of recent URLs visited and files downloaded.
Malware purveyors will often deploy infostealer malware by bundling it with “cracked” or pirated software titles. Indeed, the stealer logs for the administrator of apkdownloadweb[.]com show this user’s PC became infected immediately after they downloaded a booby-trapped mobile application development toolkit.
Those stolen credentials indicate Apkdownloadweb[.]com is maintained by a 20-something native of Dhaka, Bangladesh named Mohammod Abdullah Khondokar.
The “browser history” folder from the admin of Apkdownloadweb shows Khondokar recently left a comment on the Facebook page of Mohammod Mehedi Hasan, and Khondokar’s Facebook profile says the two are friends.
Neither MD Hasan nor MD Abdullah Khondokar responded to requests for comment. KrebsOnSecurity also sought comment from Meta.
I recently went through this with a close family member this week. One distinction, they do not seem to be creating groups, but rather Facebook user accounts. They will crawl the mutual friends of the deceased and request to add them as a friend. In our case, there was a legitimate live stream on the obituary, so you can understand how confusing this was. Combating this TTP requires you to keep your friends on private and keep your wall settings set to prevent people from posting on your wall. The links were also TinyURL shorteners redirecting to a website to input your credit card, hosted by NameCheap. Facebook denied my reports of the user but removed their posts containing pictures. That is, until the perp decided to move on and switch the user photos to a different person that passed. It is essentially a game of whack-a-mole, and FB is slow react and respond. The user is still live days later.
Ah, that’s interesting. Thank you for sharing your experience. I have found that these streaming groups or accounts are deactivated some time after the service, with the links removed. Although this is done inconsistently, so it makes me wonder if they’re only removing the ones people complain about.
Impressive investigating, as always. It’s dismaying to see people preying on bereavement.
Wondering if a former president did something like this for his visit to ANC Section 60?
I’ve noticed something similar (but not exactly the same) on Facebook groups for alumni associations, PTA’s, etc. Someone will post a comment stating that inactive members will be removed that day, and to comment if you don’t want to be removed. They then provide a link to a website that sells (unauthorized) tee shirts or other “spirit wear” for the school. It may be just a way to drive sales, but the MO (hijacking a group and providing a link to get payment info) is similar.
I run a number of private Facebook groups, some with thousands of members. For years, accounts with fake profiles have requested membership and it takes time to verify if an account is real or not. Lately, I’ve noticed that there are now fake universes of fake profiles. Hackers create fake friends and fake families. Dozens and dozens. They then post, comment, and like between the fake accounts to make it look real. They use AI generated photos. A giveaway is that they often post a man with his wife as the man’s profile photo, trying to make it look like a benign family man. I report these fake profiles (it’s too hard to report a whole fake network), and Facebook almost never takes a reported profile down. Instead I get a canned message that the account isn’t violating TOS. It’s a jungle out there for FB admins who care about the safety of their members.
What the admin of my subdivision’s FB group does is require a current member to vouch for you. So on top of all the vetting they do like you detailed, they also have to name someone in the group that the admin then goes to and says “can you vouch for so-and-so”. Happened to me recently; a fake profile said they were renting at my address (not true), and their profile looked as right as rain. There would have been no easy or obvious way to spot it as fake, but because the FB admin reached out to me to vouch for them, we were quickly able to say “nope!” and move on. It’s almost like MFA for members. Maybe this could be something you leverage?
Got hit by this last week when we posted my son’s funeral announcement. Absolutely deplorable, and FBs review process for accounts that are CLEARLY malicious is woefully broken.
Can I ask why anyone who reads this blog would ever use Facebook? Please don’t state that its the only way to keep in contact with people. There are plenty of other options.
With respect, there are a wide range of readers who frequent this site and who are probably still on Facebook, mainly because the people they care about are there. Even if those people are in the minority here, we all have friends and family that use FB every day, I’d wager.
As Brian said, while those who read the blog may not want to use it, almost everyone else they know will, and almost everyone those contacts know will. We’ve all tried to get people to move to better platforms, and all run into the same complete lack of interest.
Security requires knowledge and at least some effort, while being on FB is easy and requires minimal thought.
Educating friends and family about using safer settings on the platform and explaining how scams and scammers work is the best compromise I’ve come up with. I taught my siblings (and eventually, my mother) and they have taught their kids in turn. It’s an uphill battle for sure, but it’s the most successful strategy I have found so far – if others have suggestions that have worked for them, I’d definitely be keen to hear them.
Thank you Brian, we appreciate your tireless work to keep people informed, your research and writing are always amazing.
Now do LinkedIn. Right? Google next.
Facebook is a cesspool of fraud, in many different manifestations. For me, I had enough in January 2023 and filed a federal lawsuit in Colorado against Facebook. That came after two years of trying to stop the continuous fraudulent penis enlargement ads. I would be looking at a friend’s newborn daughter, with monstrous sch..ngs right next to her. I had captured hundreds of images and communications between myself an Facebook.
However, Facebook was able to get the case transferred to California due to the terms of service. And a week or two after I called the clerk of the court recently, the Federal Court dismissed the case. But of course, LOL. We see that the courts put in their mouths whatever is dripping the most money, especially when it comes to those mega-corporations like Google, Facebook, Twitter, Apple, 3M, Exon, …, so I expected nothing else, but one has to try,
Facebook is now blocked from everything, including servers. Facebook is poison for the mind, IMHO, and no valid need to go there. Anything on FB, I can buy on Amazon, cheaper. And now it’s starting on YouTube, with barely dressed and one hopes of age oriental girls, with the videos flipped 90 degrees. No telling where that comes from.
keep speaking the truth
mfers, will learn the hard way
The levels that scammers will go to steal money are truly reprehensible… Preying on people after losing a loved one is an all new low!
Similar scams are occurring in GoFundMe also. Beware of. As soon as the accident occurs and a close friend/family posts a legitimate Gofundme to raise funds to support the family and funeral expenses, the same profile photo, accident details, and police reports get copied to different GoFundMe by the fake users to lure the funds from the community.
Be aware. Check with legitimate sources before you provide monetary support to the cause.
Unfortunately, GoFundMe is not cross-checking the fake listings as they can do a better job of avoiding such cheaters.
Wow, just when you think scammers couldn’t sink any lower, they find a way to exploit funerals…
Meanwhile, Facebook’s response is about as fast as a dial-up connection in 1999—playing a lovely game of whack-a-mole with the scammers. Sad to see people getting targeted during such a vulnerable time. Great job uncovering this, Krebs! If only the scammers put this much effort into a real job…
This doesn’t go well with all the old folks either. The ones that click on every single thing they see. My mom for example. They’re the perfect target because they’re on death’s door along with all their friends! It’s exhausting.
They really shouldn’t be on the “inter”net at all. We need an oldsnet.
Big icons, no outside actors, curated for those impaired by life’s journey.
We’ll call it… America Online.
lol, can’t wait to hear the 56k modems fire up
Thought I would have a look to see if I can really find one via searching “funeral live” and wow it’s that easy… so I report the user to Facebook and like usual I get back an automated response (or atleast one from somebody with not enough brain cells to know what a scam is) saying that the user/account won’t be actioned with this message:
“””
We didn’t remove the Page
To keep our review process as fair as possible, we use the same set of Community Standards to review all reports.
We’ve taken a look and found that the Page doesn’t go against our Community Standards.
We understand that this might be upsetting, so we recommend exploring the options available to control what you see.
If you want us to review something specific within a Page, make sure that you report the content (for example photo), not the entire Page.
“””
Same thing happens with the vast seas of scam marketplace listings I report… I genuinely have no idea why I bother reporting they don’t actually care.
Even though I’m paranoid about going to scam sites (even on my locked down phone) I decided to click through to the scam site through the Facebook browser so hopefully the “reviewer” can see actually it’s a scam site on my new report… gotta love the website requires a “free account” to view, so you put in an email and password to create an account (why not try to password stuff the scam victims too) and it takes you instantly to a page demanding a $1 payment… that’s a weird “free” fee
i guess when the learning curve increases and general public completely understands the real costs and dangers of social engineering through “social media”, they will seek the creators of such sites and exact due payment for damages done to family, friends, and society.
The most entertaining part is watching them award themselves metals, honors, and accolades, all the while destroying working people, businesses, and general society.
reality always rears it’s ugly head and is always more dangerous then ones and zeros and white ivory tower facades
i guess when the learning curve increases and general public completely understands the real costs and dangers of social engineering through “social media”, they will seek the creators of such sites and exact due payment for damages done to family, friends, and society.
The most entertaining part is watching them award themselves metals, honors, and accolades, all the while destroying working people, businesses, and general society.
reality always rears it’s ugly head and is always more dangerous then ones and zeros and white ivory tower facades
If scams about someones dearly departed aren’t enough for users to give these social media platforms like Facebook the electronic kick to the curb, then maybe this 100 page report from the Federal Trade Commission would help further elucidate their problem and danger. This link was from an NBC News security article “Social media companies engaged in ‘vast surveillance’…”
https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf (129 pages)
“A Look Behind the Screens – Examining the Data Practices of Social Media and Video Streaming Services”
But what Brian said earlier is true about it being hard to leave the platform when you have loved ones also on the platform. For me we’ve learned to use the phone/texting more, but some became fond loved memories, including some family members.
Something similar is being used on Reddit to appear at the top of Google when you search for watch (any recent movie) online. The websites are always registered by NameCheap and you’re redirected to an identical landing page to the one in this article. The landing page is from the affiliate network TORO Advertising, you can see them an promoting it in this thread: https://www.blackhatworld.com/seo/toro-advertising-global-smartlink-exclusive-campaigns-direct-advertisers.1459383/page-2#post-16437179. If you sign up your card will be charged 2x recurring payments every 14 days for $43 lol