Web Analytics Made Easy -

Blog posts of '2018' 'December'

01785 463 178 BT Fake Calls - you are going to be disconnected, press 1

01785 463 178 BT Fake Calls - you are going to be disconnected, press 1

We have been receiving reports of suspect phone calls, allegedly from BT stating that the service is about to be shut down and to please press 1 for details.

Now we have not taken the plunge of actually pressing 1 to speak to someone but can report that the 1471 lookup gives a number of 01785463178 which will not receive calls 'the number you have called is not recognised' which seems odd as it is the BT service that gives the number in the first place and so it should be correct.

These calls are being received by people who are on the BT 152 call protect privacy service which seems strange as you would think that the numbers would be protected.

Either way none of the customers of BT being contacted have had their service removed and so this is obviously a scam.

If we intercept a call we will try speaking to someone to find out what they are trying to extract from people and report back.

Urgent to all residents of the building - Spam Warning !!

Urgent to all residents of the building - Spam Warning !!

This email is interesting as it appears to be aimed at smaller companies sharing a large office building where staff may not know the name of the fire-safety officer or building administrator.

The email itself, however, is very simple and has no signature to impress authority on anyone:




From:                                                       Frances Moyer <[email protected]>

Sent:                                                         11 December 2018 13:43

To:                                                            Support

Subject:                                                   Urgent to all residents of the building


Hi All,
Please find below the Up to date emergency exit map.


Emergency Exit Map.


Frances Moyer,
Estate Management

The link for 'Emergency Exit Map' is actually pointing at a Google Drive folder: https://docs.google.com/uc?id=1JPbpDcSLpHmb1fsAO4mJHNK7jDOpXAwK which is a link to an application to harm your computer.
We have reported this link to Google and it will hopefully be dropped today.
Report the originating email address as fraudulent and do not run any executables you download from the web under any circumstances.
PayPal Automatic Notification - Spam Warning!!

PayPal Automatic  Notification - Spam Warning!!

This email has been seen today in the UK:




From:                                                       PayPal Services <[email protected]>

Sent:                                                         11 December 2018 18:47

To:                                                            Accounts Team

Subject:                                                   PayPal Automatic  Notification






Ag Promotion, here are your invoice details









The following Invoice Notification is being sent to you personally by PayPal Inc.



Thank you so much for utilizing PayPal and here is your receipt.
Your PayPal Invoice has been paid and now accessible for download.

 Make sure you click the link previously mentioned to see in depth information.





Help Fees   |  Shop









Click the link to Unsubscribe

Make sure you don't respond to this email. We're unable to respond to requests sent to this email. For instant answers to your inquiries, visit our Help by simply clicking "Help" found on any PayPal page.




PayPal is Licensed as a Money Transmitter by the New York State Dept of Monetary Services. PayPal, NMLS #920537, Permit #FB2341, Ma Foreign Transaction Certificate. PayPal, Inc., Transmit Funds By Money Order By The Division of Banking, Commonwealth of Pennsylvania. PayPal, Rhode Island Licensed Money Transferor. PAYPAL, NHOS #910447, PERMIT #34967, IS REGISTERED THROUGH THE GA DEPT OF BANKING AND FINANCING. 




Copyright laws 2018 PayPal, Inc. All rights reserved. PayPal is placed at 2215 N. 1st Street., San Antonio, CA 96131.





 The link 'Get Receipt' is actually pointing at http://earthchangingmoment.net?32Ee24=[email identification string] where the =[String] will log your email address with the spammers.
The spammers have also kept all of the social networking links from a real PayPal email to feign authenticity.
There is no website to speak of at http://earthchangingmoment.net but do please report it as fraudulent anyway, at least until it is repaired.
You got notification from DocuSign Electronic Service - Spam Warning!!

You got notification from DocuSign Electronic Service - Spam Warning!!


This email, posing as a Docusign email, is actually from qualitybumper.com.

The email itself attempts to persuade you to open a link to 'review an invoice' from DocuSign:




From:                                                       DocuSign Signature  Service <[email protected]>

Sent:                                                         10 December 2018 17:44

To:                                                            Accounts Team

Subject:                                                   You got notification from DocuSign Electronic Service








Review and sign an invoice.


Dear Receiver,

Please sign this invoice
This is an electronically generated notice.


This email holds a secure link to DocuSign. Do not share this link with others.

Additional Signing Way
Please visit DocuSign.com, click on 'Access Documents', and enter the code: 0E99A5B514

About DocuSign
Sign documents in just minutes. It is risk-free. No matter if you are in an office, at home or even across the globe -- Our service gives a trusted solution for Digital Operations .

Questions regarding an Invoice?
In case you need to modify the document or have concerns , reach out to the sender directly.

If you cannot sign an invoice, please visit the Help page on our support Center .

This message was sent to you by DocuSign Electronic Signature Service.



The link marked 'Review Invoice' actually points to: http://wfqaonline.com?32sE1=[string] where presumably the string is informing the website owner of your email address.
If we try and browse to the website itself, we find it to be an IIS server with no website, with or without a string following the equals sign and so the website does nto give a recognisable response but may just make a not of your email address for their database. If it does, it does so very fast.
Please mark the source email as a spam source and the website as dangerous so that the owner can take action.