A dozen Crypto attempts today

Posted on June 27, 2016 by The Old Wolf

crypto

All of these arrived in my inbox today; many are duplicated versions of the same message with minor changes.

Dear info,

Cathleen Holcomb asked me to send you the attached Word document, which contains the final version of the report.

Please let me know if you have any trouble with the file, and please let Cathleen know if you have any questions about the contents of the report.

Kind regards

Alisa Harper

Managing Director

Notice that all of these emails begin with “Dear Info,” since the relevant address is “info@devnull.com.” This in itself should be a red flag.

Dear info:

Thank you for your email regarding your order of 21 June, and sorry for the delay in replying. I am writing to confirm receipt of your order, and to inform you that the item you requested will be delivered by 25 June at the latest. If you require more information regarding this order, please do not hesitate to contact me.

Also, our records show that we have not yet received payment for the previous order of 11 June, so I would be grateful if you could send payment as soon as possible. Please find attached the corresponding invoice.

If there is anything else you require, our company would be pleased to help. Looking forward to hearing from you soon.

Yours sincerely

Benjamin Martin

Chief Executive Officer

Information. A report. An invoice with request for payment. A spreadsheet. All looking innocuous and legitimate.

Dear info,

The reference you requested is attached.

Let me know if you have any questions.

Best regards

Erma Frederick

CEO

No matter how official emails like this look, you should verify every detail before proceeding.

Dear info,

Our records show that we have not yet received payment for the previous order #A-393685

Could you please send payment as soon as possible?

Please find attached file for details.

Yours sincerely

Jami Garrett

Mexico Key Account Director

Don’t open those attachments! They are almost certainly javascript files which will download an encryption virus or something equally vicious.

Be careful out there.

The Old Wolf has spoken.

Infect your computer from home!

Posted on June 27, 2016 by The Old Wolf

From: <my email address>

To: <my email address>

Subject: Cooperarion with a large firm

Hello!

We are looking for employees working remotely.

My name is [Audra|Joni|Gus|Emily], I am the personnel manager of a large International company. (I got four of these in my mailbox today).
Most of the work you can do from home, that is, at a distance.
Salary is $2500-$5000.

If you are interested in this offer, please visit Our Site

Best regards!

If you’re careless enough to click that link (disabled above), what you’ll be taken to is this:

http://yaseminalkaya.xyz/wp-content/plugins/easy-tables-vc/xxxxxx/lib/jquery-handsontable/test/jasmine/spec/settings/

whereupon your computer will promptly be infected with an encryption virus or some other evil chicanery.

Do not respond to emails like this, and do not click embedded links!

The Old Wolf has spoken.

Not from Yahoo (scam)

Posted on May 24, 2016 by The Old Wolf

yahoo

“Your Mail version is outdated.” “Upgrade your account now.”

Never follow links like this that ask you to enter your email username and password. Would you hand your credit card to a criminal? Don’t give access to your Yahoo, Gmail, Hotmail, or other accounts to scammers.

If you have loved ones who are not especially tech-savvy, please protect them from this kind of jiggery-pokery.

Be safe out there.

The Old Wolf has spoken.

Malware Payloads

Posted on April 3, 2016 by The Old Wolf

Chapa NO MALWARE

I’ve noticed a lot of malicious emails coming through to one of my addresses lately – interestingly enough not at Gmail, which may even filter these things out before they are even sent to Spam – but to one of my private email addresses. Here are two examples:

Dear info,

Many thanks for your card payment. Please find payment confirmation attached below. Should you have any queries, please do not hesitate to contact Credit Control Team.

Best regards

Dena Carpenter

Director Audit Services

Attachment: 851E2_info_43A8AE.rar

And this one:

Dear info,

Please check the bill in attachment.

In order to avoid fine you have to pay in 48 hours.

Best regards

Antonia Snider

Executive Director Sales Account Management Training Performance Support

Attachment: info_e-bill_669770.zip

Both of these emails came with compressed attachments, one a .zip file and one a .rar file. Inside each was a document with the extension “.js,” meaning it’s a javascript file which would automatically run once the file was clicked on to see the “invoice”or “bill.”

DO NOT DO THIS.

From Microsoft’s Malware Protection Center:

Payload: Downloads malware or unwanted software

This threat can download other malware and unwanted software onto your PC. We have seen it download the following threats:

PWS:Win32/Fareit

Ransom:Win32/Crowti.A

Connects to a remote host

We have seen this threat connect to a remote host, including:

davis1.ru using port 80

Malware can connect to a remote host to do any of the following:

Check for an Internet connection

Download and run files (including updates or other malware)

Report a new infection to its author

Receive configuration or other data

Receive instructions from a malicious hacker

Search for your PC location

Upload information taken from your PC

Validate a digital certificate

We have seen this threat access online content, including:

two.jpg

one.jpg

Another similar threat is 097M/Donoff. This Microsoft Article shows many types of emails that are being sent out to try to get people to run this malware. One of my emails contained Win32/Penzievs, which is so new that Microsoft has no technical details on it yet.

Working at Carbonite™, we have seen many customers who have been infected by the Cryptolocker virus and similar encryption programs. Almost all of these vicious payloads come as email attachments that are opened by the unwary. While having good anti-virus protection and a rcloud-based backup system that protects multiple versions of your files is good insurance, the best procedure is never to open attachments from unknown sources, no matter how legitimate they look. Especially always avoid “.exe,” “.com,” “.zip,” and “.rar” files.

Be careful out there. Protect yourself and your loved ones.

The Old Wolf has spoken.

Never “Verify Your Email.”

Posted on May 25, 2015 by The Old Wolf

No email service will send you a message asking you to provide your address and password, or other financial data. They just won’t.

This email is bogus. Note the red circle next to the “click to validate” link – that’s a warning from WOT (Web of Trust) that indicates the website is not to be trusted.

If you’re foolish enough to click the link, which goes to http://bookinghh.myfreesitehost.com/smluptt/wadohjom.htm (NOT a Yahoo website), you’ll get this:

If you fill out this information, scammers now have access to your email account, and they will use it to steal information or send out criminal spam.

Never do this. Be careful out there.

The Old Wolf has spoken.

Phishing: Watch those URLs

Posted on April 24, 2015 by The Old Wolf

Today in my Yahoo! mail account:

If you click that “Sign In” link, you get taken to

http://www.oficinadentalpr.com/includes/drpbx/db/obfuscated.php

which is apparently a dental office in Brazil. (I tried contacting them to let them know that their website had been compromised, but their contact page seems to be malfunctioning.)

Edit: As of today, the entire “Oficina Dental” account has been suspended. Either they got infected and their ISP suspended them on general principles, or the whole page was a sleazy front for this scam operation. We’ll never know.

At any rate, this is what you get:

Which leads you to the regular “Enter your critical personal information and credit card and bank data” page.

The ongoing lesson: Don’t click embedded links in emails. Just don’t.

The Old Wolf has spoken.

THE MOST IDIOTIC SCAM OKAY

Posted on October 19, 2014 by The Old Wolf

I’ve gotten hundreds of emails from Nigerian (or other nationality) scammer, but this one just made my head spin with its stupidity.

From: “BARR. JOHN KURTY” <office_moneygram@yahoo.com>

Subject: U.S. DEPARTMENT OF HOMELAND SECURITY

U.S. DEPARTMENT OF HOMELAND SECURITY, MG Richard Peter; Adjutant General and Director State Military Department Washington Military Dept., Bldg1 Camp Murry ,Wash 98430-5000 USA GOOD DAY TO YOU.

MY NAME IS MR. JOHNSON WILLIAM, WHAT IS HOLDING YOU TO SEND THE MONEY RIGHT NOW PLEASE GO AHEAD AND SEND THE MONEY SO THAT YOU WILL RECEIVE YOUR BOX WITHIN 24HOURS YOU HAVE IT ONCE YOU SEND MONEY THAT IS THE ONLY DELAY WE HAVE RIGHT NOW TO DELIVER YOUR CONGNMENT BOX TO YOU SO TRY YOUR POSSIBLE BEST TO SEND THE MONEY TODAY BECAUSE YOU HAVE ONLY (3 DAYS)IF YOU DID NOT MAKE THE PAYMENT THEN I WILL DIVERT YOUR FUNDS TO US GOVERNMENT FUND OR BENIN GOVERNMENT TREASURY.

I WILL WAITING TO HEAR FROM YOU WITH THE PAYMENT INFORMATION AS SOON AS POSSIBLE OKAY. MAY GOD BLESS YOU.

WHEN I ARRIVE IN THE BENIN PARLIAMENT IN COTONOU, I FOUND YOUR CONSIGNMENT BOX CLEARANCE FILE LYING ON THE FOREIGN AFFAIR OFFICE DESK WITHOUT ANY ATTENTION ON A THOROUGH SCRUTINY I DISCOVERED THAT YOUR CONSIGNMENT HAVE BEEN ABANDONED BY YOUR DELIVERY AGENT. MEANWHILE, I WAS MADE TO UNDERSTAND THAT THEY HAVE TRY TO REACH YOU, BUT NO WAY AND THEY HAVE MADE SEVERAL ATTEMPTS TO CONTACT YOUR DELIVERY AGENT BUT TO NO AVAIL. TO MY GREATEST SURPRISE, DURING MY RECENT ROUTINE RE-CHECKING, I PERSONALLY DISCOVERED THAT YOUR CONSIGNMENT CONTENT DECLARATION DOCUMENTS STATED THAT YOUR CONSIGNMENT CONTAINS PERSONAL EFFECTS MEANWHILE, IT CONTAINS UNITED STATES DOLLAR BILLS WORTH OVER US$40 MILLION DOLLARS, WHICH MADE IT IMPOSSIBLE FOR THE CONSIGNMENT TO BE DELIVERED TO YOU EARLIER BEFORE NOW.

BASED ON THIS PERSONAL DISCOVERY, I AM CONTACTING YOU NOW TO LET YOU KNOW THAT WITH MY POSITION AND POWER AS THE SECRETARY OF U.S DEPARTMENT OF HOMELAND SECURITY, I CAN ASSIST YOU TO LEGALLY CLEAR YOUR CONSIGNMENT FUND, BUT YOU MUST AGREE WITH THE FOLLOWING CONDITIONS. BECAUSE I HAVE CALLED OUR OFFICE IN WASHINGTON,DC FROM BENIN, WHO HAS BEEN INTERCEPTING ALL YOUR TELEPHONE CALLS, WITH THE HELP OF MTN, TIGO VODAFONE AND AIRTEL NETWORK BENIN.

I ALSO RECEIVED SOME INFORMATION FROM OUR HOMELAND SECURITY OFFICE IN BENIN REPUBLIC, ABOUT YOUR EMAILS, THAT YOU HAVE BEEN DEALING AND SENDING MONEY TO PEOPLES IN BENIN GHANA SOUTH AFRICA TOGO BENIN AND NIGERIA , WHO CLAIMS TO BE THE MONEY GRAM DIRECTOR. YOU ARE ALSO DEALING WITH A BANK, AND OTHER NAMES WHICH I AM STILL WAITING TO BE FORWARDED TO ME FROM OUR OFFICE IN WASHINGTON,DC. WHO HAVE MONITORED ALL YOUR DEALINGS WITH THIS HOODLUM. YOU ARE ADVICE TO HENCE FORT STOP FURTHER DEALINGS WITH ALL THE ABOVE MENTIONED PEOPLE, UNTIL WE COMPLETE OUR INVESTIGATION. BECAUSE YOUR DEALING WITH THEM IS TERMED AS ILLEGAL TRANSACTION.

I WISH TO INFORM THAT WE THE HOMELAND SECURITY IS ON LOOK OUT FOR ALL THE ABOVE MENTIONED NAME, MOSTLY THOSE WHO CLAIMS TO BE THE DIRECTOR OF WEST AFRICAN DEBT MONEY GRAM AND MONEY GRAM AND PROPERTY RECOVERY BENIN. ALL THIS MENTIONED PEOPLE ARE IMPOSTOR, AND WE INTEND TO APPREHEND THEM SOON. I WANT YOU TO PLEASE STOP COMMUNICATING, AND DEALING WITH THEM UNTIL WE COMPLETE OUR INVESTIGATION. I WISH TO NOTIFY YOU ABOUT THE LATEST DEVELOPMENT CONCERNING YOUR BOX OF CONSIGNMENT THAT WAS HANDLE OVER TO ME AFTER THE MEETING HELD BETWEEN ME AND SOME OF THE TOP PARLIAMENT MEMBERS OF BENIN AND THE FOREIGN AFFAIR MINSTER IN THE BENIN CAPITAL HEADQUARTERS COTONOU, DUE TO THE DELAY FOR YOU NOT HAVE RECEIVED YOUR CONSIGNMENT BOX FOR LONG TIME NOW.

ACCORDINGLY, WE HAVE WAIVED AWAY ALL YOUR CONSIGNMENT BOX CLEARANCE FEES AND AUTHORIZED THE GOVERNMENT OF BENIN REPUBLIC TO ALLOW ME FLY WITH THIS YOUR APPROVED CONSIGNMENT BOX TO YOU WITHOUT ANY DELAY WHICH THEY HAVE AGREED. THE ONLY FEE YOU WILL PAY TO CONFIRM YOUR CONSIGNMENT BOX RECEIVED IN YOUR POSSESSION IS THE WEIGHT FEE OF YOUR CONSIGNMENT BOX WHICH IS SUM OF $75.00 ONLY.

IN ORDER WORDS YOUR BOX IS WITH ME NOW AND I SHALL BE COMING TO YOUR COUNTRY AS SOON AS I HEAR FROM YOU AND I WILL BE COMING ALONG WITH YOUR BOX OF CONSIGNMENT,BUT REMEMBER THAT AS THE SECRETARY OF THE DEPARTMENT OF HOMELAND SECURITY UNITED STATES OF AMERICA, I AM A US GOVERNMENT SECURITY AGENT AND I HAVE THE POWER TO GO THROUGH ANY AIRPORT CUSTOMS WITHOUT INSPECTING WHAT I CARRY ALONG. AND AS SOON AS I ARRIVE IN YOUR STATE I WILL GIVE YOU A PHONE CALL FOR YOU TO GIVE ME DIRECTION TO YOUR HOME ADDRESS SO THAT WE CAN MEET FACE TO FACE AND HAND OVER YOUR BOX TO YOU BEFORE PROCEEDING BACK TO THE STATES. SO I WANT YOU TO RE-CONFIRM TO ME THE BELOW INFORMATION FOR PROPER UNDERSTANDING BY FILLING THE ATTACH HOMELAND SECURITY REGISTRATION FORM OKAY.

BENEFICIARY NAME. . . . .
ADDRESS. . . .
TEL PHONE. . . . . . . . .
OCCUPATION. . . . .
COUNTRY. . . . . . . . . . .
SEX. . . . . .. . . . . . . .

AS SOON AS I ARRIVE I SHALL CALL YOU ON YOUR TELEPHONE NUMBER THEN MEET YOU IN PERSON AND HAND OVER YOUR CONSIGNMENT BOX TO YOU BEFORE I RETURN BACK TO WASHINGTON DC.
I HAVE TAKEN THIS ASSIGNMENT UPON MYSELF BECAUSE I UNDERSTAND THAT YOU HAVE REALLY PAID SO MUCH ON THE COST OF DELIVERY, BUT NOTHING WAS RECEIVED BY YOU. SO BE ADVICE TO CONTACT ME IMMEDIATELY YOU GET THIS EMAIL NOW BECAUSE EVERY THING HAS BEEN DONE OK. THIS IS DIRECTLY FROM OUR PRESIDENT BARACK OBAMA. ONCE YOU SEND THE MONEY, TRY TO NOTIFY ME WITH THE MTCN FOR EASY PICK UP AND FOR IMMEDIATE ACTION ON THE DELIVERY OF YOUR CONSIGNMENT BOX,FOR YOU TO RECEIVE YOUR INHERITED FUNDS WITHOUT ANY FURTHER DELAY AGAIN . SINCE YOU WAS UNABLE TO RECEIVE IT SINCE .
SEND THE FEE VIA MONEY money gram TRANSFER.

RECEIVERâ€™ PETER ONUORAH
COUNTRY:. . . . . . . . . .BENIN
CITY:. . . . . . . . . . . . COTONOU
AMOUNT:. . . . . . . . . . . . . . . .$75.00
QUESTION:. . . . . . . . URGENT
ANSWER:. . . . . . .TODAY
MTCN:. . . . . . . . . .
Sender’s NAME . . . .
SENDER’S ADDRESS. . .

AS SOON AS YOU SEND THE FEE MAKE SURE YOU SEND ME THE PAYMENT INFORMATION.ONCE YOU SEND THE MONEY, TRY TO NOTIFY ME WITH THE MTCN FOR CONFIRMATION AND FOR IMMEDIATE ACTION ON THE HANDLING OVER OF YOUR FUND TO YOU.ALSO YOU ARE TO FORWARD TO US ANY MAIL THAT YOU HAVE BEEN RECEIVING FROM PEOPLE FOR PROPER VERIFICATION AND INVESTIGATION BEFORE YOU DEAL WITH THEM OKAY.

I HAVE A VERY LIMITED TIME TO STAY HERE SO I WOULD LIKE YOU TO URGENTLY RESPOND TO THIS MESSAGE WITH THE PAYMENT , MY DEAR, THIS IS THE OPPORTUNITY FOR YOU AND HAVE TO COMPLY AND YOUR BOX SHALL BE DELIVER TO YOUR DESIGNATED ADDRESS.BUT REMEMBER THAT AFTER (3 DAYS) YOU DID NOT MAKE THE PAYMENT THEN I WILL DIVERT YOUR FUNDS TO US GOVERNMENT FUND OR BENIN GOVERNMENT TREASURY. PLEASE TREAT THIS AS MATTER OF URGENCY.
SINCERELY YOURS,

BARR. JOHN KURTY
SECRETARY OF THE DEPARTMENT OF HOMELAND SECURIT

This is wrong on all possible levels:

Horrible grammar and spelling
American government officials don’t use the title “Barrister”
It’s written in all caps
The scammer invokes the name of God to try to make himself look virtuous.
Is his name John Kurty, Johnson William, or Richard Peter, or Peter Onuorah? The ignorant jimakplon can’t even keep his scam facts straight. Add to that the use of non-existent names which use common English surnames as given names or vice versa.
This guy is an idiot OKAY

I have a hard time not using language to describe these people that would not exceed the family-friendly nature of this blog. They are the hqiz of hqiz-eaters.

In case you got a similar email and were wondering, this is a scam.

This does not exist.

Never send money to a stranger via Western Union, MoneyGram, or MoneyPak, or any other untraceable and unrecoverable means.

Stay safe out there.

The Old Wolf has spoken.

The FBI is writing to me

Posted on September 29, 2014 by The Old Wolf

… from Benin.

Riiiiiight…

To: undisclosed-recipients:

Attn: Beneficiary,

All the people that have their names in the list would be inset in our website any moment from now because we are charged to wipe away all the fraudulent transactions being held on the internet in which many people have lost their lives and properties. So it will be better for you to update us on the actual date in which you would be able to make the payment of $85 Usd to the agency over there in Benin for them to issue the FRAUD CLEARANCE CERTIFICATE to you because that is the only guarantee that would make us believe that your name and ID was really forged and not real as claimed because the German Business Man has contacted all the Crimes Agency on this matter and it was your ID that he has placed in all the Crimes Department for a search of you.

This Certificate will be attached along with the previous Clean Bill Certificate so that the attorney who is handling this process could get everything mandated as you have only 48hours to co-operate with this directives and this last Certificate as stated by the issuance department would cost you the sum of $85 Usd and this fees should be paid within a short while from now on.

The payment should be sent through either Western Union Money Transfer or Money Gram Transfer with the below details:

Receivers Name: Simeon Ekwe
Location: Cotonou Benin Republic
Text Question: WHAT FOR
Text Answer: GOOD
Amount: $85 Usd.

The payment details should be sent once the payment has been sent and don’t forget to include the Senders Name and Address and the MTCN NUMBER.

This is our advise to you and we do hope to get a positive feed back from you as soon as possible.

BEST REGARD

JAMES B. COMEY
DIRECTOR FEDERAL BUREAU OF INVESTIGATION (FBI)

Never fall for these scams. Never send money via Western Union to a stranger, especially in a foreign country, especially in Africa. Just don’t do it.

Be careful out there

The Old Wolf has spoken.

No, this is NOT the Ambassador to the Benin Republic

Posted on September 26, 2014 by The Old Wolf

It should go without saying. It’s so blatantly obvious. But sadly, people still do fall for this. I post these in the hope that even a single soul, somewhere, who has received this same message will do a search online and find this post.

These ignorant criminals, sitting in rat-infested internet cafes in various places in Africa, don’t give up because people continue to fall for their lies. These people have no morals. Please protect yourselves and your loved ones from the activities of these scum-sucking bottom-feeders.

NEVER RESPOND TO SCAM EMAILS LIKE THIS ONE.

Subject: DEAR SCAM VICTIM PLEASE REPLY IMMEDIATELY

From: James Knight <jamesknightambassador7@gmail.com

To: undisclosed-recipients:;

ATTENTION DEAR

US Ambassador to Benin Republic

Without mincing words, I am convinced 100% that you have had bitter experience with various ‘scammers’ claiming to be high government officials and thereby defrauding you of your ‘hard-earned money’. The activities of these scammers has changed your perspective about conducting business on the internet, and you now believed there is no genuine business that can be conducted on the internet anymore. Well, I am an American and the internet was created by Americans for the purpose of creating awareness for your products/services and conducting genuine business with easy. I am fully committed to deliver the “diplomatic consignment” to you in the United States in order to differentiate myself from the many Benin Republic you have dealt with. I am a full citizen of the United States , but I was on a Foreign Mission here in Benin as an US Ambassador. Hence, I am making every efforts to ensure that no citizen of the United States is cheated by Benin Republic .

Therefore, I need your utmost support and understanding to actualize this dream. I also want you to understand that I do trust you and I expect you to show me the same trust and respect in return since trust is a 2-ways street, On the other hand, trust is a relationship of reliance, Trust also means being able to predict what other people will do and what situations will occur.

Trust is both an emotional and logical act. Emotionally, it is where you expose your vulnerabilities to people, but believing they will not take advantage of your openness. Logically, it is where you have assessed the probabilities of gain and loss, calculating expected utility based on hard performance data, and concluded that the person in question will behave in a predictable manner. In practice, trust is a bit of both. I trust you because I have experienced your trustworthiness by merely believing in what I have said, even when you have not seen me, and because I have faith in human nature.

Frankly speaking, I understand that anyone in your shoes will feel betrayed, but I still want you to show me your trust by giving me the benefit of doubt on this delivery arrangement. My identity and personality is verifiable, and I promise to deliver the consignment to you in the United States without any hitch. Please do not allow this mission to die off because of US$145.00 TO REGISTER YOUR PACKAGE AS AN AMBASSADORIAL PACKAGE, I meant so well for you and I believe you will appreciate me more when you have finally received your partial payment of US$2,5Million upon my arrival with the package in United States . I will use my position and personality to deposit the US$2,5Million into your bank account in the United States without questioning from the financial monitoring authorities, since all documentations proving the legitimacy of the funds has been processed.

Please don’t see me as one of the numerous dubious Benin Republic you have dealt with in the past. I am a different person entirely and I came from a different continent. I have the American spirit in me and I hate cheaters. I promise to always uphold the national unity of the United States . Please reply back ASAP and let me know your possibility of sending the US$145.00 today.

You can send it via western union Or Money Gram with below name.

Reciever’s name………Simeon Ekwe
Country……….Benin Republic,
City………..Cotonou,
Text Question…….God?
Answer……….Bless,
Amount ……..US$145.00 Only
MTCN…….
Sender’s name…..

Note that you are expected to send the fee right immediately to enable me register your package as an AMBASSADORIAL PACKAGE because once i package that it will give me ability to pass through every Custom offices without interception of the package.

Respectfully yours,

Mr.James Knight
US Ambassador to Benin Republic
+229-982-767-81.

“Ambassador to Benin Republic”. Right. You can spot the bad English of these filthy criminals a mile away if you are in the least familiar with their scams.

Be careful out there and protect yourselves and your loved ones.

The Old Wolf has spoken.

Playing in the World Game

As One

Tag Archives: email

A dozen Crypto attempts today

Infect your computer from home!

Not from Yahoo (scam)

Malware Payloads

Never “Verify Your Email.”

Phishing: Watch those URLs

THE MOST IDIOTIC SCAM OKAY

The FBI is writing to me

No, this is NOT the Ambassador to the Benin Republic