Phishing Expeditions keep getting better & better . . .

[britechguy]

Found in my inbox, sans the big red comment and redactions. The generic subject line should be enough to raise suspicions on its own. The "revert to this message" is the second big red flag. That being said, the rest looks pretty good. I had no idea where John Deere's corporate locations were until I checked, just for fun:

 

[frase]

 

[seashore]

"Kindly, revert to his message with some possible options."

Oh, I can think of a few.

 

[Markverhyden]

Thanks goodness they included that. If it was me I'd never had figured out who it was from..........

 

[britechguy]

Thanks goodness they included that

Sad thing is, this sort of thing is what gives it the little bit of realism, in my opinion. I've received way more than one organization/company that included such unnecessary inanity when it was on letterhead.

 

[MDD1963]

You reverting to the message expeditiously seems both logical, and mandatory!

 

[HCHTech]

I wonder if the usage of John Deere is related to your bucolic surroundings - just another way to target people, I guess.

 

[britechguy]

I wonder if the usage of John Deere is related to your bucolic surroundings

That certainly could be part of the calculus. The Shenandoah Valley is still "big in agriculture/farming" and you see a lot of John Deere, Mahindra, and other ag equipment brands here.

 

[britechguy]

Who falls for stuff like this? . . .

 

[ThatPlace928]

Who falls for stuff like this? . . .

View attachment 15913

The world has just enough idiots in it to make phishing scams successful.

 

[phaZed]

"P.P. Service" My immature is showing.

 

[wiz]

I wanted to share with you a useful Thunderbird add-on called TORPEDO that I've been using. It's a great program that enhances Thunderbird's functionality. You may find it beneficial for your work as well. Feel free to check it out when you have a moment.

KIT - Secuso Research - Results - Usable S&P Tools - Secure Communication - TORPEDO

secuso.aifb.kit.edu

 

[britechguy]

Latest gem:
--------------------------
Honored Respected and team ,

By subscribing, you guarantee that we will always provide excellent content, special features, and a flawless user experience. I appreciate your help.

Shipping Code: LJPSAD6U52EW
Product Code: 50079
Transaction Date: February 28, 2024


Quality and excellence are our commitments. Thank you.

With sincere gratitude and ongoing best wishes,
Zoraida Cavan
Cackson St, Rancho Cucamonga, California 87673

Adapt this message as necessary. We are here to help you!
-----------------

Of course, it had a false bill attached.

 

[thecomputerguy]

A client of mine went through this ... the scammers purchased a domain that looked similar to theirs except they changed a u to a v.

My client wasn't targeted. THEIR client was. What ended up happening is my clients client was compromised and they grabbed a signature for the CFO of my client. Registered the domain .. something like they registered bvngalo.com when my client is actually bungalo.com

They grabbed my clients signature, created an email called CFO@bvngalo.com, pasted and pasted the signature.

That cost my clients client like $30k-$40k.

My client was all upset because he thought it was his fault ... after checking ... it wasn't us, it was them.

 

[Markverhyden]

A client of mine went through this ... the scammers purchased a domain that looked similar to theirs except they changed a u to a v.

My client wasn't targeted. THEIR client was. What ended up happening is my clients client was compromised and they grabbed a signature for the CFO of my client. Registered the domain .. something like they registered bvngalo.com when my client is actually bungalo.com

They grabbed my clients signature, created an email called CFO@bvngalo.com, pasted and pasted the signature.

That cost my clients client like $30k-$40k.

My client was all upset because he thought it was his fault ... after checking ... it wasn't us, it was them.

Had the exact same thing happen to a customer. One of their customers had a domain created that was almost exactly the same. In that case the original was, for example, boxcorporation.com. The scammers created boxcorp.com. Of course free email with the hosting company. I'm sure the CC used was a stolen number. Once I identified the registrar and hosting I sent emails out to each advising about the scamming. They killed the DNS entries in a matter of hours. Our customer caught on almost immediately since it was a change of payment situation. Don't think anyone lost any money in that situation.