Bitcoin Forum
November 20, 2017, 02:02:47 PM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: Locallbitcoins.com scam phishing email  (Read 1996 times)
escrow.ms
Legendary
*
Offline Offline

Activity: 1092

GPG Key-ID: B82BA7E1 | I don't use skype.


View Profile
November 04, 2013, 06:55:28 AM
 #1

If you got any mail like this don't click on it. It's a scam



That email is not sent by localbitcoins.com
If you will click on that link it will redirect you to a phishing site which is "locall" not "local".

Email source:
Code:
                                                                                                                                                                                                                                                             
Delivered-To: escrow.ms@gmail.com
Received: by 10.70.50.136 with SMTP id c8csp57023pdo;
        Sun, 3 Nov 2013 01:16:45 -0800 (PST)
X-Received: by 10.236.210.49 with SMTP id t37mr8867975yho.46.1383470204824;
        Sun, 03 Nov 2013 01:16:44 -0800 (PST)
Return-Path: <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>
Received: from mail142.wdc04.mandrillapp.com (mail142.wdc04.mandrillapp.com. [205.201.131.142])
        by mx.google.com with ESMTP id n1si3881500yhk.200.2013.11.03.01.16.44
        for <escrow.ms@gmail.com>;
        Sun, 03 Nov 2013 01:16:44 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com designates 205.201.131.142 as permitted sender) client-ip=205.201.131.142;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com designates 205.201.131.142 as permitted sender) smtp.mail=bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com;
       dkim=pass header.i=support@mail142.wdc04.mandrillapp.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill; d=mail142.wdc04.mandrillapp.com;
 h=From:Sender:Subject:Reply-To:To:Message-Id:Date:MIME-Version:Content-Type; i=support@mail142.wdc04.mandrillapp.com;
 bh=LPc1jg0JR7eQAADsQF13QRm13Uw=;
 b=WLwqGpZCl7wEX58DacpGU6P2gIU+n7WsPgi3YZ0aykVx3W9GPMvfw4rw1Q0cyys2SYmkluPlBoNW
   OiJwrhVg3Gu306ixuwZgOQ2kn+wCv/HcLDRmHG18jqWmoBxTwSenW58sVGknufFBLKVIr8xzbHHg
   NNwy4lvg9QmCkre/L4E=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=mail142.wdc04.mandrillapp.com;
 b=DOxhFlD36Rf4UAd6J5B8Nj54HgJqwX2DD/DPcEAdRLQz/t8yquj4+C0TKKHbvmZ7hlwqrVim74Xf
   P7LyW8VvEvaz2+PjK3TgdxMHo711fScKCcE+bLcHgHUi3Z0cQSGIxBIkoRUHAerv6zZpLGZnwzEQ
   dE5IDpM441pdEgh4enE=;
Received: from localhost (127.0.0.1) by mail142.wdc04.mandrillapp.com id heoa7o1jvjgs for <escrow.ms@gmail.com>; Sun, 3 Nov 2013 09:16:42 +0000 (envelope-from <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com;
 i=@mandrillapp.com; q=dns/txt; s=mandrill; t=1383470201; h=From :
 Sender : Subject : Reply-To : To : Message-Id : Date : MIME-Version :
 Content-Type : From : Subject : Date : X-Mandrill-User :
 List-Unsubscribe; bh=QmhIWzNdWe+s0Vu63TFIyEmeHSML8xTye1H9thJtRQQ=;
 b=eIP43+pOKJnmGcvA4VWSWBogDhdyjmE0kIe4jepJOPGFQSIxNDVjTe8vDR425TARk4eQiX
 BQSmgr0G7CyOsNPs5mt4NlXxuvap2kEEP6XdtdVoqgNjBtKzJQFYRYcjmwYPwm/tfeyhE/4D
 QiIFsTuAGXrl1OEwjQR3N+w+yKVh0=
From: support <support@localbitcoins.com>
Sender: support <support@mail142.wdc04.mandrillapp.com>
Subject: [localbitcoins.com] Confirm your email
Return-Path: <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>
X-Mailer: Smart_Send_3_1_0
Reply-To: <support@localbitcoins.com>
To: <escrow.ms@gmail.com>
Message-Id: <1005761950924881034916091@name-29e3aac043>
Received: from [173.220.222.194] by mandrillapp.com id f44b32e63a6549b6aa82f3e5ee0a1d1e; Sun, 03 Nov 2013 09:16:41 +0000
X-Report-Abuse: Please forward a copy of this message, including all headers, to abuse@mandrill.com
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30103182.f44b32e63a6549b6aa82f3e5ee0a1d1e
X-Mandrill-User: md_30103182
Date: Sun, 03 Nov 2013 09:16:41 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-C-id4lwphK27vmiHdII0KQ"

--_av-C-id4lwphK27vmiHdII0KQ
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Thank you for being a valued member of LocalBitcoins.com!

We pride ourselves in bringing you the highest security possible here at LocalBitcoins.com. We occasionally ask users to verify their contact information so they never find themselves locked out of their account.

Please confirm your email by clicking the following link:

https://localbitcoins.com/confirm_email/2odmBRArUdHMwZzCXY4by6

**LocalBitcoins.com will never ask for your password through email**



--_av-C-id4lwphK27vmiHdII0KQ
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<head>
<meta content="text/html; charset=windows-1252" http-equiv="Content-Type">
<meta name="GENERATOR" content="MSHTML 8.00.6001.23532"></head>
<body>
<p><font size="2" face="Arial, Helvetica, sans-serif">Thank you for being a valued member of LocalBitcoins.com!</font></p>
<p><font size="2" face="Arial">We pride ourselves in bringing you the highest security possible here at LocalBitcoins.com. We&nbsp;occasionally ask users to verify their contact information so&nbsp;they never find themselves locked out of their account.</font></p>
<p><font size="2" face="Arial">Please confirm your email by clicking the following link:</font></p>
<p><font size="2" face="Arial"><a href="http://mandrillapp.com/track/click.php?u=30103182&id=f44b32e63a6549b6aa82f3e5ee0a1d1e&url=http%3A%2F%2F[b]www.locallbitcoins.com[/b]%2Faccounts%2Flogin&url_id=6f7451d5f96408232e63ef0552f49d4b99ef8eaa">https://localbitcoins.com/confirm_email/2odmBRArUdHMwZzCXY4by6</a></font></p>
<p><font size="2" face="Arial">**LocalBitcoins.com will never ask for your password through email**</font></p><img src="http://mandrillapp.com/track/open.php?u=30103182&id=f44b32e63a6549b6aa82f3e5ee0a1d1e" height="1" width="1"></body>

--_av-C-id4lwphK27vmiHdII0KQ--

Please click here to know why I have negative feedback. https://21.co/escrow/
Tip address: 1nPfxnncZqWvVP4UHT6XLfNzfaik7akQS
Join ICO Now A blockchain platform for effective freelancing
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
escrow.ms
Legendary
*
Offline Offline

Activity: 1092

GPG Key-ID: B82BA7E1 | I don't use skype.


View Profile
November 04, 2013, 07:00:51 AM
 #2

Please report that "locall" site as phishing page here.
http://www.google.com/safebrowsing/report_phish/

and here
http://resources.publicdomainregistry.com/report-abuse/

Please click here to know why I have negative feedback. https://21.co/escrow/
Tip address: 1nPfxnncZqWvVP4UHT6XLfNzfaik7akQS
Tomatocage
Legendary
*
Offline Offline

Activity: 1526

brb keeping up with the Kardashians


View Profile
November 04, 2013, 06:35:29 PM
 #3

You might want to include the exact domain Wink

Nvm, found it buried in the dump: locallbitcoins.com

THIS SPOT FOR RENT* | GPG ID: 4880D85C | 1% Escrow | 8% IPO/ICO Escrow services Temporarily Closed | Bitcointalk is the ONLY place where I use this name (No Skype/IRC/YIM/AIM/etc) | 13CsmTqGNwvFXb7tD9yFvJcEYCDTB8wQTS | Beware of these SCAM sites! | *Sponsored Link
escrow.ms
Legendary
*
Offline Offline

Activity: 1092

GPG Key-ID: B82BA7E1 | I don't use skype.


View Profile
November 05, 2013, 06:18:13 AM
 #4

You might want to include the exact domain Wink

Nvm, found it buried in the dump: locallbitcoins.com

Actually i didnt wanted people to click on it,even by mistake.
Anyways domain got suspended registrar. Smiley


Please click here to know why I have negative feedback. https://21.co/escrow/
Tip address: 1nPfxnncZqWvVP4UHT6XLfNzfaik7akQS
Tomatocage
Legendary
*
Offline Offline

Activity: 1526

brb keeping up with the Kardashians


View Profile
November 05, 2013, 04:52:30 PM
 #5

Good job, man.. thanks for the heads up!

THIS SPOT FOR RENT* | GPG ID: 4880D85C | 1% Escrow | 8% IPO/ICO Escrow services Temporarily Closed | Bitcointalk is the ONLY place where I use this name (No Skype/IRC/YIM/AIM/etc) | 13CsmTqGNwvFXb7tD9yFvJcEYCDTB8wQTS | Beware of these SCAM sites! | *Sponsored Link
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!