Fake Download Open Office 2009 – Credit Card Fraud

Hi,

This morning I’ve discovered another funny Fraud attempt, based on a fake membership to Download Open Office 2009. This is the mail that I’ve received:

—————————————————————–

Open Office Suite 2009

Open, Create & Edit Your Files
Download Office Suite 2009??Here
Edit Word, Excel & Power Point files- 100% MS Office Compatible.

Office Solutions

Read and write PDF files just like Adobe.
Here’s how to download Open Office 2009:
1. Go to: Download Page
2. Download Open Office 2009
3. Receive access immediately
This software package is the best way to edit your documents.
Publish all of your documents online in the HTML format.
Thank you for choosing us, the worldwide leader in Open Office 2009.
For More Information Visit our Website
Thank You,

David Matthews

If you want to stop receiving mail, please go to:
http://daily–new-product.org/
or you may contact us at the following address:

Plaza Neptuno, local #7
Via ricardo J Alfaro, Tumba Muerto
Panama Ciudad
Republica de Panama

—————————————————————–

Republica de Panama? and OpenOffice?..that really strange you don’t !?!?

but let see this ‘great offer’..by clicking on the link reported into mail we are suddenly prompted to:

http://67.214.168.130/openoffice/index.asp?aff=001&camp=openoffice_espd&kbid=1587&sub=oo_espd&pop=1

and also this as you should understand sounds strange.. OpenOffice Website that is based upon an IP..

A classical well designed fake page, now let’s click on download, and as we can see we are asked for Membership, after filling email and Name/Surname fields appears the core of the Scam, the Membership to Be Activated needs a Credit Card PaymentūüėČ

After accepting we are infront off a classical phishing form that contains:

  • Name
  • Surname
  • Location
  • PostalCode
  • E-Mail
  • Cc Number
  • CcV2
  • Scad

Here you can see the screenshot:

After clicking system “validates” you transaction and the fraud is successfully completedūüôā

Here some information about the used IP

IP Information for 67.214.168.130

IP Location: United States United States South Bend Colostore.com
IP Address: 67.214.168.130
Blacklist Status: Clear

Whois Record

OrgName:    Colostore.com
OrgID:      KCA-7
Address:    1805 South Michigan Street
City:       South Bend
StateProv:  IN
PostalCode: 46613
Country:    US

ReferralServer: rwhois://rwhois.colostore.com:4321/

NetRange:¬†¬†¬†67.214.160.0¬†–¬†67.214.191.255
CIDR:       67.214.160.0/19
OriginAS:   AS12260
NetName:    COLOSTORE-COM
NetHandle:  NET-67-214-160-0-1
Parent:     NET-67-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.COLOSTORE.COM
NameServer: NS2.COLOSTORE.COM
Comment:    http://www.colostore.com
RegDate:    2007-09-28
Updated:    2008-07-21

See you to the next post..ūüôā

8 Responses to Fake Download Open Office 2009 – Credit Card Fraud

  1. Dionisio J Mazuze says:

    thank you for taking a step to stop this, me personally i received the same email, but i suspected it because when i clicked it didnt direct me to the website of open office, so i decide to go to the site but the release that was there is 3.x.x.x not 2009

    God bless

  2. wildnspeady says:

    I wish I would have seen this before I got suckered into trying to buy the product. I paid threw paypal…instead of getting a download page I got a broken link…2 hrs later and 5 emails with the exact same links, I asked for my money back….funny they can get my money instantly out of my paypal but they claim it will take 4 to 10 business days for me to get my money back. I wished I would have looked into them better, but they are sneeky they dont even tell you what company they are really untill after you pay…and the company is Advance Telecom Inc. if you look them up you will find they have done this alot with other programs as well…..like seling avg 7.xxxx a free download and passing it off as an upgraded full version avg8.

  3. Juuso says:

    Hi
    Yeah, I got the same mail and needed the dang thing to open a book dokument I¬īd written while working in a Windows environment.
    I never got anywhere from those addresses.
    So it was a scam?
    Just my luck!
    Thanks for your vigilance!

    Juuso

  4. evilcodecave says:

    Hi,
    Thank you for the comments people!ūüôā
    feedbacks are always good to read!

    Juuso, yes this is another for of Scam

    Regards,
    Giuseppe ‘Evilcry’ Bonfa’

  5. karsook16 says:

    Hey thanks for this update on this latest scam…..I recently got a similar email but the name of the sender was changed to “Greg Matthews” instead of “David Matthews”….

  6. Leanne says:

    I just got one from the same people after I downloaded open office.
    sender was Greg Matthews as well.

  7. Loan Guy says:

    Hi, possibly our post may be off topic but anyways, I’ve been browsing around your blog and it looks really neat. It is obvious that you know your subject and you are fervent about it. Iím creating a fresh weblog and I’m striving to make it look great, plus provide the best quality information. I’ve gleaned much at your website and also I anticipate additional quality information and will be back soon. Thanks.

  8. For having lived long, I have experienced many instances of being obliged, by better information or fuller consideration, to change opinions, even on important subjects, which I once thought right but found to be otherwise.†

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: