Bitcoin Forum
November 02, 2024, 04:57:35 PM *
News: Latest Bitcoin Core release: 28.0 [Torrent]
 
   Home   Help Search Login Register More  
Warning: One or more bitcointalk.org users have reported that they believe that the creator of this topic displays some red flags which make them high-risk. (Login to see the detailed trust ratings.) While the bitcointalk.org administration does not verify such claims, you should proceed with extreme caution.
Pages: [1]
  Print  
Author Topic: Locallbitcoins.com scam phishing email  (Read 2130 times)
escrow.ms (OP)
Legendary
*
Offline Offline

Activity: 1274
Merit: 1004


View Profile
November 04, 2013, 06:55:28 AM
Last edit: November 04, 2013, 07:24:15 AM by escrow.ms
 #1

If you got any mail like this don't click on it. It's a scam



That email is not sent by localbitcoins.com
If you will click on that link it will redirect you to a phishing site which is "locall" not "local".

Email source:
Code:
                                                                                                                                                                                                                                                               
Delivered-To: escrow.ms@gmail.com
Received: by 10.70.50.136 with SMTP id c8csp57023pdo;
        Sun, 3 Nov 2013 01:16:45 -0800 (PST)
X-Received: by 10.236.210.49 with SMTP id t37mr8867975yho.46.1383470204824;
        Sun, 03 Nov 2013 01:16:44 -0800 (PST)
Return-Path: <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>
Received: from mail142.wdc04.mandrillapp.com (mail142.wdc04.mandrillapp.com. [205.201.131.142])
        by mx.google.com with ESMTP id n1si3881500yhk.200.2013.11.03.01.16.44
        for <escrow.ms@gmail.com>;
        Sun, 03 Nov 2013 01:16:44 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com designates 205.201.131.142 as permitted sender) client-ip=205.201.131.142;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com designates 205.201.131.142 as permitted sender) smtp.mail=bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com;
       dkim=pass header.i=support@mail142.wdc04.mandrillapp.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill; d=mail142.wdc04.mandrillapp.com;
 h=From:Sender:Subject:Reply-To:To:Message-Id:Date:MIME-Version:Content-Type; i=support@mail142.wdc04.mandrillapp.com;
 bh=LPc1jg0JR7eQAADsQF13QRm13Uw=;
 b=WLwqGpZCl7wEX58DacpGU6P2gIU+n7WsPgi3YZ0aykVx3W9GPMvfw4rw1Q0cyys2SYmkluPlBoNW
   OiJwrhVg3Gu306ixuwZgOQ2kn+wCv/HcLDRmHG18jqWmoBxTwSenW58sVGknufFBLKVIr8xzbHHg
   NNwy4lvg9QmCkre/L4E=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=mail142.wdc04.mandrillapp.com;
 b=DOxhFlD36Rf4UAd6J5B8Nj54HgJqwX2DD/DPcEAdRLQz/t8yquj4+C0TKKHbvmZ7hlwqrVim74Xf
   P7LyW8VvEvaz2+PjK3TgdxMHo711fScKCcE+bLcHgHUi3Z0cQSGIxBIkoRUHAerv6zZpLGZnwzEQ
   dE5IDpM441pdEgh4enE=;
Received: from localhost (127.0.0.1) by mail142.wdc04.mandrillapp.com id heoa7o1jvjgs for <escrow.ms@gmail.com>; Sun, 3 Nov 2013 09:16:42 +0000 (envelope-from <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com;
 i=@mandrillapp.com; q=dns/txt; s=mandrill; t=1383470201; h=From :
 Sender : Subject : Reply-To : To : Message-Id : Date : MIME-Version :
 Content-Type : From : Subject : Date : X-Mandrill-User :
 List-Unsubscribe; bh=QmhIWzNdWe+s0Vu63TFIyEmeHSML8xTye1H9thJtRQQ=;
 b=eIP43+pOKJnmGcvA4VWSWBogDhdyjmE0kIe4jepJOPGFQSIxNDVjTe8vDR425TARk4eQiX
 BQSmgr0G7CyOsNPs5mt4NlXxuvap2kEEP6XdtdVoqgNjBtKzJQFYRYcjmwYPwm/tfeyhE/4D
 QiIFsTuAGXrl1OEwjQR3N+w+yKVh0=
From: support <support@localbitcoins.com>
Sender: support <support@mail142.wdc04.mandrillapp.com>
Subject: [localbitcoins.com] Confirm your email
Return-Path: <bounce-md_30103182.52761479.v1-f44b32e63a6549b6aa82f3e5ee0a1d1e@mandrillapp.com>
X-Mailer: Smart_Send_3_1_0
Reply-To: <support@localbitcoins.com>
To: <escrow.ms@gmail.com>
Message-Id: <1005761950924881034916091@name-29e3aac043>
Received: from [173.220.222.194] by mandrillapp.com id f44b32e63a6549b6aa82f3e5ee0a1d1e; Sun, 03 Nov 2013 09:16:41 +0000
X-Report-Abuse: Please forward a copy of this message, including all headers, to abuse@mandrill.com
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30103182.f44b32e63a6549b6aa82f3e5ee0a1d1e
X-Mandrill-User: md_30103182
Date: Sun, 03 Nov 2013 09:16:41 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-C-id4lwphK27vmiHdII0KQ"

--_av-C-id4lwphK27vmiHdII0KQ
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Thank you for being a valued member of LocalBitcoins.com!

We pride ourselves in bringing you the highest security possible here at LocalBitcoins.com. We occasionally ask users to verify their contact information so they never find themselves locked out of their account.

Please confirm your email by clicking the following link:

https://localbitcoins.com/confirm_email/2odmBRArUdHMwZzCXY4by6

**LocalBitcoins.com will never ask for your password through email**



--_av-C-id4lwphK27vmiHdII0KQ
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<head>
<meta content="text/html; charset=windows-1252" http-equiv="Content-Type">
<meta name="GENERATOR" content="MSHTML 8.00.6001.23532"></head>
<body>
<p><font size="2" face="Arial, Helvetica, sans-serif">Thank you for being a valued member of LocalBitcoins.com!</font></p>
<p><font size="2" face="Arial">We pride ourselves in bringing you the highest security possible here at LocalBitcoins.com. We&nbsp;occasionally ask users to verify their contact information so&nbsp;they never find themselves locked out of their account.</font></p>
<p><font size="2" face="Arial">Please confirm your email by clicking the following link:</font></p>
<p><font size="2" face="Arial"><a href="http://mandrillapp.com/track/click.php?u=30103182&id=f44b32e63a6549b6aa82f3e5ee0a1d1e&url=http%3A%2F%2F[b]www.locallbitcoins.com[/b]%2Faccounts%2Flogin&url_id=6f7451d5f96408232e63ef0552f49d4b99ef8eaa">https://localbitcoins.com/confirm_email/2odmBRArUdHMwZzCXY4by6</a></font></p>
<p><font size="2" face="Arial">**LocalBitcoins.com will never ask for your password through email**</font></p><img src="http://mandrillapp.com/track/open.php?u=30103182&id=f44b32e63a6549b6aa82f3e5ee0a1d1e" height="1" width="1"></body>

--_av-C-id4lwphK27vmiHdII0KQ--
escrow.ms (OP)
Legendary
*
Offline Offline

Activity: 1274
Merit: 1004


View Profile
November 04, 2013, 07:00:51 AM
 #2

Please report that "locall" site as phishing page here.
http://www.google.com/safebrowsing/report_phish/

and here
http://resources.publicdomainregistry.com/report-abuse/
Tomatocage
Legendary
*
Offline Offline

Activity: 1554
Merit: 1222

brb keeping up with the Kardashians


View Profile
November 04, 2013, 06:35:29 PM
 #3

You might want to include the exact domain Wink

Nvm, found it buried in the dump: locallbitcoins.com

Recommended Exchanges: Binance.com | CelsiusNetwork
GPG ID: 4880D85C | 1% Escrow | 8% IPO/ICO Escrow services Temporarily Closed | Bitcointalk is the ONLY place where I use this name (No Skype/IRC/YIM/AIM/etc) | 13CsmTqGNwvFXb7tD9yFvJcEYCDTB8wQTS | Beware of these SCAM sites! | *Sponsored Link
escrow.ms (OP)
Legendary
*
Offline Offline

Activity: 1274
Merit: 1004


View Profile
November 05, 2013, 06:18:13 AM
Last edit: November 05, 2013, 04:55:37 PM by escrow.ms
 #4

You might want to include the exact domain Wink

Nvm, found it buried in the dump: locallbitcoins.com

Actually i didnt wanted people to click on it,even by mistake.
Anyways domain got suspended registrar. Smiley

Tomatocage
Legendary
*
Offline Offline

Activity: 1554
Merit: 1222

brb keeping up with the Kardashians


View Profile
November 05, 2013, 04:52:30 PM
 #5

Good job, man.. thanks for the heads up!

Recommended Exchanges: Binance.com | CelsiusNetwork
GPG ID: 4880D85C | 1% Escrow | 8% IPO/ICO Escrow services Temporarily Closed | Bitcointalk is the ONLY place where I use this name (No Skype/IRC/YIM/AIM/etc) | 13CsmTqGNwvFXb7tD9yFvJcEYCDTB8wQTS | Beware of these SCAM sites! | *Sponsored Link
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!