Panto tickets email nasty

[Dos_Box]

Bizzare! I've just recived two obvious nasties in my in-box addressed to two EduGeek email addresses I use and strangely they are for Panto tickets to see Peter Pan in Bournmouth!

The sending IP address for this is in Lithuania and they want you to print out the attached PDF (yeh, right!).

I'd put this up in security but that does not get indexed and is hidden from non-members so I thouight I's put it in here in case you get any relatives phoning you up should you they receive similar.

What makes this differant is that the email itself looks very well done (see attached pic) and authentic. I was on the verge of calling Mrs Dos_Box to see if she'd booked something for the kids (albeit 250-odd miles away!).

Anyone esle had something similar?

 

Edited September 8, 2014 by Dos_Box

[Hefferzzzz]

+1

 

I had this email through this morning too. It is a very well done email with all of the correct details for BH Live (including email address) and as far as I could tell, no spelling mistakes!

 

It prompeted me to call my card company and just check that nothing had been charged.

 

I can see this one catching a lot of people out.

[CadlaM]

We've had this too. I assume from the similarity in MO that its from same source as last week's "Westlothian" Scam e-mails. Blacklisted it.

 

It looks so genuine that Sophos PureMassage not identifying it as Spam

[hardtailstar]

Thanks for the heads up, i'll keep an eye out.

[spacebar]

Same here, It almost had me, apart from the fact there is no attachment that I can see, and also no VAT.

 

However I can see many people falling for it.

[Dos_Box]

I've emailed the Bournmouth Pavillion Theatre and let them know. I can see them getting a lot of calls in the very near future!

[Dos_Box]

+1

 

I had this email through this morning too. It is a very well done email with all of the correct details for BH Live (including email address) and as far as I could tell, no spelling mistakes!

 

It prompeted me to call my card company and just check that nothing had been charged.

 

I can see this one catching a lot of people out.

 

Yeah, I had to check my card details against the invoice too. Thankfully not mine.

[Hefferzzzz]

I've emailed the Bournmouth Pavillion Theatre and let them know. I can see them getting a lot of calls in the very near future!

 

Their number is already down due to volume of calls, apparently no room in the queue!

[spacebar]

Just had another one.

[visioN]

Someone from here rang and got through to a voice mail saying they had been hacked and to ignore the e-mails!

 

probably why they looked so genuine

[visioN]

Just rang the number myself - they've said they didn't send, nor did the e-mails come from them. Spoofing?

[CAM]

TBH, unless I expect an invoice the title alone is enough to get instantly deleted without even opening the mail. I get so many of them.

[Gatt]

We've had these at the University I work at too

 

We blocked it using the seat allocation string which appears to be consistent amongst all the emails sent out

[Dos_Box]

TBH, unless I expect an invoice the title alone is enough to get instantly deleted without even opening the mail. I get so many of them.

 

The thing is, we do take our kids to shows and events etc. and sometimes they don't send out the tickets until a few days before and we do recive some via email.

You unclutured swine

[Chris_]

I had this email this morning also. I thought it looked all quite genuine, apart from I hadn't booked any tickets, and I couldn't see the attachment. I was expecting a .zip containing some nasty along the lines of cryptolocker. I thought I could take the IT support office for a Christmas outing

[hawc]

I got one, for some reason, Branson mail got it. I did check, and the card number it gave was none of mine

[penfold_99]

You could tell it was a fake straight away as the price for print-at-home was far to cheap, if it was £5 or £10 i would have been more believable.

[MatthewL]

Got it through on my phone this morning, had to look twice as it looked quite genuine but there was no chance is was a mis typing of the email address as it was to my domain. Just deleted it and didn't check the headers out, one of the better ones I have seen for while.

[CAM]

The thing is, we do take our kids to shows and events etc. and sometimes they don't send out the tickets until a few days before and we do recive some via email.

You unclutured swine

 

Spammers have more cultured targets in mind now?

 

Also just seen this flash up in my spam digest. Atomwide snagged it at 10am (and as you can see I don't do theatre either, must be a generic template gone horribly right).