Car Wrap Scam part 2

[SlapHappy]

The line would look similar to this one: Look for the phrase i have highlighted in red. in the full headers.

Reply-To: scammer name <scammername@gmail.com>

[MrBlue1784]

@slaphappy: Thanks. I'll post the full header and maybe you'll be able to get more info that way. The full header is:

From jeffrey@monsterrenerrgy.com Sat Feb 28 17:03:16 2015
X-Apparently-To: Sat, 28 Feb 2015 17:03:28 +0000
Return-Path: <jeffrey@monsterrenerrgy.com>
Received-SPF:
X-YMailISG:
X-Originating-IP: [64.98.42.58]
Authentication-Results: mta1363.mail.gq1.yahoo.com from=monsterrenerrgy.com;
domainkeys=neutral (no sig); from=monsterrenerrgy.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtprelay.b.hostedemail.com) (64.98.42.58)
by mta1363.mail.gq1.yahoo.com with SMTP; Sat, 28 Feb 2015 17:03:17 +0000
Received: from filter.hostedemail.com (10.5.19.248.rfc1918.com [10.5.19.248])
by smtprelay04.b.hostedemail.com (Postfix) with ESMTP id EA6297B612;
Sat, 28 Feb 2015 17:03:16 +0000 (UTC)
X-Session-Marker: 6A656666726579406D6F6E7374657272656E65727267792E636F6D
X-Spam-Summary:
X-HE-Tag: order60_90f81772cbd1c
X-Filterd-Recvd-Size: 3068
Received: from mail.monsterrenerrgy.com (imap-ext [64.98.36.5])
(Authenticated sender: webmail@jeffrey@monsterrenerrgy.com)
by omf06.b.hostedemail.com (Postfix) with ESMTPA;
Sat, 28 Feb 2015 17:03:16 +0000 (UTC)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_5e63e6eded91340de7739974467b0746"
Date: Sat, 28 Feb 2015 17:03:16 +0000
From: jeffrey@monsterrenerrgy.com
To: undisclosed-recipients:;
Subject: .....Get Started !!!!
Reply-To: getstarted@monsterrenerrgy.com
Mail-Reply-To: getstarted@monsterrenerrgy.com
Message-ID: <80c925ffd5bac80905720b981a2835d5@monsterrenerrgy.com>
X-Sender: jeffrey@monsterrenerrgy.com
User-Agent: Roundcube Webmail/1.0.2
X-Originating-IP: [41.66.208.156]
Content-Length: 2275

[SlapHappy]

Reply-To: getstarted@monsterrenerrgy.com

2 r's in monster and in energy.... thanks.

[SlapHappy]

http://whois.domaintools.com/monsterrenerrgy.com

monsterrenerrgy.com is a scammer domain used for fake emails impersonating the real company.

Whois Record for MonsterRenerrGy.com


Registrant Org VistaPrint Technologies Ltd is associated with ~456,520 other domains
Registrar TUCOWS DOMAINS INC.
Registrar Status clientTransferProhibited, clientUpdateProhibited
Dates Created on 2015-02-18 - Expires on 2016-02-18 - Updated on 2015-02-18
Name Server(s) NS2.VPWEB.COM (has 332,228 domains)
NS3.VPWEB.COM (has 332,228 domains)
NS4.VPWEB.COM (has 332,228 domains)

IP Address 54.228.217.38 - 60,706 other sites hosted on this server
IP Location Ireland - Dublin City - Dublin - Amazon.com Inc.
ASN Ireland AS16509 AMAZON-02 - Amazon.com, Inc. (registered May 04, 2000)
Domain Status Registered And No Website
Whois History 2 records have been archived since 2015-02-18
IP History 2 changes on 2 unique IP addresses over 0 years
Hosting History 1 change on 2 unique name servers over 0 year
Whois Server whois.tucows.com
Website
Website Title None given.
Response Code 200
SEO Score 62%
Terms 27 (Unique: 24, Linked: 2)
Images 1 (Alt tags missing: 1)
Links 1 (Internal: 0, Outbound: 0)
Whois Record ( last updated on 2015-03-02 )
Domain Name: MONSTERRENERRGY.COM
Registry Domain ID: 1903749723_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.tucows.com
Registrar URL: http://tucowsdomains.com
Updated Date: 2015-02-18T12:18:25Z
Creation Date: 2015-02-18T12:18:25Z
Registrar Registration Expiration Date: 2016-02-18T12:18:25Z
Registrar: TUCOWS, INC.
Registrar IANA ID: 69
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1.4165350123
Reseller: Vistaprint
Reseller:
Reseller: 866-811-1674
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registry Registrant ID:
Registrant Name: VistaPrint Technologies Ltd
Registrant Organization: VistaPrint Technologies Ltd
Registrant Street: Canon's Court 22 Victoria Street
Registrant City: Hamilton
Registrant State/Province:
Registrant Postal Code: HM12
Registrant Country: BM
Registrant Phone: +1.7816526199
Registrant Phone Ext:
Registrant Fax: +1.7816526096
Registrant Fax Ext:
Registrant Email:
Registry Admin ID:
Admin Name: Domain Administrator
Admin Organization: VistaPrint
Admin Street: 95 Hayden Avenue
Admin City: Lexington
Admin State/Province: MA
Admin Postal Code: 02421
Admin Country: US
Admin Phone: +1.7816526199
Admin Phone Ext:
Admin Fax: +1.7816526096
Admin Fax Ext:
Admin Email:
Registry Tech ID:
Tech Name: Domain Administrator
Tech Organization: VistaPrint
Tech Street: 95 Hayden Ave.
Tech City: Lexington
Tech State/Province: MA
Tech Postal Code: 02421
Tech Country: US
Tech Phone: +1.7816526199
Tech Phone Ext:
Tech Fax: +1.7816526096
Tech Fax Ext:
Tech Email:
Name Server: NS3.VPWEB.COM
Name Server: NS4.VPWEB.COM
Name Server: NS2.VPWEB.COM
DNSSEC: Unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

Registration Service Provider:
Vistaprint,
866-811-1674

[Big Al]

Please keep any E-mails from this scammer as The Website Killing team says the host sometimes asks for them.
BA

ETA: Being reported as dead by the Website Killing team.

[kj22]

Hey everyone. I'm a software engineering student with an interest in security, so these scam emails are child's play for me. I got one today with an email address that was registered to a very believable domain name, so I felt inclined to send it here. Unfortunately it's through the school email platform, so I'm really not sure how to view headers since it's very limited. However, I can probably look into how I can read my email via some third party application or tool and add it later on. Anyway here's the email.

Hello ,

This is the basic premise of the "Paid to drive your car"

Concept: We seeks people -- regular citizens, not professional drivers -- to go about their normal routine as they usually do, only with an advert of any of the companies we are advertising their product pasted on your car (NESCAFE, LIPTON TEA & DURACELL COMPANIES).

Our company is one of the most innovative UK based Advertising agencies with clients allover the world. We have a target to advertise so many products for a number of companies mostly in USA,UK and EUROPE as a whole and we also have representatives in this regions.

The ads are typically vinyl decals, also known as "auto wraps," that almost seem to be painted on the vehicle and which will cover any portion of your car's exterior surface.

What does the company get out of this type of ad strategy?

Lots of exposure and awareness. The auto wraps tend to be colorful and eye-catching and attract lots of attention. Plus, it's a form of advertising with a captive audience, this means people who are stuck in traffic can't avoid seeing the wrapped car alongside. This program will last for 3 months and the minimum period you can participate is 1 month.

You will be compensated with a sum of Four hundred dollars (400 Dollars) per Week, which is essentially a "rental" payment for letting our company use the space.
We shall provide experts that will handle the advert placement on your car. You will receive an upfront payment of Four hundred dollars (400 Dollars) for accepting to carry this advert on your car and other weekly payments.

Send the required information below:
Full Name:
Occupation:
Make of car/ year:
Exterior Color of Car:
Address:
city:
State:
Zip code:
Phone Number(s) mobile/home:
Email

Best Regards,
Joshua Ross
Hiring Manager,
Car Wrap Advert Agent.

The email address is carwrapagent@wrapyourcar.com. I went to wrapyourcar.com and it seemed very believable. After scanning it for harmful javascript code it was clean, so I presume the site is just to make people fall for the scam even more. I was going to mess with him, but I figured the amount of phishing emails would only increase exponentially if I sent a response. Oh well.

[SlapHappy]

kj22,

Can you post the "Reply to:" email address from the full email headers?
Thanks. This will be the scammer's real email address. The other is a spoofed email address of the real website, it looks like to me.

[kj22]

Yeah, like I said my schools email client is very limited. When I click "compose email to" it brings up the wrapyourcar.com email address. However, when I clicked "reply to", it gave me his real email address which is:

carwrapagent1@gmail.com

[SlapHappy]

Thanks, kj22.
Now others can be warned.

[Kspencer81]

I gave them my full name and address. How can I get this under control? I got a text saying the payment was on its way. If I just return everything and don't cash anything or send them any money can I avoid being scammed?