Author |
Message |
atj
Wannabe Baiter
Joined: 30 Apr 2008
Posts: 88
Location: out of this world
|
Posted:
Wed Jan 21, 2009 6:59 pm |
|
I've just picked this out of my spam, it's the most blatant attempt at phishing I've ever seen.
LINK
Forum blowing URL changed to link - Roy |
_________________
|
|
|
|
luckey
Moderator
Joined: 25 Jan 2007
Posts: 5672
Location: Check the lost and found
|
Posted:
Wed Jan 21, 2009 7:04 pm |
|
Er, doesn't that take you to the Google Docs login page?
I know they do their best to collect personal information, but as far as I know, Google is legit. |
_________________ Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased. |
|
|
|
Cathartic Kate
Elite Baiter
Joined: 03 Dec 2008
Posts: 1542
Location: Spooner Hall
|
Posted:
Wed Jan 21, 2009 7:18 pm |
|
Maybe meant humourously.
I know as a Brit that sometimes humour does not travel well, or sometimes not at all
Edit to say noted https.
I think I saw that mentioned before on this forum and therefore secure and trusted? |
_________________ Give the lads some extra pain with your own IT admin from hell - visit toolkits for Grooble Gambit
Proud member of "The Todger Club"
< никогда достаточно
Last edited by Cathartic Kate on Wed Jan 21, 2009 7:29 pm; edited 1 time in total |
|
|
|
luckey
Moderator
Joined: 25 Jan 2007
Posts: 5672
Location: Check the lost and found
|
Posted:
Wed Jan 21, 2009 7:27 pm |
|
^^Could be. I'll move it to GC just in case.
Edit: Hey, you're right. When I put it here, it's quite funny.
GC must be in England. |
_________________ Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased. |
|
|
|
Roycropper
Baiting Guru
Joined: 14 Nov 2005
Posts: 7992
Location: Luxury Coffin
|
Posted:
Wed Jan 21, 2009 7:47 pm |
|
/\/\ But the poster isn't. |
_________________ the European Union has bounced on our freckles
COULD YOU IMAGINE WHAT HAPPENED WHEN I WENT TO THE BANK
our Agent is Completely broke, pocketless and stranded
I WLL SEND AN AFRICA WITCH TO ATTACH YOU BASTARD
You go die like bird
i started shouting HALLELUJAGOBBLE but none of them notice me immediately police arrested me due to the shouting
f*ck u asshole ur damn mother will loose ur fcuking skull brain ur brain is nothing to compare with rat f*ck ur u
MY FRIEND ALEX WAS DETAINED IN POLICE STATION
I am not happy due to the question i answered at money office. Let me tell you do not play with me ok.
x4 6Yrs x6 |
|
|
|
atj
Wannabe Baiter
Joined: 30 Apr 2008
Posts: 88
Location: out of this world
|
Posted:
Wed Jan 21, 2009 7:55 pm |
|
Well here's the email, it looks a scam to me. Maybe one of you could do the detective work on it. I ain't that good yet.
Delivered-To: [email protected]
Received: by 10.210.132.7 with SMTP id f7cs189223ebd;
Tue, 20 Jan 2009 10:52:19 -0800 (PST)
Received: by 10.65.20.20 with SMTP id x20mr3481130qbi.63.1232477538232;
Tue, 20 Jan 2009 10:52:18 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay.wow.lk (mxr2.wow.lk [202.124.160.61])
by mx.google.com with ESMTP id p9si13809010qbp.35.2009.01.20.10.52.15;
Tue, 20 Jan 2009 10:52:17 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) client-ip=202.124.160.61;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) [email protected]
Received: from webmail.wow.lk (ftp.wow.lk [202.124.160.4])
by relay.wow.lk (8.13.8/8.13. with ESMTP id n0KIqAZ6017676
for <[email protected]>; Wed, 21 Jan 2009 00:22:11 +0530
Received: from 217.20.240.19 (proxying for 10.11.19.35)
(SquirrelMail authenticated user inco)
by webmail.wow.lk with HTTP;
Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Message-ID: <[email protected]>
Date: Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Subject: United State of America Tax Withholding
From: "Internal revenue services" <[email protected]>
To: [email protected]
User-Agent: SquirrelMail/1.4.17
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20090120185211_92576"
X-Priority: 3 (Normal)
Importance: Normal
------=_20090120185211_92576
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
xxxxxxxxxxxxxxx
Our records indicate that you are a non-resident alien. As a result, you
are exempt from United States of America Tax reporting and withholdings,
on interest paid on your bank account and other financial dealings. To
protect your exemption, from paying tax on your accounts and other
financial benefit held in USA, We are required by law to update our
records to rectify your exemption status.
Therefore, you are to authenticate the following by completing form
W-8BEN, and return to us as soon as possible through the fax number:
+1-206-350-8992
If you are a USA Citizen and resident, this form W-8BEN exempts you,
please indicate �USA Citizen/Resident� on the form and return it to us.
We shall then send you a form W9095.
When completing form W-8BEN, please follow the steps below
1. We need you to provide your permanent address if different
from the current mailing address on your Form W-8BEN. You must indicate,
if a non-USA resident, your country of origin to support your non-resident
status (if your bank account or other financial dealing has a USA address
for mailing purpose).
2. If any joint account holder are now USA residents or
Citizen, or in any way subject to USA tax reporting laws, please check the
box in this section.
3. Please have all account holders, sign and date the form
separately and fax it to above-mentioned number.
Please, complete Form W-8BEN �attached� and return to us within 1 (one)
week from the receipt of this letter in order to enable us update your
records immediately. If your account or any other financial benefits are
not rectified in a timely manner, it will be subject to USA tax reporting
and back up withholding (if back up withholding applies, we are require to
withhold 30% of the interest paid to you).
We appreciate your cooperation in helping us protect your exempt status
and also update our records.
Sincerely.
Director of Information
And there's a load of crap after this that I've cut out because >I think it's too much for one post, if you want that too let me know.
|
_________________
|
|
|
|
luckey
Moderator
Joined: 25 Jan 2007
Posts: 5672
Location: Check the lost and found
|
Posted:
Wed Jan 21, 2009 8:14 pm |
|
Scam email wrote: |
Please, complete Form W-8BEN attached and return to us within 1 (one) week from the receipt of this letter in order to enable us update your records immediately. |
Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.
No doubt it's a phishing email, or they may try to hit you up for that "USA tax reporting and back up witholding" money. I'll be that adds up. |
_________________ Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased. |
|
|
|
Old No. 7
Master of Master Baiters
Joined: 31 Jul 2007
Posts: 777
Location: Somewhere Else
|
Posted:
Wed Jan 21, 2009 8:18 pm |
|
+1-206-350-8992 is a Seattle, WA unlisted landline
Sender is spoofing headers, but at least one satellite and a free email service in Sri Lanka involved (Suntel wOw.lk), with the satellite being the probable source.
No return path other than the spoofed IRS address
As OP said, seems to be phishing by fax (phaxing? )
Not much can be done, IMHO |
_________________ 200+ sites killed, from these countries => �
Like my flags? Want some of your own? Let justjay teach you how to kill sites here (clicky).
Hobbes may have retired, but get his brilliant WriteJunk here (clicky) and never touch a .dll again
Proud to be a mouth-breather who posted a load of shit, disappeared into the night but mysteriously reappeared after a long absence |
|
|
|
atj
Wannabe Baiter
Joined: 30 Apr 2008
Posts: 88
Location: out of this world
|
Posted:
Wed Jan 21, 2009 8:29 pm |
|
luckey wrote: |
Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.
|
Quote tags fixed - Roy
Yes. I opened it with google docs. As old No.7 says though, there's not much point doing anything with it, they would just try any info they get, if they come up with nothing they will drop you, or would they? |
_________________
|
|
|
|
luckey
Moderator
Joined: 25 Jan 2007
Posts: 5672
Location: Check the lost and found
|
Posted:
Wed Jan 21, 2009 8:41 pm |
|
Mystery solved. I'll move this to misc scams, since it was a serious inquiry. |
_________________ Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased. |
|
|
|
|