Anyone receiving any email scams directed at electricians?

[captaincaveman]

Hi all.

I've recently been receiving lots of iffy looking emails asking to send me pics of jobs that want doing. I've ignored some which are just too vague and suspicious but just replied to one which sounds more credible. Just wondering if there is a new wave of scams directed at electricians or whether I'm just getting paranoid. Anyone else getting these and has anyone been stung?

 

[rhitey]

Hmm ok so dumb question but what do these idiots gain from this exercise?
Is it just to bung our email addresses on more spam lists???

 

[Deleted member 26818]

Hmm ok so dumb question but what do these idiots gain from this exercise?
Is it just to bung our email addresses on more spam lists???

I imagine the photos that you would have to download after replying contain some Trojan Horse software, that will steal your data and cost you money.

 

[Wilko]

Hi - never never never open attachments from an unknown source. The attachment itself used to be the problem, but as Spin has said that can cleaned for us, if we are lucky. However within the attachment may be further links that you'll be asked to click on...
The missing phone contact is a good thought .

 

[MG201]

A guy I know who does roofing got caught put with this type of scam. They ministered his emails and when a invoice for 33k was paid they had sent an email to client changing bank details. .police got involved but as most scams he lost his £...as you are basicly downloading malware.

 

[SparkyChick]

Hmm ok so dumb question but what do these idiots gain from this exercise?
Is it just to bung our email addresses on more spam lists???

They could be looking to collect email addresses of possible targets. I'd be interested to know which of my email addresses these are being sent to, but as they are using the BCC field, it's impossible to tell.

Spamming or phishing is simply a numbers game. The more targets you have, the greater the chance someone will respond 'positively'. It costs nothing to send an email, so they have nothing to lose and potentially a lot to gain.

 

[JOURNEYMAN]

SparkyChick said: ↑
Before I reply to it... has anyone else received this email?

Yay! Was beginning to feel left out. Mine arrived today....binned it.

 

[plugsandsparks]

If you look at the pure message source data it will show you the email address it was sent to. Also the originating IP is Vienna Austria. I suspect they are bouncing off a system they have hacked there.

 

[SparkyChick]

So, I've had another email in response to the reply I sent... apparently, he's been out of town

Anyhow, it's following the pattern, and having investigated the link it gives you to click, AVG reported it as a Dropbox phising attack, but I suspect that is just the start.

So... if you get an email from [email protected] ignore it

The link goes to the domain filmden.xyz (I have reported the abuse by this domain to the company that handles the domain) and have sent an email to [email protected] reporting the email address.

I would encourage all of you to do the same. If you're unsure of how to get the required information out of the email, send me a PM on here to let me know to expect it, but forward the email to me and I'll get the information and report it to the relevant people.

If you have received one and have clicked the link, then make sure your anti-virus software is up to date and run a full scan of your system. If that doesn't find anything, you might be lucky, but my advice would be to download SpyBot Search and Destroy and run a full scan with that and Malware Bytes and run a full scan with that.

If I receive anymore, I may well start using a special email address that I can turn off in the future and reply to them to collect as many domains and emails as I can to try and make it more difficult for them, but I would encourage everyone who receives one of these to make the effort and report them.

 

[SparkyChick]

Update... wasn't expecting Microsoft to act quite so quickly, but that email address has apparently been suspended

 

[stuarth]

I received this one yesterday

Hello
I would like to get a quote for a full electrical job at my property and was wondering if you would be available to replace the fuse box and maybe just check the electrics for me? I may need a few sockets installed as well and also carry out some major renovation works there.
We are looking to change and fix in new LED Lights, Storage Heaters, Lighting, Cable, Consumer Units, Sockets & Switches.
Kindly get back to me so i can send you pics of the property and see if you are available to carry out the work.
Best regards

thanks for the heads up everyone

 

[Toneyz]

Update... wasn't expecting Microsoft to act quite so quickly, but that email address has apparently been suspended

Well done your actions have prevented others of us getting stung.

 

[MIDDLE EAST]

I’ve received a few of these recently, smelled a rat as there was no contact details or adress and the introduction was just a “hello”. The message also contradicts itself, stating a “full electrical job”, then a fuse board replacement and testing, then some specific jobs, then major renovations,(make your mind up). Steve Jones has sent me a couple. Good to know I’m not alone.

 

[SparkyChick]

Out of interest I tried the website that was hosting the dodgy content they wanted me to download... looks like it's disappeared as well.

So, as I said in my somewhat lengthy post... I encourage everyone who receives one of these to take the time and report them. The more people who do, the less chance there is that one of us will get stung.

 

[andysparkfree]

yep, seems wide spread, im glad i read this thread

 

[andysparkfree]

And yep again

 

[rhitey]

Well could turn into a long thread just had another one that looks a bit dodgy to me
Coming from a Hotmail.com address, what do you guys think?

Hi there,


We are looking to have our current kitchen extractor fan removed and then replaced with a new one.


Since moving into the house we have discovered that some of the work hasn’t been carried out to the safest standard and so need it doing professionally. The extractor fan isn’t on tiles, the tiles have been added around it, we can remove them before the job begins, but would be good to know beforehand.


If there could be a weekend between the two parts of the job, that would give us the time to do the decorating we want to do in the kitchen.


Is this something you would be able to do?


Thanks,

Natalie

 

[Gazthesparky]

There at it again I seem to be having a lot of these just reacently

Can safely say this has gone straight in the bin

 

[SparkyChick]

There at it again I seem to be having a lot of these just reacently

Can safely say this has gone straight in the bin

View attachment 44360

If by chance it's still in the bin, any chance you could forward it to me?

If so, PM me and I'll give you my email address.

 

[Gazthesparky]

If by chance it's still in the bin, any chance you could forward it to me?

If so, PM me and I'll give you my email address.

Why would you want this ??

 

[SparkyChick]

Why would you want this ??

Because the link that points to the dodgy file can be viewed. That reveals the domain they are using to host the payload they are trying to get you to download.

With that information, you can report the domain to the company that runs the top level domain they are using. And if they are doing their job properly, they'll suspend the domain. Every domain costs money, so the more they get reported, the more they lose and at some point it may end up not being a cost effective scam.

Same applies to the email address they used to send the mail to you. That can be reported to the company providing the mail service. Running such scams through say Gmail is frowned up and so the address should end up being shutdown.

 

[SparkyChick]

Oh and another useful nugget... if you get calls from the area code 01632 you can safely ignore them.

01632 is a fake area code reserved for use by TV programs etc. It does not exist and if it is displayed on caller ID, it's a good indication the caller ID is being faked. Only non-reputable companies will fake their number to be a non-existent number

 

[rhitey]

Well the plot thickens
Monday morning and I've had a reply to one of those crappy emails asking me to "download" all the documents and a similar download url to what SparkyChick said
https: //plightgen.xyz/Ivorycoast-Docplans/img/17/1
Reported Justinlewis0009@ outlook.com to outlook
Oh and I've added a couple spaces in the above so no one accidently clicks on them

 

[SparkyChick]

So seeing as how the top level domain .xyz seems to be popular with these scum bags... this is the website of the company that operates it:-

.xyz Official Registry Operator Website - https://nic.xyz/

They have an abuse policy and an easy means for reporting it. The domain I reported to them was taken off-line quite quickly.

And @rhitey , I commend your efforts reporting them. Thank you

The more people that take the initiative and report these scum bags, the more difficult it is for them to make their scam profitable. Every domain costs money, every email account costs money at some point. The more they end up out of pocket, the less inclined they will be to continue their scam.

 

[Richsand007]

Same here, offers with an attachment or link to click. Here’s a receipt one I received....

“
Hello I got your details online would like to get a quote for a full electrical job at my property and was wondering if you would be available to replace the fuse box and maybe just check the electrics for me? I may need a few sockets installed as well and also carry out some major renovation works there.

Kindly get back to me so i can send you pics of the property and see if you are available to carry out the work.

Pauline Bradley

“

 

[telectrix]

just report as phishing and microsoft will do the usual....bugger all.