Category: Scams

Ive been very busy at work this week, and my inbox has had 10-20 emails unread in it constantly each day so far. I spotted this one sat in  the list and I was drawn to it as it referred to an invoice and I didn’t recognise the name so wanted to know what it was.

Gmail completely missed the fact it was a scam/spam email – and it didn’t seem alarmed that the email contained a ZIP file attachment :/

The email is from;

from: Patrica Sheppard <SheppardPatrica59@dsldevice.lan>
date: 8 March 2016 at 14:36
subject: FW: Invoice #993057-2016-03

Reply to address was the same, Patrica Sheppard <SheppardPatrica59@dsldevice.lan>

Didn’t open the attachment as it would obviously screw my PC over – but I find it highly alarming that this was allowed to get to my inbox and wasn’t picked up by gmail. Someone less knowledgable would have downloaded it and opened it and if their AV was crap it could have been game over.

Stay safe peeps – even the best spam filters in the world will let you down every once in a while!

OK, so this email was formatted professionally, it contained my details, a CUSTOMER details and was quite worrying really…

I think it’s actually more a phishing/hoax email that is sent out to get traffic to a website rather than infect your PC or steal your identity – but still it’s misleading!

Automated Confirmation No. 3384872

Adam Medison <adam@bleachbright-news.com>

Hello Dear Actual Customer Name,

Thank you for your dedication and loyalty.

Your full transaction details can be found here

Date/Time: 1/5/2016 10:00 AM EST
Confirmation number: 3384872
Account number: *********5200
Payment type: Online internal transfer
* Pending payment amount: $9,522.70
Member ID: info@correct-domain.co.uk

Please confirm receipt of this notice immediately.

Click here to confirm receipt

You are on the right path to becoming extremely rich!

Keep up the good work.

To your success,

– Adam

This email was sent to info@correct-domain.co.uk | Unsubscribe | Forward this email to a friend

It was quite alarming to receive with it having such accurate info in – they must have got it from WHOIS records as the email they published of ours is only linked to that customer via their domain.

I ignored it, and then got this a few days later!

Adam Medison <adam@youroption.co>

Hey,

You are ready to begin earning money with your new cash
system. Your request to access from your account ending in
**** 7389 has been completed, and the money is available
in your new balance.

— Please Access Your New Account Here

If you have any questions, please contact us by clicking here.

Enjoy,

– Adam Madison

FastCashBiz

This email was sent to info@correct-domain.co.uk | Unsubscribe | Forward this email to a friend

Also a scam/spam/hoax.

So, im sorry to say but you are not going to receive lots of money, and these guys simply want you to click the links to get traffic to their site.

Its like referer spam, but different haha 🙂

I get sent SO many different styles of scam email, some are the same old thing recycled, some are bloody clever and others sit somewhere in the middle.

All of them are devious and sneaky though, this one being no exception!

Sender;

From: “department_amazon” <amazon@account-department.com>
Date: 4 Oct 2015 01:39
Subject: noreply [notice number [1707302085]

Then an image that didnt load, probably an Amazon logo, followed by this text;

Form required

Dear
thank you for shopping with amazon
we are sorry to inform you that regarding your account we are unable to link your credit card in your account.
we closed your account temporarily until we hear from you
What should you do !
1-download the secure browser window from:
https://www.amazon.com/case?id=AM_88_999_103_25
2-login to your account and follow the steps
. .

Sincerely,

Amazon

Devious, sneaky but written by a friggin moron! No capital letters at the start of sentences, spaces before punctuation, inaccurate descriptions of stuff – this would never had been signed off by Amazon 🙂

The link was a strange one too, it looks fairly normal above but when you hover over it, it went to;

hXXps://www.facebook.com/download/703544469751142/AM_88_999_103_25.html

Never seen Facebook hosting something being used in a scam before – I havent clicked it but I suspect it either encourages you to download something else, it will redirect me to some nasty website or it will give me instructions on the next actions they want me to take.

Be careful though peeps – you would have to be pretty simple to think this is a real email but for every 1000 people who see this for what it is – there will be 1 person who falls for it and that may be all they need.

This was a very new style of scam, one guaranteed to fool any parent or concerned human!

It was sent from;

———- Forwarded message ———-
From: “kids Iive-safe.” <contact@xfpbma8p.millioncoupon.co>
Date: 3 Oct 2015 13:53
Subject: family Safety- alert [S.no:23803].

And the email looks like this;

It comes across very genuine and real,  but when you hover over elements the links show as;

hXXp://user.name.xfpbma8p.giftsworld.lol/Nvew/rrcmzm-r500ja/hhuzumcr-cgzllucggh.qwm

Breaking that down, the domain name is

hXXp://giftsworld.lol

And whether that looks & feels like a trustworthy domain or not, its certainly not something you would expect a message of this nature to utilise!

The unsubscribe link goes to;

hXXp://user.name.xfpbma8p.giftsworld.lol/Ljp/rrcmzm-r500ja/hhuzumcr-cgzllucggh.qwm

Which is slightly different to the original URL, so I bet the target pages show slightly different info so as to further reinforce its authenticity.

A very unusual scam this one, and also quite worrying as MANY people will fall for this.

Be warned guys!