Friday, October 26, 2012

Another fake email claim to be from Liberty Reserve

Please ignore such type fraud emails, read what LR says about such type Fraud:
Liberty Reserve DOES NOT offer ANY investment opportunities directly or indirectly.

http://blog.libertyreserve.com/2011/06/notice-about-investments.html

Liberty reserve account number of this scammers :  U5782292

 Here is email and headers

Delivered-To: s*****n@gmail.com Received: by 10.14.119.201 with SMTP id n49csp67891eeh; Fri, 26 Oct 2012 06:26:04 -0700 (PDTReceived: from mr.google.com ([10.50.169.36]) by 10.50.169.36 with SMTP id ab4mr2572123igc.66.1351257964363 (num_hops = 1); Fri, 26 Oct 2012 06:26:04 -0700 (PDReceived: by 10.50.169.36 with SMTP id ab4mr2061362igc.66.1351257963797; Fri, 26 Oct 2012 06:26:03 -0700 (PDTX- Received: by 10.64.16.72 with SMTP id e8csp241849ied; Fri, 26 Oct 2012 06:26:02 -0700 (PDTReceived: by 10.204.156.81 with SMTP id v17mr7000268bkw.49.1351257962104; Fri, 26 Oct 2012 06:26:02 -0700 (PDTReturn-Path: <no_reply@libertyreserve.com>Received: from mail.bl.elta-kabel.com (ebl1.elta-kabel.com. [62.68.96.8]) by mx.google.com with ESMTP id fq15si2126246bkc.26.2012.10.26.06.26.01; Fri, 26 Oct 2012 06:26:02 -0700 (PDReceived-SPF: fail (google.com: domain of no_reply@libertyreserve.com does not designate 62.68.96.8 as permitted sender) client-ip=62.68.96.8;Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of no_reply@libertyreserve.com does not designate 62.68.96.8 as permitted sender) smtp.mail=no_reply@libertyreserve.comReceived: from smtp.bl.elta-kabel.com (unknown [62.68.100.62]) by mail.bl.elta-kabel.com (Postfix) with SMTP id 864321DF804C for  s*********@gmail.com>; Fri, 26 Oct 2012 15:11:34 +0200 (CEST)Received: from 57.176.52.83 by ; Fri, 26 Oct 2012 16:17:12 +0200Message-ID: <CLKUNFKAXRTBNHOYHBGYOU@hotmail.com>From: "" <no_reply@libertyreserve.com>Reply-To: "" <no_reply@libertyreserve.com>To: s*******@gmail.com Subject: New Message from Liberty ReserveDate: Fri, 26 Oct 2012 11:17:12 -0300X-Mailer: Microsoft Outlook Express 6.00.2600.0000MIME-Version: 1.0Content-Type: multipart/alternative; boundary="--230624667425533664X-Priority: 3X-MSMail-Priority: Normal
============================================

Please note that in all e-mails from Liberty Reserve we will:
Always address you by your first name.
Never send you any links or attached files.
Never ask you to send us your password and/or login PIN.
============================================

Dear Liberty Reserve Members,


Liberty Reserve has made considerable progress and improvement, it has become the leading e-currency and its services are being improved continuously.

Recently we have estabilished a very important relation with leading Forex traders from Costa Rica and we decided to give a special offer to you:

GET 150% RETURN IN 7 DAYS!

This opportunity will not last long, so you must react quickly.

Deposits are accepted until October 28. 2012. 00:00 (UTC), which means that you have about 35 hours to make a deposit in case you are interested in this offer.


One unit in this special program is worth 100 US dollars. The minimal deposit is 1 unit ($100), while the maximum deposit is 500 units ($50000) per member.

You need to make a spend to:

Liberty Reserve account - https://sci.libertyreserve.com/?lr_acc=U5782292

The 150% payout will be made back to your LR account in 7 days, on November 4. 2012. 00:00 (UTC).

The payout is GUARANTEED and there is no risk from losing your funds.

This is a TIME LIMITED ONE-TIME OFFER and you must ACT NOW!


Thank you.
 Please blacklist this LR account numbers: U5782292

Monday, June 18, 2012

Reset Liberty reserve account data trick

Today we pay Your attention to some old scam trick and show step by step how scum may gets Your private info to reset your Liberty reserve account data  to rob your LR.
 
First step scammer sent fake email that is claim to be from Liberty Reserve
Here is latest email, the name of this scum is  Romeo   
IP  83.18.26.138  
Operated from Spain
 
Here is email
============================================
Please note that in all e-mails from Liberty Reserve we will:
Always inform you about security changes.
Never send you any links or attached files.
Never ask you to send us your password and/or login PIN.
============================================
 1. The text above if fake  original text would  be like this:


=============================================================
Please note that in all e-mails from Liberty Reserve we will:
1. Always address you by your first name.
2. Never send you any links or attached files.
3. Never ask you to send us your password and/or login PIN.
=============================================================


Dear stfxxxxxxin@gmail.com
 2. LR always address you by your first name. Email isn't my name ;)

We are glad to present our new security improvements.

This is a real owner verification
Please login to Liberty Reserve account and update your security information today. If you don't update your account in 24 hours we will suspend your account and you will not be able to send or recive money.


How can I update my account information?


Click the link below and confirm your Liberty Reserve account information, otherwise your account access will be suspended:
https://www.libertyreserve.com/en/login

 3. The Link also fake, if you move muse over the link you will see real link, in this case
http://www.cbstur.com.br/twk.php  that is redirect you to another site, there is may be any link
since scum is used different sites
Please DO NOT reply to this e-mail.

Please help us to improve our security everyday.
Thank you for understanding.
For information and support please use our contact form in the help section of our web site.


Thank you.

If you click the link  you will be taken to Fake Liberty reserve site on this page

They ask you provide Your LR account number and Email that is used for LR, when you click "Confirm" button Info will be send to the scum.   And You will be taken to the next page
On this page they ask you provide Security Question / Answer / Zip    this info will be used later to reset Your Liberty reserve Pass, Pin and so on.  If you have gives them info and click "Proceed"
You will be take to Fake Google Mail  site   (In fact just page on the same server just imitated Gmail)
That's final step of their Fake Show, on this page victim gives them his Gmail  login  and will be redirect to real Liberty reserve site.
Later scum will be reset Your Liberty reserve Pass / Pin   and empty Your liberty reserve account.

Please,  ignore all such email, don't be Victim  don't give any chances to this scammers.
 
Rules is simple as always 

You can prevent spoof from affecting you

Spoof or phishing emails and the spoof websites often associated with them are deceptive in appearance. However, they contain content that reveals that they are fake. The most important thing to do to protect yourself is to be able to spot this misleading content:

What to watch out for

  1. Generic greetings. Many spoof emails begin with a general greeting, such as: "Dear Liberty Reserve member."
  2. A false sense of urgency. Most spoof emails try to deceive you with the threat that your account is in jeopardy if you don’t update it ASAP.
  3. Fake links. The text in a link looks valid, but then sends you to a spoof address. Always check where a link is going before you click. Move your mouse over it and look at the URL in your browser or email status bar. If the link looks suspicious, do not click on it, and be aware that a fake link may even have the text "LibertyReserve" in it. If you are not sure about an email, forward the suspicious email to Liberty Reserve support for analysis.

Questions Liberty Reserve will never ask you in an email

To help you better identify fake emails, we follow strict rules. We will never ask for the following personal information in emails:
  • Credit and debit card numbers;
  • Bank account numbers;
  • Driver’s License numbers;
  • Email addresses;
  • Passwords;
  • Your full name.

Saturday, April 28, 2012

Another Phishing liberty Reserve site


There is 3 fake sites currently

libcrtyreserve.com libCrtyreserve.com
libertyrcserve.com libertyrCserve.com
llbertyreserve.com lLbertyreserve.com

WHOIS info:
IP Information for 194.28.132.171
IP Location: Ukraine Ukraine Fortune Science And Production Company
ASN: AS47434
Reverse IP: 4 websites use this address.

This guy send spam from the hacked sites to avoid spam abuse and domain blocks here is a spam email they try to trick you:

==================================
Please note that in all e-mails from Liberty Reserve we will:
1. Always address you by your first name.
2. Never send you any links or attached files.
3. Never ask you to send us your password and/or login PIN.
==================================

Dear Customer,

Your account has been blocked due to 5 unsuccessful Reset Code tries. Please take action if you did not try to login to your account.

You have 3 hours to change your password and update security questions, also you will be charged with 0.50$ unlock fee. In order to unlock your account here:

http://sci.libcrtyreserve.com/?unlock=true

Please DO NOT reply to this e-mail.

For information and support please use our contact form in the help section of our web site.

Thank you.

Please note that Liberty Reserve Always address you by your first name, WILL NEVER ask you to click on on any hyperlinks, to validate your account, or to supply ANY info through e-mail.
There may be NO WAY to unblock or validate your account by clicking any links.
Please, Blacklist all sites above.