Category: Scams

I get sent SO many different styles of scam email, some are the same old thing recycled, some are bloody clever and others sit somewhere in the middle.

All of them are devious and sneaky though, this one being no exception!

Sender;

From: “department_amazon” <amazon@account-department.com>
Date: 4 Oct 2015 01:39
Subject: noreply [notice number [1707302085]

Then an image that didnt load, probably an Amazon logo, followed by this text;

Form required

Dear
thank you for shopping with amazon
we are sorry to inform you that regarding your account we are unable to link your credit card in your account.
we closed your account temporarily until we hear from you
What should you do !
1-download the secure browser window from:
https://www.amazon.com/case?id=AM_88_999_103_25
2-login to your account and follow the steps
. .

Sincerely,

Amazon

Devious, sneaky but written by a friggin moron! No capital letters at the start of sentences, spaces before punctuation, inaccurate descriptions of stuff – this would never had been signed off by Amazon 🙂

The link was a strange one too, it looks fairly normal above but when you hover over it, it went to;

hXXps://www.facebook.com/download/703544469751142/AM_88_999_103_25.html

Never seen Facebook hosting something being used in a scam before – I havent clicked it but I suspect it either encourages you to download something else, it will redirect me to some nasty website or it will give me instructions on the next actions they want me to take.

Be careful though peeps – you would have to be pretty simple to think this is a real email but for every 1000 people who see this for what it is – there will be 1 person who falls for it and that may be all they need.

This was a very new style of scam, one guaranteed to fool any parent or concerned human!

It was sent from;

———- Forwarded message ———-
From: “kids Iive-safe.” <contact@xfpbma8p.millioncoupon.co>
Date: 3 Oct 2015 13:53
Subject: family Safety- alert [S.no:23803].

And the email looks like this;

It comes across very genuine and real,  but when you hover over elements the links show as;

hXXp://user.name.xfpbma8p.giftsworld.lol/Nvew/rrcmzm-r500ja/hhuzumcr-cgzllucggh.qwm

Breaking that down, the domain name is

hXXp://giftsworld.lol

And whether that looks & feels like a trustworthy domain or not, its certainly not something you would expect a message of this nature to utilise!

The unsubscribe link goes to;

hXXp://user.name.xfpbma8p.giftsworld.lol/Ljp/rrcmzm-r500ja/hhuzumcr-cgzllucggh.qwm

Which is slightly different to the original URL, so I bet the target pages show slightly different info so as to further reinforce its authenticity.

A very unusual scam this one, and also quite worrying as MANY people will fall for this.

Be warned guys!

Scams that promise millions of monies are not new, they have been around as long as the internet – but I do find it interesting how these scams evolve and try to embrace more modern *things* to make their scam more believable.

Had this one recently;

From: Mrs. Rachael Adams. <marketing@yuanlai01.com>
Date: 5 August 2015 at 14:32
Subject: YOUR BMW CAR AND CHECK OF $1,500.000.00 USD!!

Hmm… yuanlai01.com doesnt seem to translate to BMW no matter what I try?

BMW LOTTERY DEPARTMENT
5070 WILSHIRE BLVD
LOS ANGELES. CA 90036
UNITED STATES OF AMERICA.
EMAIL: mike_james00@hotmail.com

Well shit me. BMW have a lottery department, and its ran by Mike James who also doesn’t seem to have an official BMW email address? Maybe the lottery department is old school? 🙂

NOTE: If you received this message in your SPAM/BULK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.

LOL – nice try.

Dear Winner,

This is to inform you that you have been selected for a prize of a brand new 2014/2015 Model BMW 5 Series Car and a Check of $1,500,000.00 USD from the international balloting programs held on the 2nd section in the UNITED STATE OF AMERICA.

Just the one state?

Description of prize vehicle;
Model: 530iA Color (exterior): Metallic Silver Mileage: 5 Transmission: Automatic 6 Speed

Options: Cold weather package, premium package, fold down rear seats w/ski bag, am fm stereo with single in dash compact disc player.

Riiiiiiiiiiight.

The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected.

Oh right. Don’t seem to remember entering a prize draw but whatever – I’ll have a free BMW and some spondoolies 🙂

The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our fiduciary claims department for more information as regards procedures to the claim of your prize.

Bloody hell they’re pulling out the big guns here. I had to google fiduciary. Great word.

Name: Mr. Mike James
Email: mike_james00@hotmail.com

Owd Mike again 🙂

Contact him by providing him with your secret pin code Number
BMW:255125HGDY03/23.

You are also advised to provide him with the under listed information as soon as possible:

1. Name In Full :
2. Residential Address :
3. Nationality :
4. Age :
5. Sex
6. Occupation :
7. Direct Phone :
8. Present Country :
9. Email address :
10. pin code Number BMW:255125HGDY03/23

Hmm. BMW, who are worth BILLIONS want this info sending in a badly formatted list in an email? To a hotmail address? Come on guys, really?

Please you are to provide him with the above listed details as soon as possible so he can begin with the processing of your prize winnings.

Congratulations again from all our staff and thank you for being part of our promotional program.

Mrs. Rachael Adams.

THE DIRECTOR PROMOTIONS
BMW LOTTERY DEPARTMENT
UNITED STATES OF AMERICA

Get f’kd Rachael!

You can keep your car you scamming wench! 🙂

I blogged before about a scam that was riding off the back of a lottery win here in the UK.

Richard and Angela Maxwell won over £53 million on the lottery, and it didn’t take long before the scammers jumped on this huge win and tried to use it to blag people via email.

My previous post was regarding their initial contact, well “they” replied!

Dear Olly,

How are you doing ? We hope this email finds you well. We sent you an email earlier informing you that your email was one of the email addresses selected to benefit from our donation project as part of events to mark our massive EuroMillions win.

Millionaires, scam or not. Putting a space before a question mark irritates me. Hah.

My wife and I are happy that you accepted to receive this financial support donation of £1million from our family fund. After winning Britain’s 10th biggest EuroMillions lottery jackpot of £53million, Angela and I decided to use part of our financial fortune to fund and support a number of good causes and it’s a privilege to be in a position to provide financial support where we could.

Its like, partially worded well, partially worded with feet in mouth.

The biggest and happiest change in our lives is that we can now support causes close to our hearts in more meaningful ways. My wife and I were incredibly lucky and we will never forget that.
As you can imagine, our donation payments would be handled by our bank in other to reduce the stress on us because it really sometimes can be stressful for my wife and I to do all these things on our own considering our old age.

Nice way of passing the responsibility over to someone that you dont have to pretend to be.

Please email your donation code -[#MaxwellsFundRecipient03] to Mr. Alan Belton, our personal banker, who also happens to be the deputy branch manager of our payout bank for payment. See Mr Belton’s contact details below;

Alan Belton. It even sounds like an English name a Nigerian would come up with.

Piraeus Bank S.A.
Tower 42, 25 Old Broad St., London EC2N 1HN
Deputy Branch Manager – Mr. Alan Belton
Email – abelton@piraeusbank5.co.uk

My bad, its a Ukrainian scam.

Domain name:
piraeusbank5.co.uk

Registrant:
Haim Koik

Registrant type:
Unknown

Registrant’s address:
13 Sheptitskogho St.
Ternopil
Ternopil’s’ka oblast
46008
Ukraine

Data validation:
Nominet was not able to match the registrant’s name and/or address against a 3rd party source on 20-Mar-2015

Registered through:
domaindiscount24
URL: http://www.domaindiscount24.net

Registrar:
Key-Systems GmbH [Tag = KEY-SYSTEMS-DE]
URL: http://www.Key-Systems.net

Owd Haim has gone to some fair trouble here, why he hasn’t opted for the free WHOIS privacy I dont know.

My wife and I would expect you to work in harmony with the payout bank in other to facilitate an immediate release of the donated amount.

Real people dont talk like that.

Best Regards,
Richard and Angela Maxwell.

Email sent from:  Richard Maxwell <r.maxwell@maxwellfoundation.co.uk>

And the WHOIS for that shows different info from the Piraeus Bank one above, however if you pay attention;

Domain name:
maxwellfoundation.co.uk

Registrant:
Maxwell Foundation

Registrant type:
Unknown

Registrant’s address:
13 perth square, highland park
Gold Coast
QLD
4800
Australia

Data validation:
Nominet was not able to match the registrant’s name and/or address against a 3rd party source on 18-May-2015

Registered through:
domaindiscount24
URL: http://www.domaindiscount24.net

Registrar:
Key-Systems GmbH [Tag = KEY-SYSTEMS-DE]
URL: http://www.Key-Systems.net

The registrar is identical on both. Busted.

They seem to be using Google for the email for both, as the MX records are all configured to use Google Apps – its amazing that Google will host a phishing URL and let someone send scam emails from it!

They even included some images in the original email that was sent;

I hope Richard and Angela are enjoying their winnings – its such a shame their name is being dragged through the mud with this horrible scam!

If you get an email from them, it will be a scam!

Let me know if you get anything like by posting a comment below.