Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating LinkedIn

DO NOT click on any links in these emails.

Phishers impersonating LinkedIn

Unread postby firefly » Wed Mar 27, 2013 6:06 am

Dylan Ferguson via LinkedIn <lyde@shapieron.tkb.pl>

Email:

LinkedIn
Dylan Ferguson just sent you a message
Date: 3/25/2013
http:/ /www.linkedin.com/?action=viewProfile&uy=profile&message=bdab
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Link: http:/ /hexaestudio.com.ar/recombination.html

Header:

Return-Path: <lyde@shapieron.tkb.pl>
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of lyde@shapieron.tkb.pl designates 89.161.65.231 as permitted sender) smtp.mail=lyde@shapieron.tkb.pl
Date: Mon, 25 Mar 2013 07:50:16 -0700
From: "Dylan Ferguson via LinkedIn" <lyde@shapieron.tkb.pl>
To: xxx
Subject: Dylan Ferguson sent you a direct message

Originating IP: 89.161.65.231
Originating ISP: As Telekomunikacja Podlasie Sp. Z O.o.
City: Bialystok
Country of Origin: Poland
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Blodwen Wallace via LinkedIn djcasola@ip36.131.adsl.wplus.ru

Unread postby firefly » Wed Mar 27, 2013 6:11 am

Email:

LinkedIn
Blodwen Wallace sent you a message
Date: 3/26/2013
http:/ /www.linkedin.com/?action=viewProfile&ll=member&message=7644ec
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Link: http:/ /dvsurvivorsjusticeact.org/stink.html

Header:

Return-Path: <djcasola@ip36.131.adsl.wplus.ru>
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of djcasola@ip36.131.adsl.wplus.ru designates 195.131.131.36 as permitted sender) smtp.mail=djcasola@ip36.131.adsl.wplus.ru
Date: Tue, 26 Mar 2013 08:17:12 -0500
From: "Blodwen Wallace via LinkedIn" <djcasola@ip36.131.adsl.wplus.ru>
To: xxx
Subject: Blodwen Wallace sent you a personal message

Originating IP: 195.131.131.36
Originating ISP: Webplus
City: Saint Petersburg
Country of Origin: Russian Federation
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Morwen Campbel via LinkedIn <chaneytkru@cpanel24.uk2.net>

Unread postby firefly » Sun Mar 31, 2013 8:34 pm

Email:

LinkedIn
Morwen Campbel sent you a message
Date: 3/31/2013
http:/ /www.linkedin.com/?action=viewMessage&qk=message&member=848e3f6
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Link: http:/ /210.245.122.38/~donexco/commendation.html

Header:

Return-Path: <chaneytkru@cpanel24.uk2.net>
Received: from cpanel24.uk2.net (cpanel24.uk2.net. [77.92.82.201])
by mx.google.com with SMTP id w10si3883991qct.63.2013.03.31.06.21.53;
Sun, 31 Mar 2013 06:21:54 -0700 (PDT)
spf=pass (google.com: best guess record for domain of chaneytkru@cpanel24.uk2.net designates 77.92.82.201 as permitted sender) smtp.mail=chaneytkru@cpanel24.uk2.net
Date: Sun, 31 Mar 2013 14:21:54 -0300
From: "Morwen Campbel via LinkedIn" <chaneytkru@cpanel24.uk2.net>
To: xxx
Subject: Morwen Campbel just sent you a personal message

Originating IP: 77.92.82.201
Originating ISP: Uk2 Infrastructure
City: London
Country of Origin: United Kingdom
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

claude.richard@gic-web-bsd-021.genotec.ch

Unread postby firefly » Mon Apr 01, 2013 4:53 pm

Dylan Lee sent you a personal message

Email:

LinkedIn
Dylan Lee has sent you a message
Date: 3/31/2013
http:/ /www.linkedin.com/?action=viewProfile&rx=member&member=95d7d
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Link: http:/ /vegasaug.org/shylockian.html

Header:

Return-Path: <claude.richard@gic-web-bsd-021.genotec.ch>
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of claude.richard@gic-web-bsd-021.genotec.ch designates 82.195.224.121 as permitted sender) smtp.mail=claude.richard@gic-web-bsd-021.genotec.ch
Date: Sun, 31 Mar 2013 23:22:18 -0700
From: "Dylan Lee via LinkedIn" <claude.richard@gic-web-bsd-021.genotec.ch>

Originating IP: 82.195.224.121
Originating ISP: Genotec Ag
City: Basel
Country of Origin: Switzerland
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

hed76n@server44.configcenter.info

Unread postby firefly » Mon Apr 01, 2013 5:19 pm

Email:

LinkedIn
Connor Sullivan just sent you a message
Date: 4/01/2013
http:/ /www.linkedin.com/?action=viewProfile&pb=member&member=93b2e4b3
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Link: http: //prccs.net/censure.html

Header:

Return-Path: <hed76n@server44.configcenter.info>
Received: from server44.configcenter.info (server44.configcenter.info. [109.75.111.134])
by mx.google.com with SMTP id i8si12896948pao.159.2013.04.01.01.05.48;
Mon, 01 Apr 2013 01:05:48 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of hed76n@server44.configcenter.info designates 109.75.111.134 as permitted sender) client-ip=109.75.111.134;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of hed76n@server44.configcenter.info designates 109.75.111.134 as permitted sender) smtp.mail=hed76n@server44.configcenter.info
Date: Mon, 1 Apr 2013 10:05:48 -0300
From: "Connor Sullivan via LinkedIn" <hed76n@server44.configcenter.info>
To: xxx
Subject: Connor Sullivan just sent you a personal message

Originating IP: 109.75.111.134
Originating ISP: Kingstaff-hosting
City: Berlin
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

LinkedIn Support nejlup_1953@duathlondeselestat.com

Unread postby firefly » Tue May 14, 2013 3:43 am

Email:

LinkedIn
From: LinkedIn Support
Date: 5/13/2013
Subject: We've got a new message for you
http:/ /www.fahrschule-schirle.de/outstrip.html - phishing link
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .

This email was intended for xxx. Learn why we included this . © 2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Header:

Return-Path: <nejlup_1953@duathlondeselestat.com>
Received: from fw-n01.wc2.dfw1.stabletransit.com (fw-n01.wc2.dfw1.stabletransit.com. [174.143.11.196])
Mon, 13 May 2013 12:17:04 -0700 (PDT)
Received-SPF: neutral (google.com: 174.143.11.196 is neither permitted nor denied by best guess record for domain of nejlup_1953@duathlondeselestat.com) client-ip=174.143.11.196;

Originating IP: 174.143.11.196
Originating ISP: Mosso
City: San Antonio
Country of Origin: United States

The phising attempt is reported.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake Linkedin email

Unread postby firefly » Sat May 18, 2013 3:29 pm

Email:

There is a new message for you

LinkedIn
From: LinkedIn Updates
Date: 5/12/2013
Subject: There is a new message for you

Phishing link: http:/ /tourselect.com.tr/crickets.html

View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.

This email was intended for xxx. © 2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA


Header:

Return-Path: <abo@entlebucher-anzeiger.ch>
Received: from 127.0.0.1 (HELO localhost) (119.110.108.41)
by mta1102.mail.ne1.yahoo.com with SMTP; Sun, 12 May 2013 04:40:24 +0000
From: LinkedIn Updates <abo@entlebucher-anzeiger.ch>
Subject: There is a new message for you

Originating IP: 119.110.108.41
Originating ISP: Tm-vads Dc Hosting
Country of Origin: Malaysia

They uses a spoofed email address, belongs to a real company.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

"LinkedIn" <mariamoser@t-online.de>

Unread postby SlapHappy » Thu Aug 27, 2015 3:09 am

* 85.214.197.244 Strato Rechenzentrum, Berlin Oranienburg Germany

Return-Path: <mariamoser@t-online.de>
Received: from mailout12.t-online.de (mailout12.t-online.de. [194.25.134.22])
by mx.google.com with ESMTPS id gk10si2945656wjb.110.2015.08.25.21.46.50
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 25 Aug 2015 21:46:51 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of mariamoser@t-online.de
designates 194.25.134.22 as permitted sender) client-ip=194.25.134.22;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of mariamoser@t-online.de d
esignates 194.25.134.22 as permitted sender) smtp.mailfrom=mariamoser@t-online.de
Received: from fwd03.aul.t-online.de (fwd03.aul.t-online.de [172.20.27.148])
by mailout12.t-online.de (Postfix) with SMTP id A5C883B73A0;
Wed, 26 Aug 2015 06:46:50 +0200 (CEST)
Received: from h2358992.stratoserver.net (S8rvLEZF8hxhYzl226UQ6st3cKKgYMXvEv7RfLAI39rvY-3gHMtLQfVJD8qh00fZlk@[85.214.197.244]) by fwd03.t-online.de
with (TLSv1:DHE-RSA-AES256-SHA encrypted)
esmtp id 1ZUSbp-0SyjZU0; Wed, 26 Aug 2015 06:46:49 +0200
Content-Type: multipart/mixed; boundary="===============1080013775=="
MIME-Version: 1.0
Subject: Security Notice Updates
To: Recipients <accountrev@rug.nl>
From: "LinkedIn" <mariamoser@t-online.de>
Date: Wed, 26 Aug 2015 06:46:50 +0200
Message-ID: <1ZUSbp-0SyjZU0@fwd03.t-online.de>
X-ID: S8rvLEZF8hxhYzl226UQ6st3cKKgYMXvEv7RfLAI39rvY-3gHMtLQfVJD8qh00fZlk
X-TOI-MSGID: e4a48c7f-733a-4693-b43a-e105d4e9d0de



LinkedIn


Security

Notice Updates




On the 23rd of August 2015, An Attempt into your account has been detected
from an unknown location,
For your security, access to your LinkedIn Account has been temporarily suspended.
To regain access,you must complete REGISTRATION BY DOWNLOAD & FILL ATTACHED FORM


PLEASE NOTE: This is a compulsory measure. Failure to update your
information will lead to service termination
Linkedin security team.


VIEW ATTACHED TO UPDATE

You received an invitation to connect. LinkedIn will use your email address to make suggestions to our members in features like People You May Know. Unsubscribe
Learn why we included this.
If you need assistance or have questions, please contact LinkedIn Customer Service.

© 2015, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

LinkedIn dixfxin@miffcrffodf.com

Unread postby firefly » Sat Feb 20, 2016 8:52 pm

Email:

LinkedIn
Justine Brown sent you personal message
http:/ /www. linkedin.com/do?action=viewMessage&q=member&id=27425168
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.


Phishing link in the content of the email: http:/ /brutalsc. com/pilots.php


Return-Path: <dixfxin@miffcrffodf.com>
Received: from u16378879.onlinehome-server.com (u16378879.onlinehome-server.com. [50.21.183.116])
Latest-Euphrates: 2C38F232452DD95C
Message-ID: <676884.31461.110087322@miffcrffodf.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=UTF-8
X-Priority: 2
Substances-Castro: authenticator
Tyler-Naked: e4759d8c36863
MIME-Version: 1.0
Subject: Justine Brown sent you personal message
From: Justine Brown <dixfxin@miffcrffodf.com>

Originating IP: 50.21.183.116
Originating ISP: 1&1 Internet Inc
City: Temple
Country of Origin: United States
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

LinkedIn csobuenosaires@loftusomeara.com

Unread postby firefly » Sat Feb 20, 2016 9:00 pm

Email:

LinkedIn
Rebecca Bailey sent you personal message
http:/ /www. linkedin. com/do?action=viewMessage&q=member&id=5654417
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.

© 2016, LinkedIn Corporation


Phishing link hidden in the content of the email: http:/ /www. myvegidea.it/airmail.php

Header:

Return-Path: <csobuenosaires@loftusomeara.com>
Received: from mail.hightechware.it (mail.hightechware.it. [95.110.169.102])
Received-SPF: fail (google.com: domain of csobuenosaires@loftusomeara.com does not designate 95.110.169.102 as permitted sender) client-ip=95.110.169.102;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of csobuenosaires@loftusomeara.com does not designate 95.110.169.102 as permitted sender) smtp.mailfrom=csobuenosaires@loftusomeara.com
X-Priority: 1
Resoluteness-Scrapings: briefs
Content-Transfer-Encoding: 7bit
Graciousness-Ceded-Fractures: 36eaa14d375
MIME-Version: 1.0
Subject: You have 1 unread personal message from Rebecca Bailey
From: Rebecca Bailey <csobuenosaires@loftusomeara.com>

Originating IP: 95.110.169.102
Originating ISP: Aruba S.p.a. - Cloud Services Farm
City: Arezzo
Country of Origin: Italy
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Next

Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 9 guests