Friday, December 10, 2010

Fraud website - libertyforfree.com

New Modern Technique to stole your money from Liberty Reserve account.
A fraudster send you spam via the internal LR-mail, here is the message that they sent to me.
Subject : Get Free $ 1 LibertyReserve daily!
Message:

Date: 12/10/2010 20:41:02

From: U9673940 (AN)

Subject: Get Free $ 1 LibertyReserve daily!

Message Hello.

You have to do nothing, just register in our program!

No sponsoring required to get paid!

No registration fee!

Referral commission 10 %!

www.libertyforfree.com



After registration they send you automatic email with instruction to next step for grab Free 1$
I was not surprised when I read that letter, here is

Hello, xxxxxxx

To complete registration you must setup your Liberty Reserve account:

1. Login to your Liberty Reserve account.

2. Click On "Merchant Tools".

3. Click On "Create new API".

4. Fill this information:
a. *API Name: isdnoir
b. *Security Word: isdnoir1
c. Check "Enabled"
d. Check Available Operations "Transfer" and "Balance"
e. Enter your Master key.

5. Click on "Submit".


Congratulations!
Now you have successfully registered in the program!

Your referral link:
http://www.libertyforfree.com/?ref=Uxxxxxx


LibertyForFree Team
-------------------------------------------------------
Get Free $ 1 daily to your Liberty Reserve account!


Well, you should never follow the instructions mentioned in the above.
Don't Create any API for someone, NEVER. If you share the API info it's same as you give someone your Login / Password and Pin. You will lose all of your money in LR at the same time !!!!!!


Fraud LR # U9673940 (AN)
Fraud site libertyforfree.com
Stay away from this site please
Don't be a victim!

Thursday, November 4, 2010

Same fraudster ( owner lEbIrtyreserve.com ) used another trick to scam people by offering Fake "Promotional Forex trade program" and entice you to pay him via Liberty Reserve.
Fraudster liberty reserve account number is: U6182712 (Liberty Reserve FX)
Dear Liberty Reserve Members,


We are please to announce that Liberty Reserve has made considerable progress and improvement, it has become the leading e-currency and its services are being improved continuously.

Recently we have estabilished a very important relation with leading Forex traders online: InstaForex Group , Prime4x, FXOpen and Finexo.com (Safecap Investments Ltd) so we have started a Promotional Forex trade program using high ranked Brokers.



================================================================================

GET 150% RETURN IN 7 DAYS! PAYOUT GUARANTEED BY LIBERTY RESERVE S.A. RISK FREE!

================================================================================

Deposits are accepted until 15. November 2010 00:00 (GMT)


One unit in this special program is worth 10 US dollars. The minimal deposit is 1 unit ($10), while the
maximum deposit is 1.000 units ($10.000) per member. ID verification required for deposits over 5.000 USD.

================================================================================
================================================================================

If you decide not to lose this great opportunity you need to make a spend to:

Liberty Reserve account U6182712 - https://sci.libertyreserve.com/?lr_acc=U6182712
*Account Name: Liberty Reserve FX - Memo: "No. of units" and e-mail.

================================================================================
================================================================================

The 150% payout will be made back to your LR account in 7 bussiness days from the time you make your deposit.

Example: If you decide to invest 10 Units in our Fx Program you will get 15 units after 7 trading days - (150 usd)

The payout is GUARANTEED and there is no risk from losing your funds.

This is a TIME LIMITED ONE-TIME OFFER and you must ACT NOW! Your money will not go to any third-party, they will be stored in our sistem-currency.

================================================================================
Keep your account secure by following these simple rules:
Do NOT click on any links!
We will never send you attached files or ask you to update your login information.
Contact us if you are unsure about an email you received.
================================================================================

Thank you,

Liberty Reserve Team


Note Liberty Reserve never sends you any offer by email.
Never assume that if a particular email or website has the words, "libertyreserve" in its name for example it has anything to do with Liberty Reserve.
1. Never access your Liberty Reserve account by clicking on any link in an email.
2. Never open or view any email attachment that is purported to be from Liberty Reserve.

Tuesday, November 2, 2010

lebirtyreserve.com new fraud triks

lebirtyreserve.com fraud site moved to new new hosting 1sthost-inc.
Continue sent out Phishing spam email, claiming to be from Liberty Guard (LibertyReserve anti Phishing software)
This is new trick that would cause you to download Trojan software and steal money from your LR account.
A Trojan horse, or Trojan, is malware that appears to perform a desirable function for the user prior to run or install but instead facilitates unauthorized access of the user's computer system. "It is a harmful piece of software that looks legitimate. Users are typically tricked into loading and executing it on their systems"

Here is a copy of the fake email:

Return-Path:
Received: from server2.1sthost-inc.net ([76.73.94.202])


LibertyGuard
Liberty Guard Features
° Notifies you with a blinking "You're on LibertyReserve.com" icon on the bottom right corner of Firefox when you visit the real Liberty Reserve web site. If the icon is not blinking then you are on a fake web site.
° Blocks fake (phishing) web sites that were reported to us by users like you.
° Updated every hour for increased security and every time you start firefox.
° Allows you to add four more web sites to the list of good web sites.
° Open source - you can view the source code of the plugin to verify that it is safe for use.
° Let us know if you want more features added to Liberty Guard.
What is Liberty Guard?
LibertyGuard is a Firefox plugin that blocks fake/phishing web sites that will try to steal your Liberty Reserve password. It will also notify you when you visit the real Liberty Reserve web site.
How can fake web sites steal my password?
These web sites are called phishing web sites. These web sites were made by hackers to look as real as possible to Liberty Reserve web site. These web sites will try to scare you that your LR account might get closed if you do not provide your Liberty Reserve password. Some people might fall for this trick and will provide the hackers their login info to their LR account.
Why should I use Liberty Guard?
For the same reason why people put car alarm on their cars - extra protection against thieves. We recommend using this plugin even if you can distinguish the real LR web site from a fake one because some fake web sites will also try to infect your computer with viruses. LibertyGuard will block the fake web site and its viruses from getting to your computer.
Please Update your Guard Now and get protecty your account.
Download LibertyGuard Now!



© 2002 — 2010 Liberty Reserve S.A. All rights reserved.


Don't be a victim! Don't download a file! Don't click on email links.

Thursday, August 12, 2010

New Phishing site lebirtyreserve.com

Another Phishing liberty Reserve site created by HYIP scammer

Site link - _http://lebirtyreserve.com/en/customer/verify/
Domain: lebirtyreserve.com

Registration Service Provided By: Gold-Domain's Customer
Contact:
Domain name: lebirtyreserve.com
Registrant Contact:

John Schreck alanmorniem@yahoo.ca
Fax:
1245 Glenwood St.
Livermore, 94550
US


Whois Records lebirtyreserve.com
IP Address: 76.73.94.204
IP Location: United States - Illinois - Woodstock - Fdcservers.net
There are 40 domains hosted on this IP address.

Mass spam send out from two different hosting accounts

First from account maxicash( blacklotus.net )
X-PHP-Script: 208.64.126.5/tmp/log/kirang.php for 94.23.114.11
Second from the variofun (nvhserver.com )sent out from site sofixfund.com
X-PHP-Script: sofixfund.com/images/temp/kirang.php for 94.23.114.11, 94.23.114.11

Phishing spam emails going around right now, claiming to be from LibertyReserve

Here is a copy of the received emails:

Return-Path:
Received: from server13.nvhserver.com (server13.nvhserver.com [72.20.34.206])
by mx.google.com with ESMTP id g14si722385vcj.141.2010.08.11.10.22.07;
Wed, 11 Aug 2010 10:22:08 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of variofun@server13.nvhserver.com designates 72.20.34.206 as permitted sender) client-ip=72.20.34.206;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of variofun@server13.nvhserver.com designates 72.20.34.206 as permitted sender) smtp.mail=variofun@server13.nvhserver.com
Received: from variofun by server13.nvhserver.com with local (Exim 4.69)
(envelope-from )
id 1OjF0A-0008U0-QZ
for xxxxxxx@gmail.com; Thu, 12 Aug 2010 00:22:06 +0700
To: xxxxxxx@gmail.com
Subject: Liberty Reserve Security Measures!
X-PHP-Script: sofixfund.com/images/temp/kirang.php for 94.23.114.11, 94.23.114.11
From:
Reply-To: no_reply@libertyreserve.com
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Thu, 12 Aug 2010 00:22:06 +0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server13.nvhserver.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [569 565] / [47 12]
X-AntiAbuse: Sender Address Domain - server13.nvhserver.com

Business account at Liberty Reserve

Dear Member,

We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive Liberty Reserve account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.


How can I restore my business account access?

Click the link below and confirm your Liberty Reserve account information, otherwise your Liberty Reserve access will remain restricted:
http://libertyreserve.com/en/customer/verify/

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience.

© 2002 — 2010 Liberty Reserve S.A. All rights reserved.

Monday, June 21, 2010

Phishing site reservexchange.net

Phishing site reservexchange.net his Web page appears to be directed to getemoney.com, but is actually pointed at reservexchange.net site instead.
On this page they ask you download "invoice"  actually archive contains a virus that will steal your Liberty Resrve account number and password.

Saturday, June 19, 2010

MasterSurfs.com scam - Fake email

There is a Phishing spam email going around right now, claiming to be from LibertyReserve
Here is a copy of the received email:
To: xxxxxxxx@gmail.com Subject: Liberty Reserve New Investment Program 
MIME-Version: 1.0Content-type: text/plain; charset=iso-8859-1 
From: "no_reply@libertyreserve.com" <no_reply@libertyreserve.com> 
Reply-To: "NoReply" <support@mastersurfs.com>
X-Priority: 3
X-Mailer: PHP 4
Message-Id: server9.go-mama-hosting.com>
Date: Sat, 19 Jun 2010 17:07:26 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server9.go-mama-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 32002] / [47 12]
X-AntiAbuse: Sender Address Domain - server9.go-mama-hosting.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: possiblefunds.com:/public_html/mail


============================================
Please note that in all e-mails from Liberty Reserve we will:
Always address you by your first name.
Never send you any links or attached files.
Never ask you to send us your password and/or login PIN.
============================================

Dear ,

MasterSurfs Ltd. is a registered company in the USA and is the most trusted name
for online making money . You can advertise your favorite website
and show it to who is interested in it...


Advantages of MasterSurfs.com :

1.Make THOUSANDS U.S DOLLARS a day (14.9% x 10 days = 149%)
2.5% Referral commission (upgraded members)
3.1% Referral commission (free members)
4.Each unit costs $2
5.Payout in 24 hours (No Minimum)
6.Earnings guaranteed
7.24/7 Support services
8.Experience forums to learn about MasterSurfs
9.30 Free credits for joining
10.Up to 2 sites to advertise


Pay with:

- CreditCards, AlertPay, Liberty Reserve and Bank wire!


Use the following link to join here for free :

http://www.mastersurfs.com


Regards

----------------------------------------------------------

Tel : +1 213-784-4265
Fax : +1 213-784-4265

M.Surfs Ltd.
7660 Beverly Blvd 243
Los Angeles, CA 90036
USA


Sender is scam admin of Mastersurfs.com fraud site started by
well known scammer who has launched multiple fraud autosurf programs before this one.
Some of them :
fundssurf.com
Magicsurfs.com
Auto-surfs.com
Goldensurfs.com
Dollarsurfs.com
Coinsurf.com

Avoid please this fraud - autosurf just like plague. Don't spend single cent in this scam.

Another intresting fact that this spam send out from Possiblefunds.com site, looks like this scumbag also scam people with HYIP's too.

Saturday, April 24, 2010

Phishing email

Phishing email, sender Cedexinvest.com Hosting: nvhserver.com

Subject: Liberty Reserve Service
X-PHP-Script: 72.20.34.206/~cedexinv/procces.php for 125.167.250.141, 125.167.250.141
From: no_reply
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Sun, 25 Apr 2010 16:43:06 +0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server13.nvhserver.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [517 513] / [47 12]
X-AntiAbuse: Sender Address Domain - server13.nvhserver.com

Dear Sir or Madam,





===============================

Thank you for using a Liberty Reserve service.

This letter was sent to your Liberty Reserve account.
===============================


As you may have noticed, Liberty Reserve's website was offline or undergoing various software upgrades a few weeks ago because of the need to apply some new security updates to the system. Everything is fine now but we need you to confirm your account with us. Please click on the following link and verify your account info by filling the form. This is done because there is a chance that some accounts do not function properly with the newly updated system and we would like to ensure that you are the genuine holder of the account. In case you don't fill all the fields, and an internal system conflict occurs between your account and system database, your Liberty Reserve account will be locked down for an unknown period of time.
We apologize for any inconvenience this might cause.

Please click on the following link to verify your account:


_http://www.libertyreserve.com/en/customer/login2/account/

Hiden link is:
http://fibertyreserve.com/en/customer/login2/account/

For information and support please e-mail us at support@libertyreserve.com

Thank you.

© 2002 — 2010 Liberty Reserve S.A. All rights reserved.



Phishing site: http://fibertyreserve.com
IP Information for 72.20.34.206
IP Location: United States United States Fullerton Staminus Communications
Resolve Host: server13.nvhserver.com
IP Address: 72.20.34.206
SSL Cert: www.rockfxltd.com SSL Certificate has expired.
Reverse IP: 61 other sites hosted on this server.

Wednesday, April 21, 2010

Phishing email

Phishing email,
** Liberty Reserve Account Block Notice **

Your account has been blocked due to numerous invalid login attempts. You will be unable to send and receive funds until your account has been activated. Click here to remove block from your account:
-http://www.libertyreserve.com/en/customer/unblock.aspx
hidden link :
_http://www.xjsparts.com.au/images/Libertyreserve.com/qwp/
Failing to unblock your account will result temporary account suspension.
Sincerely, Liberty Reserve Customer Service

If you receive this e-mail
* Do not reply.
* Do not open any attachments. Attachments may contain malicious code that will infect your computer.
* Do not click on any links.

If you clicked on links in a suspicious e-mail or phishing Web site and entered confidential information, change email and passwords and also Lgin PIN and Master Key - immediately

Phishing site: http://www.xjsparts.com.au/
IP Information for 209.25.170.13
IP Location: United States United States Dania Liquidnet Ltd
Resolve Host: supremeserver15.com
SSL Cert: liquidnet ltd. SSL Certificate has expired.
Reverse IP: 649 other sites hosted on this server.

Sunday, April 18, 2010

lrexchange.net is a Fraud LibertyReserve "exchange site"

lrexchange.net is a Fraud LibertyReserve "exchange site", they claim to pay 25% additional bonus on Exchange Liberty reserve (LR) to PayPal (PP)or AlertPay (AP)
http://www.lrexchange.net
IP Location: United States United States Los Angeles Webnx
Resolve Host: 67-220-217-230.hosted.static.webnx.com
IP Address: 67.220.217.230
Reverse IP: 2,294 other sites hosted on this server.

Fraud LR # U3706256 (Investors Account)
Stay away from this site please
Don't be a victim!

Saturday, April 3, 2010

Gudoil.net - Gudoil Fraud via API

This scum forced naive users to install API for getting paid and then steal all the money from their Liberty accounts via API.
---------- Forwarded message ----------
From: Gud Oil
Date: Fri, 26 Mar 2010 14:16:45 +0100
Subject: Re: HAVE INVESTED
To: *************

We want to pay you now

Sir we can not currenlty send money with direct. transfer we need to
make it a secure transfer.

For us to be able to pay you follow this steps.

1. Login to your Liberty Reserve Account.

2. Click On Merchant Tools

3. Click On Create new API

4. FIll the form *API Name, *Security Word and also remember to check
on "Enabled" and also Transfer "Enabled".

5. Send us The API Name and the Security Word you use. ( this is
important to make the transfer securely.)

By sending us this, it will help us to transfer you fund to you securely.

Regards
Admin

Fraud LR # U7626786 (GUDOIL INVESTMENT)

Fraud LR

Cheating at HYIP forums: posting fake LR# and claim that it is LR number of some HYIP site for making deposit Fraud LR # U6710999

Financenova sent out Phishing Emails

Fraudulent emails, claim to be from liberty reserve department sent out from Financenova.com server.

Subject: Liberty Reserve Offer - ACT NOW!
X-PHP-Script: www.financenova.com/admin.php for 212.150.184.108
From: no_reply@libertyreserve.com
Reply-To: no_reply@libertyreserve.com


Dear user

Liberty Reserve has made considerable progress and improvement, it has become the leading e-currency and its services are being improved continuously.

Recently we have estabilished a very important relation with leading Forex traders from Costa Rica and we decided to give a special offer to you:

GET 148% RETURN IN 7 DAYS!

This opportunity will not last long, so you must react quickly.

Deposits are accepted until April 2. 2009 00:00 (GMT), which means that you have about 32 hours to make a deposit in case you are interested in this offer.


One unit in this special program is worth 100 US dollars. The minimal deposit is 1 unit ($100), while the maximum deposit is 1000 units ($100000) per member.

You need to make a spend to:

Liberty Reserve account U1931963 - https://sci.libertyreserve.com/?lr_acc=U1931963

The 148% payout will be made back to your LR account in 7 days, on April 9. 2010. 00:00 (GMT).

The payout is GUARANTEED and there is no risk from losing your funds.

This is a TIME LIMITED ONE-TIME OFFER and you must ACT NOW!

Thank you.

Liberty Reserve Team

Fraud LR # U1931963 and U6619747 (Finance Nova)