June 7, 2017


Do you know anyone who owns a timeshare property?  We’ve been finding these short but sketchy emails during the last few weeks.  They mostly come from “Cynthia” and “Jodie” and randomly target email accounts, asking if you have a timeshare for sale.   Though they contain no links, they ask for a reply.  We can’t be certain of their game, but we are 100% certain they are scams.  Look carefully at the from address of these three that arrived in our honey-pot email server in the last few weeks.

Share this with friends who have a timeshare property and then say deeeleeeete!

From: cynthia_b89@rin.com
Time: 2017-06-02 08:22:20
Subject: Your Vacation_Unit
Hello, I am interested_in your Timeshare unit. Please let me know if it is still available for sale. Thanks, Cynthia

 From: jdclark@rim.com
Time: 2017-05-12 12:29:41
Subject: Your vacation_Unit
Hello, I am interested_in your Timeshare unit. Please let me know if it is still available for sale. Thanks, Jodie

 From: jclark_67@fond.com
Time: 2017-04-27 03:39:52
Subject: Your Vacation Timeshare Unit
Hello, I would like to discuss your Timeshare Unit. Please let me know if it is still available for sale. Thanks, Jodie

And while we’re focused on questionable, sketchy emails here’s another one for those solicitations looking to hire employees.  This email came from Vera Natalia Garcia Duarte and she says they “are recruiting staffs” in the UK.  She found us through our LinkedIn profile.  How nice.



Sample Scam Subject Lines:

ATTENTION REQUIRED: A weight loss supplements backed by illustrative evidence

Attn: Online poker is back in the US! Receive a $2,000 bonus today

Bizarre stretch fixes bad backs

Clinton finally speaks and drops a BOMBSHELL

Don’t buy solar panels before seeing THIS

Get High-Quality Affordable Printer Ink

How To Look Younger (Without Botox!)

Oh my god – you NEED to see this

Learn to play piano video

Play today and receive a 200% bonus on sign up. Start Winning Now

REVEALED: Natural Breast Enlargement!

The most viewed post ever on Facebook: 86897789

WARNING: the weight reduction pill everyone’s been waiting for


Sample Scam Email Addresses

ABC-Health-Report @ friction.tenei.us

BreakingOnForbs @ cludcomputting.bid

CNN_Breaking_News @ forward.exactlymiracleoil.us

Dr.Shapiro @ lake.availableregrowhair.us

Eliminatewrinkles @ oaksdarts.info

Heart.Attack.Fighter @ strange.fightheartattackthough.us

MemorialDay-MilitaryFlashlight @ implementation.iqame.us

Nutrisystem-Affiliate @ council.varew.us

PredatorNameSearch-KidsLiveSafe @ blind.ignme.us

RussianSingles @ specialist.regdatingrussianladies.us

Snore_B_Gone @ culture.catho.us

The-Shepards-Diet @ able.worksweightloss.top

Warranty_Notification @ freeze.ltuck.us








Phish NETS:  Bad Apples

Nothing but rotten Apples this week.  Lots of them.  Here are two…

This awful phishing email came from the creatively constructed domain support-invalidlogin.com.  “Your APPLE ID We’ve noticed that some of your account informations appears to be missing or incorrect.”   Look how these criminals stretched out the Apple logo.  Would anyone fall for this?  God, we hope not.  A mouse-over of  “Login to Apple” reveals a shortened link at bit.ly.  We unshortened that link using URLEX.org and discovered that it points to the website mv-to.update-id-acc-DOT-com. A WHOIS lookup of this domain reveals that it was registered through an Australian Registrar on May 30 and the site description is listed as “DEPARTMENT OF THE ENVIRONMENT AND ENERGY.”



Though this next Apple phishing scam was better designed, there are still grammatical, punctuation and capitalization errors that give it away, in addition to the wrong from address and mouse-over link.  However, the best part of this stupid phish is the greeting… “Reversed Customer.”  We can’t help but smile sometimes at the foreigners who try so hard to separate us from our money.





YOUR MONEY:  Free Bonus at Bingo Hall, Auto Warranty Has Expired, and your MassMutual Life Insurance Acceptance Letter

Do you like playing bingo?  Did you know that it was invented by an Italian in 1530 according to Wikipedia.  We’re not surprised to learn that Bingo is played online for money at the real website called BingoHall.ag (.ag is the 2-letter country code for the islands called Antigua and Barbuda in the Caribbean.) But before you rush off to the real BingoHall.ag, you might want to read the reviews of some very pissed off consumers and people who say that the site isn’t trustworthy. However, this next email actually didn’t come from Bingo Hall.  It came from a subdomain (temple) of the domain qraze.us and the links point back to it.  Qraze.us  was registered just hours before the email came out by someone named “Edik Pendleton” from Benijofar, Spain and the site is being hosted in England.  The spammy white text at the bottom of the email came from a Yelp review of Pucket’s Grocery & Restaurant in Nashville, TN.  Would you like to give qraze.us your credit card information and open a new account now?



The design and presentation of these next two scam emails lead us to believe they were created by the same designer.  You be the judge…

From Final.Warranty.Notice @ removal.canvehiclewarrantextend.us comes the subject line “Notice your Auto Warranty Has Expired. Action Required. Ref. No. 22263215”  It even offers a username (your email) and an account ending in “2237.”  This is as phony as a $3 bill.  That long domain canvehiclewarrantextend.us was registered on June 1st by a Garvin Brockman from Bayanzurkh, Mongolia.  However, we are very interested in the “Great genuine barbecue” review at the bottom of the email!    Again, a Yelp review.  This one is for a BBQ in Rigby, Idaho called Lil’ Mike’s Smokin BBQ.  Sounds great!


This next offer expires in 72 hours, says Ian Johnson from the Approval Department of “MassMutual Life Insurance.”  Yeah, whatever.  You’ve received a guaranteed acceptance letter for life insurance, starting at less than $10 per month.  Can you believe that “you won’t need to take a medical exam or answer any health questions?”  That ought to confirm that it’s a scam!  But the greatest reveal, once again, is a simple WHOIS lookup of the domain.  Lifeinsurancewaited.us was registered by Edik Pendleton of Benijofar, Spain!  Looks like Edik represents both Bingo and Life Insurance!  What a well rounded repertoire.

Now delete.




TOP STORY: We Know The Best People

During the last few weeks we’ve been contacted by Dignitaries, International Attorneys and Barristers, Bank Managers, Chairmen and senior staff members of government agencies around the world. And many are waiting at airports for our reply!  This most exemplary list of special people even includes Vice President Mike Pence who emailed us as recently as June 3! This is all so exciting and our heads are swimming!  Vice President Pence must be traveling because the email came to us from an address in Italy.  Apparently he writes to inform us that $20 million dollars is to be delivered to our “humble address” through a delivery agent.  Do you doubt us?  People, we don’t make this sh*t up!  In fact, all of these amazingly special people have money for us.  We can’t possibly take up this column with all the good news so we’ll just share the email from Vice President Pence and below we’ll give you a link to a pdf file containing all the other wonderful emails we’ve received recently.

From: flaviogamerro@alice.it Time:  2017-06-03 06:58:03 Subject: Assigned By President Donald Trump

Assigned By President Donald Trump

I am  Mike Pence, and I am writing to inform you about your Bank Check Draft brought back by the United Embassy from the government of Benin Republic in the white house Washington DC been mandated to be deliver to your home address once you reconfirm it with the one we have here with us to avoid wrong delivery of your check draft Twenty million united states dollars $20,000,000,00usd that was assigned to be delivered to your humble home address by Honorable president Donald Trump the president of this great country this week by a delivery agent MR Jackson Perez

Also reconfirm your details for the check delivery by filling the form below and send it immediately to our Email in for verification and for prompt collection of your fund.

Fill The Form Below:

Full Names : Residential Address Mobile Number Fax Number Occupation Sex Age Nationality : Country : Marital Status :

A copy of your ID or passport

Accept my hearty congratulation again!

Yours Sincerely,

MR MIKE PENCE vice-president USA 1600 Pennsylvania Ave NW, Washington, DC 20500, United States

In addtion to Vice President Pence, our distinguished list of people includes:

Dr. Hassan Musa, senior staff of the Nigerian Ports Authority Mrs. Maria Tokunbo ; Bank Manager of BOA BANK, Abidjan Ci Robert Williams, Inspection Unit Manager United Nations Inspection Agency in Hartsfield Jackson International Airport Atlanta, Georgia Office of The Presidency, Nigerian Presidential Complex, Aso Rock Presidential Villa, Abuja-Nigeria. Diplomat Anthony Wharton Diplomat Andrew Ndife Diplomat Richard Harry Dr Charles Holliday Jr.. Bank of America, Vice Chairman on Investment Banking Director Abdel Whani, Chairman Payment Verification Panel Barrister Adewigi Wetigoma

You can pull up a pdf of the emails of all these distinguished people on our website!




FOR YOUR SAFETY:   Update on IRS Call Scam from India

We’ve reported on the phony IRS scam callers for more than a year now.  You can find recorded calls on our website here. These bastards have targeted hundreds of thousands of Americans and made millions of dollars from their high-pressure fraudulent tactics.  Last October, the Indian government successfully shut down a big IRS scam operation call center and these scams seemed to disappear as a result.

We’re sorry to report that they are back, and most likely from India again, judging by the accents.  Last week, Doug at TDS received IRS scam calls from the following phone numbers:




Of course, Doug couldn’t resist and he called back to speak to the “IRS agent.”  The agent suddenly seemed speechless when Doug turned the conversation to his scam.

 Click to play.



ON THE LIGHTER SIDE:   Grandma Goes Wild!

We used to think that 60 was the new 40.  Apparently, 88 is the new 50!  Whoduthunk that the headline “photos show grandma taking everything off” (from CNN live, no less.) would generate any interest.  I guess we’re wrong, according to this email from eliminateswrinkes @ oaksdarts.info.  We learn something new every day from the Internet.  **sigh**



Until next week, surf safely!