Scam Email: Dillon Adams

Here's another one, though a time ago we already had reported this one as Dale Adams.

From: Dillon Adams [dillonadams.group@yahoo.com] IP: 41.138.182.120

Hello,
We own a store here in Australia and willing to purchase from you but before we proceed we want to be sure your email is correct and also to confirm if you can follow our order up via email since we will want the transaction to be done via email. We know of a freight forwarder that will pick of the order at your end since they are less expensive compare to UPS,FEDEX,USPS AND DHL. Beside they are perfect in delivery to the remote area we are in AU. Payment mode will be credit card, USA BILLED Mastercard (NO PAYPAL). Confirm this email before we proceed to send the quote of order.

Kind regards,
Dillon Adams & Group. 

A Scam of the Scam

Can you image how embarrassed and ashamed a victim would feel falling for this one? A scam that is basically targeting people saying they are compensating people who have fallen victim to the Nigerian scam, explaining the scam and all? A scam about a scam. Very despicable behavior.

From: OFFICE OF THE NIGERIAN PRESIDENCY [office@nig.com]
Subject: YOUR SCAMMED VICTIMS COMPENSATION HAS BEEN APPROVED

Hello, Sir/Madam
REF/PAYMENTS CODE: FGN/PHBPLC/06654/011 ($965,000 USD)
    
This is to bring to your notice that we are delegated from the UNITED NATIONS INTERNATIONAL FRAUD MONITORING UNIT, I wish to notify you that the office of the Nigerian presidency has been authorized to pay out to 50 innocent victims of the widely know internet scam called Advanced Fee Fraud aka (419) the sum of US$965,000(Nine Hundred and sixty Five Thousand Dollars Only each).You have been listed and approved for this payment as one of the scammed victims.
    
On these faithful recommendations, we want you to know that during the last U.N. meeting held at Abuja, Nigeria, as it has come to an alarming proportion based on reports from different victims, some of these victims have almost lost their lives, families, properties, and friends. The most alarming aspect of the issue was on the amount money lost by these various innocent individuals to scams artists operating in syndicates all over the world today, and in other to compensate victims, the UNITED NATIONS Body in conjunction with the newly elected government in Nigerian has agreed to pay 50 victims $965,000 dollars each.
    
    
SCAMMED VICTIM/REF/PAYMENTS
CODE: FGN/PHBPLC/06654/011
1) Your full name and residential address
2) Your direct phone number
3) Your file reference number
4) Your nominated account details where your funds will be transferred into
    
    
Best Regards,
Office Nig
    

Scam Email: Ray Collins

We've seen the content of this spam over and over again, but this one is under a different name so I am posting an alert.

I just received this one-looks very suspicious. The e-mail doesn't  match the name. ralph.gregg2010@inbox.com

Thanks for taking the time to compile the list.

The scam email I received:

Hello,

Good day to you over there, My name is Ray Collins and i hope this  message finds you well.I was going through your works and my eyes  caught your very first work in your portfolio on [url inserted here]. I am interested in purchasing this  work for my new resident. Kindly get back to me with the detailed  price, availability and more information of the piece.

I hope to read back from you as soon as possible.
Kind regards,
Ray.

Scam Email: Frank Mayfield II

I hate when I get emails like the one below. My stomach just sinks. And I know I have to keep working at posting these. All the scammers need are a few success cases to make all their efforts worthwhile and I just need to keep posting all their efforts to make it harder for them to catch artists unaware.

Because the artist below had actual financial loss, he did one thing right - immediately contact the bank. And now he can also use the links I have in the upper right column for reporting the online crime to the FBI and the Internet Crime Report Center. The artwork doesn't come back, by the way. Not sure what scammers do with the art but it doesn't come back. And given the scammer using the Frank Mayfield name had a success this week, we can all be sure we'll be seeing more of this one this week.

I have an earlier blog post on Frank Mayfield, with the contents of the actual scam email. Use the search bar at the top of my blog for Frank Mayfield and you'll find the earlier alert as well. I felt like this report deserved its own post to being up to the top of the list.

Dear Kathleen. I am sending you this email as I have unfortunately fallen for a scam that I later found posted by you. Feeling terrifically naive and stupid, but If there is anything I can do to help you get this guy. I would like to help as much as I can. I really don't know if there's anything I can do, It is the Frank mayfield scam. I contacted police and there is nothing they can do and had no suggestion beyond going to the bank where I cashed the money and alerting them. Which I promptly did. I now am just waiting to hear back from the bank as to whether the travellers checks I cashed were stolen or counterfeit. Is there anywhere I can report this to, or  should report this to.? Actually sent portrait, I imagine it will come back to me. Are you aware of anyone else who fell for this particular scam that I could perhaps contact? My god I feel dumb !

Don't feel dumb. Really ALL scams and cons are set up to make the victims feel ashamed and dumb. Think of all the celebrities and really smart people who fell for the Bernie Madoff scam and then felt ashamed and dumb. It's how these work. It's not about you. With the proper information, you would have known better and acted differently. I'll just keep posting these, and adding them to my facebook page for spreading the word about scams and hopefully these will keep showing up in the Google results and then I have to just get more and more artists to know to google the name first if something doesn't seem right.

So so sorry this happened to you. Report it to links above and stay on your bank and hopefully our report of your experience will help others avoid the same fate. Thanks for sharing your unfortunate experience.

Scam Email: Airlines Travel Reservations

While not specifically art-related, artists are often on the move and making reservations and this scam email looked SO real, I thought it was worth sharing for educational purposes.

This type of email is called "phishing" because the intent is to try and get you to click on the link in the email, log in with your personal information on some site, and then they get your log in to use themselves and do all kinds of damage, in this case probably book flights online for themselves with your valid credit card information.

This phishing emails are tough! They look so real. The most common ones look like they are coming from a bank and that your account has been temporarily frozen and you need to log in to confirm your identity. Yikes! In the below scam email, Qatar Airways *is* actually at the url of qatarairways.com. And the booking and cancelling urls look logical. But they are not. If you open a brand new browser window and manually type in qatarairways.com and look at what their real booking url is, its different. No https at the beginning and no booking.qatarairways.com urls. But the fake urls look real and look logical so they will catch some people unaware. And notice the "From" email. If you are not paying attention, it won't stick out but it is not from qatarairways.com.

Of course, phishing emails rely on trying to trick only a population of people who are either currently or have recently used that service. If you've never dealt with Qatar Airways, you will be suspicious - but hopefully not unaware enough to click on the link in the email to check it out - the scammers are counting on that as well.

How do you avoid these phishing emails? When it comes to logging into a site and or "confirming" or "cancelling" personal information - never never never never (one  more time!) never do this by clicking on a link in an email. Period. And DO NOT manually type the SAME url from the email into a new browser. You'll land on the same falsified website that probably looks just like the real one. Google the company or site and go to the site manually from a google search (or whatever search engine you use). Or look up their phone number and do really important things via the phone.

From: "Qatar Airways"
Date: August 29, 2010 6:51:43 AM PDT
Subject: Booking confirmation email

Thanks for the purchase!

Your booking is confirmed.
Booking number: K4QCTI

Your credit card has been charged for $438.60 (USD)

Please print the itinerary/receipt for your reference.
Sign in to qatarairways.com and print it by clicking the link below

https://booking.qatarairways.com/global/en/GetPNRsListServle/

To cancel your booking online, please click the link below:

https://booking.qatarairways.com/global/en/CancelBookTripPlanServlet/
 
On board you will be offered:
– Beverages;
– Food;
– Daily press.

Thank you for choosing Qatar Airways and we look forward to welcoming you
on board.

Best regards,
Qatar Airways

Scam Email: Paul Moore

We've seen this scam email before - under the name of Paul Peter. Exactly same content but change of name and change of gmail account to receive replies. Here is what another artist wrote me this morning:

This is the second of this type letter I have receive which is clearly a scam. The other was from someone with the last name Rice , which is listed as the name of  an art scammer. Note that this letter doesn`t name the piece except in the “subject”. I didn`t respond. Thanks for your efforts to halt this crime. Should this be reported ? If so, where?

Scam Email Sent:

From: Paul Moore [mailto:ppmmore@gmail.com]
Sent: Sunday, August 29, 2010 5:46 PM
Subject: Ruffles, Acrylic

Hello,

Good day to you over there, My name is Paul Moore I'm from Seattle  and i hope this message finds you well.I was going through your works and my eyes caught...., i will like to have it for my new apartment this month. please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

iTunes Hack - It's Not What You Think

People are seeing thousands of dollars being taken from their PayPal account apparently via the iTunes Store. At first, it was thought to be an iTunes hack. But it is probably not. The more likely culprit is that your paypal account got "phished" via a scam email - you know, the kind that look like they are from PayPal but they actually are not? And then you click on the link in the email to "log in" or "reactivate" your account - but you are at a fake site that looks like PayPal and yet it is not. And now the "phisher" has your paypal account info and can proceed to buy things with that account.

One customer said his account was charged over $4700 in the iTunes store and when he called PayPal he was told a large number of iTunes accounts were compromised. People who were scammed say that the receipt claims it was for the purchase (at $99.99 a time - a clever move by the scammers, aiming to get it underneath the credit card "suspicion" level and also below the automatic level where the merchant has to bear the cost of reversing the payment) of "CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc)". There is no product called "Dragon Crystals" and they don't come in 10,000 packs.

It is now emerging that it was their paypal accounts that were compromised (and I guess the hackers just really like iTunes). Not iTunes.

This can not be said enough (and so we say it again): be absolutely sure before you enter critical data such as your username and password onto any site. And when logging into a site, never go to the site from an email login link - put the real site url in your browser 'location' field and go there independently of any links in an email and then log in.

Scam Email: Smith Paul

I just love when I get these myself in my own email box. Then I can look at the full headers and see all kinds of things. Let's begin with the actual lame scam email:

From: Smith Paul [smithpaul479@gmail.com]
Subject: Mail Order

Hello Sales, Top of the day to you. I am Smith Paul, I would like to place an order from your store but before i proceed, i would like to know if you can ship to AUSTRALIA and accept credit card as a method of payment, If you do kindly get back to me with your valid website address for selection of items needed. I await to read from you today. Regards Smith Paul

Now look at the full headers and see what you can see:

Return-path: [alfuraih@l1.fancytech.com]
Delivery-date: Mon, 23 Aug 2010 15:53:26 -0500
Received: from l1.fancytech.com ([74.200.215.226]:59448)
(envelope-from [alfuraih@l1.fancytech.com])    id 1One1G-0004cI-KY
Subject: Mail Order
From: Smith Paul [smithpaul479@gmail.com]
Message-Id: [E1OndlA-0007mM-P6@l1.fancytech.com]
Date: Mon, 23 Aug 2010 15:36:48 -0500
X-AntiAbuse: Primary Hostname - l1.fancytech.com
X-AntiAbuse: Sender Address Domain - l1.fancytech.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/alfuraih/public_html/aa.php

X-Source-Dir: alfuraih.com:/public_html

You'll notice that this scammer is using php software to send these emails and it even has the folder address on his server computer where the software lives that is generating these scam emails. You'll notice the actual server origin is registered to fancytech.com, which no surprise is a foreign entity. You'll notice the actual IP of the originating server that sent the email: 74.200.215.226.

He probably doesn't even get that he probably got his faked name backwards...

Scam Email: Patricia Fenton

We've been receiving a number of reports now that perhaps the scammer previously sending email as Barbara Santos is now sending the same scam email as Patricia Fenton. Here's a consistent clue with this spammer - they always seem to be using the email service called mybestmail.com.

Hi Kathleen,
Thanks again for having your Stop Art Scams Blog. Here is the address that was used on my emails from "Patricia Fenton":pat.fenton1@mybestmail.com [209.59.166.66] Thanks again-- and let me know if there is anything else that I can do to help fight these scammers!
Rebecca

Scammers Make DDoS Threats to Website Owners

An artist friend got an email along these lines so I wanted to post this alert to others.

A group of scammers is trying to trick website owners into sending them money by threatening to launch crippling Distributed Denial of Service (DDoS) attacks.

According to security researchers from Symantec who intercepted the fake messages, the scammers are sending them to email addresses they gather from domain whois information.

The rogue emails come with subjects of "Hosting – Important Updates and Information" to make it look as if they appear from the recipient's domain registrar and contain intentional spelling mistakes to avoid spam filters.

"We hold a huge network of Distributed Denial Of Service Attack, allowing to suspend any website. We have been watching [domain_name] and were able to find out that you have spent pretty money much for its advancement and we want to to offer you to spend a little more yet.

"Just as little as 200 bucks as a voluntary donation to our fund will keep your web site away from DDOS attack," part of the message signed by the "Top Manager of ZeleniyHach project," reads.

The scammers claim that if the money are not sent to them in the form of a Webmoney Payment Check within 48 hours, another zero is added to the sum, making it $2,000.

"Attempts of gathering personal information or money by using tactics similar to those mentioned here are very common in scam attacks. Symantec recommends that users ignore emails from unknown senders […]," Symantec's Samir Patil, writes.

Even though Symantec assures users that this is just a scam, DDoS-based extortion does exist and has been used by cybercriminals before.

However, buying DDoS services from a botnet runner to attack the competition's services is a much more common occurrence.

According to a Kaspersky Lab report on the underground economy released last year, botnet owners charge between fifty to several thousands dollars for launching DDoS attacks, depending on length and target.

Scam Email: Martin Robert

Here is a scammer that can't decide on what fake name to settle on, got lazy and rather than have it look like it was going to one person (who he supposedly saw your web site and liked some "products"), just sent it to a group distribution list, and clearly could not get his command of the English language together. Like not even close (how's that for grammar...)

From: roberts martins [martins_roberts@yahoo.com]
Subject: info
To: martins_roberts@yahoo.com

Hello,

My name is Martin Robert, Am American, but lives and work here in Cyprus .I run

a company  here in Cyprus.

I recently viewed your web page and i was caught up in ordering some of your

products,we are located in Cyprus,i will like to know if you have the items in

stocks.

DO YOU ACCEPT US ISSUE CREDIT CARD?
HAVE YOU SHIPPED INTERNATIONAL IN THE PAST?
DO YOU HAVE A PERSONAL SHIPPING AGENT?


  So kindly get back to me with the right contact person email,phone  number

and confirmation of your website so that i can place my order quickly,i want you

to know that i have my own personal shipping agent that will come for the pick

up at your store,please advise so that i
can proceed by going ahead to place the order.


I am waiting anxiously to hear back from you.

Best regard.

From the desk of Purchasing Manager,

Fax:206-984-4614
Email : martins_roberts@yahoo.com

Martin Robert

Scam Email: Lynda Diamond

We've seen this particular email content a *lot* lately, with just the name and email changed up. But the content remains basically unchanged. Also, we've reported in the past on a Linda Diamond [lindadiamond1@live.com] so this particular scammer does seem fond of just creating new accounts on live.com.

From: "lyndiamond@live.com" [lyndiamond@live.com]
Subject: Placing an Order!!!

Hello Sir/Madam, I am lynda diamond, an American but I live and work here in Australia. I will like to place an order for some items from you, but I will like to know what you have available in stock . Let me have your website address so I can view the products you have presently in stock and if there is any special pricing I need to know about. Lastly regarding payment I will be sending you my credit card for the full payment charges for my order . In order to avoid any form of delays can you let me know the type of credit cards you accept? I hope to hear from you as soon as possible so we can proceed with the Order Regards Lynda

Scam Email: Paul Sanders

Okay "Paul", you are going to have to put a little more effort into your illegal activities than this!

From:    Paul Sanders (sanderspaul@yahoo.com)
Subject: Please respond for more details.‏

Hello,

I am Paul Sanders, I am ill and would die having been diagnosed with
cancer disease.
I want to distribute my funds to charities in your country through you.
 
Please respond for more details.

Respectfully,

Paul Sanders

Scam Email: Paul

Here is a scammer reported today that doesn't even reference a last name. Perhaps as more reports come in, we'll be enlightened as to what fake last name this scammer is using, but for now, it's just "Paul".

From: Paul [paulpp77@yahoo.com]
Subject: Order Inquiry

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Norway,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager
Paul

Scam Email: Alice Drew - Still Sending Email

We anticipated that the "Alice Drew" scammer would not go away, given we know this particular scammer successfully got money out of some artists last week.

It seems the key to my making their lives miserable is to post their names and emails as widely as I can and then just educate as many artists as I can to google the name BEFORE they send any money or artwork. And these alerts will be showing up in google results. That seems to be the key that is beginning to work.

The twist I didn't like about the below email was it would appear Alice Drew is going through Facebook pages and emailing artists. Ack!

Here is an email I received this morning from an artist:

Thanks to your site and list of scammers I caught this one before it went too far!

It seemed too good to be true and very strange. Sure is!

Thanks for the site, saved me!!

See here:

First Email:

On Sat, Aug 7, 2010 at 12:13 AM, Alice Drew [alicedrew1@live.com] wrote:
Hello,
I am Alice drew, an American but I live and work here in Australia. I want to place an order in your store,and i will like to know if you ship to Australia,my method of payment will be credit card. So please let me know if i can proceed with the order,And please do not forget to get back to me with the website address where most of your product can be seen. So I will be able to make my choice of items and get back to you with list of items needed.I will await your prompt response as soon as you receive this mail

Thanks with regards
Alice

Second Email:

Hello,
Thanks for getting back to me on time, Please find below for the list of items needed and get back to me with the quote asap.

Edward Ruscha
Sweets, Meats, Sheets
1975
6 color screenprint with varnish overprint
32 3/4 x 25 7/8 inches
83 × 66 cm
Edition 3/55
QTY:1

The Lost Night, Graphite on paper, 43 x 78 Inches
QTY:1

Please get back to me with the total cost estimate for this order so that i can make my payment via my visa or master credit card.
Like i stated in my previuos message i am an American but I live and work here in Australia and I want these products here.
Do not worry about the shipping, I will make arrangement for the pick up of these items from your place thru my shipping agency.
PLEASE LET ME KNOW THE GRAND TOTAL WEIGHT OF THESE ITEMS FOR SHIPPING REASON.
Alice