Content Director Doug Fodeman | Creative Director David Deutsch | Issue 311


We want to play a game with our readers… Guess the Scam site!  Below are four websites that offer auto transport services.  One of them is a complete fraud.  Can you guess which is the scammer’s website? You can use whatever tools or resources you want to help you make your decision. (Please note that though we have used three different online tools to test for malware on the scammer’s site, we have no control what these nefarious characters may do with their websites. However, given the type of scam this represents, it would be extremely unlikely for them to set a malware trap on their site.  If you visit these sites, you do so at your own risk. We visited all of these websites on August 1 and found no risks.)  We’ll reveal the scam website in our Top Story below.

Montway Auto Transport

Nationwide ShipEx


Direct Express Auto Transport

There are many different ways to see through scams.  Nigerian 419 scams are probably the easiest of all simply because the reality is that ONLY scammers will contact us via email to say that they have money to give to us, or wish us to enter into a business partnership, etc.  However, we would like to remind our readers that one of the ways to see through scam emails is when you get an email from one address but are asked to reply to a different address (or that reply is automated in the “reply-to” settings.)  Also look for country codes in sender’s email addresses.  These will often reveal that the email is highly suspicious.  Here are three examples.  The emails were sent from India, Brazil and Romania. All of them ask you to reply to a different email address than the one used to contact you.


August, 2020 marks our sixth full year of exposing online and phone-related threats, scams and fraud. We want to thank our many thousands of readers for contributing their stories, scam texts, emails and suspicious social media posts over the years.  It is only with your effort and willingness to share your experiences that we are able to offer such relevant and important content. We are very proud of this partnership with our readers and the fact that together we have helped more than a million people to recognize these risks and learn how to avoid them.  Education against cyberthreats is key!

Check out our newest article about a fake businessman and construction company!  Read Michael Hills and Hills Inc. Construction is a Scammer.

Daily Scam Home Page

Amazon, Apple ID, and Wells Fargo Bank

During the last few weeks we have been informing readers of a noticeable increase in scam emails disguised as product purchases and containing call-back phone numbers.  What makes these emails so dangerous is that they don’t contain any clickable links (or working links).  They offer phone numbers to call to cancel your order (that you never placed to begin with!)  Here is another such email that pretends to an Amazon purchase of a Firestick for $799! The Firestick shown in the email can normally be purchased for about $40-$50. But wait, you can call the scammer’s phone number 877-546-5672 to cancel your order.  This email was sent from a generic iCloud account.  Calling these scam phone numbers is VERY DANGEROUS because these cybercriminals are so clever at manipulating people once they have them on a phone call.


WARNING: If you use Google to investigate suspicious phone numbers, BE EXTREMELY CAREFUL NOT TO CLICK on links to any websites EXCEPT the most well-known websites like  The cybercriminal gangs who target us KNOW that most of us will search for phone numbers in Google.  They have created lots of malware-laden websites displaying their scam phone numbers that try to infect our computers when we click a link to investigate them.  For example, searching for 877-546-5672 pulls up a link to the crap domain lbogbjtgu[.]xyz. This domain was registered in Japan in October, 2019 and is hosted on a server in Germany.  Step away from these bear traps!


Here is another phish pretending to be from Amazon asking for a “Payment Address Verification Request.”  Apparently, your Amazon account has been blocked “because our service has detected two unauthorized devices.”  The email didn’t come from, but came from “,” a domain that was registered less than 3 weeks earlier. The link in this email will redirect to a hacked website for a restaurant in Spain (“.es” = España = Spain)


Though this next email says FROM “” the REAL email address is in the <> brackets that follow.  The email came from vcuxas[.]com, a domain that was registered just 4 days earlier in Canada.  The message says that they have been unable to “charge you for your account” and that you’ll be locked out in three days.  Of course, that’s not how Apple operates.  The link obviously doesn’t point to!

One of our longtime readers sent us this email pretending to be from Wells Fargo Bank about an “unusual incorrect sign in attempt.” We were curious about the oddly named domain that showed up when we moused over “Verify Here.”  When we looked it up we discovered that the domain used in this link is for a hacked website to a lock service in Vietnam!

Daily Scam Home Page


CVS Reward, CVS Shopper Raffle Text and Watch Video Here

Though the TDS reader who sent us this next email about a CVS “EXCLUSIVE OFFER” didn’t have a working link for us to trace, the scam is obvious!  Look at the FROM address! ‘Nuf said!


This text from 586-785-5936 claims to be about a “Shoppers raffle” in which we won “this weeks C.V.S. survey!”  We’re invited to pick a $87+ surprise.  However, neither the phone number nor the link have any connection whatsoever to CVS.  The domain v5u0[.]com was registered on July 16, about 10 days before this text was received.  We took a screenshot of the webpage at the end of that link.  The “reviews” left by “Verified” people are lame and we don’t believe any of them!  By the way, the statement at the bottom of the webpage connected to this link say “Limited Supply: 9 Rewards Remaining.” It is another dark pattern to engineer a click!

Another staple in the cybercriminal clickbait collection for many years was an email invitation to watch a video.  We hadn’t seen this type of clickbait in some months, until recently.  Check out this malicious clickbait that did NOT come from CNN and was never reported by CNN.  Subject line is “Why you should put garlic in your ear before going to sleep.”  Fortunately, the Zulu URL Risk Analyzer had no problem identifying that the link leads to a malicious website.  The domain used, instionyl[.]us, was registered by someone named Ranjeet Roy in India in May.


Daily Scam Home Page


Can You Guess the Scam Site?

Last week, one of our TDS readers sent us the following email, recognizing immediately that it was a fraud.  Here are the red flags we noted:

  1. The email represented a business but came from a generic email service (Yahoo) and not the business.

  2. The name in front of the email address (Shakira Miller) doesn’t match the name in the email address (aab.abdullah73)

  3. The email is signed by “Nick Rogers,” the “Personnel Manager” for Nationwide Shipping Experts.  However, the email was sent from Shakira Miller (or Aab Abdullah). 

  4. The recipient is asked to contact a different email address than that of the sender:  This is VERY standard practice by most online scammers who use email as their primary method of contact, especially scammers from Africa.

  5. The English used in the email is so awkward as to be comical.  The sender is clearly not a native English speaker.  This very likely indicates the scammer is from another country where English is not the native language.

  6. The recipient is offered the job without EVER having met or spoken to anyone at the company!

  7. The list of “Basic Duties” is simply stupid.  ‘Nuf said.

This scammer’s bogus website is listed as Nationwide Shipping Experts at the domain “”


If you were not comfortable visiting this scam website, here is a screenshot of if from our visit last weekend.  (Click to enlarge.) There are 2 important things to note…

  1. The address listed is 416 Marshall Street, Milford, DE 19963.

  2. The website owners misspelled the company name in the contact email provided at the bottom of the page!


Why are we so sure this business website is a complete fraud?  Let’s start with the domain name itself. was registered in Russia on May 7, 2020 --less than 3 months ago.


We used to look up the address for this international auto transport company and discovered that the address is for a 4-bedroom, 800 square foot house in Maryland that was last sold in February for $80K.


And finally, the well respected computer security company McAfee has blacklisted the website for this business.  If you discovered other reasons to be suspicious about, we invite you to let us know and we’ll share them with our readers next week.  In the meantime, we encourage ALL our readers to send an email to and report this website as fraudulent. GoDaddy is the registrar and hosting service for this fake website. Send them a link to our Top Story!


Daily Scam Home Page


Salacious Scams

Imagine getting an email with the subject line “Pictures of your wife (naked)...”  Most people would likely be upset by this and click to open the email, only to find that it is an email about Erectile Dysfunction, or so it seems.  This is actually another piece of malicious clickbait.  The link “Click the link now, you will thank me later!” (NO, you won’t!) leads to a website that has been identified as malicious by the service Forcepoint Threatseeker.  Step away from this ledge!


Until next week, surf safely!

Forward to Friends

About Us
Contact Support
Manage Subscription


Produced by:
Deutsch Creative
Copyright © 2020 The Daily Scam, All rights reserved.

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

Email Marketing Powered by Mailchimp