Fradulent email claiming to be from Coinbase

[biophil]

This is a pretty obvious scam, but it doesn't look like anybody else has mentioned it yet.

I just received the following email from "news@coinbase.com." I've left the BTC address in because I figured maybe someone would want to sleuth it. But as should be obvious, anybody promising guaranteed "risk-free" 50% growth in 10 days is lying to you.

I've alerted Coinbase and updated my security settings with them. Here's the email:

In This Issue:
        Get 150% profit with Coinbase Invest Fund

Dear philipnbrown,

We're happy to announce a new product - Coinbase Invest Fund, reliable platform for
small and medium scale investments. Fund assets are diversified among emerging Forex
positions at Coinbase Exchange. Deposits are risk-free insured by institutions such as the New
York Stock Exchange.

Want to become a professional investor?
Our first short-term investment program starts today - GET 150% FOR A 10-DAY DEPOSIT.

Investment offer is active from 20th of April 12:00 AM Pacific until 30th of April.
Coinbase offers you a fixed return with a 50% growth for a 10 day period.
You can deposit today from $100. Maximum deposit amount per one person
or legal entity is 60 Bitcoins. That's an astonishing opportunity to earn up to $8,500 per 10 days!

Investors who want to apply, please make a deposit to

         1EufoLx8tScXSH3phBWKHAbN6wYHfsngH or click the link below
         https://blockchain.info/qr?data=1EufoLx8tScXSH3phBWKHAbN6wYHfsngH&size=400

Once a payment is made you will get an e-mail about successful participation.
Please note: Initial deposit amounts exceeding +30 Bitcoins will qualify your membership for a 2nd level upgrade.

We will return your initial deposit with dividends on 1st of May, 2015 12:00 AM Pacific Time.
(for example: investing 10 Bitcoins today will return 15 Bitcoins in a 10 day period)
Profits are withdrawn without any delay and Coinbase waives all fees for 1st level investments.

Hurry up! This is a limited, one-time opportunity.

Kind regards,
The Coinbase Invest Fund Team

Do not reply to this e-mail

[1715345396]

1715345396

[1715345396]

1715345396

[1715345396]

1715345396

[1715345396]

1715345396

[abyrnes81]

This is a pretty obvious scam, but it doesn't look like anybody else has mentioned it yet.

I just received the following email from "news@coinbase.com." I've left the BTC address in because I figured maybe someone would want to sleuth it. But as should be obvious, anybody promising guaranteed "risk-free" 50% growth in 10 days is lying to you.

I've alerted Coinbase and updated my security settings with them. Here's the email:

In This Issue:
        Get 150% profit with Coinbase Invest Fund

Dear philipnbrown,

We're happy to announce a new product - Coinbase Invest Fund, reliable platform for
small and medium scale investments. Fund assets are diversified among emerging Forex
positions at Coinbase Exchange. Deposits are risk-free insured by institutions such as the New
York Stock Exchange.

Want to become a professional investor?
Our first short-term investment program starts today - GET 150% FOR A 10-DAY DEPOSIT.

Investment offer is active from 20th of April 12:00 AM Pacific until 30th of April.
Coinbase offers you a fixed return with a 50% growth for a 10 day period.
You can deposit today from $100. Maximum deposit amount per one person
or legal entity is 60 Bitcoins. That's an astonishing opportunity to earn up to $8,500 per 10 days!

Investors who want to apply, please make a deposit to

         1EufoLx8tScXSH3phBWKHAbN6wYHfsngH or click the link below
         https://blockchain.info/qr?data=1EufoLx8tScXSH3phBWKHAbN6wYHfsngH&size=400

Once a payment is made you will get an e-mail about successful participation.
Please note: Initial deposit amounts exceeding +30 Bitcoins will qualify your membership for a 2nd level upgrade.

We will return your initial deposit with dividends on 1st of May, 2015 12:00 AM Pacific Time.
(for example: investing 10 Bitcoins today will return 15 Bitcoins in a 10 day period)
Profits are withdrawn without any delay and Coinbase waives all fees for 1st level investments.

Hurry up! This is a limited, one-time opportunity.

Kind regards,
The Coinbase Invest Fund Team

Do not reply to this e-mail

Thanks for the heads up, I will check my e-mail address and delete that e-mail (if I will find it). It seems the scammers don't want to stop.

[defcon23]

Thanx for sharing 

[HELP.org]

I got one and it appears to have sent though a coinbase server:

Code:

/Received: from o1.em.coinbase.com (o1.em.coinbase.com [50.31.37.137])[code]

[/code]

[escrow.ms]

Looks like they are sending unique address to each email id.

Source code

Code:

                                                                                                                                                                                                                                                               
Delivered-To: escrow.ms@gmail.com
Received: by 10.76.153.38 with SMTP id vd6csp4800732oab;
        Wed, 8 Apr 2015 11:51:55 -0700 (PDT)
X-Received: by 10.50.41.8 with SMTP id b8mr2793899igl.38.1428519115181;
        Wed, 08 Apr 2015 11:51:55 -0700 (PDT)
Return-Path: <bounces+1604765-6e2d-escrow.ms=gmail.com@em.coinbase.com>
Received: from o1.em.coinbase.com (o1.em.coinbase.com. [50.31.37.137])
        by mx.google.com with ESMTPS id d5si272580icw.68.2015.04.08.11.51.54
        for <escrow.ms@gmail.com>
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 08 Apr 2015 11:51:55 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounces+1604765-6e2d-escrow.ms=gmail.com@em.coinbase.com designates 50.31.37.137 as permitted sender) client-ip=50.31.37.137;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounces+1604765-6e2d-escrow.ms=gmail.com@em.coinbase.com designates 50.31.37.137 as permitted sender) smtp.mail=bounces+1604765-6e2d-escrow.ms=gmail.com@em.coinbase.com;
       dkim=pass header.i=@coinbase.com;
       dmarc=pass (p=REJECT dis=NONE) header.from=coinbase.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=coinbase.com; 
	h=content-type:mime-version:content-transfer-encoding:from:to:subject; 
	s=smtpapi; bh=CHfTJJfVjMRd5iKAMGsdHLVng7A=; b=D2Dh5NZdoEyY4N3LUb
	TA9uD+L8f5Wa5rMwndHixhuyfcPcrTf0mEOiX3U3baHSoJYLxZsVHM3Z8hEzz+n5
	A8NrSr8bxzFMWUOzn7ZW3TLePZ5d7VnK7/c1DajsVGhuB7KZ9/tB9WK9FO1bDpEH
	fDWvVlvUvvj0TDxYcdif3+Dnk=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.info; 
	h=content-type:mime-version:content-transfer-encoding:from:to:subject:x-feedback-id; 
	s=smtpapi; bh=CHfTJJfVjMRd5iKAMGsdHLVng7A=; b=gyenHhJUU/lIUk2s2T
	N5iBakHnuOTaVbsfoHyKNY116l2Dj8w4SguXS1y38SjI75aup+Bx28WIFW7fHqsT
	NRgWNmn9CfnQO1oyftORzOMMJ7fyjFzVI2X+qROhnQhWTO3UC/udjiXlt5nZz5VG
	gYkgmbDZBqnYsZICSPLooikb8=
Received: by filter0141p1mdw1.sendgrid.net with SMTP id filter0141p1mdw1.31690.552578C64
        2015-04-08 18:51:51.619822276 +0000 UTC
Received: from MTYwNDc2NQ (unknown [5.101.100.198])
	by ismtpd-004 (SG) with HTTP id 14c9a5fcacf.2249.a0f
	for <escrow.ms@gmail.com>; Wed, 08 Apr 2015 18:51:51 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
From: Coinbase <news@coinbase.com>
To: escrow.ms@gmail.com
Subject: escrow.ms, We've got a message for You
Date: Wed, 08 Apr 2015 18:51:46 GMT
Message-ID: <14c9a5fcacf.2249.a0f@ismtpd-004>
X-SG-EID: 7PhlXrJmhsCbas7nuUGZYrhdwQ4zRRW0ML0t3CEYTVENAkE43ZGc6F6AVP5irhzknjoN1e+Z3gfcbx
 rqAAn8how+OrYSsn057X406rBnNa+GQObKw1HzolVs0tUFu2VzAjILWTKydM8slTC4iK62UPOvlbzo
 Ts5zo/HcDf/MhbA=
X-Feedback-ID: 1604765:Nxn+fEjZ1AV/+KOFnZzqAn545X5dCG8m7jNoPFWCJuk=:Nxn+fEjZ1AV/+KOFnZzqAn545X5dCG8m7jNoPFWCJuk=:SG

In This Issue:
	Get 150% profit with Coinbase Invest Fund
=20
Dear escrow.ms,
=20
We're happy to announce a new product - Coinbase Invest Fund, reliable plat=
form for
small and medium scale investments. Fund assets are diversified among emerg=
ing Forex
positions at Coinbase Exchange. Deposits are risk-free insured by instituti=
ons such as the New
York Stock Exchange.

Want to become a professional investor?=20
Our first short-term investment program starts today - GET 150% FOR A 10-DA=
Y DEPOSIT.
=20
Investment offer is active from 20th of April 12:00 AM Pacific until 30th o=
f April.
Coinbase offers you a fixed return with a 50% growth for a 10 day period.
You can deposit today from $100. Maximum deposit amount per one person
or legal entity is 60 Bitcoins. That's an astonishing opportunity to earn u=
p to $8,500 per 10 days!
=20
Investors who want to apply, please make a deposit to
=20
	 1Ag4iMG5R99bGFBGtNEadSKYZXVcXqs8zS or click the link below
	 https://blockchain.info/qr?data=3D1Ag4iMG5R99bGFBGtNEadSKYZXVcXqs8zS&size=
=3D400
=20
Once a payment is made you will get an e-mail about successful participatio=
n.
Please note: Initial deposit amounts exceeding +30 Bitcoins will qualify yo=
ur membership for a 2nd level upgrade.
=20
We will return your initial deposit with dividends on 1st of May, 2015 12:0=
0 AM Pacific Time.
(for example: investing 10 Bitcoins today will return 15 Bitcoins in a 10 d=
ay period)
Profits are withdrawn without any delay and Coinbase waives all fees for 1s=
t level investments.

Hurry up! This is a limited, one-time opportunity.
=20
Kind regards,
The Coinbase Invest Fund Team
=20
Do not reply to this e-mail

DNS records for em.coinbase.com
Host    Type    Data    TTL
em.coinbase.com    CNAME    sendgrid.net    231

Looks like their sendgrid account got compromised.

[cyberpitstop]

Same here

[Quickseller]

According to this reddit, it doesn't appear to be from a leaked coinbase email DB, because one person is claiming to have received it to an email not associated with their coinbase account, but one that is associated with their LBC and purse.io accounts.

[Xandrah]

Getting the email too, mostly to administration email accounts for my pool.

In This Issue:
   Get 150% profit with Coinbase Invest Fund
 
Dear deltapool,
 
We're happy to announce a new product - Coinbase Invest Fund, reliable platform for
small and medium scale investments. Fund assets are diversified among emerging Forex
positions at Coinbase Exchange. Deposits are risk-free insured by institutions such as the New
York Stock Exchange.

Want to become a professional investor?
Our first short-term investment program starts today - GET 150% FOR A 10-DAY DEPOSIT.
 
Investment offer is active from 20th of April 12:00 AM Pacific until 30th of April.
Coinbase offers you a fixed return with a 50% growth for a 10 day period.
You can deposit today from $100. Maximum deposit amount per one person
or legal entity is 60 Bitcoins. That's an astonishing opportunity to earn up to $8,500 per 10 days!
 
Investors who want to apply, please make a deposit to
 
    1651v2vDiPeGqpfKtDDFgLhAP94rwzBqB6 or click the link below
    https://blockchain.info/qr?data=1651v2vDiPeGqpfKtDDFgLhAP94rwzBqB6&size=400
 
Once a payment is made you will get an e-mail about successful participation.
Please note: Initial deposit amounts exceeding +30 Bitcoins will qualify your membership for a 2nd level upgrade.
 
We will return your initial deposit with dividends on 1st of May, 2015 12:00 AM Pacific Time.
(for example: investing 10 Bitcoins today will return 15 Bitcoins in a 10 day period)
Profits are withdrawn without any delay and Coinbase waives all fees for 1st level investments.

Hurry up! This is a limited, one-time opportunity.
 
Kind regards,
The Coinbase Invest Fund Team
 

Return-Path: bounces+1604765-0c1d-info=deltapool.net@em.coinbase.com
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on SRVX338
X-Spam-Level: ***
X-Spam-Status: No, score=3.8 required=5.0 tests=LOCALPART_IN_SUBJECT,RISK_FREE,
   URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0
Received: from o1.em.coinbase.com (o1.em.coinbase.com [50.31.37.137])
   by delta-zone.co.uk
   ; Wed, 8 Apr 2015 20:35:01 +0100
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=coinbase.com;
   h=content-type:mime-version:content-transfer-encoding:from:to:subject;
   s=smtpapi; bh=QFnVw72CJHLce0JhHB22as21y5s=; b=BEyroLHae+hlb5It0X
   9bk9kKjxFiQWqr2kZLKy7g2yNdl3qs2+++f1FbUMFXt9C9JXFLu53P5zjWBovVtw
   OkYVa32FUwD7y88aLXYfgmCfwAoIcjG2OioHcwgFbFvldAEzSFQrP1LqrQEZdijm
   MlCM4CF1LowzrsKLUxQs6a7k8=
Received: by filter0146p1mdw1.sendgrid.net with SMTP id filter0146p1mdw1.12555.5525830BB
        2015-04-08 19:35:39.796263688 +0000 UTC
Received: from MTYwNDc2NQ (unknown [5.101.100.198])
   by ismtpd-001 (SG) with HTTP id 14c9a87e517.7569.bb0
   for <info@deltapool.net>; Wed, 08 Apr 2015 19:35:39 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
From: Coinbase <news@coinbase.com>
To: info@deltapool.net
Subject: deltapool, We've got a message for You
Date: Wed, 08 Apr 2015 19:35:39 GMT
Message-ID: <14c9a87e517.7569.bb0@ismtpd-001>
X-SG-EID: SstF2N5V2aCc39L4e9UbvDkZSLCUv96M2IGyx/wdKbef0KeRpF+AnI01HoKFPgaFmkOCSfBKSXABWO
 Fh5nWKC43igeBoxO7QtmO1XEX05OKIA0KnaYK2l2uXoDG7HXJK1GzBk3dGHyb5uwDAaCvpq7hnxudG
 eCYNK35JFPx3V56Nl0Rt5xpdRhOJ+Ln7THNf

[cyberpitstop]

I received another "Scam Coinbase"email to an address only used for one company GAW miners. No one else ever saw that address before only them.

[kolloh]

I checked and did not receive this email with my Coinbase email account.