SPAM: yourdomain.com Final Extension

Another domain renewal scam is circulating this week.

The format is the same as usual - danger, danger danger, about to expire, your domain, final warning etc.

Then right at the bottom it says something like:

Failure to make payment may result in account closing (making it difficult for your customers and your friends to locate you, using search engines on the web).

So it is actually a service to submit you to search engines.

Well there is only really one search engine unfortunately, although Ecosia's plan is a good one, so there is no need to pay someone to submit your pages. Google are quite capable of finding you themselves.

The email arrives as:

SECURITY ALERT - Tesco Bank Spam Scam

Beware of these fake Tesco spam emails:

Electronic Intuit  Message - Spam Alert!

watch out for this spam QuickBooks message:

INTUITNEWTEST

You and your family can live in United States - Spam Alert!

The following email has been seen this week in several places but has reared it's ugly head before as well:

One of the concerning things about this email is that they have a quality TLD (Top Level Domain) to assure the surfing public that the site is legitimate.

GreenCard

From:                                        Green Card Britain <dontreply@royalmesa.net>

Sent:                                         Monday, June 4, 2018 6:54 PM

To:                                            Support

Subject:                                    You and your family can live in United States

 

Join the Formal American Green Card Loterry Program

Diversity Immigrant Visa Lottery       Aloha,

55,000 people will enjoy USA citizenship. Check if you are eligible for one. Find out Here Quick appliance within 5 minutes Read additional information, go here We wanted to take a moment to thank you for being a member of our subscribers. We have enjoyed this year immensely and truly appreciate you for being a part of our community and newsletter. We wish you and your family a wonderful year of health, happiness and prosperity.       Be Well!

You’re receiving this email because you signed up on our websites, attended one of our previous events or bought one of our products. To manage your email preferences please click here. report spam

The 'Find Out Here' link points to: http://cleverelite.com/link.php?M=1211686&N=309&L=75&F=H which, in turn forwards us to: https://usalws.com/register/?ASEM and we see:

 

 

As you can see the USALWS.com domain sits well and is fairly convincing.

Web users who have typed in their real details report that they are inundated with calls asking for personal information so definitely do not enter any details into this form.

 

Lottery is spelt with one R and two T's and so this email definitely originates in a non-English speaking country - 'Join the Formal American Green Card Loterry Program' is not a good sign to see at the top of any email.

 

Do not click unsubscribe - they may get your email address - it points at http://pmtarock.com/unsubscribe.php?C=dc949d983862fda3a57fff732ecd5e6f&L=5&M=1211686&N=309

 

Do not click report spam - they may get your email address - it points at http://pmtarock.com/spam_report_en.htm 

 

 

💸 Incoming BitCoin Transfer - You received 0.881110 BTC!

The following email has been reported as currently active:

Hello,

You just received 0.881110 BitCoin incoming transfer from Info.

Sender: info@sthildas.oldham.sch.uk

Receiver: recipient email

Amount: 0.881110 BTC

Deadline: 23-05-2018 13:19:28

Transfer has been made from account holder:

c23cb46b19164de4ea6667a27c7c95bab1a6509b76a9fae2856d7a8cf72b950e

Accept the transfer now:

http://www4.bitcoin-gb.tk/claim/uk4njQORyWgrV0hS

Only 7 days remaining to accept your BitCoin transfer! If you do not accept this transfer, the money will be returned to sender.

To claim your BitCoin please visit the link below:

http://www4.bitcoin-gb.tk/claim/uk4njQORyWgrV0hS

Best regards,

Roxana Rigby

Bitcoin Account Manager

The link forwards you to:

https://cryptocode.online/

Whenever there is a supposed quick way to increase capital, con-people quickly associate themselves with the name in the hope of riding the excitement in order to rip people off. Any crypto currency such as Bitcoin is a huge risk to invest in and should be treated with EXTREME caution. This website is not an investment site, but an attempt at taking money based on the reputation of Bitcoin - do not enter your name, report this site as fraudulent using your browser, and mark this email as spam and/or phishing.

The intent of this email is fraudulent, and so it is safe to assume that the website is fraudulent also. Any testimonials are contrived and should not be believed.

You can report fraudulent websites with the help of this page which tells you how to report fraudulent or malware websites.

Virus alert... from Mail Admin #

You may receive the following:

The link above points to: 

http://lauratimmermans.ca/Drupal/server/upload/scan%202018/scan%202018/scan/auth.php?%20email=recipient@emaildomain.com

Where recipient@emaildomain.com is replaced by your email address which enables the website to look fairly realistic:

Which is a link to a compromised website that will ask for your email password - UNDER NO CIRCUMSTANCES SHOULD YOU EVER ENTER YOUR EMAIL PASSWORD INTO AN UNKNOWN SITE!

The above obviously has all sorts of fake associations to antivirus companies along the bottom, but the only point of this is to get your email account login password.

The 'Start Scan' button will show a progress meter, just to convince you that the site is real and give them time to login to your email and steal your data.

This website has been reported to the owners and to Google and Microsoft.

Please mark this email as spam and inform your email provider that this email should be blocked.

Natwest Spam: Incomplete Security Information

You may receive the following message, purporting to be from Natwest:

Disability Action Alliance - DAA Receipt#

Spam: Receipt # 255247

Beware of these fake receipts:

Payment Receipt

YOUR PAYMENT HAS BEEN PROCESSED

We send  Google.Docs document.

Link points to: https://www.ethereumpower.io/itr_inv_doc.zip

Which obviously downloads a inv doc.zip file to corrupt your computer or add a root kit etc.

We have reported the Google link and the website as well as marking the email as spam - please do the same if you receive one of these.

Spam: Receipt # 255247

Beware of these fake receipts:

Payment Receipt

YOUR PAYMENT HAS BEEN PROCESSED

We send  Google.Docs document.

Link points to: https://www.ethereumpower.io/itr_inv_doc.zip

Which obviously downloads a inv doc.zip file to corrupt your computer or add a root kit etc.

We have reported the Google link and the website as well as marking the email as spam - please do the same if you receive one of these.