Yesterday I had written a post about an email which pretends to be from Gmail team, which requested information about account details, browsers etc. you can read it here: Gmail Phishing Scam in Circulation Do not Reply

Today I received another email regarding the same, but the style of convincing to reply looks a little official. This is the email which I received:

Gmail is experiencing congestion causing slow network due to unused accounts registerred by most of our Users. Google Team want to remove/eliminate all unused/unwanted accounts.

Gmail also want to know how often you use your Account . Send us your domain login below for verification and for your account not to be shut down unexpectedly.

Account:
Password:
Birth date:
Country:

Warning!!!   Account owner that refuses to update his or her account within Seven days of receiving this warning will lose his or her account permanently.

Thanks Gmail!

G MAI L BETA

Have you noticed something, there are spelling and grammatical mistakes in the message. (I do not think that Gmail team will hire a 10 grade kid to write and send warning emails on their behalf ) They wanted to know how often I use my Gmail account, what a silly question? They already know how often and from which geographic locations (IPs) I login, which browser, operating system I use and more..

In the previous email, I tried to track the sender’s IP, and it was located at some place in South Africa.

In today’s email I tried to track the return path. Have a look below what I got
Return-Path: <karpoffaffiliates@gmail.com>
Received-SPF: pass (google.com: domain of karpoffaffiliates@gmail.com designates 10.239.193.19 as permitted sender) client-ip=10.239.193.19;Authentication-Results: mr.google.com; spf=pass (google.com: domain of karpoffaffiliates@gmail.com designates 10.239.193.19 as permitted sender) smtp.mail=karpoffaffiliates@gmail.com; dkim=pass header.i=karpoffaffiliates@gmail.com
Received: from mr.google.com ([10.239.193.19])
Sender: karpoffaffiliates@gmail.com
Received: by 10.239.193.19 with SMTP id g19mt77889hbi.207.1264948501790;

It is a little technical jargon, but we are not going to mess with it. The things important for us are the Return-Path (which is karpoffaffiliates@gmail.com)

I just Googled the email id karpoffaffiliates@gmail.com, and look what I found

When you will visit first 2, 3 listing you can easily find that the email belongs to KARPOFF AFFILIATES LLC.

Visit here: http://www.dealmakers.net/ads/ad_det.asp?id=1554 and you can get the whole picture.

So after doing all these research I am still unsure whether these emails are being sent by Gmail these, or some scammers.

But for your own safety, DO NOT REPLY.

Hope you all have found this post useful.

What is your opinion on this, please post in comments.

Do not forget to follow me on Twitter for updates.

Bookmark & Share!!!

Popularity: 9% [?]