Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating Amazon

DO NOT click on any links in these emails.

Phishers impersonating Amazon

Unread postby firefly » Sun Jun 04, 2017 4:03 pm

Email:

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 161-565-461 placed on June 1, 2017.

Status: CANCELED
______________________________________________________________

1 "Ruinously"; 2002, Deluxe Edition
By: Wilma Cook

Sold by: Amazon.com LLC
_____________________________________________________________________
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / logon.at/__administrator/components/com_xcloner-backupandrestore/assistantship.php

Header:

Return-Path: <collier-buspatie@proctors.org>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: permerror (encountered permanent error during SPF processing of domain of proctors.org)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1625.mail.gq1.yahoo.com from=amazonstyling.com; domainkeys=neutral (no sig); from=amazonstyling.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
Reply-To: "order-update@amazon.com" <order-update@amazonstyling.com>
To:
Salts-Microprocedure-Rumpus: 73111C8927366
Subject: Your order 161-565-461 has been successfully canceled
Content-Type: text/html; charset=UTF-8
MIME-Version: 1.0
Investigations-Philanthropy-Transfers: 834
X-AMAZONstyling-MAIL-RELAY-TYPE: notification
X-AMAZONstyling-RTE-VERSION: 2.0
Parody-Caravans-Celticizes: 4275
Date: Thu, 1 Jun 2017

amazonstyling.com does not exist.

proctors.org is having a potential "hacked" warning.

theaterdiespur.de is an innocent victim in this case, their server being used to spread the emails.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 51227
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: Phishers impersonating Amazon

Unread postby firefly » Sun Jun 04, 2017 4:14 pm

Email:

Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 14-331-494 placed on June 4, 2017.

Status: CANCELED

_____________________________________________________________________

1 "Inventive"; 2007, Deluxe Edition
By: Bobby Ferguson

Sold by: Amazon.com LLC

_____________________________________________________________________

Thank you for visiting Amazon.com!

---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / hantimber.com/stops.php

Header:

Return-Path: <distribution@healthfxamerica.com>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: none (domain of healthfxamerica.com does not designate permitted sender hosts)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1344.mail.bf1.yahoo.com from=amazon.com; domainkeys=neutral (no sig); from=amazon.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
From: "order-update@amazon.com" <order-update@amazon.com>
X-AMAZON-RTE-VERSION: 2.0
Content-Type: text/html; charset=UTF-8
X-AMAZON-MAIL-RELAY-TYPE: notification
Pong-Thereafter: c5d2b81e9f4f8c24
Date: Sun, 4 Jun 2017
Content-Transfer-Encoding: 7bit
Subject: Amazon.com - Your Cancellation (14-331-494)
Reply-To: "order-update@amazon.com" <order-update@amazon.com>
Message-ID: <urn.correios.msg.a7de8c6e92da253e3fec3acfe4dcfdd5c1647e04e9d593@1113021893775.rte-svc-na-i-491619ea.us-east-0.amazon.com>
To:
Vacate-Punted-Plans: casework
Bounces-to: a7de8c6e92da253e3fec3acfe4dcfdd5c1647e0 ... amazon.com
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 51227
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

AmazonTeam - gdnnurctszp@casesplus.com

Unread postby firefly » Thu Dec 07, 2017 5:48 pm

Email:

Hi xxx

Kyra, Amazon Team

We update your data
View message - clickable link
© Amazon. We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort please opt-out.



Return-Path: <gdnnurctszp@casesplus.com>
Received-SPF: none (domain of casesplus.com does not designate permitted sender hosts)
Received: from 127.0.0.1 (HELO static-200-105-204-66.acelerate.net) (200.105.204.66)
Subject: We update your data
From: AmazonTeam <gdnnurctszp@casesplus.com>

Originating IP: 200.105.204.66
Originating ISP: Axs Bolivia S. A.
City: La Paz
Country of Origin: Bolivia

Phishing link hidden in the message: http: / / gedpro.net/busied.php
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 51227
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

returnpath@rentmasseur.com

Unread postby SlapHappy » Wed Dec 27, 2017 8:09 pm

* 138.253.100.116 P¦j Liverpool United Kingdom

Return-Path: <returnpath@rentmasseur.com>
Received: from check.graceonbag.com (u20375937.onlinehome-server.com.
[74.208.65.172])
by mx.google.com with ESMTP id 36si7440113iod.195.2017.12.27.10.30.24
for <xxxx>;
Wed, 27 Dec 2017 10:30:24 -0800 (PST)
Received-SPF: fail (google.com: domain of returnpath@rentmasseur.com does
not designate 74.208.65.172 as permitted sender) client-ip=74.208.65.172;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of returnpath@rentmasseur.com does not
designate 74.208.65.172 as permitted sender)
smtp.mailfrom=returnpath@rentmasseur.com
From: AMAZON <tKPN65se4T1hWklzT@check.graceonbag.com>
Subject: HI xxx,_Your_Order_no #812-4623_might_ARRIVED
Sender: <reply@tkpn65se4t1hwklzt.vqsfqf.alpha-lt.net>
Bounces_to: <VQSfqf.VQSfqf.VQSfqf.VQSfqf@VQSfqf.bbc.co.uk
Received: from sweet-page.com (138.253.100.116) by pandora.com id
tianya.cn.1373 for <xxx>; Date (envelope-from <survey@ltpri02.alpha-lt.net>)
Message-id: <tKPN65se4T1hWklzT.tKPN65se4T1hWklzT@7355.mail-wi0-f171.google.com>
To: "97,190.16Kh.inbox@amfd02.alpha-mail.net> <" <xxxt@oc96s.4d3en.74ezg.__rand>
Precedence: bulk
List-Unsubscribe: <mailto:unsub-16416392@vm-jhaller1.olypen.com>
Reply-To: <contact@qkadsrv.com>, <koisq@developunit.info>, <154so@spiegel.de>, <0145sqo@tianya.cn>, <mz@ehow.com>
Date: Date
X-Feedback-ID: VQSfqf:29bmC:by5E7:dyn06
content-type: text/html

HI xxx, Amazon: Your Reward no #812-4623 might have ARRIVED
http:/ /bit.ly/2pCoaXw



If you would like to be removed from our list and stop receiving new event e-mails, Please Click here .
Or send a mail to:
contact@qkadsrv.com,koisq@developunit.info,154so@spiegel.de,0145sqo@tianya.cn,mz@ehow.com
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
human guy! With small brain.
 
Posts: 44049
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.


Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 1 guest