I do think sometimes, some of these scammy spammers do have half a braincell – or they just get super lucky. I got this the other day;
And I am a google workspace user, so that seemed kinda relevant (There are fairly simple ways of finding this out so that I can be targeted, but the fact they did that [or may have done that] is impressive.
The sender address and reply-to are laughably fake though;
Unless Google are now recieving reply emails at an address registered with a German rivals email service. I think not.
This isn’t a link Google would use – I highlighted the domain in Bold and that should be google.com or googleservices.com or something like that.
I used an isolated browser and machine to open the link, Nord blocked it but I bypassed that and it took me to a page that was “Loading” but nothing happened. Either it was trying to steal stuff in the background or install malware or something or it is now broken as its been reported.
These Google credential scams are getting more and more common now, so be aware and if you are unsure about anything at all contact me by commenting or email scams@0lly.uk.
Firstly, I am not suggesting Greystar Apartments are a scam, but this scam itself is doing the rounds and these people are pretending to be Greystar Worldwide LLC. This is the Greystar Apartments PPC Scam.
It started with an enquiry, the domain looked a bit dodgy but I actually thought it was another marketing agency at first. This is a tactic used by them sometimes, like “Oh we are looking for agency partners for a big client” but all they are really trying to get you to do is join their super secret lead-gen club.
I replied, with the utmost professionalism;
As I knew this wasnt a legit request.
Hmm, I Googled the name and this guy is the managing director, but this screams scam to anyone that knows what they are looking at. That said, I wasnt sure how they were gonna try and scam me yet – I still knew this was dodgy AF.
Its written to literally make a small digital marketing agency owner weak at the knees – $70,000 budget a month?! That management fee will be the equivalent of someone’s WAGE! Oh SHIT!
Also the Greystarppc.com domain name was registerd 7 days prior to me writing this article.;
Anyway, like I always do, I baited them;
My new friend Christopher replied;
And I got this email through;
Email it was sent from was adspromonoreply@googlemail.com – Greystar Apartments PPC Scam
The email they have sent from is wrong, although fairly convincing. Also, the Fwd: bit at the end of the subject is something you would not see. These emails are auto generated, not forwarded.
The button itself also shows us our next clue, as it links here;
Again, they have done a good job with this planning, they used a Googlemail email to send a Google email, and have hosted a fake Google ads page, on Googles server.
This scam WILL trick innocent people.
Clicking the CONTINUE button and Nord stepped in;
It was trying to send me to google.accounts-signin.com – again, looks convincing, but the domain is www.accounts-signin.com and that doesnt look like a Google domain.
I bypassed Nord but it looks like the page has been taken down now anyway.
In short, this is a fairly well thought out scam, they are trying to get you to add your Google credentials into a fake login page I suspect – and then once they have your Google login they would proceed to ruin your life.
There may be more to it along the way – but if you are a digital agency owner, dont fall for these scams. There are a few variations, a few where they get you to quote for work and, and a few other variations.
Greystar Apartments PPC Scam
Greystar Apartments PPC Scam
UPDATE: I had to restore the Greystar Apartments PPC Scam article due to a software glitch, and in doing so I had to take some of the screenshots again. One of them was the WHOIS lookup, and when I did the first one it seemed to show me more information that it should have done – i’m not sure what is happening here but i’m sure this info should be redacted;
So that’s interesting!
I’ve emailed lskfoods@gmail.com to see what they have to say for themselves. I will update the post if they reply.
UPDATE 2: Their email has been disabled – this lead is dead 🙁
