Anyone familiar with this type of scam (possible fake sites)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Dec 18, 2008 6:56 am

Gift Wish

Dear Good Friend,
This email has been sent from www.gift-wish.com because Financial help is needed from you, so we invited you to see their gift wishes.

Original message:

---------------------------------

We are making this wish not for ourselves, but for Aritha. She usually on top of things, but money has been really funny around her. To get her taken care of so we are going to list out her online PayPal email account [email protected]. Well things have been really tight of late, and we suppose there are other things she could put this money to but here is the story:>>> Aritha has been thrown so much this last year alone, and has had it difficult. She has 2 lovely children Katie 2 1/2 and Dylan 11 months (who are currently living with her father). She is also getting married in December to the love of her life. She does not have a lot of money and bills are hard to pay. We are placing this wish to help her. We would like her children to have a special Christmas this year and make them smile. Her Katie is so beautiful and is kind and gentle; she never has a frown and makes the most out of everything. Aritha is very special she loves to help out everyone. She never thinks of herself. It is time she gets some help. Even her soon to be Husband Mike could use a little pick up. It would be great for them not to have to worry for awhile about things. We are hopping she doesn't see this and everything will be a surprise if not its ok we don't mind she knowing. She deserves it and is a hard worker and does everything for everyone and she kids it is time to pay it forward and help them. ---------------- If you would like to know more about our Gift Recipient statuses please contact us at [email protected] or donate via PayPal [email protected]

---------------------------------

You can follow the URL to see the list:

http://www.gift-wishes.com/for_buyers/params/secret/6b8f754db3891f7443fe1195666a42b6/[/quote]

Here it the weird part

Quote:

or sign in with:

Login: 15_MY CATCHTER [email protected]

Password: gqVK0d

Have Fun,
Gift-Wish.com

If you go to login at www.gift-wish.com you can login through "Google accounts" they seem to want your password.

Anyway guys if you can do anything about this go ahead, it seems a particularly nasty one.

Posted: Thu Dec 18, 2008 7:23 am

could you post the headers please.

Quote:

Registrant:
Contactprivacy.com
96 Mowat Ave
Toronto, ON M6K 3M1
CA

Domain name: GIFT-WISH.COM

Administrative Contact:
contactprivacy.com, [email protected]
96 Mowat Ave
Toronto, ON M6K 3M1
CA
+1.4165385457
Technical Contact:
contactprivacy.com, [email protected]
96 Mowat Ave
Toronto, ON M6K 3M1
CA
+1.4165385457

Registration Service Provider:
MDMS Enterprises
http://www.mdms.org

Registrar of Record: TUCOWS, INC.
Record last updated on 02-Aug-2008.
Record expires on 04-May-2009.
Record created on 04-May-2004.

Registrar Domain Name Help Center:
http://domainhelp.tucows.com

Domain servers in listed order:
NS3.AFRAID.ORG
NS2.AFRAID.ORG
NS4.AFRAID.ORG
NS1.AFRAID.ORG

Posted: Thu Dec 18, 2008 7:31 am

Quote:

Delivered-To: [email protected]
Received: by 10.86.27.2 with SMTP id a2cs71667fga;
Wed, 17 Dec 2008 13:36:47 -0800 (PST)
Received: by 10.100.207.14 with SMTP id e14mr969548ang.60.1229549805640;
Wed, 17 Dec 2008 13:36:45 -0800 (PST)
Return-Path: <[email protected]>
Received: from smarty.dreamhost.com (smarty.dreamhost.com [208.113.175.8])
by mx.google.com with ESMTP id c14si3193097ana.38.2008.12.17.13.36.44;
Wed, 17 Dec 2008 13:36:45 -0800 (PST)
Received-SPF: neutral (google.com: 208.113.175.8 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=208.113.175.8;
Authentication-Results: mx.google.com; spf=neutral (google.com: 208.113.175.8 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from spilotro.dreamhost.com (spilotro.dreamhost.com [67.205.46.10])
by smarty.dreamhost.com (Postfix) with ESMTP id 9F121EE264
for <[email protected]>; Wed, 17 Dec 2008 13:36:43 -0800 (PST)
Received: by spilotro.dreamhost.com (Postfix, from userid 1687082)
id 8C8346C782; Wed, 17 Dec 2008 13:36:43 -0800 (PST)
To: [email protected]
Subject: Gift Wishes: Invitation email
Date: Wed, 17 Dec 2008 13:36:43 -0800
From: "[email protected]" <[email protected]>
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: PHPMailer [version 1.73]
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_65d8e25dd20f6322bc17af55d06cc0ce"

Just to clarify they told you log in with 15_CATCHEREMAIL so if it was [email protected] it would be [email protected]

Posted: Thu Dec 18, 2008 11:17 am

2 IP addies in the header
208.113.175.8 United States (Brea)
67.205.46.10 United States (Brea)

Help page is in pig latin.
Best sellers page is in pig latin
Privacy page is in pig latin
For Retailers page is in pig latin
About page is in pig latin.
Terms of Use page is in pig latin

Red flags are a wavin'

Looks like it is a take on www.gift-wish.com

Who-is for www.giftwishes.com
whois query for gift-wishes.com...

Results returned from whois.internic.net:

Domain Name: GIFT-WISHES.COM
Registrar: NEW DREAM NETWORK, LLC
Whois Server: whois.dreamhost.com
Referral URL: http://www.dreamhost.com
Name Server: NS1.DREAMHOST.COM
Name Server: NS2.DREAMHOST.COM
Name Server: NS3.DREAMHOST.COM
Status: ok
Updated Date: 20-apr-2008
Creation Date: 24-may-2007
Expiration Date: 24-may-2009

>>> Last update of whois database: Thu, 18 Dec 2008 11:23:52 UTC <<<

Domain Name: gift-wishes.com

Registrant Contact:
gift-wishes.com Private Registrant [email protected]
DreamHost Web Hosting
417 Associated Rd #324
Brea, CA 92821
US
+1.2139471032

Administrative Contact:
gift-wishes.com Private Registrant [email protected]
DreamHost Web Hosting
417 Associated Rd #324
Brea, CA 92821
US
+1.2139471032

Technical Contact:
gift-wishes.com Private Registrant [email protected]
DreamHost Web Hosting
417 Associated Rd #324
Brea, CA 92821
US
+1.2139471032

Billing Contact:
gift-wishes.com Private Registrant [email protected]
DreamHost Web Hosting
417 Associated Rd #324
Brea, CA 92821
US
+1.2139471032

Record created on 2007-05-24 12:25:27.
Record expires on 2009-05-24 12:25:27.

Domain servers in listed order:

ns1.dreamhost.com
ns2.dreamhost.com
ns3.dreamhost.com

Edit (again) to add :
www.gift-wish.com looks like nothing more than a password stealer.

The plot thickens....

Posted: Fri Dec 19, 2008 2:08 pm

Is this just a plain old begging email?

Quote:

Hello XXXX XXXX, it’s me Aritha. How are you? We’re fine. I would
like to thank you for your time and appreciate your help. When I
got the email I was shocked that I had received help and I really
do appreciate it very much. It was a blessing because now we can
expect to be at home together. I want to personally thank God,
which had put hope to my cause through you...

These are things that I need to have and pay off, 1 month rent ago
$670, New Electric bill is not yet out but the old is 2 months ago
$225, Land Phone is from October $380 + reconnect $110 and please
my land phone has already hang-up but I will try and reconnect it
as soon as possible. I wanted to cut off the cable is $500.00 and
Phone because the bill is too mush to pay but I need to pay off
first etc… It is well!
Please, my Fiancée needed only a little pick up of $ 1,850 or less
Words can not explain how much I appreciate this and I want to let
you know that you can just help us as God leads you. I wait to
hear from you.
Respect,
Aritha

And should I just let her down gently that the funds I thought I had were in an icelandic bank?

Anyone familiar with this type of scam (possible fake sites)	View next topic View previous topic