new (to me) but obvious scam | Bitcointalksearch.org

Kluge

donator

Activity: 1218

Merit: 1015

Here's a well-done example of a phishing attempt.

Hi, you got a new offer to your SELL advertisement. Message:
Hey, wondering if you can do this trade??

Deal: 384.47 USD = 1 BTC (price 384.47 USD/BTC)
----
You can reply to this message by replying to this email. You can also reply on site: https://localbitcoins.com/ads/37726/103702 <- actual URL is http://llocalbitc[break, don't click]oins.com/accounts/login

Email conversation token: 3AWW4PUS1GSHSBGX2QD7N2OMI. Don't remove this from message when replying. Also reply above this message - the content after the lines above will be removed.

DiamondCardz

legendary

Activity: 1134

Merit: 1112

Quote from: Kluge on November 10, 2013, 03:15:30 PM

Our mailing address is:
Bitcoininfo
Washington
wallestreet
washington, WA 1500

wallestreet

Oh God I can't stop laughing.

Kluge

donator

Activity: 1218

Merit: 1015

Hehe, here's one I received recently... they thought of everything, even a mailing address:

New way how to use bitcoins in all e-shops in the world.

Exchange rate of bitcoins is very high now. Use Pl[scam, don't visit]azacoin.com and spend your bitcoins in your favourite e-shop!

Pl[scam, don't visit]azaCoin.com is new revolutionary way how to do shopping everywhere in the world. Just enter the product you want to buy with BTC!

Enjoy your shopping

Bitcoin info team
Copyright © 2013 Bitcoininfo, All rights reserved.
Bitcoin info

Our mailing address is:
Bitcoininfo
Washington
wallestreet
washington, WA 1500

dooglus

legendary

Activity: 2940

Merit: 1330

Quote from: MPOE-PR on November 09, 2013, 08:15:11 PM

I lolled @ "Dear Bitcoin Member".

This? (NVSFW)

https://i.imgur.com/yNTaO.jpg

MPOE-PR

hero member

Activity: 756

Merit: 522

I lolled @ "Dear Bitcoin Member".

dooglus

legendary

Activity: 2940

Merit: 1330

Quote from: philip2000uk on November 09, 2013, 07:00:43 AM

"in 1 hours" LOL!

I takes 1 hours, sure, but it's also IMMEDIATE:

Quote from: philip2000uk on November 09, 2013, 07:00:43 AM

You can pretend to be from any address in gmail. I think if you did a full header check then you'll find out who it is.

This:

Code:

Return-Path: 
Received: from anonymous-proxy.krasl.com (anonymous-proxy.krasl.com. [77.93.216.69])
        by mx.google.com with ESMTPS id x45si10125394eey.66.2013.11.09.00.14.56
        for 
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Sat, 09 Nov 2013 00:14:57 -0800 (PST)
Received-SPF: neutral (google.com: 77.93.216.69 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=77.93.216.69;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 77.93.216.69 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]

BadBear

legendary

Activity: 1652

Merit: 1127

Yeah these types always spike when the exchange rate rises.

Kluge

donator

Activity: 1218

Merit: 1015

Yeah - I've been receiving them since the early Gox hack, but activity spiked again a couple weeks after the BTCTalk hack, but's died down again for me.

Some impersonate theymos, a well-known organization, or even John K. Sometimes they don't impersonate, but instead claim to be a new mining company. Some will take the old phishing approach "Hellow, this is Mtgox support and your account has been suspended due to suspicious activity. PLease clicik here to verify your account and unlock it. Thank you and good day, sir, Mtgox" I'm still surprised I haven't seen one try for some reasonable authenticity and make a false PGP signature when they try impersonating an individual. Then for the 99% of people who don't check, "oh look, it's signed - must be him!"

Liquid

hero member

Activity: 826

Merit: 500