'Cancer Girl' scam has stolen more than half a million dollars
EMMA MCGOWAN 26 JUL 2022
Since learning of the Cancer Girl scam, Avast researchers have blocked all of the related domains that they were able to find and protected almost 1,000 users in just 48 hours.
The past decade has seen a rise in personal crowdfunding, with people raising money online for everything from school supplies to medical bills to funeral expenses. The appeals go out on social media, imploring friends, families, and acquaintances to help. And, like so many other things online, some of these appeals are scams.
The Avast Threat Labs team recently identified one such scam circulating on YouTube. In a heartbreaking video ad, a little girl sits in a hospital gown. She appears with her head shaved and she’s crying as she speaks into the camera. She tells the viewer that she has cancer and that her family can’t afford treatment.
“The treatment costs a lot of money and my parents don’t have much money,” she cries. “Please help me get well. Please! I don’t want to die.”
The video is highly emotive and asks viewers to donate to the young girls’ cancer treatment via a linked donation fundraising page. If you want to save “Alexandra,” (or Ariela, Ksenia, or Barbara, depending on the video), you can contribute right away.
“While there’s no way to know who this little girl actually is or what her situation or her family’s circumstances are, we do know for sure that this is a scam and the more than $640,000 already raised will not go toward treatment,” Pavel Novak, Threat Operations Analyst at Avast, says. “Our research uncovered an entire series of videos which feature the same little girl, with appeals in Arabic, French, Portuguese, Spanish, and Hebrew. We also found videos making similar appeals, but with different little girls.”
Overall, the Cancer Girl scam videos have been viewed more than 10 million times. Threat Labs research also found:
• All of the domains were registered very recently.
• The videos use anonymous email addresses, like (I have removed the email addresses because of the anti-spam bot, but basically they are just numbers and gmail addresses).
• “Alexandra” and “Ariela” have the same email contact addresses, despite videos of two different girls in what one can assume are very different geographies.
• The address can be traced to a residential complex in Jerusalem.
The videos also use hyperbolic claims, including the fact that Cancer Girl’s cancer has spread throughout her entire body. They ask for donations to treat said cancer, but if a cancer has spread that far then it’s likely too late for medical intervention. The lack of specificity is a common red flag in online scams.
“This scam, like so many, takes advantage of the altruistic impulses that humans have to help each other,” Novak says. “It’s especially malicious and unethical because it is potentially taking advantage of a real child, sick or not, whose video was either stolen for the scam or who is being forced to act out this scene. It also erodes peoples’ trust in personal crowdfunding and charity and siphons money away from real causes and institutions.”
Since learning of the Cancer Girl scam, Avast researchers have blocked all of the related domains that they were able to find and protected almost 1,000 users in just 48 hours. They also reported the videos to YouTube, and the scam to the Israel Cyber Emergency Response Team (CERT), where the domains appear to be registered to.
Finally, there appear to be similar scams circulating via email. Avast researchers do not suspect the two campaigns to be related, despite such campaigns using the same scenario, however, teams like ours can only do so much — it’s up to each individual to treat everything they see online with a critical eye and pause before hitting that “donate” button.
Chinasa sent to Kirikiri prison for burning Oyingbo Lagos BRT bus terminus
Published By: Nimot Sulaimon 11th August, 2022
By Moronke Boboye/Ikeja
An Ikeja Magistrate’s Court on Thursday ordered the remand of Michael Chinasa, an indigene of Anambra, accused of setting fire to a BRT bus terminus at Oyingbo in Lagos during a protest in October 2020 over alleged police abuses.
The defendant, 21, who is unemployed and resides at 21, Ilogbo St., Apapa Road, Lagos, is being tried for conspiracy, arson, and causing a breach of peace.
The Magistrate, Mrs M.C. Ayinde, who refused to take the defendant’s plea, ordered that he should be remanded in Kirikiri Correctional centre until Sept. 1, pending legal advice.
Ayinde ordered that the case file should be duplicated and sent to the office of the Lagos State Director of Public Prosecutions (DPP) for legal advice.
The Prosecution Counsel, Insp Segun Oke, told the court that the offences were committed in October 2020 at the Oyingbo BRT bus terminus, Lagos.
Oke said that Michael and others at large set the BRT bus terminal on fire during the #EndSARS protest.
The offences, he said, contravened the provisions of Sections 168, 343 and 411 of the Criminal Laws of Lagos State, 2015.
EndSARS protests: Man remanded for allegedly setting BRT bus terminal on fire
Published on August 11, 2022 By Nsikak Nseyen
An Ikeja Magistrate’s Court on Thursday remanded a 21- year -old man, Chinasa Michael, in Kirikiri Correctional Centre for allegedly setting fire to the Oyingbo BRT bus terminal during the #EndSARS protests.
Magistrate M.C. Ayinde refused to take Michael’s plea for want in jurisdiction, NAN reports.
Ayinde directed the police to return the case file to the office of the Director of Public Prosecution (DPP) for legal advice.
The suspect, an unemployed man, who resides at 21, Ilogbo St., Apapa, Costain, Lagos, is charged with conspiracy, arson, and causing breach of peace.
The Prosecution Counsel, Insp Segun Oke, told the court that the offence was committed in October 2020 at the Oyingbo BRT bus terminal, Lagos.
Oke said that Michael and others at large set the BRT bus terminal on fire during the #EndSARS protest.
The offence, he said, contravenes the provisions of Sections 168, 343, and 411 of the Criminal Laws of Lagos State, 2015.
#EndSars: Court remands man for allegedly setting BRT bus terminal on fire
The magistrate ordered that the defendant be remanded pending legal advice
By Agency Report August 11, 2022
An Ikeja Magistrate’s Court on Thursday ordered the remand of one Chinasa Michael, accused of setting fire to a BRT bus terminal at Oyingbo in Lagos during a protest in the year 2020 over alleged police abuses.
The defendant, 21, who is unemployed and resides at No. 21, Ilogbo St., Apapa Road, Lagos, is being tried for conspiracy, arson, and causing the breach of peace.
The magistrate, M.C. Ayinde, who refused to take the defendant’s plea, ordered that he should be remanded in Kirikiri Correctional centre until 1 September, pending legal advice.
Mrs Ayinde ordered that the case file should be duplicated and sent to the office of the Lagos State Director of Public Prosecutions (DPP) for legal advice.
The prosecution counsel, Segun Oke, told the court that the offences were committed in October 2020 at the Oyingbo BRT bus terminal, Lagos.
Mr Oke said Mr Michael and others at large set the BRT bus terminal on fire during the #EndSars protest.
The offences, he said, contravened the provisions of Sections 168, 343 and 411 of the Criminal Laws of Lagos State, 2015.
There are many very similar ads from the same people.
naptu2: I have never gotten to the end of that advert. I began to get annoyed the first time that I saw, because of how the girl was being portrayed, but something else quickly took over from the annoyance. That was suspicion. There are many things that made me suspicious, including the fact that they were paying for a YouTube advert. There are uncountable ways in which they could get even more traction and spread their message for free, so why pay for a YouTube ad when you need money for treatment?
There are other things that made me suspicious and I remembered hearing about a similar situation sometime ago, which turned out to be a scam. Still, I don't jump to conclusions, so I decided to investigate further later. I never got round to it before I saw this article 2 days ago. Then I saw evidence (on other sites) that this advert was related to the other scams that I had seen earlier. That's the first time that I actually spent any time on the video (I usually just skip it).
There's one other thing that you should note. Apart from using free methods of spreading their message, genuine appeals for help usually provide a means by which donors can ask questions and seek further information. However, in all these scam child cancer adverts (there are more than just the African and European adverts) the comments section is always locked so that potential victims cannot see the complaints of previous victims.
Alexandra: Scammers extort millions using 9-year-old girl as bait Dubawa August 9, 2022
By Phillip Anjorin and Silas Jonathan
Anyone with an iota of compassion will feel pity for Alexandra. On several social media platforms, Alexandra, a 9-year-old girl, is portrayed as a desolate cancer patient who has already suffered severe hair loss and is struggling for her life.
The emotional video depicted Alexandra in tears as she reaches out for financial assistance for treatment. “I don’t want to die,” she says, as tears drizzle down her cheeks.
The video was also shared as a sponsored post on Facebook, YouTube and as Google Ads. It has so far generated lots of reactions amongst social media users. Yet DUBAWA’s findings revealed the organisation soliciting the funds, “Netiv Halev,” is fraudulent.
Alexandra’s supposed quest for survival Cancer is one medical condition that experts are yet to overcome despite technological advancement. A study in 2012 revealed that cancer claims as many as 21,000 lives every day globally.
According to the World Cancer Research Funds, more than 18 million cases were diagnosed in 2020, with varying impacts on gender, among other factors. Further findings also revealed that cancer is the second largest cause of death in children from age 1 to 14, with accidents claiming the highest.
Alexandra, supposedly one of the few that the world would know of her medical state, was in tears as she shared her wishes to stay alive. The alleged 9-year-old girl pleaded with viewers to come to her aid as her parents are too poor to handle her medical expenses.
The plea has generated more than 14,000 reactions, 6500 comments and 1900 shares on Facebook as of July this year. It has also generated more than 2.9 million views and 2,200 likes on this YouTube channel since it was posted on July 2. Also, there are more than 3,410 subscribers on the channel.
Lanre Olagunju, an editor for a popular news medium in Nigeria, said he had donated $10 and his wife was planning to give out even more money for the cause.
“I gave $10, I paid using my card. My wife is planning to give more,” he said while expressing surprise that the whole thing is a scam.
Unlike Lanre, Esther Danladi, a civil servant in Abuja, was not so fortunate. After donating $5 for the cause, she said that her dollar domiciliary account was wiped out.
“The video touched my heart. I cried because this little girl seemed helpless. But minutes after I donated, my account was wiped out,” Esther claimed.
Apparently, the whole thing is more premeditated than it appears on the surface. Ads and promotions are even, currently, being run on Google AdSense to give the post a wider audience reach.
On their website dedicated to collecting donations, unsuspecting members of the public have already donated more than $536,000 out of the $727,881 target by June 2022.
But a month later in July, the benchmark increased to $1.15 million after the contribution nearly hit the previous limit. It seems the perpetrators are on an unending mission to keep siphoning funds from unsuspecting victims.
There is a sophisticated process
To donate to the cause, the user is required to provide a mail address, name and phone number, and subsequently, make a payment using credit or debit card details.
In cases where the request ends unsuccessfully, an automated follow-up mail is sent to the donor to try it again. The user has to then start from the beginning, and any attempt to check the website for previous activity is rendered futile.
Finding the loops; verifying the scheme
The homepage that is receiving the donations is presented in Hebrew, but after it was translated to English; there was no information “about” its previous activities; contact details, or even details about the organisation’s structure.
Craig Silverman, the media editor of BuzzFeed News, explained that websites with credibility would provide a bit of detail about what they do on a dedicated segment as they have nothing to hide. “Most websites tell you at least a bit about what they are. Whether on a dedicated About page, a description in the footer or somewhere else; this is a good place to check for a website’s credibility.”
“A lack of clear information could be a hint the site was created in haste or is trying to conceal details about its ownership and purpose,” as is the case with this website.
A check on the authenticity of the website on Trend Micro Check (a website that checks for scams and misinformation) reveals that the website is a scam and is designed to host hoaxes.
Additionally, DUBAWA’s analysis of the website’s URL revealed the existence of more than 3 domains hosted on the same IP address (62.219.78.222). Some of the foremost DUBAWA traced were:
An alarming fact about these domains is that they were all registered recently; they are all seeking donations; have the same colour shade; they all showcased different girls: “Alexandra” and “Ariela.” All the cancer patients are seeking help and have the same contact email addresses, even though the videos are of different girls from different countries. These email addresses used by the domains are anonymous email addresses, such as 6554997@gmail.com or asd1010850@gmail.com.
An intentional effort was also made to redact important traceable details for privacy’s sake. This simply implies that the information is hidden away because whoever owns the domain didn’t want people to have access to it. This is not the case with legit, transparent websites.
These aforementioned findings also corroborate the results of the analysis carried out on “ScamAdviser”, a reliable online tool that dictates scams and rates the trustworthiness of websites. In the case of the “Netiv-halev” website, the tool details that:
“donate.n-halev.org might be a scam. We found several indicators for this.
donate.n-halev.org review is somewhat low according to our “Scamadviser” algorithm.”
The company, “Netiv-Halev” gave No. 21 Hoshe’a Street, Jerusalem, Israel, as its address. However, DUBAWA’s findings on Google Maps indicated no registered presence of the company in that location. In fact, other details found about the location reveal the area is entirely for residential houses.
Netiv Halev: The Multifaceted Scam Network
Netiv Halev looks like a recently created charity running a Non-governmental organisation that provides assistance for medical patients and families.
Searches about the organisation didn’t turn up any relevant results, and neither did search about their associated organisations such as the “Brother to Brother organisation” and others. There is also no record of either organisation on websites like Charity Navigator or Charity Watch.
There is no third-party verification apart from the claim that “the organisation has a proper management certificate and a nonprofit registration number: 580566784, which DUBAWA found to be non-existent.
The website has multiple alternatives, with the European version having the highest recognition until Alexandra started trending on African social media spaces.
The European version
Noticeably, Alexandra’s video, in particular, was uploaded five months ago on another Israeli platform’s YouTube Channel, Chen Lahaim, which DUBAWA finds to be directly related to Netiv Halev. Here, Chen operates a different program called: “The Chen Lachaim Organisation,” a scheme described to help cancer patients in Palestine, specifically.
This time the email is: haiat@haiat.org, even though the IP address of the website is discovered by DUBAWA to be the same as that of “Netiv-halev.”
Further findings also revealed that the scheme has been in existence for two years, although with different identities. A collection of these links can be seen here, all having the same message template.
Another ominous suspicion is that no further detail was given about any of these children, their medical conditions, families, country of origin, or even their current location, thus casting a wall of doubt on the authenticity of the stories.
Defensive walls
To protect the dubious activities over the years, DUBAWA finds that opposing comments made on the posts are deleted. If users attempt to report them on any of the social media platforms, their accounts are hacked and access denied.
“I tried to report them on Facebook. The two attempts I made on Facebook were successful but a week later, my account was hacked and I couldn’t log into it again,” Esther said.
Also, the comment section on the YouTube post is disabled. As a result, users cannot directly raise an alarm for unsuspecting victims to beware.
Conclusion
The video showing Alexandra appealing for financial support (and other such videos existing over the years) are sponsored to defraud unsuspecting citizens. They are carefully-planned schemes by Israeli-based illegal organisations to guilt-trip users into donating their hard-earned money.
The immediate past General Officer Commanding (GOC) 81 Division, Nigerian Army, Maj.-Gen. Umar Musa, on Tuesday, said that investigations were still ongoing concerning a police officer, SP Orukpe Monday, allegedly killed by some soldiers in Lagos last Thursday.
Umar disclosed this on Tuesday while handing over to the new GOC, 81 Division, Maj.-Gen. Obinna Ajunwa, at the Division’s Headquarters on Victoria Island, Lagos State.
On Thursday, Aug. 4, a crisis occurred between some soldiers and some policemen near Ojo in Lagos State, leading to the death of Monday.
Musa said that preliminary investigations revealed that the police officer shot at the soldier during the altercation which clipped him in the ear but narrowly missed his vital parts.
“The other soldiers reacted to the shot fired by the police officer and this led to their beating the policeman to death.
“We have paid a condolence visit to the Commissioner of Police to tell him that we will take necessary measures to prevent future occurrences of such nature.
“The injured soldier is in the hospital receiving treatment and investigation is ongoing to ascertain the next line of action to be taken,” he said.
It would be recalled that Inspector Monday Orukpe serving with the Lagos State Police Command died from the torture he allegedly received from soldiers who attacked him and his colleagues in the Trade Fair area of Lagos State.
Another Inspector, Igbafe Ojo, who was reportedly tortured by the same soldiers, had been hospitalized at the military hospital in Ojo Military Cantonment, where doctors said that he was receiving treatment.
It was reported that the soldiers were on their way to attend a training program at the Ojo Military Cantonment on Wednesday when the bus transporting them to the down encountered mild traffic around the Trade Fair area of the Lagos Badagry Expressway.
Maj.-Gen. Musa also advised the personnel of the division to give the new GOC the necessary cooperation needed so that the division could move to greater heights.
“I urge you all to be loyal, dedicated, and redouble your efforts to surmount the current security challenges the country is facing.
“We are all aware of how threats are spreading all over the country and we are doing our best to ensure that we curtail all these activities.
“I assure the civilian populace that the army is doing its best to ensure that the country remains peaceful,” he said.
Musa encouraged the media to continue to give correct reportage and publicity concerning the activities of the Nigerian Army so that the bandits would know that they were being subdued.
Also speaking, the new GOC, Maj.-Gen. Ajunwa said that he would strive to identify the security gaps in the state and deploy strategies to mitigate them.
MAJOR GENERAL OBINNA AJUNWA ASSUMES COMMAND AS THE 32nd GENERAL OFFICER COMMANDING 81 DIVISION NIGERIAN ARMY
The newly appointed General Officer Commanding (GOC) 81 Divison Nigerian Army (NA) Major General Obinna Ajunwa has assumed command of the Division in line with the recent posting by the Headquarters NA Department of Military Secretary.
At the handing and taking over ceremony of the office of the GOC held at Headquarters 81 Division in Lagos Major General Ajunwa thanked the Chief of Army Staff for finding him worthy of this great responsibility. He thereafter commended the immediate past GOC Major General Umar Thama Musa for taking the Division to greater heights. He pledged to contribute to the success recorded so far. General Ajunwa urged senior officers of the Division to work as a team and demonstrate professionalism during the discharge of their duties. He said the only way to ensure success is to move the Division to greater heights.
Earlier, the immediate past GOC, General Musa who has been redeployed as the new GOC 82 Division thanked God for granting him successful tenure of office and the COAS for finding him worthy of the appointment as GOC. He expressed confidence in the ability of the new GOC to deliver on his new assignment. He, therefore, thanked Commanders and Principal Staff Officers for the support and cooperation he enjoyed during his tour of duty and appealed for the same and even more to be extended to his successor.
Highlights of the occasion include the commissioning of some projects, the signing of handing and taking over notes, the quarter guard procedure, a group photograph, and a farewell address to troops.
OLANIYI OSOBA Major Acting Deputy Director 81 Division Nigerian Army Public Relations 9 August 2022
REBUTTAL: NO SOLDIER WAS SHOT AT; SOLDIERS ATTACKED POLICEMEN UNPROVOKED
The attention of the Lagos State Police Command has been drawn to a report credited to Major General Umar Musa, outgoing GOC 81 Division, claiming that a ‘police officer shot at the soldier during the altercation which clipped him in the ear but narrowly missed his vital parts.’ In as much as the Lagos State Police Command is in a grieving mood and has decided to toe the line of civility, it is pertinent to stand against misinformation.
The fact remains that on Wednesday, August 3, 2022, at the Trade Fair area of Lagos State, about thirty Privates of the Nigerian Army attacked five policemen for stopping vehicles along their lane to pave way for a heavy duty truck joining the expressway. After the soldiers had brutalized the ASP leading the team, taken out his magazine, and abducted two Inspectors with their rifles, the next Inspector they attempted to attack fired a single shot into the air – an act that made the soldiers retreat.
The single shot was into the air. At no point was anyone hit. The Lagos State Police Command challenges the Army authorities to present the soldier allegedly shot.
While we mourn our fallen hero, and pray for the total recovery of the second abducted Inspector, we urge Nigerians to disregard the claim that a soldier was shot as there is absolutely no truth to it.
Meanwhile, the Lagos State Police Command eagerly awaits the report of the panel of inquiry set up by the Nigerian Army to investigate the immediate and remote cause of the incident. The Command equally looks forward to the fishing out of the soldiers behind the torture and murder of Inspector Monday Orukpe; and the return of two AK47 rifles and three magazines carted away by the soldiers, in line with the pledge made by the Nigerian Army as conveyed by Brigadier-General KN Nwoko during a condolence visit to the Commissioner of Police, Lagos State Command, CP Abiodun Ablabi, fdc.
SP BENJAMIN HUNDEYIN, anipr, mipra, Police Public Relations Officer, Lagos State Command, Ikeja-Lagos August 10, 2022
Crime › Re: Israeli Scammers Defraud Nigerians With Child Cancer YouTube Adverts. by naptu2(op): 6:20pm On Aug 11, 2022
