Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating Amazon

DO NOT click on any links in these emails.

Phishers impersonating Amazon

Unread postby firefly » Sun Jun 04, 2017 4:03 pm

Email:

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 161-565-461 placed on June 1, 2017.

Status: CANCELED
______________________________________________________________

1 "Ruinously"; 2002, Deluxe Edition
By: Wilma Cook

Sold by: Amazon.com LLC
_____________________________________________________________________
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / logon.at/__administrator/components/com_xcloner-backupandrestore/assistantship.php

Header:

Return-Path: <collier-buspatie@proctors.org>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: permerror (encountered permanent error during SPF processing of domain of proctors.org)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1625.mail.gq1.yahoo.com from=amazonstyling.com; domainkeys=neutral (no sig); from=amazonstyling.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
Reply-To: "order-update@amazon.com" <order-update@amazonstyling.com>
To:
Salts-Microprocedure-Rumpus: 73111C8927366
Subject: Your order 161-565-461 has been successfully canceled
Content-Type: text/html; charset=UTF-8
MIME-Version: 1.0
Investigations-Philanthropy-Transfers: 834
X-AMAZONstyling-MAIL-RELAY-TYPE: notification
X-AMAZONstyling-RTE-VERSION: 2.0
Parody-Caravans-Celticizes: 4275
Date: Thu, 1 Jun 2017

amazonstyling.com does not exist.

proctors.org is having a potential "hacked" warning.

theaterdiespur.de is an innocent victim in this case, their server being used to spread the emails.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: Phishers impersonating Amazon

Unread postby firefly » Sun Jun 04, 2017 4:14 pm

Email:

Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 14-331-494 placed on June 4, 2017.

Status: CANCELED

_____________________________________________________________________

1 "Inventive"; 2007, Deluxe Edition
By: Bobby Ferguson

Sold by: Amazon.com LLC

_____________________________________________________________________

Thank you for visiting Amazon.com!

---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------


Phishing link hidden in the message (disabled) - masked by the order number: http: / / hantimber.com/stops.php

Header:

Return-Path: <distribution@healthfxamerica.com>
X-YahooFilteredBulk: 87.106.64.76
Received-SPF: none (domain of healthfxamerica.com does not designate permitted sender hosts)
X-Originating-IP: [87.106.64.76]
Authentication-Results: mta1344.mail.bf1.yahoo.com from=amazon.com; domainkeys=neutral (no sig); from=amazon.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO theaterdiespur.de) (87.106.64.76)
From: "order-update@amazon.com" <order-update@amazon.com>
X-AMAZON-RTE-VERSION: 2.0
Content-Type: text/html; charset=UTF-8
X-AMAZON-MAIL-RELAY-TYPE: notification
Pong-Thereafter: c5d2b81e9f4f8c24
Date: Sun, 4 Jun 2017
Content-Transfer-Encoding: 7bit
Subject: Amazon.com - Your Cancellation (14-331-494)
Reply-To: "order-update@amazon.com" <order-update@amazon.com>
Message-ID: <urn.correios.msg.a7de8c6e92da253e3fec3acfe4dcfdd5c1647e04e9d593@1113021893775.rte-svc-na-i-491619ea.us-east-0.amazon.com>
To:
Vacate-Punted-Plans: casework
Bounces-to: a7de8c6e92da253e3fec3acfe4dcfdd5c1647e0 ... amazon.com
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

AmazonTeam - gdnnurctszp@casesplus.com

Unread postby firefly » Thu Dec 07, 2017 5:48 pm

Email:

Hi xxx

Kyra, Amazon Team

We update your data
View message - clickable link
© Amazon. We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort please opt-out.



Return-Path: <gdnnurctszp@casesplus.com>
Received-SPF: none (domain of casesplus.com does not designate permitted sender hosts)
Received: from 127.0.0.1 (HELO static-200-105-204-66.acelerate.net) (200.105.204.66)
Subject: We update your data
From: AmazonTeam <gdnnurctszp@casesplus.com>

Originating IP: 200.105.204.66
Originating ISP: Axs Bolivia S. A.
City: La Paz
Country of Origin: Bolivia

Phishing link hidden in the message: http: / / gedpro.net/busied.php
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

returnpath@rentmasseur.com

Unread postby SlapHappy » Wed Dec 27, 2017 8:09 pm

* 138.253.100.116 P¦j Liverpool United Kingdom

Return-Path: <returnpath@rentmasseur.com>
Received: from check.graceonbag.com (u20375937.onlinehome-server.com.
[74.208.65.172])
by mx.google.com with ESMTP id 36si7440113iod.195.2017.12.27.10.30.24
for <xxxx>;
Wed, 27 Dec 2017 10:30:24 -0800 (PST)
Received-SPF: fail (google.com: domain of returnpath@rentmasseur.com does
not designate 74.208.65.172 as permitted sender) client-ip=74.208.65.172;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of returnpath@rentmasseur.com does not
designate 74.208.65.172 as permitted sender)
smtp.mailfrom=returnpath@rentmasseur.com
From: AMAZON <tKPN65se4T1hWklzT@check.graceonbag.com>
Subject: HI xxx,_Your_Order_no #812-4623_might_ARRIVED
Sender: <reply@tkpn65se4t1hwklzt.vqsfqf.alpha-lt.net>
Bounces_to: <VQSfqf.VQSfqf.VQSfqf.VQSfqf@VQSfqf.bbc.co.uk
Received: from sweet-page.com (138.253.100.116) by pandora.com id
tianya.cn.1373 for <xxx>; Date (envelope-from <survey@ltpri02.alpha-lt.net>)
Message-id: <tKPN65se4T1hWklzT.tKPN65se4T1hWklzT@7355.mail-wi0-f171.google.com>
To: "97,190.16Kh.inbox@amfd02.alpha-mail.net> <" <xxxt@oc96s.4d3en.74ezg.__rand>
Precedence: bulk
List-Unsubscribe: <mailto:unsub-16416392@vm-jhaller1.olypen.com>
Reply-To: <contact@qkadsrv.com>, <koisq@developunit.info>, <154so@spiegel.de>, <0145sqo@tianya.cn>, <mz@ehow.com>
Date: Date
X-Feedback-ID: VQSfqf:29bmC:by5E7:dyn06
content-type: text/html

HI xxx, Amazon: Your Reward no #812-4623 might have ARRIVED
http:/ /bit.ly/2pCoaXw



If you would like to be removed from our list and stop receiving new event e-mails, Please Click here .
Or send a mail to:
contact@qkadsrv.com,koisq@developunit.info,154so@spiegel.de,0145sqo@tianya.cn,mz@ehow.com
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

jacksimth35678@gmail.com

Unread postby firefly » Sat Feb 05, 2022 3:05 am

Fake invoice.

Hello,

Thank you for purchasing with Amazon. Your order product from Amazon is now ready for shipment. You will receive your order within 3 next working days. All details are given below..

If you have any information related to your product then you can contact us on this number +1(872)23-48176

Order Id- 2759BCTP7192
Item- Auto Full Gaming Office Desk Ergonomic Lumbar Support, Racing Style PU Leather PC High Back Adjustable

Order Price- $715.00
Shipping & Handling Charges- Null
Estimated Delivery Date- 2/6/2022
Shipping Add- 1100 Roddy Way La Habra, California(CA), 90631

Amazon


+18722348176
Number billable as mobile number
Country or destination United States
City or exchange location Chicago, IL
Original network provider* T-mobile Usa, Inc.

Return-Path: <jacksimth35678@gmail.com>
From: Invoice - Details <jacksimth35678@gmail.com>
Date: Wed, 2 Feb 2022 18:00:12 +0000
Message-ID: <CAJLov1Uo3BkP1MbY_ypmuVg4qEGuhc_n2vHZG6RGTbytrNeotg@mail.gmail.com>
Subject: Order From Amazon
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

robinbrook4628@gmail.com

Unread postby firefly » Sat Feb 05, 2022 4:02 am

Fake invoice.

Hello,

We sent this important email confirmation. Your ordered product is now ready. You will receive your product within 3 working days. We hope you will enjoy it.

If you need more information about you order you can contact us +1(872)23-48176

Order info :

Order id : 3478HJSN7812
Product Description : HP 14 Laptop, AMD Ryzen 5 5500U, 8 GB RAM, 256 GB SSD Storage, 14-inch Full HD Display

Price : $945.00
Shipping Charges : $5.00
Total price : $950.00
Estimated Delivery Date :2/7/2022
Shipping Address : 14019 Beach Blvd #903 Jacksonville Beach, Florida(FL), 32250

Amazon


Header:

Return-Path: <robinbrook4628@gmail.com>
From: Shipping - Information <robinbrook4628@gmail.com>
Date: Thu, 3 Feb 2022 13:45:17 +0000
Message-ID: <CAKsNupiW4HK0BhiJPAtkk+BLxx1RMNth+BSZVx4aopnKHs621Q@mail.gmail.com>
Subject: Invoice mail from Amazon

+18722348176 - same as above
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe


Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 16 guests