New Phishing site lebirtyreserve.com

Another Phishing liberty Reserve site created by HYIP scammer

Site link - _http://lebirtyreserve.com/en/customer/verify/
Domain: lebirtyreserve.com

Registration Service Provided By: Gold-Domain's Customer
Contact:
Domain name: lebirtyreserve.com
Registrant Contact:

John Schreck alanmorniem@yahoo.ca
Fax:
1245 Glenwood St.
Livermore, 94550
US


Whois Records lebirtyreserve.com
IP Address: 76.73.94.204
IP Location: United States - Illinois - Woodstock - Fdcservers.net
There are 40 domains hosted on this IP address.

Mass spam send out from two different hosting accounts

First from account maxicash( blacklotus.net )
X-PHP-Script: 208.64.126.5/tmp/log/kirang.php for 94.23.114.11
Second from the variofun (nvhserver.com )sent out from site sofixfund.com
X-PHP-Script: sofixfund.com/images/temp/kirang.php for 94.23.114.11, 94.23.114.11

Phishing spam emails going around right now, claiming to be from LibertyReserve

Here is a copy of the received emails:

Return-Path:
Received: from server13.nvhserver.com (server13.nvhserver.com [72.20.34.206])
by mx.google.com with ESMTP id g14si722385vcj.141.2010.08.11.10.22.07;
Wed, 11 Aug 2010 10:22:08 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of variofun@server13.nvhserver.com designates 72.20.34.206 as permitted sender) client-ip=72.20.34.206;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of variofun@server13.nvhserver.com designates 72.20.34.206 as permitted sender) smtp.mail=variofun@server13.nvhserver.com
Received: from variofun by server13.nvhserver.com with local (Exim 4.69)
(envelope-from )
id 1OjF0A-0008U0-QZ
for xxxxxxx@gmail.com; Thu, 12 Aug 2010 00:22:06 +0700
To: xxxxxxx@gmail.com
Subject: Liberty Reserve Security Measures!
X-PHP-Script: sofixfund.com/images/temp/kirang.php for 94.23.114.11, 94.23.114.11
From:
Reply-To: no_reply@libertyreserve.com
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Thu, 12 Aug 2010 00:22:06 +0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server13.nvhserver.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [569 565] / [47 12]
X-AntiAbuse: Sender Address Domain - server13.nvhserver.com

Business account at Liberty Reserve

Dear Member,

We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive Liberty Reserve account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.


How can I restore my business account access?

Click the link below and confirm your Liberty Reserve account information, otherwise your Liberty Reserve access will remain restricted:
http://libertyreserve.com/en/customer/verify/

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience.

© 2002 — 2010 Liberty Reserve S.A. All rights reserved.

Phishing site reservexchange.net

Phishing site reservexchange.net his Web page appears to be directed to getemoney.com, but is actually pointed at reservexchange.net site instead.

On this page they ask you download "invoice"  actually archive contains a virus that will steal your Liberty Resrve account number and password.

MasterSurfs.com scam - Fake email

There is a Phishing spam email going around right now, claiming to be from LibertyReserve
Here is a copy of the received email:

To: xxxxxxxx@gmail.com Subject: Liberty Reserve New Investment Program 

MIME-Version: 1.0Content-type: text/plain; charset=iso-8859-1 

From: "no_reply@libertyreserve.com" <no_reply@libertyreserve.com> 

Reply-To: "NoReply" <support@mastersurfs.com>

X-Priority: 3
X-Mailer: PHP 4
Message-Id: server9.go-mama-hosting.com>
Date: Sat, 19 Jun 2010 17:07:26 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server9.go-mama-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 32002] / [47 12]
X-AntiAbuse: Sender Address Domain - server9.go-mama-hosting.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: possiblefunds.com:/public_html/mail

============================================
Please note that in all e-mails from Liberty Reserve we will:
Always address you by your first name.
Never send you any links or attached files.
Never ask you to send us your password and/or login PIN.
============================================

Dear ,

MasterSurfs Ltd. is a registered company in the USA and is the most trusted name
for online making money . You can advertise your favorite website
and show it to who is interested in it...


Advantages of MasterSurfs.com :

1.Make THOUSANDS U.S DOLLARS a day (14.9% x 10 days = 149%)
2.5% Referral commission (upgraded members)
3.1% Referral commission (free members)
4.Each unit costs $2
5.Payout in 24 hours (No Minimum)
6.Earnings guaranteed
7.24/7 Support services
8.Experience forums to learn about MasterSurfs
9.30 Free credits for joining
10.Up to 2 sites to advertise


Pay with:

- CreditCards, AlertPay, Liberty Reserve and Bank wire!


Use the following link to join here for free :

http://www.mastersurfs.com


Regards

----------------------------------------------------------

Tel : +1 213-784-4265
Fax : +1 213-784-4265

M.Surfs Ltd.
7660 Beverly Blvd 243
Los Angeles, CA 90036
USA

Sender is scam admin of Mastersurfs.com fraud site started by
well known scammer who has launched multiple fraud autosurf programs before this one.
Some of them :
fundssurf.com
Magicsurfs.com
Auto-surfs.com
Goldensurfs.com
Dollarsurfs.com
Coinsurf.com

Avoid please this fraud - autosurf just like plague. Don't spend single cent in this scam.

Another intresting fact that this spam send out from Possiblefunds.com site, looks like this scumbag also scam people with HYIP's too.

Phishing email

Phishing email, sender Cedexinvest.com Hosting: nvhserver.com

Subject: Liberty Reserve Service
X-PHP-Script: 72.20.34.206/~cedexinv/procces.php for 125.167.250.141, 125.167.250.141
From: no_reply
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Sun, 25 Apr 2010 16:43:06 +0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server13.nvhserver.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [517 513] / [47 12]
X-AntiAbuse: Sender Address Domain - server13.nvhserver.com

Dear Sir or Madam,





===============================

Thank you for using a Liberty Reserve service.

This letter was sent to your Liberty Reserve account.
===============================


As you may have noticed, Liberty Reserve's website was offline or undergoing various software upgrades a few weeks ago because of the need to apply some new security updates to the system. Everything is fine now but we need you to confirm your account with us. Please click on the following link and verify your account info by filling the form. This is done because there is a chance that some accounts do not function properly with the newly updated system and we would like to ensure that you are the genuine holder of the account. In case you don't fill all the fields, and an internal system conflict occurs between your account and system database, your Liberty Reserve account will be locked down for an unknown period of time.
We apologize for any inconvenience this might cause.

Please click on the following link to verify your account:


_http://www.libertyreserve.com/en/customer/login2/account/

Hiden link is:
http://fibertyreserve.com/en/customer/login2/account/

For information and support please e-mail us at support@libertyreserve.com

Thank you.

© 2002 — 2010 Liberty Reserve S.A. All rights reserved.

Phishing site: http://fibertyreserve.com
IP Information for 72.20.34.206
IP Location: United States United States Fullerton Staminus Communications
Resolve Host: server13.nvhserver.com
IP Address: 72.20.34.206
SSL Cert: www.rockfxltd.com SSL Certificate has expired.
Reverse IP: 61 other sites hosted on this server.

Phishing email

Phishing email,

** Liberty Reserve Account Block Notice **

Your account has been blocked due to numerous invalid login attempts. You will be unable to send and receive funds until your account has been activated. Click here to remove block from your account:
-http://www.libertyreserve.com/en/customer/unblock.aspx

hidden link :
_http://www.xjsparts.com.au/images/Libertyreserve.com/qwp/

Failing to unblock your account will result temporary account suspension.
Sincerely, Liberty Reserve Customer Service

If you receive this e-mail
* Do not reply.
* Do not open any attachments. Attachments may contain malicious code that will infect your computer.
* Do not click on any links.
If you clicked on links in a suspicious e-mail or phishing Web site and entered confidential information, change email and passwords and also Lgin PIN and Master Key - immediately

Phishing site: http://www.xjsparts.com.au/
IP Information for 209.25.170.13
IP Location: United States United States Dania Liquidnet Ltd
Resolve Host: supremeserver15.com
SSL Cert: liquidnet ltd. SSL Certificate has expired.
Reverse IP: 649 other sites hosted on this server.

lrexchange.net is a Fraud LibertyReserve "exchange site"

lrexchange.net is a Fraud LibertyReserve "exchange site", they claim to pay 25% additional bonus on Exchange Liberty reserve (LR) to PayPal (PP)or AlertPay (AP)
http://www.lrexchange.net
IP Location: United States United States Los Angeles Webnx
Resolve Host: 67-220-217-230.hosted.static.webnx.com
IP Address: 67.220.217.230
Reverse IP: 2,294 other sites hosted on this server.

Fraud LR # U3706256 (Investors Account)
Stay away from this site please
Don't be a victim!

Gudoil.net - Gudoil Fraud via API

This scum forced naive users to install API for getting paid and then steal all the money from their Liberty accounts via API.

---------- Forwarded message ----------
From: Gud Oil
Date: Fri, 26 Mar 2010 14:16:45 +0100
Subject: Re: HAVE INVESTED
To: *************

We want to pay you now

Sir we can not currenlty send money with direct. transfer we need to
make it a secure transfer.

For us to be able to pay you follow this steps.

1. Login to your Liberty Reserve Account.

2. Click On Merchant Tools

3. Click On Create new API

4. FIll the form *API Name, *Security Word and also remember to check
on "Enabled" and also Transfer "Enabled".

5. Send us The API Name and the Security Word you use. ( this is
important to make the transfer securely.)

By sending us this, it will help us to transfer you fund to you securely.

Regards
Admin

Fraud LR # U7626786 (GUDOIL INVESTMENT)

Fraud LR

Cheating at HYIP forums: posting fake LR# and claim that it is LR number of some HYIP site for making deposit Fraud LR # U6710999

Financenova sent out Phishing Emails

Fraudulent emails, claim to be from liberty reserve department sent out from Financenova.com server.

Subject: Liberty Reserve Offer - ACT NOW!
X-PHP-Script: www.financenova.com/admin.php for 212.150.184.108
From: no_reply@libertyreserve.com
Reply-To: no_reply@libertyreserve.com

Dear user

Liberty Reserve has made considerable progress and improvement, it has become the leading e-currency and its services are being improved continuously.

Recently we have estabilished a very important relation with leading Forex traders from Costa Rica and we decided to give a special offer to you:

GET 148% RETURN IN 7 DAYS!

This opportunity will not last long, so you must react quickly.

Deposits are accepted until April 2. 2009 00:00 (GMT), which means that you have about 32 hours to make a deposit in case you are interested in this offer.


One unit in this special program is worth 100 US dollars. The minimal deposit is 1 unit ($100), while the maximum deposit is 1000 units ($100000) per member.

You need to make a spend to:

Liberty Reserve account U1931963 - https://sci.libertyreserve.com/?lr_acc=U1931963

The 148% payout will be made back to your LR account in 7 days, on April 9. 2010. 00:00 (GMT).

The payout is GUARANTEED and there is no risk from losing your funds.

This is a TIME LIMITED ONE-TIME OFFER and you must ACT NOW!

Thank you.

Liberty Reserve Team

Fraud LR # U1931963 and U6619747 (Finance Nova)