American Express FAKE CHARGE with fake resolution link

Choosing NO Speak to a rep takes you to this fake site:

https://newtopgun.info/wp/4793222/11cd?0af77209=cb9399d6b4571c49a6e2e67bddef91a2

HEADERS:
Received: from 127.0.0.1
by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-6c7c7fc564-sf7bp.gq1.yahoo.com with HTTP; Mon, 21 Aug 2023 16:57:46 +0000
Return-Path: [email protected]
X-Originating-Ip: [149.72.217.41]
Received-SPF: pass (domain of send.ksd1.klaviyomail.com designates 149.72.217.41 as permitted sender)
Authentication-Results: atlas-production.v2-mail-prod1-gq1.omega.yahoo.com;
dkim=pass [email protected] header.s=m1;
dkim=pass [email protected] header.s=smtpapi;
spf=pass smtp.mailfrom=send.ksd1.klaviyomail.com;
dmarc=fail(p=NONE) header.from=lowvarates.com;
X-Apparently-To:
a5xYbRs5
Received: from 149.72.217.41 (EHLO o1377.shared.klaviyomail.com)
by 10.214.167.142 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Mon, 21 Aug 2023 16:57:46 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ksd1.klaviyomail.com;
h=content-type:from:mime-version:subject:reply-to:list-unsubscribe:to:
cc:content-type:from:subject:to;
s=m1; bh=XSkDRTAETU31d/x/7VcfOrPZs4QuI9nvwhyfxZLnnds=;
b=Ch8Jrf50HQW6iOkTjDFEHwrW0d2nvnZ7eu6GzHve5cmruBFFb778k+/p+/SunCBVIecb
RGZoD6fxCm/DTgQ1F8F/61GKfC0tCCgcK3LZS/Juouhmkr7qitTp0iW6J5wd7OwtBZKab2
+RAFZGdkE5JLiPeEQ4LOCNqRN/h44CcIo=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info;
h=content-type:from:mime-version:subject:reply-to:list-unsubscribe:to:
cc:content-type:from:subject:to;
s=smtpapi; bh=XSkDRTAETU31d/x/7VcfOrPZs4QuI9nvwhyfxZLnnds=;
b=nR3NtQJc6BQrjy0UZORReuGcVS1F7PH8zWzPhsnjjtebW6xJ9nxB1OUguckrSNreI0lb
ImTgnZf3ZVKNFkJMHqClYDUCZUipNNcyI4b+1m8pSO0o37MsQw9XnJCTNiV01XnlewHkBH
ndJ2Uc6UxmMXebgGDj+H4Knf3qsa08irY=
Received: by filterdrecv-84b96456cb-5hl7m with SMTP id filterdrecv-84b96456cb-5hl7m-1-64E3978A-1C
2023-08-21 16:57:46.405464677 +0000 UTC m=+8875170.374212162
Received: from MzIwNjY2Mzk (unknown)
by geopod-ismtpd-canary-0 (SG)
with HTTP
id Zz1Jod11ThWllxNdfoFEuQ
Mon, 21 Aug 2023 16:57:46.226 +0000 (UTC)
Content-Type: multipart/alternative; boundary=a8874eac511e5a0e8e7891e00561bf99ce3313af221ea8fdba315d1f8ddc
Date: Mon, 21 Aug 2023 16:57:46 +0000 (UTC)
From: “[email protected]” [email protected]
Mime-Version: 1.0
Message-ID: Zz1Jod11ThWllxNdfoFEuQ@geopod-ismtpd-canary-0
Subject: A recent charge attempt requires your attention
Reply-To: [email protected]
X-Kmail-Ops: 01H8CFZSN3F5PZHSKJEA20V5YZ
X-Kmail-Account: SVJX3T
X-Kmail-Message: 01H8CFZXFRXMNA2PRG03VS1E63
List-Unsubscribe:
=?us-ascii?Q?=3Chttps=3A=2F=2Fmanage=2Ekmail-lists=2Ecom=2Fsubscriptions=2Funsubscribe=3Fa=3DSV?=
=?us-ascii?Q?JX3T&c=3D01H8CFZSN3F5PZHSKJEA20V5YZ&k=3D39e?=
=?us-ascii?Q?3673fced06db6246c38265b238514&g=3DTBnfRp&?=
=?us-ascii?Q?m=3D01H8CFZXFRXMNA2PRG03VS1E63&r=3DXSButsC=3E?=
X-SG-EID:
=?us-ascii?Q?RGbuNFB3vcUQ3V2iz=2F4TBGggIMUpV=2FZzoYo3VRppI+HSEn1oRA0N6no4lXumHv?=
=?us-ascii?Q?PV6VaYNuo+KCs7grrbo7oto+G4Cdlk6Ip3rGTLc?=
=?us-ascii?Q?R2qwePKqlxkfk25pp7orfIhOA0vXgzFqpQTe8yb?=
=?us-ascii?Q?9Qzwh7SUBfo9KbjRpfCPDiMLUw89tebFl3xgRRS?=
=?us-ascii?Q?vMXrC+Ms0phgWO2uCu9HRDI2Gk069p6JRydneOC?=
=?us-ascii?Q?qAlcEpw4KZUQtPMBeQfm2edfoyOoDVnU24wV4bc?=
=?us-ascii?Q?WqtP3A9L1=2FJkiQS6O4Y0cuNDogyp6J6xjWcK9bb?=
=?us-ascii?Q?I4Q=3D?=
X-SG-ID:
=?us-ascii?Q?N2C25iY2uzGMFz6rgvQsb3WdckyvbC2eFaxvdDHn8D1nndBBW0fUClUlZF2fTQ?=
=?us-ascii?Q?6KFNfMiYlmHdQOxcjveirgDvcE3f88=2FedHpKUND?=
=?us-ascii?Q?yFZ8d4GuiMg1wM4It6lrY64g1yfX4kPw26+7DN9?=
=?us-ascii?Q?Q9vteHTRcY6HJWIYq1Ofx5WI7Oiw9=2FQRAdZDhlo?=
=?us-ascii?Q?=2FxMX7bl+fr81CQcm7PSZqrCRJPyap0srquL7RW+?=
=?us-ascii?Q?QXnrC2YRAIVS8qfRqNEtDZNZyQsmQTkchiEu6A8?=
=?us-ascii?Q?Mkp3uDLRxl=2FVi2tV1g+vA=3D=3D?=
To: .com
X-Entity-ID: NmidvORO5mqbNBD5aNBiaQ==
Content-Length: 35224

–a8874eac511e5a0e8e7891e00561bf99ce3313af221ea8fdba315d1f8ddc
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0

Does this look familiar?

=A0

Responding to this alert does not change the status of the charge.

2 Likes

website is already down which is pretty interesting seeing as its timestamped as today at 12:57. going to try and contact LowVARates and see if “Garrett Law” actually works there.

2 Likes

When I try the american express login page still comes up. It appears they want to get your login info. Try again it works:

https://newtopgun.info/wp/4793222/11cd?0af77209=cb9399d6b4571c49a6e2e67bddef91a2
[/quote]