Spam Warning: You received notification from DocuSign Signature Service 

You may see the following email, purportedly from DocuSign. We have seen it being captured by most spam guards but also getting through many on other occasions.

Ooh, a tax refund!! SPAM - (1) New message from GB Revenue and Taxes.

This email has been received this week at sircles spam catcher:

-

Spam Warning: Important Docs Secured ShareFile Attachment

Watch out for this email doing the rounds this week:

SECURITY ALERT - Tesco Bank Spam Scam

Beware of these fake Tesco spam emails:

🤖 Cryptocurrency Auto Trading Robot Beta made Scage rich! SPAM!!!

Beware of the latest brand of spammers who bring together two elements of the modern financial world - Cryptocurrency and Artificial Intelligence.

They claim to have AI computers that deal in cryptocurrency on your behalf and so make you huge sums of money.

These supposed companies - invariably they are registered on an island in the Caribbean - offer to get these computers to deal on your behalf day and night in order to increase your capital.

Before you invest with anyone, get opinions from a finance professional so that you can be sure that you are not about to be ripped-off.

If we take a look at this con, we can see a few elements that are typical in their setup.

First they use email to entrap - 

As you can see the email arrives from: 

Cryptocurrency Robot Augustine <augustine_116@www.cryptotraderuk.cf>

And the email reads:

* Beta Test Invitation *

 Your invitation code: DFlgiYtv4216

 This amazing Cryptocurrency AUTO TRADING robot can make you rich!

 Do you know Bitcoin? Ethereum? Ever heard about Ripple? Cryptocurrencies is the future! While the market is growing fast, this is the best opportunity to take advantage and earn a million or two this year!

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

Auto Trading software utilizes special alghoritms and artificial intelligence to trade cryptocurrencies while you sleep!

Just imagine waking up every day and see 2-3k GBP on your account!

 First results are amazing - join us while registration is still open!

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

 Auto Trading is a way to get rich in 2018!

 Use the invitation code above to receive an extra 1,000 GBP after registration!

Click this link to start trading:

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

Don't wait before it's too late!

You will thank me later!

Cheers,

Augustine

---------------------------------------------------------------------------

--

This message has been sent automatically because scage@letsignit.com has requested us to send you this invitation.

Sender IP address: 51.185.158.173

The country code CF is for the Central African Republic and is not a likely source for someone recommending crypto-currency trading in the UK.

Now let's have a look at the site itself from http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L 

We appear to have been forwarded to https://cryptocode.online/ which is obviously a way of making you think you are still looking at a company in your own country.

If we run a Who.is to lookup who owns this site we see:

Domain Profile

Registrant Country	CN
Registrar	ERANET INTERNATIONAL LIMITED  IANA ID: 1868  URL: http://www.now.cn/  Whois Server: whois.todaynic.com    (p)
Registrar Status	serverTransferProhibited, clientTransferProhibited
Dates	29 days old Created on 2018-04-30 Expires on 2019-04-30 Updated on 2018-05-05
Name Servers	ANDY.NS.CLOUDFLARE.COM (has 7,758,752 domains) ZITA.NS.CLOUDFLARE.COM (has 7,758,752 domains)
Tech Contact	—
IP Address	77.87.77.124 - 4 other sites hosted on this server
IP Location	- Lodzkie - Radomsko - Euronet S.c. Jacek Majak Aleksandra Kuc
ASN	AS197226 SPRINT-SDC, PL (registered Aug 17, 2010)

So immediately we notice that this site has been thrown together using a simple template and they haven't even bothered changing most of the icons and photo before publishing. Whoever Derrick Simmons CEO is, his photo and name are undoubtedly a fake.

If we look further down the page:

This site is not affiliated in any way with Time Magazine, Forbes or CNN - be extremely careful of any site that you arrive at from email.

No one has just 'won' $4576 USD - this site is not even offering a lottery.

Notice it is a secured version of the site at: http://smartcryptocode.com 

Cryptocode.online is a secure site, so it is obviously an improvement of the above site...

If we enter our details in one of the endless pop-up requests for our email and name, we are taken to: https://www.365markets.com/ 

Now this is a website requesting money to be deposited which means that it is extremely dangerous and you should not enter any personal or banking details at any time. 

The company is registered in Bulgaria, at R.A. Hadzhi Dimitar bl., 113., en A., fl. 4, app 8, Sofia 1510, Bulgaria but their live chat is not functioning now - 5pm their time - in the working week.

There is a phone number in Bulgaria which I will not call but these are required to keep the website open under EU and Bulgarian law.

If we look at the security of this secured site - It is a Cloudflare SSL certificate with sni65230.cloudflaressl.com as it's actual name. Then the following sites are added as an alternative name:

Reporting Fraudulent Websites with your Browser

When you receive an email that has links to a fraudulent site, you should report that site, to your browser provider so that other users can be saved from falling into the intended trap.

When you are sent to a site that the email tells you is giving you something, and when you arrive you are asked to make a payment, that is a form of misrepresentation; which is phishing. You should report phishing sites to Google:

https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

The advantage of reporting to Google is that they will adjust Google Chrome to warn people, and that is currently the most popular browser on Earth.

If the site you are sent to by a suspicious email tries to download a file to your computer (no matter what the file pertains to be) then it is most likely a malicious software site. These pages should be reported by pasting the URL in the browser address bar into the following Google page for malicious software sites:

https://safebrowsing.google.com/safebrowsing/report_badware/?hl=en

You can also read about Google's preventative measures programme against harmful internet use here:

https://safebrowsing.google.com/

If you are using Microsoft Edge or Internet Explorer, you can also report fraudulent sites. 

You can open the old style Internet Explorer by pressing the Windows Button + R and entering iexplore and pressing OK.

From the Safety menu, point to SmartScreen Filter, then click Report Unsafe Website.

Select one or both of the following check boxes you feel to be appropriate:

• I think this is a phishing website
• I think this website contains malicious software

If you are using Firefox, or if you wish to report the site to Mozilla to help more people, you can report fraudulent sites to Mozilla here:

https://www.mozilla.org/en-US/about/legal/fraud-report/

Here you can choose from:

• Domain name
• Collecting personal information
• Charging for software
• Logo misuse (phishing)
• Distributing modified Mozilla/Malware

And choose which products are affected.

In general it is always worth checking that the site is secured - by seeing if there is a padlock in the browser address bar or that the https has gone green etc. - and that the domain is correct. The domain must be the last item in the address bar before the first / (forward slash) as many fraudulent domains trick us by using facebook.com-uerjfnf0e837e3e0d0y.uzbxyn.com/webapp/ye.js or facebook.com.wifubd97fidn9.interstrartter.net/webapp/ku.js similar. Notice that the facebook.com is followed by a hyphen or a dot instead of the forward slash / that represents the end of the domain.

💸 Incoming BitCoin Transfer - You received 0.881110 BTC!

The following email has been reported as currently active:

Hello,

You just received 0.881110 BitCoin incoming transfer from Info.

Sender: info@sthildas.oldham.sch.uk

Receiver: recipient email

Amount: 0.881110 BTC

Deadline: 23-05-2018 13:19:28

Transfer has been made from account holder:

c23cb46b19164de4ea6667a27c7c95bab1a6509b76a9fae2856d7a8cf72b950e

Accept the transfer now:

http://www4.bitcoin-gb.tk/claim/uk4njQORyWgrV0hS

Only 7 days remaining to accept your BitCoin transfer! If you do not accept this transfer, the money will be returned to sender.

To claim your BitCoin please visit the link below:

http://www4.bitcoin-gb.tk/claim/uk4njQORyWgrV0hS

Best regards,

Roxana Rigby

Bitcoin Account Manager

The link forwards you to:

https://cryptocode.online/

Whenever there is a supposed quick way to increase capital, con-people quickly associate themselves with the name in the hope of riding the excitement in order to rip people off. Any crypto currency such as Bitcoin is a huge risk to invest in and should be treated with EXTREME caution. This website is not an investment site, but an attempt at taking money based on the reputation of Bitcoin - do not enter your name, report this site as fraudulent using your browser, and mark this email as spam and/or phishing.

The intent of this email is fraudulent, and so it is safe to assume that the website is fraudulent also. Any testimonials are contrived and should not be believed.

You can report fraudulent websites with the help of this page which tells you how to report fraudulent or malware websites.

Natwest Spam: Incomplete Security Information

You may receive the following message, purporting to be from Natwest:

Disability Action Alliance - DAA Receipt#

Spam: Receipt # 255247

Beware of these fake receipts:

Payment Receipt

YOUR PAYMENT HAS BEEN PROCESSED

We send  Google.Docs document.

Link points to: https://www.ethereumpower.io/itr_inv_doc.zip

Which obviously downloads a inv doc.zip file to corrupt your computer or add a root kit etc.

We have reported the Google link and the website as well as marking the email as spam - please do the same if you receive one of these.