Attacks aimed at company inboxes, vendors, and procurement rather than individual consumers.
View All Tags
This is a official email. We are the Domain Registration Service company in Shanghai, China. The Chinese domain name registration scam, back for the third time in our archive, sent from a nine-month-old domain with the same phone numbers and the same Shanghai address as the version we dissected in June 2024.
The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.
We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.
You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.
Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.
We are reaching out to inform you that your domain registration with WordPress.com is approaching its expiration date and requires renewal to maintain active status. A pixel-perfect WordPress.com notice sent from an Italian postmaster mailbox, whose only button points at a German health domain.
A firm in Germany needs a supplier of extracted materials from India for production in there plant. The same sender, the same dummy recipient, nineteen hours later, with every phrase swapped for a synonym.
Our firm in Germany needs a supplier of extracts materials from India, reply for details. Fifteen words, no company name, no signature, sent from a free Polish mailbox to somebody else's address.
Judicial Notice. Case Matter: Tax Dispute / Financeira. Investigating Authority: Renda Tax Department, Government of India. A summons from a tax authority that does not exist, sent from a free Outlook mailbox, still carrying the Portuguese words of the template it was copied from.
Warning: do not use this project as a template for your mailing campaign! A fraudster sent us the built-in demo file of a commercial mass-mail program instead of the scam, exposing the machinery behind the campaign.
