new (to me) but obvious scam

[dooglus]

I just received the following email, apparently from bitcoin.org, but no doubt a forgery.

If it sounds too good to be true, it probably is...



Edit: no victims yet: http://blockchain.info/address/1DRtePjGwKj7RHcFchF9ATRxWF8Wp44s4B

[philip2000uk]

"in 1 hours" LOL!
You can pretend to be from any address in gmail.  I think if you did a full header check then you'll find out who it is.

[Liquid]

have seen this from other members its a common scam it seems

delete.

Go back to watching the bitcoin price with some popcorn 

[Kluge]

Yeah - I've been receiving them since the early Gox hack, but activity spiked again a couple weeks after the BTCTalk hack, but's died down again for me.

Some impersonate theymos, a well-known organization, or even John K. Sometimes they don't impersonate, but instead claim to be a new mining company. Some will take the old phishing approach "Hellow, this is Mtgox support and your account has been suspended due to suspicious activity. PLease clicik here to verify your account and unlock it. Thank you and good day, sir, Mtgox" I'm still surprised I haven't seen one try for some reasonable authenticity and make a false PGP signature when they try impersonating an individual. Then for the 99% of people who don't check, "oh look, it's signed - must be him!"

[BadBear]

Yeah these types always spike when the exchange rate rises.

[dooglus]

"in 1 hours" LOL!

I takes 1 hours, sure, but it's also IMMEDIATE:

The 300%-500% payout will be made back to your Bitcoin Address in 1 hours.

The payout is IMMEDIATE, GUARANTEED and there is NO RISK from losing your bitcoin.

You can pretend to be from any address in gmail.  I think if you did a full header check then you'll find out who it is.

This:

Code:

Return-Path: <no-reply@anonymouse.cz>
Received: from anonymous-proxy.krasl.com (anonymous-proxy.krasl.com. [77.93.216.69])
        by mx.google.com with ESMTPS id x45si10125394eey.66.2013.11.09.00.14.56
        for <dooglus@gmail.com>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Sat, 09 Nov 2013 00:14:57 -0800 (PST)
Received-SPF: neutral (google.com: 77.93.216.69 is neither permitted nor denied by best guess record for domain of no-reply@anonymouse.cz) client-ip=77.93.216.69;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 77.93.216.69 is neither permitted nor denied by best guess record for domain of no-reply@anonymouse.cz) smtp.mail=no-reply@anonymouse.cz

[MPOE-PR]

I lolled @ "Dear Bitcoin Member".

[dooglus]

I lolled @ "Dear Bitcoin Member".

This?  (NVSFW)

https://i.imgur.com/yNTaO.jpg

[Kluge]

Hehe, here's one I received recently... they thought of everything, even a mailing address:

New way how to use bitcoins in all e-shops in the world.

Exchange rate of bitcoins is very high now. Use Pl[scam, don't visit]azacoin.com and spend your bitcoins in your favourite e-shop!

Pl[scam, don't visit]azaCoin.com is new revolutionary way how to do shopping everywhere in the world. Just enter the product you want to buy with BTC!

Enjoy your shopping

Bitcoin info team
Copyright © 2013 Bitcoininfo, All rights reserved.
Bitcoin info

Our mailing address is:
Bitcoininfo
Washington
wallestreet
washington, WA 1500

[DiamondCardz]

Our mailing address is:
Bitcoininfo
Washington
wallestreet
washington, WA 1500

wallestreet

Oh God I can't stop laughing.

[Kluge]

Here's a well-done example of a phishing attempt.

Hi, you got a new offer to your SELL advertisement. Message:
Hey, wondering if you can do this trade??

Deal: 384.47 USD = 1 BTC (price 384.47 USD/BTC)
----
You can reply to this message by replying to this email. You can also reply on site: https://localbitcoins.com/ads/37726/103702 <- actual URL is http://llocalbitc[break, don't click]oins.com/accounts/login



Email conversation token: 3AWW4PUS1GSHSBGX2QD7N2OMI. Don't remove this from message when replying. Also reply above this message - the content after the lines above will be removed.