Jilly Juice – Jillian Epperly

Scammer’s website www.jillyjuice.com

Scammer’s email [email protected]

Country United States

Type of a scam Counterfeit Product

Initial means of contact Not applicable

Two Patterns of Racketeering Activity:
Computer Crimes
Health Fraud

Pattern 1: Computer Crimes
————————————
Malvertising [7/16/2019]
https://archive.is/cRsji

Quttera Result Files Analysis
https://archive.is/3ocNL

Virustotal Reverse Engineering Competitive Intelligence
<span title="https://www.virustotal.com/gui/url/77b690afe99a61accafb8d249bf3ed52fbbc9fe7bc8f921786e98190e8dcdb8c/detection
https://www.virustotal.com/gui/url/77b690afe99a61accafb8d249bf3ed52fbbc9fe7bc8f9…⇄ />

IP Address Relations
https://www.virustotal.com/gui/ip-address/198.57.219.8/relations

Threat MD5 Analysis
<span title="https://ybin.me/p/fcd6708f5bf87cd1#5Wy6knEH8rd5OffdYGeT/3+aSVajEX0by36pvT3wgDE=
https://ybin.me/p/fcd6708f5bf87cd1#5Wy6knEH8rd5OffdYGeT/3+aSVajEX0by36pvT3wgDE=<…⇄ />
————————————
Pattern 2: Health Fraud

Proof of Concept -> BBB Scam Tracker
BBB Scam Tracker Report Incidents from 2018
Date Scam Type Postal Code Dollars Lost Details
Mar 27, 2018 Healthcare/Medicaid/Medicare 44706 $30.00 View
Mar 24, 2018 Healthcare/Medicaid/Medicare V2R 5S5 $150.00 View
Mar 07, 2018 Healthcare/Medicaid/Medicare 30004 $0.00 View
Feb 03, 2018 Healthcare/Medicaid/Medicare 77014 $230.00 View
Jan 29, 2018 Healthcare/Medicaid/Medicare 77477 $0.00 View

Computer Fraud and Abuse Act
18 U.S. Code §1030. Fraud and related activity in connection with computers
18 U.S.C. § 1030(a)(5): Damaging a protected computer (including viruses, worms)

[2019-07-12]
Be advised that Jillian Mai-Thai Epperly is hosting a downloadable trojan browser hijacker on her Jillyjuice website named “DailyRecipeGuide”. She is hosting different “Advertisements” to lure website visitors in for reasons of social engineering. She requires you to give consent in order to execute the file. Don’t. The file was tested. It isn’t safe to execute and isn’t safe to visit that website. She has it rigged up with potential “Malvertising”. The trojan executable is a browser hijacker that allows her to spy in on your browsing activities. She will be attempting to track your every move if you download and excute that file.

Sandbox Proof of Concept on 7-12-2019:
https://archive.is/X9XGa
https://archive.fo/Xyvxs
https://archive.fo/1qqvS
https://archive.fo/eY1ET

Tencent HABO Intel
<span title="https://vtbehaviour.commondatastorage.googleapis.com/f21b2144f01819886d7e1f78a3b08867f147cc9fa955349a*******695d1416_Tencent%20HABO.html?GoogleAccessId=*******@developer.gserviceaccount.com&Expires=*******763&Signature=HmIRIkzioYk7EGSmFkCjZ9uwc3f9WnkSiKUHf%2BsDcLN77oUjlTiRvIx%2Bf89FcpPXilxDOTqiOhYO%0AqMcH90AAGtcyEc4a73Fm0jsCIH29fAs0OLkUMCIItB5nXmBGeKKyFukTqHCRNqxw922jtHSHJX7N%0AzxKiGx8DCTGEVI4dzQ0%3D&response-content-type=text%2Fhtml;
https://vtbehaviour.commondatastorage.googleapis.com/f21b2144f01819886d7e1f78a3b…⇄ />

Virustotal Reverse Engineering Intel
<span title="https://www.virustotal.com/gui/file/f21b2144f01819886d7e1f78a3b08867f147cc9fa955349a*******695d1416/detection
https://www.virustotal.com/gui/file/f21b2144f01819886d7e1f78a3b08867f147cc9fa955…⇄ />

Mindspark Domain Information
https://www.virustotal.com/gui/domain/www.mindspark.com/relations

Adversary Algorithm Flow Layout:
1. Initial Access -> Sucker List.
2. Discovery -> Targets of Interest.
3. Technical Information Gathering -> Specific Details on the Mark
4. Pretext -> Invitation to product X through Invitation.
5. Defense Evasion -> Plausible Denial of menacing activities.
6. Spoofing -> Product is masked as a remedy
7. Privilege Escalation -> Ingratiation with the target(s).
8. Credential Access -> Credit Card Numbers, Debit Card Numbers etc, Passwords, Username, Email, Routing Numbers etc.
9. Lateral Movement -> Move from node to node smoothly.
10. Data Exfiltration -> Data of Interest Acquisition.
11. Impact -> Zero-sum.
12. Backdoor -> Return to the environment to direct and administer malevolent activity upon marks previous conformance to the confidence trick.

SHA256: 965e7bbdf3e6a1171a50fcc4f0e5a9ac45b42cb*******488ab82b07bb4e8bf9
Exiftool File Metadata
CreatorTool: Softplicity
FileType: PDF
FileTypeExtension: pdf
Format: application/pdf
Linearized: No
MIMEType: application/pdf
ModifyDate: 2018:07:08 22:28:35+02:00
PDFVersion: 1.5
PageCount: 5
PageLayout: SinglePage
PageMode: UseNone

Phishing Website Contacted from The PDF File Linked with JillyJuice
http: //Hunter () serv-botsalw () ru/
ESET -> Phishing
*checks-user-input
*detect-debug-environment
*direct-cpu-clock-access
*long-sleeps
*pdf runtime-modules

Processes Injected:
(2504) C:Program Files (x86)AdobeReader 9.0ReaderAcroRd32.exe

Commonly Abused Properties:
*Contains 5 page(s).
*Contains 81 object start declaration(s) and 81 object end declaration(s).
*Contains 9 stream object start declaration(s) and 9 stream object end declaration(s).
*This PDF document has a cross reference table (xref).
*Has a pointer to the cross reference table (startxref).
*Has a trailer dictionary containing entries allowing the cross reference table, and thus the file objects, to be read.

WHOIS Records:
Creation Date: 2017-12-28T20:58:46Z
DNSSEC: unsigned
Domain Name: JILLYJUICE.COM
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS14.WIXDNS.NET | NS15.WIXDNS.NET
Registrar: Network Solutions, LLC
Registrar Abuse Contact Email: *******@web.com
Registrar Abuse Contact Phone: *******680
Registrar IANA ID: 2
Registrar URL: http://networksolutions.com
Registrar WHOIS Server: whois.networksolutions.com
Registry Domain ID: *******180_DOMAIN_COM-VRSN
Registry Expiry Date: 2023-12-28T20:58:46Z
Updated Date: 2019-06-05T03:05:59Z

*Process Injection
ID: T1055
Sub-techniques: T1055.001, T1055.002, T1055.003, T1055.004, T1055.005, T1055.008, T1055.009, T1055.011, T1055.012, T1055.013, T1055.014
Tactics: Defense Evasion, Privilege Escalation
Platforms: Linux, Windows, macOS
Data Sources: API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Defense Bypassed: Anti-virus, Application control
CAPEC ID: CAPEC-640
Contributors: Anastasios Pingios; Christiaan Beek, @ChristiaanBeek; Ryan Becwar
Version: 1.1
Created: 31 May 2017
Last Modified: 20 June 2020

Malicious Website Advertisement on JillyJuice
https://www.virustotal.com/gui/domain/free.dailyrecipeguide.com/relations

Cash App Archived URL for reasons of Documenting Private Financial Advantage linked with Jillians Illicit Activities:
<span title="https://www.virustotal.com/gui/url/a4f55ad1e7578c6442c184fee4b6b31684f21c192b040d2c4bb28ac68dba18d9/details
https://www.virustotal.com/gui/url/a4f55ad1e7578c6442c184fee4b6b31684f21c192b040…⇄ />

2019 Detected technologies:
*Wix (CMS)
*Website React (JavaScript Frameworks)
*Website Google AdSense (Advertising Networks)

2018 Detected technologies:
*WordPress (CMS)
*PHP (Programming Languages)
*Nginx (Web Servers)
*React (JavaScript Frameworks)
*Google AdSense (Advertising Networks)
*Google Analytics (Analytics)
*Twitter Emoji (Twemoji) (Miscellaneous)
*jQuery (JavaScript Libraries)

Scan History:
https://urlscan.io/search/#page.domain%3Awww.jillyjuice.com

Detailed Technology Profile:
https://builtwith.com/detailed/jillyjuice.com

2018 DOM Tree:
https://urlscan.io/result/70b7d872-41b5-42ef-8566-4921b19295ba/dom/

2019 DOM Tree:
https://urlscan.io/result/1e541633-7bf4-4d4c-a3e4-c071c8dd2c9a/

404 URLs. Suspicious Indicators.
https://www.jillyjuice (dot) com/ 404 No Content
https://www.jillyjuice (dot) com/z;a.crossorigin= 404 No Content
https://www.jillyjuice (dot) com/[];c[l]={onLoad:function(b){h.push(b);g&&!x||e(h)},forceLoad:function(){x=!0…⇄ 404 No content

Proof of Concept [18-07-2019]
https://archive.is/zKf5D

Competitive Reverse Engineering Intel on Jillian’s Malvertisements
<span title="https://www.virustotal.com/gui/file/f425880db443b7eb5895db65d168e6e7d7b1af92f4666ba8602d52e09a9a7631/detection
https://www.virustotal.com/gui/file/f425880db443b7eb5895db65d168e6e7d7b1af92f466…⇄ />
https://www.virustotal.com/gui/ip-address/35.244.218.203/relations
https://www.virustotal.com/gui/domain/infragistics.com/relations
https://www.virustotal.com/gui/domain/asp.net/relations

Victim Location 30004

Type of a scam Healthcare/Medicaid/Medicare

Jillian Epperly began a Facebook group promoting her "protocol" in April of 2017. This protocol consists of a typical anti-candida diet and daily consumption of a "fermented" cabbage juice drink. This cabbage juice drink is a "[censored]ized" (Jillian proudly admits) recipe that she had taken from a well-known and respected health website. Jillian changed the recipe from 1 teaspoon of salt : 2 cups water : 2 cups cabbage to 1 TABLESPOON salt : 2 cups water : 2 cups cabbage. Members are instructed to use these new ratios and allow the concoction to "ferment" for 3 days. This juice is touted by Jillian and her moderators to be able to reverse all health conditions, including cancer, ALS, Autism, etc. Some of her claims are even more outrageous: reversal of Downs Syndrome, regrow the of foreskin on circumcised males, regrowth of uteruses in women who had undergone hysterectomies. To achieve these results, Jillian urges members to drink up to 1 gallon of her ferment per day – which calculates out to be at least 4 TABLESPOONS of salt. The goal in consuming large amounts of this juice is to induce what Jillian calls "waterfalls", better known as explosive diarrhea. These "waterfalls", according to Jillian, will expel all of the candida and parasites in a person’s body which she says are causing all of these health problems in the first place. Any negative effects reported back to Jillian by members are labeled as "healing symptoms" – even extreme swelling, seizures, heart attack symptoms, and severe headaches. On top of all of this dangerous advice, Jillian charges $75/hour for a private consultation and she frequently posted in her Facebook group about accepting donations. Because of this obvious scam and cult-like nature of the group, there is a movement to spread awareness and warn people about Jillians protocol on social media, involving many groups. For this reason, Jillain has moved off of Facebook, creating her jillyjuice.com website, so she can carry on with her scam with mire privacy. Her fees seem to be changing, but the last time I saw, her fee is $30 for a membership, nit including private consultations, which I believe are still $75/hour. This scam needs to be STOPPED! Many people & pets (including her own dog,) have been and are being harmed. children, as young as 3 months old, have been or are being fed this dangerous cabbage and salt solution. There are 2 alleged deaths from excessive consumption of this juice. I implore you to investigate this website further! Thank you for your time.

Victim Location 77014

Total money lost $230

Type of a scam Healthcare/Medicaid/Medicare

This is a complicated scam.

Jillian Epperly also known as Jillian Burke or Jillian Mai Thi has been running a group through social media, facebook for some time, preying on vulnerable people with health conditions. She claims to have found a way to reverse all health conditions A to Z. Including cancer, HIV, Down syndrome and homosexuality, as well as growing back organs and limbs.

She takes payment for consultations, giving health and diet advise for a fee of $75.

She recently has moved to a purpose built pngage pushing her dangerous protocol which consists of an anti inflammatory diet (AIP diet) with gallons of a high salt and pureed cabbage concoction which she claims to be a ferment, but isnt.

The problem with her ‘Juice’ is that is it very high in salt, she advises to drink 8 tablespoons of salt a day, which is enough to kill and adult human. She also recommends this as a sole food for babies to replace infant formula or breastfeeding.

Many in her group have had serious side affects and there are a number of her followers who have died. She removes all negative feed back from her groups and web site so others cant see the truth of what is happening.

I became aware of this scam when a good friend of mine and her newborn son were recommended this protocol for candida, and started it in good faith. The pair of them nearly died while Jillian claimed the pains they were suffering were healing symptoms. They had severe kidney issues, and salt poisoning. Chills, fevers, shakes weakness, diarrhea, vomiting and hallucinations.

Jillian is now running this same scam through her paid members wordpress pngage. She is charging $30 for a years access to her page, thinly veiled behind the word donation although her language changes frequently. She is still charging for private consultations despite being totally unlicensed which is illegal.

This woman is charging people to join her club, feeding them false medical facts, and damaging them then cutting them off without refund when they need help. Often doxxing and shunning them making videos to shame them for questioning her, or her no existent qualifications.

Jillian Epperly is dangerous, please help stop her hurting more people

Victim Location 77477

Type of a scam Healthcare/Medicaid/Medicare

Jillian Epperly is practicing medicine without a license. She has diagnosed people and attempted to prescribe a specific diet to cure/heal/reverse all ailments including cancer,autism,and down syndrome. She has created a website www.jillyjuice.com where she charges people a fee to view her medical claims. She offers coaching and private consultations which she charges people for. She was doing this on facebook for an entire year but now there are many injuries and even deaths associated with jillian epperly and her "jilly juice"

*** There has been a ripoff report filed against her due to someone dying after they paid Jillian for her coaching. *** *** was encouraged by Jillian and her team to drink a gallon of her recipe per day. There is 4 tablespoons of salt per gallon of "jilly Juice". Jillian Epperly told *** he could heal his cancer with her salty recipe.

Jillian Epperly is selling a recipe that is mostly salt and Jillian intends on selling specific salt on her website. Salt is toxic in high amounts and people are being harmed by the jilly juice protocol.

Many people are being harmed. Seizures are reported among many other painful side effects like bloody stool and uncontrollable vomitting. Children are being subjected to this and have been given enemas. Children have passed what looks like stomach lining after being subjected to this.

Pets are also being harmed. I have seen a report of a dog having a seizure and a cat died after given the recipe.

Jillian tells parents its safe to feed her recipe to infants and that her recipe is better than formula. She insists that mothers are infecting babies via breastmilk and that they have to purge their babies of viruses. Jillian admits her recipe can cause detox in infants.

This link discusses kids on Jillian Epperlys protocol

*** This blog is dedicated to exposing this scam and the pain associated with salt poisoning:

*** *** And someone made a youtube video exposing her

*** Jillian Epperly actively targets,harasses and cyber bullies anyone who speaks out about her protocol. She doxxes them and tries to scare people into silence. I am in fear of my online safety as a result because of Jillians bullying. Please keep my name private.