Bitcoin Forum

Economy => Scam Accusations => Topic started by: vesperwillow on January 15, 2014, 04:58:09 AM



Title: [SCAM] Google Services & Blockchain Info Wallet Checker
Post by: vesperwillow on January 15, 2014, 04:58:09 AM
If you get this email DO NOT CLICK ANY LINKS - report it as Phishing / Scam / Spam to your provider

Just got this email through an email account I use for mining, which means it came from one of the pools I'm on. My email is set to hidden on all pools. Not sure if it's a scam, but it SURE looks like one. On examining the hidden link data, it redirects to a google drive to load some file. I didn't click on it. I'll include the header data below, and a pic of the email. I won't include the email as I wouldn't want anyone clicking the link.

Looks like someone exploited a relay somewhere.

Anyone else see this? What makes me curious is the email account is for mining pools. If it's hidden, someone had server-side access..

http://s21.postimg.org/svi7z4zhz/bitscam.jpg

Quote
Received: by 10.216.177.133 with SMTP id d5csp247824wem;
        Tue, 14 Jan 2014 20:45:32 -0800 (PST)
X-Received: by 10.194.176.163 with SMTP id cj3mr121390wjc.8.1389761132178;
        Tue, 14 Jan 2014 20:45:32 -0800 (PST)
Return-Path: <apache@tifon.es>
Received: from tifon.es (tifon.es. [82.223.247.223])
        by mx.google.com with ESMTPS id e4si2480832wik.48.2014.01.14.20.45.31
        for <hidden>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Tue, 14 Jan 2014 20:45:32 -0800 (PST)
Received-SPF: fail (google.com: domain of apache@tifon.es does not designate 82.223.247.223 as permitted sender) client-ip=82.223.247.223;
Authentication-Results: mx.google.com;
       spf=hardfail (google.com: domain of apache@tifon.es does not designate 82.223.247.223 as permitted sender) smtp.mail=apache@tifon.es
Received: by tifon.es (Postfix, from userid 48)
   id 2472E6503B1; Wed, 15 Jan 2014 05:45:31 +0100 (CET)
To: hidden
Subject: Is your wallet.dat compromised? Know it with Google
From: Google Services <bitcoin@googleservices.com>
Reply-To: bitcoin@googleservices.com
Errors-To: bitcoin@googleservices.com
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <20140115044531.2472E6503B1@tifon.es>
Date: Wed, 15 Jan 2014 05:45:31 +0100 (CET)


Title: Re: [Possible SCAM] Google Services & Blockchain Info Wallet Checker
Post by: pr0d1gy on January 15, 2014, 05:00:57 AM
Just saw it in my inbox... Yea, its even hosted on Google dive... But I'm sure its complete fake. Watch out for this one!


Title: Re: [Possible SCAM] Google Services & Blockchain Info Wallet Checker
Post by: Wipeout2097 on January 15, 2014, 05:08:30 AM
Oh, I was going to post this too. Elaborate SCAM, yes...

https://i.imgur.com/1nNde4d.png

the email points to
https://i.imgur.com/nkn7Fsm.png


https://i.imgur.com/n4vqn8e.png




Title: Re: [Possible SCAM] Google Services & Blockchain Info Wallet Checker
Post by: vesperwillow on January 15, 2014, 05:10:41 AM
That looks clearly like a scam. Wanting you to upload your file.. and they have an offline/imitation copy of the blockchain website.

Nice.

I heard one of the pools got hacked today. Will try to find out more.


Title: Re: [Possible SCAM] Google Services & Blockchain Info Wallet Checker
Post by: pr0d1gy on January 15, 2014, 05:56:52 AM
That looks clearly like a scam. Wanting you to upload your file.. and they have an offline/imitation copy of the blockchain website.

Nice.

I heard one of the pools got hacked today. Will try to find out more.

Not sure if it related, but I did get an email from an old pool that I haven't used for months...

https://i.imgur.com/iBY1cQP.png


Title: Re: [SCAM] Google Services & Blockchain Info Wallet Checker
Post by: cross1943 on January 15, 2014, 06:22:18 AM
wow....cool scam..But...it's use mail scam...囧


Title: Re: [SCAM] Google Services & Blockchain Info Wallet Checker
Post by: gekkomk on January 16, 2014, 02:04:39 AM
Good to know, thanks.


Title: Re: [SCAM] Google Services & Blockchain Info Wallet Checker
Post by: choochimil on January 16, 2014, 03:57:21 AM
Yes I got the same email to an email address I only use for pool mining. I did not click on anything.