Coinbase Investment fund email?

[ajw7989]

Anyone else just get an email from news@coinbase.com about an investment fund? Sounds too good to be true.

Code:

In This Issue:
        Get 150% profit with Coinbase Invest Fund

Dear ajw7989,

We're happy to announce a new product - Coinbase Invest Fund, reliable platform for
small and medium scale investments. Fund assets are diversified among emerging Forex
positions at Coinbase Exchange. Deposits are risk-free insured by institutions such as the New
York Stock Exchange.

Want to become a professional investor?
Our first short-term investment program starts today - GET 150% FOR A 10-DAY DEPOSIT.

Investment offer is active from 20th of April 12:00 AM Pacific until 30th of April.
Coinbase offers you a fixed return with a 50% growth for a 10 day period.
You can deposit today from $100. Maximum deposit amount per one person
or legal entity is 60 Bitcoins. That's an astonishing opportunity to earn up to $8,500 per 10 days!

Investors who want to apply, please make a deposit to

         1LzobTyP2RpfgBq8H59E25dibtNpKvb69J or click the link below
         https://blockchain.info/qr?data=1LzobTyP2RpfgBq8H59E25dibtNpKvb69J&size=400

Once a payment is made you will get an e-mail about successful participation.
Please note: Initial deposit amounts exceeding +30 Bitcoins will qualify your membership for a 2nd level upgrade.

We will return your initial deposit with dividends on 1st of May, 2015 12:00 AM Pacific Time.
(for example: investing 10 Bitcoins today will return 15 Bitcoins in a 10 day period)
Profits are withdrawn without any delay and Coinbase waives all fees for 1st level investments.

Hurry up! This is a limited, one-time opportunity.

Kind regards,
The Coinbase Invest Fund Team

Do not reply to this e-mail

[marcotheminer]

Seems really sketchy, absolutely not from CoinBase.

What annoys me is how did these scammers get access to CoinBase's users' emails (CoinBase's fault?).

[bernard75]

It is not their database that was hacked.
I use this mail for sensitive things only but i never registered at Coinbase.

[Morton Bitcoin Management]

I received the same email too

[SirChiko]

It isn't from coinbase...tons of users got it.
I just don't get how come that i use coinbase too but i didn't get that e-mail.

[Zombie123]

Yea I got it too. Obviously fraud

[ajw7989]

The red flag for me and any phishing emails is the fact that they addressed me by my username but whenever you make a deposit or withdrawal you get a confirmation email which uses your first name. What is strange though is its from news@coinbase.com but if you dig deeper it says mailed by    em.coinbase.com and signed by    coinbase.com when the other emails are both mailed and signed by coinbase.com

[tjwebb]

I got the same email. Seems legit. LOL

Also, excuse me while I move all my coin out of coinbase...

[allyouracid]

The red flag for me and any phishing emails is the fact that they addressed me by my username but whenever you make a deposit or withdrawal you get a confirmation email which uses your first name. What is strange though is its from news@coinbase.com but if you dig deeper it says mailed by    em.coinbase.com and signed by    coinbase.com when the other emails are both mailed and signed by coinbase.com

It's strange, indeed. I wonder where they have my full name (firstname+lastname) from. I may have registered at coinbase, but I never used it, because it's not supported in Germany.

I think we all must have something in common, here. Any service we have registered to, which maybe sells the data of its users, or maybe was hacked… ideas, anyone?


.edit:
Too bad they're using different BTC addresses for each recipient. Would be interesting to see how much money they got, already. Seems that some guys were not as stupid as most other scammers here!

[LongJohnJake]

Seems really sketchy, absolutely not from CoinBase.

What annoys me is how did these scammers get access to CoinBase's users' emails (CoinBase's fault?).

Following is from Coinbase online chat.  Cannot believe how nonchalant they are about this whole incident!

"Now Chatting
Seth: Hi there! What can I help you with today?
→Got your News message about the investment product. Please supply more information, such as a Prospectus.
Seth: That appears to be a scam email. It's not from us.
→So how did they get my username and your domain?
Seth: That is beyond my technical understanding, I'm afraid.
→Good god, man!! Your site got hacked and that's the best you can say!!
→Wait til I blog that moronic response!
Seth: I do not believe our site has been hacked. But feel free to do what you want. Have a nice day!"

[allyouracid]

Seems really sketchy, absolutely not from CoinBase.

What annoys me is how did these scammers get access to CoinBase's users' emails (CoinBase's fault?).

Following is from Coinbase online chat.  Cannot believe how nonchalant they are about this whole incident!

"Now Chatting
Seth: Hi there! What can I help you with today?
→Got your News message about the investment product. Please supply more information, such as a Prospectus.
Seth: That appears to be a scam email. It's not from us.
→So how did they get my username and your domain?
Seth: That is beyond my technical understanding, I'm afraid.
→Good god, man!! Your site got hacked and that's the best you can say!!
→Wait til I blog that moronic response!
Seth: I do not believe our site has been hacked. But feel free to do what you want. Have a nice day!"

If someone ranted to me in such a threatening tone, without even knowing the facts, I wouldn't have been more kindly, either, to be honest.

[jus341]

Response I got from Coinbase:

Hi there,

My apologies for the inconvenience here, we are currently investigating this and are in the process of getting it shut down. This is NOT an official Coinbase email, please DO NOT click any links or otherwise engage with this communication. Thank you for forwarding.

-Alex H
Supervisor

[lexico]

got it too.
Never registered at coinbase.
The only btc related stuff I registered to with that email address is Bitcointalk, Localbitcoins and Kraken (and havent used these in more than a year).  
[edit: perhaps Gox. not sure...]
So it is probably one of these that had their memberslist leaked/hacked.
(Or.. one of these fuckers sold their data)

[dboldt]

I used to get a lot of random 1 satashi deposits from people I didn't know.  I think if someone sends you BTC on coinbase they can then see your email address and username.  I suspect someone sent out millions of 'free' satashis to harvest their email addresses and usernames.

[crazyivan]

100% scam. I guess we have all registered for something and its not coinbase. Can anyone guess what that might be?

[bernard75]

Never registered at coinbase.
The only btc related stuff I registered to with that email address is Bitcointalk, Localbitcoins and Kraken (and havent used these in more than a year).  
So it is probably one of these that had their memberslist leaked/hacked.
(Or.. one of these fuckers sold their data)

I havent used this mail for any of those.

[erik__]

Received it on my gmail account.  Obvious scam.  The only thing I wonder about is how it managed to dodge Google's spam/scam filters.

[lexico]

Received it on my gmail account.  Obvious scam.  The only thing I wonder about is how it managed to dodge Google's spam/scam filters.

Check the email headers.
I don't know how DNS spoofing/hacking works, so I cant tell the details, But from here it it looks like this actually comes from coinbase servers.

[OnkelPaul]

Extremely interesting - they seem to be using coinbase's mail infrastructure, here are some headers from the mail that I got:

Received: from o1.em.coinbase.com (o1.em.coinbase.com [50.31.37.137])
   (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
   (No client certificate requested)
   by xxx (mail service) with ESMTPS id xxxx
   for <xxx>; Wed,  8 Apr 2015 xx:xx:xx +xxxx (xxx)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=coinbase.com;
   h=content-type:mime-version:content-transfer-encoding:from:to:subject;
   s=smtpapi; bh=xxxx; b=xxxx
Received: by filterxxx.sendgrid.net with SMTP id filterxxxx
        2015-04-08 xx:xx:xx.xxxxxxxx +0000 UTC
Received: from xxxx (unknown [5.101.xx.xx])
   by ismtpd-008 (SG) with HTTP id xxxx
   for <xxx>; Wed, 08 Apr 2015 xx:xx:xx +0000 (UTC)

(xxx'd all identifying information)

Maybe a hacked coinbase employee mail account?
The original source of the HTTP request is a DigitalOcean IP address, presumably a VPS. I don't know whether the whole run was sent from that IP, if it was, xxxing does not make much sense of course as it is not specific to me.

Onkel Paul

[lexico]

...

mine looks the same.

hacked user account (news@coinbase.com) is an option.
Still the question of how they got my emailaddress.