Tag: email scam

  • Greystar Apartments PPC Scam

    Firstly, I am not suggesting Greystar Apartments are a scam, but this scam itself is doing the rounds and these people are pretending to be Greystar Worldwide LLC. This is the Greystar Apartments PPC Scam.

    Greystar Apartments PPC Scam

    It started with an enquiry, the domain looked a bit dodgy but I actually thought it was another marketing agency at first. This is a tactic used by them sometimes, like “Oh we are looking for agency partners for a big client” but all they are really trying to get you to do is join their super secret lead-gen club.

    I replied, with the utmost professionalism;

    As I knew this wasnt a legit request.

    Greystar Apartments PPC Scam

    Hmm, I Googled the name and this guy is the managing director, but this screams scam to anyone that knows what they are looking at. That said, I wasnt sure how they were gonna try and scam me yet – I still knew this was dodgy AF.

    Its written to literally make a small digital marketing agency owner weak at the knees – $70,000 budget a month?! That management fee will be the equivalent of someone’s WAGE! Oh SHIT!

    Also the Greystarppc.com domain name was registerd 7 days prior to me writing this article.;

    Anyway, like I always do, I baited them;

    My new friend Christopher replied;

    And I got this email through;

    Email it was sent from was adspromonoreply@googlemail.com – Greystar Apartments PPC Scam

    The email they have sent from is wrong, although fairly convincing. Also, the Fwd: bit at the end of the subject is something you would not see. These emails are auto generated, not forwarded.

    The button itself also shows us our next clue, as it links here;

    Again, they have done a good job with this planning, they used a Googlemail email to send a Google email, and have hosted a fake Google ads page, on Googles server.

    This scam WILL trick innocent people.

    Clicking the CONTINUE button and Nord stepped in;

    It was trying to send me to google.accounts-signin.com – again, looks convincing, but the domain is www.accounts-signin.com and that doesnt look like a Google domain.

    I bypassed Nord but it looks like the page has been taken down now anyway.

    In short, this is a fairly well thought out scam, they are trying to get you to add your Google credentials into a fake login page I suspect – and then once they have your Google login they would proceed to ruin your life.

    There may be more to it along the way – but if you are a digital agency owner, dont fall for these scams. There are a few variations, a few where they get you to quote for work and, and a few other variations.

    Greystar Apartments PPC Scam

    Greystar Apartments PPC Scam

    UPDATE: I had to restore the Greystar Apartments PPC Scam article due to a software glitch, and in doing so I had to take some of the screenshots again. One of them was the WHOIS lookup, and when I did the first one it seemed to show me more information that it should have done – i’m not sure what is happening here but i’m sure this info should be redacted;

    Contact Information
Registrant:
Name: bui van Dong
Organization: None
Email: lskfoods@gmail.com
Status: active
Phone: tel:+84.898402000
Kind: individual
Mailing Address: bach nga, xa nga son, tinh thanh hoa, 100000
ISO-3166 Code: VN
Administrative:
Name: bui van Dong
Organization: None
Email: lskfoods@gmail.com
Status: active
Phone: tel:+84.898402000
Kind: individual
Mailing Address: bach nga, xa nga son, tinh thanh hoa, 100000
ISO-3166 Code: VN
Technical:
Name: bui van Dong
Organization: None
Email: lskfoods@gmail.com
Status: active
Phone: tel:+84.898402000
Kind: individual
Mailing Address: bach nga, xa nga son, tinh thanh hoa, 100000
ISO-3166 Code: VN

Registrar Information
Name: Nhan Hoa Software Company Ltd.
IANA ID: 1710
Abuse contact email: hdung@nhanhoa.com
Abuse contact phone: tel:+844 73086680
DNSSEC Information
Delegation Signed: Unsigned

    So that’s interesting!

    I’ve emailed lskfoods@gmail.com to see what they have to say for themselves. I will update the post if they reply.

    UPDATE 2: Their email has been disabled – this lead is dead 🙁