SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 Phishing

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
atj
Wannabe Baiter


Joined: 30 Apr 2008
Posts: 88
Location: out of this world


PostPosted: Wed Jan 21, 2009 6:59 pm Reply with quoteBack to top

I've just picked this out of my spam, it's the most blatant attempt at phishing I've ever seen.

LINK

Forum blowing URL changed to link - Roy

_________________
Closed lad accounts
View user's profileSend private message
luckey
Moderator


Joined: 25 Jan 2007
Posts: 5630
Location: Check the lost and found


PostPosted: Wed Jan 21, 2009 7:04 pm Reply with quoteBack to top

Er, doesn't that take you to the Google Docs login page? Confused


I know they do their best to collect personal information, but as far as I know, Google is legit. Wink

_________________
Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased.
View user's profileSend private messageSend e-mail
Cathartic Kate
Elite Baiter


Joined: 03 Dec 2008
Posts: 1542
Location: Spooner Hall


PostPosted: Wed Jan 21, 2009 7:18 pm Reply with quoteBack to top

Maybe meant humourously.

I know as a Brit that sometimes humour does not travel well, or sometimes not at all

Wink

Edit to say noted https.

I think I saw that mentioned before on this forum and therefore secure and trusted?

_________________
Give the lads some extra pain with your own IT admin from hell - visit toolkits for Grooble Gambit

Proud member of "The Todger Club"

Closed lad accounts < никогда достаточно




Goat

Last edited by Cathartic Kate on Wed Jan 21, 2009 7:29 pm; edited 1 time in total
View user's profileSend private message
luckey
Moderator


Joined: 25 Jan 2007
Posts: 5630
Location: Check the lost and found


PostPosted: Wed Jan 21, 2009 7:27 pm Reply with quoteBack to top

^^Could be. I'll move it to GC just in case. Very Happy


Edit: Hey, you're right. When I put it here, it's quite funny.

GC must be in England. Laughing

_________________
Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased.
View user's profileSend private messageSend e-mail
Roycropper
Undead Moderator


Joined: 14 Nov 2005
Posts: 7993
Location: Luxury Coffin


PostPosted: Wed Jan 21, 2009 7:47 pm Reply with quoteBack to top

/\/\ But the poster isn't. Wink

_________________
the European Union has bounced on our freckles
COULD YOU IMAGINE WHAT HAPPENED WHEN I WENT TO THE BANK
our Agent is Completely broke, pocketless and stranded
I WLL SEND AN AFRICA WITCH TO ATTACH YOU BASTARD
You go die like bird
i started shouting HALLELUJAGOBBLE but none of them notice me immediately police arrested me due to the shouting
f*ck u asshole ur damn mother will loose ur fcuking skull brain ur brain is nothing to compare with rat f*ck ur u
MY FRIEND ALEX WAS DETAINED IN POLICE STATION
I am not happy due to the question i answered at money office. Let me tell you do not play with me ok.
Pith Helmet 10
x4 United Kingdom New Zealand Mortar Closed lad accounts Sand Timer 6Yrs Tattoo x6 Flying Monkey
View user's profileSend private message
atj
Wannabe Baiter


Joined: 30 Apr 2008
Posts: 88
Location: out of this world


PostPosted: Wed Jan 21, 2009 7:55 pm Reply with quoteBack to top

Well here's the email, it looks a scam to me. Maybe one of you could do the detective work on it. I ain't that good yet.


Delivered-To: [email protected]
Received: by 10.210.132.7 with SMTP id f7cs189223ebd;
Tue, 20 Jan 2009 10:52:19 -0800 (PST)
Received: by 10.65.20.20 with SMTP id x20mr3481130qbi.63.1232477538232;
Tue, 20 Jan 2009 10:52:18 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay.wow.lk (mxr2.wow.lk [202.124.160.61])
by mx.google.com with ESMTP id p9si13809010qbp.35.2009.01.20.10.52.15;
Tue, 20 Jan 2009 10:52:17 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) client-ip=202.124.160.61;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) [email protected]
Received: from webmail.wow.lk (ftp.wow.lk [202.124.160.4])
by relay.wow.lk (8.13.8/8.13.Cool with ESMTP id n0KIqAZ6017676
for <[email protected]>; Wed, 21 Jan 2009 00:22:11 +0530
Received: from 217.20.240.19 (proxying for 10.11.19.35)
(SquirrelMail authenticated user inco)
by webmail.wow.lk with HTTP;
Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Message-ID: <[email protected]>
Date: Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Subject: United State of America Tax Withholding
From: "Internal revenue services" <[email protected]>
To: [email protected]
User-Agent: SquirrelMail/1.4.17
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20090120185211_92576"
X-Priority: 3 (Normal)
Importance: Normal

------=_20090120185211_92576
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

xxxxxxxxxxxxxxx

Our records indicate that you are a non-resident alien. As a result, you
are exempt from United States of America Tax reporting and withholdings,
on interest paid on your bank account and other financial dealings. To
protect your exemption, from paying tax on your accounts and other
financial benefit held in USA, We are required by law to update our
records to rectify your exemption status.

Therefore, you are to authenticate the following by completing form
W-8BEN, and return to us as soon as possible through the fax number:
+1-206-350-8992

If you are a USA Citizen and resident, this form W-8BEN exempts you,
please indicate �USA Citizen/Resident� on the form and return it to us.
We shall then send you a form W9095.

When completing form W-8BEN, please follow the steps below

1. We need you to provide your permanent address if different
from the current mailing address on your Form W-8BEN. You must indicate,
if a non-USA resident, your country of origin to support your non-resident
status (if your bank account or other financial dealing has a USA address
for mailing purpose).

2. If any joint account holder are now USA residents or
Citizen, or in any way subject to USA tax reporting laws, please check the
box in this section.

3. Please have all account holders, sign and date the form
separately and fax it to above-mentioned number.

Please, complete Form W-8BEN �attached� and return to us within 1 (one)
week from the receipt of this letter in order to enable us update your
records immediately. If your account or any other financial benefits are
not rectified in a timely manner, it will be subject to USA tax reporting
and back up withholding (if back up withholding applies, we are require to
withhold 30% of the interest paid to you).

We appreciate your cooperation in helping us protect your exempt status
and also update our records.

Sincerely.
Director of Information


And there's a load of crap after this that I've cut out because >I think it's too much for one post, if you want that too let me know.
Very Happy

_________________
Closed lad accounts
View user's profileSend private message
luckey
Moderator


Joined: 25 Jan 2007
Posts: 5630
Location: Check the lost and found


PostPosted: Wed Jan 21, 2009 8:14 pm Reply with quoteBack to top

Scam email wrote:
Please, complete Form W-8BEN attached and return to us within 1 (one) week from the receipt of this letter in order to enable us update your records immediately.


Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.

No doubt it's a phishing email, or they may try to hit you up for that "USA tax reporting and back up witholding" money. I'll be that adds up. Wink

_________________
Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased.
View user's profileSend private messageSend e-mail
Old No. 7
Master of Master Baiters


Joined: 31 Jul 2007
Posts: 777
Location: Somewhere Else


PostPosted: Wed Jan 21, 2009 8:18 pm Reply with quoteBack to top

+1-206-350-8992 is a Seattle, WA unlisted landline

Sender is spoofing headers, but at least one satellite and a free email service in Sri Lanka involved (Suntel wOw.lk), with the satellite being the probable source.

No return path other than the spoofed IRS address

As OP said, seems to be phishing by fax (phaxing? Very Happy)

Not much can be done, IMHO

_________________
200+ sites killed, from these countries => United Kingdom Netherlands Russia Nigeria Switzerland Ukraine South Africa Germany United States Canada Senegal Benin Spain Ghana Ivory Coast Cambodia Flag United Nations

pony pony pony Closed lad accounts Mortar

Like my flags? Want some of your own? Let justjay teach you how to kill sites here (clicky).

Hobbes may have retired, but get his brilliant WriteJunk here (clicky) and never touch a .dll again

Proud to be a mouth-breather who posted a load of shit, disappeared into the night but mysteriously reappeared after a long absence
View user's profileSend private message
atj
Wannabe Baiter


Joined: 30 Apr 2008
Posts: 88
Location: out of this world


PostPosted: Wed Jan 21, 2009 8:29 pm Reply with quoteBack to top

luckey wrote:

Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.


Quote tags fixed - Roy

Yes. I opened it with google docs. As old No.7 says though, there's not much point doing anything with it, they would just try any info they get, if they come up with nothing they will drop you, or would they?

_________________
Closed lad accounts
View user's profileSend private message
luckey
Moderator


Joined: 25 Jan 2007
Posts: 5630
Location: Check the lost and found


PostPosted: Wed Jan 21, 2009 8:41 pm Reply with quoteBack to top

Mystery solved. I'll move this to misc scams, since it was a serious inquiry. Very Happy

_________________
Moderator: \ˈmä-də-ˌrā-tər\: noun
A material which slows down neutrons after fission to speeds at which their probability for interaction with the fuel material is increased.
View user's profileSend private messageSend e-mail
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



** Find out information about your IP address **


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT