Site logo

     


Advert.
Switch to full style
DO NOT click on any links in these emails.
Post a reply

Phishers impersonating Amazon

Sun Jun 04, 2017 4:03 pm

Email:

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 161-565-461 placed on June 1, 2017.

Status: CANCELED
______________________________________________________________

1 "Ruinously"; 2002, Deluxe Edition
By: Wilma Cook

Sold by: Amazon.com LLC
_____________________________________________________________________
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / logon.at/__administrator/components/com_xcloner-backupandrestore/assistantship.php

Header:

Return-Path: <collier-buspatie@proctors.org>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: permerror (encountered permanent error during SPF processing of domain of proctors.org)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1625.mail.gq1.yahoo.com from=amazonstyling.com; domainkeys=neutral (no sig); from=amazonstyling.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
Reply-To: "order-update@amazon.com" <order-update@amazonstyling.com>
To:
Salts-Microprocedure-Rumpus: 73111C8927366
Subject: Your order 161-565-461 has been successfully canceled
Content-Type: text/html; charset=UTF-8
MIME-Version: 1.0
Investigations-Philanthropy-Transfers: 834
X-AMAZONstyling-MAIL-RELAY-TYPE: notification
X-AMAZONstyling-RTE-VERSION: 2.0
Parody-Caravans-Celticizes: 4275
Date: Thu, 1 Jun 2017

amazonstyling.com does not exist.

proctors.org is having a potential "hacked" warning.

theaterdiespur.de is an innocent victim in this case, their server being used to spread the emails.

Re: Phishers impersonating Amazon

Sun Jun 04, 2017 4:14 pm

Email:

Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 14-331-494 placed on June 4, 2017.

Status: CANCELED

_____________________________________________________________________

1 "Inventive"; 2007, Deluxe Edition
By: Bobby Ferguson

Sold by: Amazon.com LLC

_____________________________________________________________________

Thank you for visiting Amazon.com!

---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / hantimber.com/stops.php

Header:

Return-Path: <distribution@healthfxamerica.com>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: none (domain of healthfxamerica.com does not designate permitted sender hosts)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1344.mail.bf1.yahoo.com from=amazon.com; domainkeys=neutral (no sig); from=amazon.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
From: "order-update@amazon.com" <order-update@amazon.com>
X-AMAZON-RTE-VERSION: 2.0
Content-Type: text/html; charset=UTF-8
X-AMAZON-MAIL-RELAY-TYPE: notification
Pong-Thereafter: c5d2b81e9f4f8c24
Date: Sun, 4 Jun 2017
Content-Transfer-Encoding: 7bit
Subject: Amazon.com - Your Cancellation (14-331-494)
Reply-To: "order-update@amazon.com" <order-update@amazon.com>
Message-ID: <urn.correios.msg.a7de8c6e92da253e3fec3acfe4dcfdd5c1647e04e9d593@1113021893775.rte-svc-na-i-491619ea.us-east-0.amazon.com>
To:
Vacate-Punted-Plans: casework
Bounces-to: a7de8c6e92da253e3fec3acfe4dcfdd5c1647e0 ... amazon.com

AmazonTeam - gdnnurctszp@casesplus.com

Thu Dec 07, 2017 5:48 pm

Email:

Hi xxx

Kyra, Amazon Team

We update your data
View message - clickable link
© Amazon. We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort please opt-out.



Return-Path: <gdnnurctszp@casesplus.com>
Received-SPF: none (domain of casesplus.com does not designate permitted sender hosts)
Received: from 127.0.0.1 (HELO static-200-105-204-66.acelerate.net) (200.105.204.66)
Subject: We update your data
From: AmazonTeam <gdnnurctszp@casesplus.com>

Originating IP: 200.105.204.66
Originating ISP: Axs Bolivia S. A.
City: La Paz
Country of Origin: Bolivia

Phishing link hidden in the message: http: / / gedpro.net/busied.php

returnpath@rentmasseur.com

Wed Dec 27, 2017 8:09 pm

* 138.253.100.116 P¦j Liverpool United Kingdom

Return-Path: <returnpath@rentmasseur.com>
Received: from check.graceonbag.com (u20375937.onlinehome-server.com.
[74.208.65.172])
by mx.google.com with ESMTP id 36si7440113iod.195.2017.12.27.10.30.24
for <xxxx>;
Wed, 27 Dec 2017 10:30:24 -0800 (PST)
Received-SPF: fail (google.com: domain of returnpath@rentmasseur.com does
not designate 74.208.65.172 as permitted sender) client-ip=74.208.65.172;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of returnpath@rentmasseur.com does not
designate 74.208.65.172 as permitted sender)
smtp.mailfrom=returnpath@rentmasseur.com
From: AMAZON <tKPN65se4T1hWklzT@check.graceonbag.com>
Subject: HI xxx,_Your_Order_no #812-4623_might_ARRIVED
Sender: <reply@tkpn65se4t1hwklzt.vqsfqf.alpha-lt.net>
Bounces_to: <VQSfqf.VQSfqf.VQSfqf.VQSfqf@VQSfqf.bbc.co.uk
Received: from sweet-page.com (138.253.100.116) by pandora.com id
tianya.cn.1373 for <xxx>; Date (envelope-from <survey@ltpri02.alpha-lt.net>)
Message-id: <tKPN65se4T1hWklzT.tKPN65se4T1hWklzT@7355.mail-wi0-f171.google.com>
To: "97,190.16Kh.inbox@amfd02.alpha-mail.net> <" <xxxt@oc96s.4d3en.74ezg.__rand>
Precedence: bulk
List-Unsubscribe: <mailto:unsub-16416392@vm-jhaller1.olypen.com>
Reply-To: <contact@qkadsrv.com>, <koisq@developunit.info>, <154so@spiegel.de>, <0145sqo@tianya.cn>, <mz@ehow.com>
Date: Date
X-Feedback-ID: VQSfqf:29bmC:by5E7:dyn06
content-type: text/html

HI xxx, Amazon: Your Reward no #812-4623 might have ARRIVED
http:/ /bit.ly/2pCoaXw



If you would like to be removed from our list and stop receiving new event e-mails, Please Click here .
Or send a mail to:
contact@qkadsrv.com,koisq@developunit.info,154so@spiegel.de,0145sqo@tianya.cn,mz@ehow.com

jacksimth35678@gmail.com

Sat Feb 05, 2022 3:05 am

Fake invoice.

Hello,

Thank you for purchasing with Amazon. Your order product from Amazon is now ready for shipment. You will receive your order within 3 next working days. All details are given below..

If you have any information related to your product then you can contact us on this number +1(872)23-48176

Order Id- 2759BCTP7192
Item- Auto Full Gaming Office Desk Ergonomic Lumbar Support, Racing Style PU Leather PC High Back Adjustable

Order Price- $715.00
Shipping & Handling Charges- Null
Estimated Delivery Date- 2/6/2022
Shipping Add- 1100 Roddy Way La Habra, California(CA), 90631

Amazon


+18722348176
Number billable as mobile number
Country or destination United States
City or exchange location Chicago, IL
Original network provider* T-mobile Usa, Inc.

Return-Path: <jacksimth35678@gmail.com>
From: Invoice - Details <jacksimth35678@gmail.com>
Date: Wed, 2 Feb 2022 18:00:12 +0000
Message-ID: <CAJLov1Uo3BkP1MbY_ypmuVg4qEGuhc_n2vHZG6RGTbytrNeotg@mail.gmail.com>
Subject: Order From Amazon

robinbrook4628@gmail.com

Sat Feb 05, 2022 4:02 am

Fake invoice.

Hello,

We sent this important email confirmation. Your ordered product is now ready. You will receive your product within 3 working days. We hope you will enjoy it.

If you need more information about you order you can contact us +1(872)23-48176

Order info :

Order id : 3478HJSN7812
Product Description : HP 14 Laptop, AMD Ryzen 5 5500U, 8 GB RAM, 256 GB SSD Storage, 14-inch Full HD Display

Price : $945.00
Shipping Charges : $5.00
Total price : $950.00
Estimated Delivery Date :2/7/2022
Shipping Address : 14019 Beach Blvd #903 Jacksonville Beach, Florida(FL), 32250

Amazon


Header:

Return-Path: <robinbrook4628@gmail.com>
From: Shipping - Information <robinbrook4628@gmail.com>
Date: Thu, 3 Feb 2022 13:45:17 +0000
Message-ID: <CAKsNupiW4HK0BhiJPAtkk+BLxx1RMNth+BSZVx4aopnKHs621Q@mail.gmail.com>
Subject: Invoice mail from Amazon

+18722348176 - same as above
Post a reply