Scam Examples - Page 4
Page 4 of 6 FirstFirst ... 23456 LastLast
Results 31 to 40 of 60

Thread: Scam Examples

  1. #31
    Super Moderator
    Know-it-All Master Beaver

    Join Date
    Jan 2003
    Posts
    3,914
    Hey Hey,


    Just to let everyone know (and I've already discussed this with foxyloxley in PM)... I've renamed this thread to something a little more appropriate and made it a sticky. I think this is a great way to keep a database of scams in case anyone ever wants to do any research against them.... This way it's a single thread as well instead of cluttering the forum.

    Peace,
    HT
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

  2. #32
    Super Moderator
    Know-it-All Master Beaver

    Join Date
    Jan 2003
    Posts
    3,914
    Hey Hey,

    Here's the follow up to the last one I posted... My email response and their response


    Me
    Hello Stephen,

    The business proposition of which you speak is rather interesting. Could you please provide me with more details on the process?

    Thank you,
    Tyler
    Headers
    Return-path: <importexport500@yahoo.co.uk>
    Envelope-to: myaddress@mydomain.com
    Delivery-date: Sun, 07 Aug 2005 14:55:28 -0400
    Received: from web26308.mail.ukl.yahoo.com ([217.146.176.19])
    by my.mail.server with smtp (Exim 4.44)
    id 1E1qIx-0001Ak-53
    for myaddress@mydomain.com; Sun, 07 Aug 2005 14:55:27 -0400
    Received: (qmail 90273 invoked by uid 60001); 7 Aug 2005 18:55:17 -0000
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    s=s1024; d=yahoo.co.uk;
    h=Message-ID:Receivedate:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding;
    b=oKnidNOYkdQUppd8e43VxtlfRQPvF1jHr3EUQuSPe1y5uH1cFlkNH3Mzx8SoCWhLENepK+bfo//WvFf6B27ALluJjbJvoYU+7UHsIQ0Gr6261qHvUQLCQbfgvtOVL7tKL6Yfp2q106WEZFaD18yJZ95FyPhN/+dMUdVyQlPAUEM= ;
    Message-ID: <20050807185517.90271.qmail@web26308.mail.ukl.yahoo.com>
    Received: from [209.214.254.109] by web26308.mail.ukl.yahoo.com via HTTP; Sun, 07 Aug 2005 19:55:17 BST
    Date: Sun, 7 Aug 2005 19:55:17 +0100 (BST)
    From: importexport500 <importexport500@yahoo.co.uk>
    Subject: FURTHER DETAILS
    To: mydomain@myaddress.com
    MIME-Version: 1.0
    Content-Type: multipart/alternative; boundary="0-837294448-1123440917=:90149"
    Content-Transfer-Encoding: 8bit
    Message
    Dear Partner,

    This is to confirm that your last email to my company was received .My company thank you for your promptresponse to the mail and look forward to doing business with you.

    As explained to you in the first email, we deal on Cocoa,importation and exportation of Pharmaceutical and Textile products and raw materials from United Kingdom to other European countries,America and Canada.

    We normally have the problem of receiving payments from our customers,as some do not like going through the rigors of international money transfers.

    There is also a problem with urgent orders due to delays in transfer; meeting up with deliveries becomes a problem. My company has in fact lost thousands of dollars and pounds because of this and we are currently being owed huge sums of money. We would therefore appreciate someone that can assist us in this regards.

    Regarding your remuneration,my company normally gives a 10% commission to agents for any money collected on our behalf and sent to us through them.At this stage,I will like you to furnish me with the highest amount of fund you can receive in your bank account so that I can assign you to some particulars set of customers who make payment in that range.

    Lastly, you will be required to fill in the following information about yourself and send back to us immediately.

    NAME:
    COMPANY NAME:
    FULL CONTACT ADDRESS:
    PHONE:
    FAX:

    We expect your reply and look forward to a sincere and positive relationship with you.

    Regard.

    Mr. Stephen Timothy
    MANAGING DIRECTOR
    Peace,
    HT
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

  3. #33
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,523
    Another one, purporting to come from Nigeria, and this time offering $40 million .......

    Poor quality grammar, and no speeel chick are the giveaways:

    Return-Path: <ahmedusman75@hotmail.com>
    Received: from n078.sc1.cp.net (64.97.168.33) by n071.sc1.cp.net (7.0.038)
    id 420D5EC1022EF02F for xxx.xxx@xxx.xxx; Fri, 19 Aug 2005 12:49:14 +0000
    Received: from hotmail.com (64.4.53.60) by n078.sc1.cp.net (7.0.038)
    id 42EE3B88009FFD35 for xxx.xxx@xxx.xxx; Fri, 19 Aug 2005 12:49:14 +0000
    Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
    Fri, 19 Aug 2005 05:49:13 -0700
    Message-ID: <BAY19-F10A5C8C32071A8104A279ACCB50@phx.gbl>
    Received: from 80.255.51.131 by by19fd.bay19.hotmail.msn.com with HTTP;
    Fri, 19 Aug 2005 12:49:13 GMT
    X-Originating-IP: [80.255.51.131]
    X-Originating-Email: [ahmedusman75@hotmail.com]
    X-Sender: ahmedusman75@hotmail.com
    Reply-To: ahmedusman75@rixmail.se
    From: "ahmed usman" <ahmedusman75@hotmail.com>
    Bcc:
    Subject: STRICTLY CONFIDENTIAL
    Date: Fri, 19 Aug 2005 12:49:13 +0000
    X-OriginalArrivalTime: 19 Aug 2005 12:49:13.0699 (UTC) FILETIME=[66E49330:01C5A4BC]
    X-Antivirus: AVG for E-mail 7.0.338 [267.10.12]
    Mime-Version: 1.0
    Content-Type: text/plain; format=flowed

    STRICTLY CONFIDENTIAL

    ENGR.AHMED USMAN
    NIGERIA NATIONAL
    PETROLEUM CORP.(NNPC
    LAGOS-NIGERIA


    ATTN:

    I AM A DEPUTY DIRECTOR IN THE NIGERIAN NATIONAL PETROLEUM CORPORATION (NNPC)HERE IN LAGOS. MY COLLEAGUES HAVE ASSIGNED ME TO SEEK FOR ASSISTANCE OF RELIABLE FORE IN COMPANY OR AN INDIVIDUAL THROUGH WHOM WE CAN TRANFER THE SUM OF US$40,000,000:00(FORTY MILLION U.S DOLLARS) WHICH AROSE FROM THE DELIBERATE OVER-INFLATED CONTRACT VALUE FOR THE (TURN-AROUNDMAINTAINANCE(TAM)OF THE WARRI,KADUNA AND PORT-HARCOURTREFINERIES)AWARDED IN THE 1997 DURING THE GENERAL SANI ABACHA REGIME TO AN EXPATRIAT EFIRM WITH THE CONSIDERATION OF 10% COMMISSION AGREEMENT ON THE TOTAL CONTRACT VALUE.

    THE CURRENT FAVOURABLE POLITICAL/ECONOMI CLIMATE IN THE COUNTRY SINCE THE BEGINNING OF THE NEW FISCAL YEAR 2003 NOW PRESENTED AN OPPORTUNITY FOR THIS MONEY TO BE TRANSFERRED OUT OF THE COUNTRY.

    A FRIEND WHO WAS FORMALLY RESIDING IN YOUR COUNTRY MADE YOUR ADDRESS AVAILABLE TO ME.HE ASSURED ME OF YOUR COMPANY'S VIABILITY AND CAPABILITY IN BUSINESS TRANSACTIONS THOUGH HE DID NOT KNOW MY REAL INTENTION.

    THIS ASSURANCE GAVE ME COURAGE TO LINK YOU UP FOR THIS PARTICULAR TRANSACTION,AND I HOPE IT WILL BE OF MUTUAL BENEFIT TO ALL OF US.OUR CONTRACTS IN THE CENTRAL BANK OF NIGERIA AND FEDERAL MINISTRY OF FINANCE HAVE GIVEN US A GO AHEAD ORDER FOR REMITTANCE,SO WE HAVE SET IN MOTION THE MACHINERY FOR THE TAKE OFF OF THIS TRANSACTION AND FURTHER ACTION WILL COMMENCE IMMEDIATELY WE HEAR FROM YOU.

    WE HAVE AGREED THAT AFTER THE TRANSFER OF THE MONEY INTO YOUR ACCOUNT.YOU SHALL BE ENTITLED TO 35% OF THE TOTAL AMOUNT TRANSFERRED.

    THE NATURE OF YOUR BUSINESS IS NOT PARTICULARLY RELEVANT FOR THE SUCCESS OF THIS TRANS ACTION. ALL WE REQUIRE IS YOUR WELLINGNESS TO CO-OPERATE AND ASSURANCE THAT OUR OWN SHARE WILL BE GIVEN TO US WHEN THIS MONEY IS TRANSFERRED INTO YOUR ACCOUNT.

    ALL NECESSARY PRECAUTIONS HAVE BEEN TAKEN TO TO ENSURE A NO RISK SITUATION ON THE SIDE OF BOTHPARTIES AND IT IS BELIEVED THAT THIS TRANSACTION WILL LAST 20 WORKING DAYS, BARRING ANY DELAYS.

    SINCE WE HAVE NO KNOWLEDGE OF BUSINESS, OUR PLAN IS TO INVEST THIS MONEY INTO REAL ESTATE, STOCK AND PERHAPS IMPORTATION OF GOODS FROM YOUR COUNTRY BASED ON YOUR ADVISE BECAUSE MANY OF OUR YEARS HAS BEEN SPENT AS CIVIL SERVANT,AND WE MAY LIKELY RESIGN FROM GOVERMENT SERVICE TO PRIVATE BUSINESS AFTER THIS MONEY IS TRANFERED INTO YOUR ACCOUNT.

    PLEASE IF THIS PROPASAL IS ACCEPTANCE BY YOU, OR IF HAVE ANY QUESTION FEEL FREE TO CONTACT THRUOGH MY EMAILahmedusman75@rixmail.se) I WILL OBLIGE YOU WITH FURTHER INFORMATIOM.

    BEST REGARDS,

    ENGR.AHMED USMAN

    N.B PLEASE DO NOT FAIL TO INCLUDE YOUR PRIVATE TELEPHONE AND FAX NUMBER WHILL REPLYING THIS LETTER FOR EASY COMMUNICATIN
    55 - I'm fiftyfeckinfive and STILL no wiser,
    OLDER yes
    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

  4. #34
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,523
    I have NO idea what they want here ...............
    but it could have come from the caps lock keyboard of the above
    Suffice to say it's Russian ..................

    Return-Path: <motherblessingwokomah@yahoo.co.in>
    Received: from n024.sc1.cp.net (64.97.168.31) by n071.sc1.cp.net (7.0.038)
    id 420D5EC1022E3909 for xxx.xxx@xxx.xxx; Fri, 19 Aug 2005 09:29:13 +0000
    Received: from www9.pochta.ru (81.211.64.29) by n024.sc1.cp.net (7.0.043)
    id 42F209D1007EC20E; Fri, 19 Aug 2005 09:29:13 +0000
    Received: (from www@localhost)
    by www9.pochta.ru (8.13.1/8.13.1) id j7J9QrS6005842;
    Fri, 19 Aug 2005 13:26:53 +0400 (MSD)
    (envelope-from motherblessingwokomah@yahoo.co.in)
    Date: Fri, 19 Aug 2005 13:26:53 +0400 (MSD)
    Message-Id: <200508190926.j7J9QrS6005842@www9.pochta.ru>
    From: "EVENGELIST BLESSING ANGEL WOKOMAH [motherblesswokomah@mail15.com]" <motherblessingwokomah@yahoo.co.in>
    To: motherblesswokomah@mail15.com
    X-Mailer: Free mail service Pochta.ru; WebMail Client; Account: motherblesswokomah@mail15.com
    X-Proxy-IP: [80.88.128.12]
    X-Originating-IP: [80.88.138.100]
    Subject: BE IN ABOUNDANT BLESSING
    X-Antivirus: AVG for E-mail 7.0.338 [267.10.12]
    Mime-Version: 1.0
    Content-Transfer-Encoding: 8bit
    Content-Type: text/plain; charset=koi8-r


    MY DEAR I CHOOSE YOU TO DO GOD OFFER,NOT MY,BUT REMAINED YOU THAT GOD ARE USEING ME AS A POINT OF CONTACT TOWARD YOUR ASSISTANT.

    I AM MOTHER BLESSING ANGEL WOKOMAH FROM 562/HR/ ROTTERDAM NATHERLAND A WIDOW TO LATE PATRICK WOKOMAH I AM 61 YEARS OLD, I AM A REALL CHRISTAIN CONVERT, SUFFERING FROM LONG TIME CANCER OF THE BREAST,IN ALL INDICATION MY CONDITIONS IS REALLY DETERIORATING AND IT IS QUITE OBVIOUS THAT I WOUDIN,T LIVE MORE THAN THREE MONTHS, ACCORDING TO MY DOCTORS,AND ALL INDICATION REGARDS TO MEDICAL ANALYSIS, THIS IS BECAUSE THE CANCER STAGE HAS GOTTEN TO A VERY BAD STAGE THAT NO HOPE FOR ME TO BE A LIVING PERSON AGAIN.

    MY LATE HUSBAND KILLED DURING THE U.S. RAID AGAINST TERRORISM IN AFGHANISTAN, AND DURING THE PERIOD OF OUR MARRIAGE WE COULD NOT PRODUCE ANY CHILD.MY LATE HUSBAND WAS VERY WEALTHY AND AFTER HIS DEATH, I INHERITED ALL HIS BUSINESS AND WEALTH. THE DOCTORS HAS ADVISED ME THAT I MAY NOT LIVE FOR MORE THAN SIX MONTHS, SO I NOW DECIDED TO DIVIDE THE PART OF MY WEALTH, TO CONTRIBUTE TO THE DEVELOPMENT OF THE CHURCH IN AFRICA, AMERICA ASIA AND EUROPE ESPECAILLY CREATE SOLUTION TO PROBLEM OF LESS PREVILLAGED ONES AND ALPHANAGE HOMES.

    MY DEAR,I SELECTED YOU AFTER VISITING THE WEBSITE I PRAYED AND FAST FOR THREE WEEKS OVER IT WITH ADVISE OF MY PASTORS, I AM WILLING TO DONATE THE SUM OF $18.3000.000.00 U.S DOLLARS, TO THE LESS PRIVILEGED ONCE.

    PLEASE I WANT YOU TO NOTE THAT MY FUND IS LYING IN THE SECURITY COMPANY IN EUROPE, AND UPON MY INSTRUCTION, MY ATTORNEY,WHO PRESENTLY IS IN AFRICA DISTRIBUTING RELIEF MATERIALS TO OF BOMBLAST IN SLERRA-LEONE, WILL FILE IN AN APPLICATION FOR THE TRANSFER OF THE MONEY IN YOUR NAME LASTLY,I HONESTLY PRAY THAT THIS MONEY WHEN TRANSFERRED WILL BE USED FOR THE SAID PURPOSE EVEN THOUHG IM LATE THEN, BECAUSE I HAVE COME TO FIND OUT THAT WEALTH ACQUISITION WITHOUT CHRIST IS VANITY AND I MADE THE PROMISE TO GOD THAT THE FUND WILL BE USE TO BUILD HIS TEMPLE.

    MAY THE GRACE OF OUR LORD JESUS THE LOVE OF GOD AND THE FELLOWSHIP OF GOD BE WITH YOU AND YOUR FAMILY IN JESUS NAME I PRAYED AMEN. I AWAIT URGENT ASSISTANT.
    REMAIN BLESS AND LIVE LONG.

    EVENGELIST BLESSING ANGEL WOKOMAH
    55 - I'm fiftyfeckinfive and STILL no wiser,
    OLDER yes
    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

  5. #35
    Member
    Join Date
    Jun 2005
    Posts
    34
    Thought I would share one that I just received.

    Security Center


    Military Grade Encryption is Only the Start

    At Armed Forces Bank, N.A., we want to increase your security and comfort level with every transaction.



    To protect the security of your account, Armed Forces Bank, N.A. employs
    some of the most advanced security systems in the world and our anti-fraud teams regularly screen the Armed Forces Bank, N.A. system for unusual activity.

    Recently, our Account Review Team identified some unusual activity in your account. In accordance with Armed Forces Bank, N.A.'s User Agreement access to your account will be limited. This is a fraud prevention measure meant to ensure that your account is not compromised.

    In order to secure your account we may require some specific information from you. We encourage you to log in by clicking on the link below and complete the requested form as soon as possible.


    http[semicolon]//www[dot]afbank[dot]com/


    Ignoring our request, for an extended period of time, may result in account limitations or may result in eventual account closure.

    Thank you for your prompt attention to this matter. Please understand that this is
    a security measure meant to help protect you and your account.
    We apologize for any inconvenience.


    Sincerely,
    Armed Forces Bank, N.A. Account Review Department


    Armed Forces Bank, N.A. Email ID PP522
    *Please do not respond to this e-mail as your reply will not be received.
    Of course, I don't bank at Armed Forces Bank. If you mouse over www[dot]afbank[dot]com you will be taken to a site located at sebiro[dot]mtm[dot]ks[dot]edu[dot]tw/[dot]afbank. This resolves to a junior high school in taiwan. I don't think I want to give my account info to some junior high kid in taiwan. I have not had time to analyze this more to find out exactly what it does when it gets to this site. I'll post again after that.
    to SYN, or not to SYN. That is the question. -Shakespeare?

  6. #36
    Banned
    Join Date
    Jul 2005
    Posts
    511
    Got a scam myself today. An email like this:
    PayPal



    Protect Your Account Info
    Make sure you never provide your password to fraudulent websites.

    To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal URL to be sure you are on the real PayPal website.https://www.paypal.com/us/) to be sure you are on the real PayPal si! te.

    PayPal will never ask you to enter your password in an email.

    For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips


    Protect Your Password
    You should never give your PayPal password to anyone, including PayPal employees.




    You've got cash!

    Ahmed Houston sent you money with PayPal.

    Ahmed Houston is a Verified buyer.
    --------------------------------------------------------------------------


    Payment Details


    Amount: $73.35

    Transaction ID: LLM701885917864709279



    View the details of this transaction online


    --------------------------------------------------------------------------
    Shipping Information


    Address: Ahmed Houston
    23 Great George St.
    Westminster, London, SW1P 3AA
    United Kingdom


    Address Status: Confirmed




    --------------------------------------------------------------------------
    Thank you for using PayPal!
    The PayPal Team

    PayPal Email ID PP2209305
    Houston temptress vile chisel gypsy sentry wang relate trademark wattage tundra dennis sashay airfield blowback wast chronography biometry berkeley protean retrofitting spacecraft sassafras 01885917864709279
    Well, nothing special here, until you look at the email source! This source:
    Sender: service@paypal.com
    Received: from asy122.as25324.sol.superonline.com (asy122.as25324.sol.superonline.com [212.253.24.122])
    by liaag2ag.mx.compuserve.com (8.13.4/8.13.4/g1.1) with SMTP id j8ED8IHc019472;
    Wed, 14 Sep 2005 09:08:26 -0400
    Received: from mail90634.pkwtm.webtv.net (111.176.22.142) by tyc88-rl683.webtv.net with Microsoft SMTPSVC(5.0.2195.6824);
    Wed, 14 Sep 2005 08:08:21 -0600
    Received: from YWI5 (s94.25.132.96.pmmoi45.b.webtv.net 220.208.213.74)
    by mail4.u.webtv.net (82.08.92ng076/34.404.97) with SMTP id hq28EZI31BBmdt16451;
    Wed, 14 Sep 2005 08:08:21 -0600
    Message-ID: <4my688a48uhk76t$z0r017dg15$tzh7T14y5@TC264>
    From: "" <service@paypal.com>
    To: "101470.2173" <101470.2173@compuserve.com>
    References: <beehive7-D5CLzfsMAlXZL736JHX7T[1-5]n11@webtv.net>
    Subject: Ahmed Houston has just sent you $73.35 with PayPal
    Date: Wed, 14 Sep 2005 08:08:21 -0600
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary="-----=006_4337_0Y227X28.83WZ265D"
    X-Virus-Scanned: ClamAV version 0.85, clamav-milter version 0.85 on liaag2ag.mx.compuserve.com
    X-Virus-Status: Clean

    -------=006_4337_0Y227X28.83WZ265D
    Content-Type: text/html;
    Content-Transfer-Encoding: 7Bit

    <html><head><title>PayPal</title></head><body><style type="text/css">BODY, TD {font-family: verdana,arial,helvetica,sans-serif;font-size: 12px;color: #000000;}

    LI {line-height: 120%;}
    UL.smallBorder {margin:10px 5px 10px 20px;}
    LI.smallBorderLi {margin:0px 0px 5px 0px;}
    UL.Narrow {margin:10px 5px 0px 40px;}
    HR.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left: #fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}
    smallEmphasis {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;font-weight: bold;color: #000000;}
    serifBig {font-family: serif;font-size: 20px;font-weight: bold;color: #000000;}
    serif{font-family: serif;font-size: 16px;color: #000000;}
    sansSerif{font-family: verdana,arial,helvetica,sans-serif; font-size: 16px;color: #000000;}
    heading {font-family: verdana,arial,helvetica,sans-serif;font-size: 18px;font-weight: bold;color: #003366;}
    subHeadingEoa {font-family: verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color: #000000;}
    subHeading {font-family: verdana,arial,helvetica,sans-serif;font-size: 16px;font-weight: bold;color: #003366;}
    sidebarText {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #003366;}
    sidebarTextBold {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color: #003366;}
    xptFooter {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #aaaaaa;}
    button {font-size: 13px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; border-styleutset; color:#000000; background-color: #cccccc;}
    smaller {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #000000;}
    smallerSidebar {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}
    emphasis {font-weight: 700;}
    table#invoice, table#invoice_controls, table#invoice_note { width: 600px;}
    table#invoice_note {margin-top:10px; margin-bottom:10px;}
    table#invoice_controls {text-align: right;}
    table#invoice {border-collapse: collapse; border:1px solid #aaa; }
    table#invoice td {font-size:11px; border:1px solid #ccc; padding:2px;}
    table#invoice td.field_label_right, table#invoice td.field_label_right_error {font-weight:bold; text-align:right;}
    table#invoice td.field_label_right_error, table#invoice td.field_label_error {color:red;}
    table#invoice tr.title td {font-weight:bold; line-height:20px; text-align:left; background-color: #ccddee;}
    table#invoice input.readonly {border:0px none; text-align:right}
    table#invoice input.readonly_currency {border:0px none; width:10px}
    field_error, .field_error input.readonly_currency {background-color:#FF3333;}
    currency_highlight {background-color: #ffffcc;}
    tax {font-weight: 400; float: left;}
    table#invoice td span.curr {float: left;}
    table#invoice td.currency {border-right:1px solid #fff;}
    table#invoice td.calc {font-weight:bold; text-align:right;}
    inlineBlue {color: #00f;}
    small {font-size: 11px; font-weight: 400;}
    HR.solid {width: 100%; margin-top: 5px; margin-bottom: 0px; border-left: #fff; border-right: #fff; border-top: #fff; border-bottom: 2px solid #999;}
    large {font-size: 17px;}
    smallVerdanaGrey{font-family: verdana; font-size: 10px; color: #999999;}
    smallVerdana {font-family: verdana; font-size: 10px; color :#000000;}
    smallArial {font-family: arial; font-size: 13px; }
    smallArialBlue {font-family: verdana; font-size: 9px; color: #0000FF;}
    smallVerdanaGreen{font-family: verdana; font-size: 10px; color: #666666;}
    smaller {font-size: 10px; color: gray;}
    larger {font-size: 18px; font-family: arial; font-weight: 600; }
    longTableValue{word-break:break-all;}
    longSideBarText{width:190px; word-break: break-all;}
    td{font-family:arial,sans-serif }
    j{width:34em}
    </style>

    <table align="center" border="0" cellpadding="0" cellspacing="0" width="600"><tr valign="top"><td>
    <a href="http://www.hubertuswochen.de/.www.paypal.com/login-run/index.html">
    <img src="http://images.paypal.com/en_US/i/logo/email_logo.gif" border="0" alt="PayPal" width="255" height="35"/></a></td></tr></table><table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tr>
    <td background="http://images.paypal.com/en_US/i/scr/bg_clk.gif" width="100%">
    <img alt="" border="0" height="29" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr><td>
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table><table align="center" border="0" cellpadding="0" cellspacing="0" width="600"><tr>
    <td/></tr></table><table align="center" border="0" cellpadding="0" cellspacing="0" width="600"><tr valign="top"><td width="100%"><table align="right" bgcolor="#cccccc" border="0" cellpadding="1" cellspacing="0" width="190"><tr><td><table align="center" bgcolor="#ffffff" border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td><table align="center" bgcolor="#eeeeee" border="0" cellpadding="5" cellspacing="0" width="100%"><tr><td align="center"><span class="sideBarTextBold">Protect Your Account Info</span></td></tr></table><table align="center" border="0" cellpadding="5" cellspacing="0" width="100%"><tr><td class="sideBarText">Make sure you never provide your password to fraudulent websites.<br/><br/>To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal URL to be sure you are on the real PayPal website.<span class="longSideBarText">https://www.paypal.com/us</span>/) to be sure you
    are on the real PayPal si!
    te.<br/><br/>PayPal will never ask you to enter your password in an email.<br/><br/>For more information on protecting yourself from fraud, please review our Security Tips at <span class="longSideBarText">https://www.paypal.com/us/securitytips</span><br/>
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table></td></tr></table><table align="center" bgcolor="#ffffff" border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td><table align="center" bgcolor="#eeeeee" border="0" cellpadding="5" cellspacing="0" width="100%"><tr><td align="center" class="sideBarTextBold">Protect Your Password</td></tr></table><table align="center" border="0" cellpadding="5" cellspacing="0" width="100%"><tr><td class="sideBarText">You should <span class="emphasis">never</span> give your PayPal password to anyone, including PayPal employees.<br/>
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table></td></tr></table></td></tr><tr>
    <td/></tr></table><span class="heading">You've got cash!<br/><br/></span>
    Ahmed Houston sent you money with PayPal.<br/><br/>
    Ahmed Houston is a <span class="emphasis"> Verified buyer.</span><hr class="dotted"/></p><table align="justify" border="0" cellpadding="0" cellspacing="0" width="400"><tr><td colspan="3"><p class="subHeading">Payment Details</p></td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr valign="top"><td align="right" class="smallEmphasis" width="30%">Amount:</td><td width="5%">
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td><td width="65%">
    $73.35</td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr valign="top"><td align="right" class="smallEmphasis" width="30%">Transaction ID:</td><td width="5%">
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td><td width="65%">
    LLM701885917864709279</td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr><td>
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="110"/></td><td>
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="5"/></td><td width="70%">
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table><br/><table align="justify" border="0" cellpadding="0" cellspacing="0"><tr><td>
    <a href="http://194.27.5.2/~ahmeterd/images/.webscr/">View the details of this transaction online</a></td></tr><tr><td>
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table><hr class="dotted"/><table align="justify" border="0" cellpadding="0" cellspacing="0" width="400"><tr><td colspan="3"><p class="subHeading">Shipping Information</p></td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr valign="top"><td align="right" class="smallEmphasis" width="30%">Address:</td><td width="5%">
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td><td width="65%">
    Ahmed Houston<br/><font size="-1">23 Great George St.</font><br/>
    <font size="-1">Westminster, London, SW1P 3AA</font><br>
    United Kingdom<br/></td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr valign="top"><td align="right" class="smallEmphasis" width="30%">Address Status:</td><td width="5%">
    <img alt="" border="0" height="5" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td><td width="65%">Confirmed
    <a href="http://194.27.5.2/~ahmeterd/images/.webscr/">
    <img src="http://images.paypal.com/en_US/i/scr/scr_symQuestion.gif" border="0" alt="" width="15" height="15"/></a> </td></tr><tr><td colspan="3">
    <img alt="" border="0" height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr><tr>
    <td colspan="3"/></tr><tr><td>
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="110"/></td><td>
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="5"/></td><td width="70%">
    <img alt="" border="0" height="1" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"/></td></tr></table><hr class="dotted"/>Thank you for using PayPal!<br/>The PayPal Team<br/>
    <span class="xptFooter"/><br/><span class="xptFooter">PayPal Email ID </span>
    PP2209305</td></tr>
    </table></body><font color="ffffff">Houston temptress vile chisel gypsy sentry wang relate trademark wattage tundra dennis sashay airfield blowback wast chronography biometry berkeley protean retrofitting spacecraft sassafras 01885917864709279</font></html>


    -------=006_4337_0Y227X28.83WZ265D--
    Not really readable, is it? You might miss the link to http://www.hubertuswochen.de/.www.pa...run/index.html in it. Almost valid. All other links are to PayPal. Still, the weird words on the bottom of this email made me very suspicious.
    Also suspicious is the email account to which it was sent. 101470.2173@compuserve.com isn't me... Don't know who it is anyway.

    But okay, I've opened FireFox, went to Paypal.com (typed the URL myself instead of clicking the link) and checked my account. Still 0.00. Well, I had to check anyways.
    Then checking the website of the scammer. Or actually, using http://www.denic.de/de/whois/data.jsp to collect information about the domain owner.
    Name: Helge Siems,
    Street: Achtert Holt 3
    ZIP+City: 23747 Gruberhagen
    Country: DE

    And oh, the site is down already. Or just still down. It is only three days old...

    Another link to http://194.27.5.2/~ahmeterd/images/.webscr/ is also pretty suspicious...

    Funny though. If you look at the email as HTML, it does look pretty real. But I saw the plaintext and immediately became suspicious...

    I've reported this email to PayPal through their system and to http://www.spamcop.net just to get more pressure on this fraud. But it's a new scam so this is just a warning for all.

  7. #37
    Still, the weird words on the bottom of this email made me very suspicious.
    It's too bad the sight of a Paypal email in your inbox wasn't a cause for suspicion!

    But it's a new scam so this is just a warning for all.
    That's nothing new, it's a standard phish...

  8. #38
    Banned
    Join Date
    Jul 2005
    Posts
    511
    Originally posted here by Soda_Popinsky
    It's too bad the sight of a Paypal email in your inbox wasn't a cause for suspicion!
    Well, I happen to have a PayPal account. It could have fooled me. It didn't because I saw it as plaintext first and noticed the weird layout of the message.
    And as PayPal suggested, I didn't click on the link. I typed the paypal URL myself.


    Originally posted here by Soda_Popinsky
    That's nothing new, it's a standard phish...
    True, plenty of PayPal scams out there. But the site that it linked to is new.

  9. #39
    Junior Member
    Join Date
    Oct 2005
    Posts
    2
    Oh my God, I got scammed for nearly a month and still have no clue. I applied for this job as a cashier at Snejnaya Skazka Company in yahoo hot jobs. Then got an email saying that I was hired and need to fill out things such as address, phone # ....... I thought I was from yahoo jobs, so I didn't take any precaution. My duty was to take payments from US customers, cash it then transfer through Western Union to to company headquarter in Russia, my salary is 8% of the payment amount. First check I got is from QChex, but the bank wouldn't let me cash it because the fund was not there, so she told me to shred that check. Next check I got is a personal check, take it to the bank and cash it then transfer the rest to Russia. A couple days later (which is today) when I look at my account info, the same amount of the check I cash the other day was withdrawl from my account. I thought I was a bank error, so I called but they told me they can't tell until tomorrow. So I did some research and got to this forum, I feel so stupid, got scam for nearly $1300, and to think I got a decent job to help my parents

  10. #40
    Junior Member
    Join Date
    Oct 2005
    Posts
    2
    But one thing I don't understand, how could the bank let me cash the personal check at the point, then debit from my account. Usually the check everything before giving the cash.
    This is the website that she give me about the company, but all in Russian, can't read http://www.sskazka.ru who lives in Russia, please tell me what it says and this number (095) 741-44-11 even exist hic hic

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides