Confused by a confirmation of a new Amazon “Prime Acct Gift” order that landed in your inbox today, when you know that you haven’t placed any such order? You’re not alone. The order with the subject ‘New-order #20953735 – confirmed’ (although the order number on yours may be different) from aaroncasey@realoffersnow.com (although your ‘from’ address may be different) is 100% a scam.
Here is what the email seems to say:
From: “Aaron Casey”
Subject: New-order #20953735 – confirmed
Date: October 14, 2016 at 12:37:23 PM MDT
…
Prime Acct Gift #18507806
…
Thank you, we appreciate it
Please confirm now for accuracy
…
Use anytime this week and enjoy the rest of your day
…
We thank you for being apart of our updates but if you wish to no longer be apart then tell us now and you will not hear more
Aiden Nieland ^ 942 Olympia Ave Ventura Ca 93004-2219
Kindly request these to no longer be sent when you let us know your preference
PO Box 971, Reno, NV 89504
Much of this is in what looks like an image, like this:
The Internet Patrol is completely free, and we don't subject you to ads or annoying video pop-ups. But it does cost us out of our pocket to keep the site going (going on 20 years now!) So your tips via CashApp, Venmo, or Paypal are VERY appreciated! Receipts will come from ISIPP.
Note that this is not actually an image, it is created with code. It is intended to make you think that if you click the link it will take you to Amazon.
However, where it really takes you is a place site called realoffersnow.com, and specifically it takes you to “http://daftee.realoffersnow.com” (don’t try it!)
And, if you look at the source code of the email, here is what it actually says:
From: “Aaron Casey”
Subject: New-order #20953735 – confirmed
Date: October 14, 2016 at 12:37:23 PM MDT
Prime Acct Gift #18507806
Thank you, we appreciate it
Please confirm now for accuracy
Use anytime this week and enjoy the rest of your day
We thank you for being apart of our updates but if you wish to no longer be apart then tell us now and you will not hear more
Aiden Nieland ^ 942 Olympia Ave Ventura Ca 93004-2219
Kindly request these to no longer be sent when you let us know your preference
PO Box 971, Reno, NV 89504
dont plan on starting now. I can understand that, but youll be safe with me; I promise. He said. I turned my head towards him. There was something in his eyes that drew me into him. It was , and the thought of sitting here for the next two hours wasnt a pleasant one. Fine, Ill go, I said hesitantly. But just to let you know, I may have an anxiety attack. He reached over and touched my hand. I shouldve pulled back, but I couldnt. He tilted his head and smiled. Youll be fine. We both got out of the Explorer and walked over to his motorcycle. The memories of the accident started to flood my mind. He handed me the helmet and saw I was shaking. He clasped my shoulders. Take a deep breath. Youll be safe. I took the helmet and put it on. There was something soothing about his voice. I trusted him, and I started to calm down. He straddled his bike and started it. He patted the seat behind him and told me to get on. I climbed on and leaned forward, wrappi ng my arms around him as tight as I could. I closed my eyes as he took off down the road, and the only thing I felt was the d against us and Lukes muscular form. He looked back for a second and asked me if I was ok. I told him I was. The sick feeling that I had a few minutes ago had ped, and it wasnt so bad riding with him; he made me feel safe. We reached our apartment building, and I let out a sigh of relief. He pulled into a parking space, and a car pulled up next to us. I looked over and saw my student, Charley, getting out of the car. Luke got off his bike as Charley ran up and hugged him. I took off my helmet. Miss Gilmore Charleys eyes lit up. Luke looked at her. This is Miss Gilmore; your teacher he asked in shock. Yes, Uncle Luke, thats her. She smiled. I looked at Charley with widened eyes. This is your uncle that youve been telling me about Yes It sure is Her smiled widened. A woman was walking over to us with a couple of bags in her hands. Luke immediately took t hem from her. She looked at me and held out her hand. Hi, Miss Gilmore, Im Maddie, Charleys mom. I smiled as I shook her hand. Its nice to meet you. Please call me Lily. Miss Gilmore, why are you riding on my Uncle Lukes motorcycle Charley asked. Your teacher lives in the apartment next door to me. Her car broke down, so I gave her a ride home, Luke said. I had no idea you lived here, Lily, Maddie said. Charley and I live in the apartments upstairs. My parents own the building. Uncle Luke, can Miss Gilmore come with us to the carnival on Friday Charley asked. Luke looked at me, and I looked at him. I could tell he was uncomfortable. Thank you for inviting me, Charley, but I t be able to make it, I said. Uncle
Those extra nonsense words are an effort to get around spam filters – and if you got this email in your inbox, guess what – it worked.
In case you’re wondering, realoffersnow.com was just created…wait for it…today!
whois realoffersnow.com
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2016-10-14T11:14:48.00Z
Creation Date: 2016-10-14T18:14:48.00Z
Registrar Registration Expiration Date: 2017-10-14T18:14:48.00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Domain Status: clientTransferProhibited icann[dot]org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: ANTONIA NIELAND
Registrant Organization: MORGANS & MORGANS FIRM
Registrant Street: 238 N BOWEN ST
Registrant City: JACKSON
Registrant State/Province: MI
Registrant Postal Code: 49202-4115
Registrant Country: US
Registrant Phone: +1.3058097175
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ANTONIAMORGANS01@GMAIL.COM
Registry Admin ID:
Admin Name: ANTONIA NIELAND
Admin Organization: MORGANS & MORGANS FIRM
Admin Street: 238 N BOWEN ST
Admin City: JACKSON
Admin State/Province: MI
Admin Postal Code: 49202-4115
Admin Country: US
Admin Phone: +1.3058097175
The Internet Patrol is completely free, and we don't subject you to ads or annoying video pop-ups. But it does cost us out of our pocket to keep the site going (going on 20 years now!) So your tips via CashApp, Venmo, or Paypal are appreciated!
Receipts will come from ISIPP.
I am getting the same thank you SCAM for the $645.60 payment.
On August 1, 2018, I received email near exact as Gary (above). Same amount, confirmation one digit different. Email includes link to “Track you order”, and linke for $50 amazon shopper reward. I checked my back accounts, where I made no such payment. I did not bother hitting the same unsubscribe link as Gary’s. Occasionally, I receive weird emails pertaining an Amazon transaction or an email that appears to be from Amazon. I happen to recognize these as not possible and just delete.
Thank_Y0u! Y0ur Payment of $645.60 was Successful. Confirmati0n-#402-8526980-0267429
(unsubscribe at PO Box 971, Reno, NV)
I just got this one in email looking like an Amazon automatic payment. I thought, WHAT THE HELL DID THE WIFE BUY NOW?
Remembering that there are a lot of scams going on, I checked into my Amazon account: no purchases there. Even though only one bank account is with Amazon, I checked all three of my bank accounts: no money being transferred.
Yep, another SCAM on the web. Enough money listed to make you choke on your breakfast.
How do we file a class action lawsuit against these idiots? It is illegal to use a false unsubscribe link!
To anyone who received this email with the University of Plymouth footer attached, please note this has nothing to do with the university and is a scam. Just delete it.
If you click “unsubscribe” I think you are playing right into their hand. How do I get rid of this?
A resurgence in domains (15+) registered under this name in the past couple of weeks (January, 2017) Junk emails, domain created the same day. ENOM should create a list of all domains by this registrant and lock them.