TOPIC:

Hello,

Today, few of our club officers have received a spam email that starts out by asking if you have time, and then the meat of it comes down to below. Curious whether this is just our club (and if so any actions for us), or is it happening at higher than club level, and you are already aware of this!  The email or phone does not belong to Chris. The imposter also followed up with a text message from (213)757-9021From: Chris Bojrab <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Sent: Tuesday, October 10, 2023 10:34 AM
To: Mayur Shah <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Subject: Re: [External] Premier ToastmastersOkay Mayur, Here is what I need you to do, Kindly make the purchase of 4 Nordstrom giftt cards at a denomination of $100 each, amounting to $400 from any nearby store or gas station. Get back to me with the picture of the receipt once you have them. Let me know how soon you can get them and how you would prefer to be reimbursed.

RegardsChris Bojrab
Thanks,
Mayur Shah
Club: 0918568
Premier Toastmasters (premiertoastmasters.org/)
 

Our spam items say our FB profile/page/website will be deleted if we don't click the link below.  I've warned everyone to not click these links.

Emails are going to our contact us email.  Is there a link to a support document for blocking spam?

And, I've answered my own question:  support.toastmastersclubs.org/doc/item/reducing-spam

Hello Support Team,

While I am waiting to hear back on this topic, 
I also found out that the exact same pattern of fraudulent email (where the person poses as club officer and starts off by asking "is this a free time for you!"), is also experienced by other club/s. I am curious if this is currently being looked into?

Below is an example of another club:

---

Forwarded message

---

From: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Date: Tue, Oct 10, 2023 at 10:36 AM
Subject: [ABA SPEAKeasies: ] ABA SPEAKeasies
To: This email address is being protected from spambots. You need JavaScript enabled to view it. <This email address is being protected from spambots. You need JavaScript enabled to view it.>Nandini, Is this a free time for you?

If yes, please email me as soon as you can.

Regards,
Tamaara Piquion 
 

Please post the entire internet email headers so we can see where this email is really coming from.

Example 1)  Below is the one I received as VPE where the imposter signed as our club President:From: This email address is being protected from spambots. You need JavaScript enabled to view it. <This email address is being protected from spambots. You need JavaScript enabled to view it.> On Behalf Of This email address is being protected from spambots. You need JavaScript enabled to view it.
Sent: Tuesday, October 10, 2023 10:08 AM
To: Mayur Shah <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Subject: [External] Premier Toastmasters
 Mayur, Is this a free time for you?


If yes, please email me as soon as you can.

Regards,
Chris Bojrab 
 Example 2)  Below is the one an officer from another club received where the imposter signed as their club President:

---

Forwarded message

---

From: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Date: Tue, Oct 10, 2023 at 10:36 AM
Subject: [ABA SPEAKeasies: ] ABA SPEAKeasies
To: This email address is being protected from spambots. You need JavaScript enabled to view it. <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Nandini, Is this a free time for you?


If yes, please email me as soon as you can.


Regards,
Tamaara Piquion
 Is this spam? Click the following link or go to the web page below to add this sender's email address (This email address is being protected from spambots. You need JavaScript enabled to view it.) to your FreeToastHost club website email blacklist: Click To Block Sender
Web Page: https://9424.toastmastersclubs.org?blacklist=01026574-flixtarty%40gmail.com&_=EANM

I need to see the internet headers for those emails.

Here is the internet header for email I received at Premier Toastmasters:

Internet Header:
Received: from PUZPR03MB6854.apcprd03.prod.outlook.com (2603:1096:301:e3::14)
 by TY0PR03MB8246.apcprd03.prod.outlook.com with HTTPS; Tue, 10 Oct 2023
 15:08:32 +0000
Received: from SG2PR02CA0066.apcprd02.prod.outlook.com (2603:1096:4:54::30) by
 PUZPR03MB6854.apcprd03.prod.outlook.com (2603:1096:301:e3::14) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.6863.38; Tue, 10 Oct 2023 15:08:29 +0000
Received: from SG1PEPF000082E2.apcprd02.prod.outlook.com
 (2603:1096:4:54:cafe::59) by SG2PR02CA0066.outlook.office365.com
 (2603:1096:4:54::30) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6886.27 via Frontend
 Transport; Tue, 10 Oct 2023 15:08:29 +0000
Authentication-Results: spf=pass (sender IP is 50.19.253.65)
 smtp.mailfrom=toastmastersclubs.org; dkim=pass (signature was verified)
 header.d=toastmastersclubs.org;dmarc=pass action=none
 header.from=toastmastersclubs.org;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of toastmastersclubs.org
 designates 50.19.253.65 as permitted sender) receiver=protection.outlook.com;
 client-ip=50.19.253.65; helo=toastmastersclubs.org; pr=C
Received: from toastmastersclubs.org (50.19.253.65) by
 SG1PEPF000082E2.mail.protection.outlook.com (10.167.240.5) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.6838.22 via Frontend Transport; Tue, 10 Oct 2023 15:08:28 +0000
Received: from localhost.localdomain (toastmastersclubs.org [127.0.0.1])
    by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 39AF8QgG005994
    for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Tue, 10 Oct 2023 15:08:26 GMT
Message-Id: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170])
    by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 39AF8Onq005960
    (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=OK)
    for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Tue, 10 Oct 2023 15:08:25 GMT
Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-58907163519so4321642a12.1
        for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Tue, 10 Oct 2023 08:08:25 -0700 (PDT)
X-Gm-Message-State: AOJu0YyWespD4wwtO0ry/I26rcht2tEgxFkMIM5IqpYx935iOhx4fITJ
    o1cN9IR/oKCgA2PDWO0KFAWwtg1xAOxXY6+8ald9fi1hHb57VZBnQVI=
X-Google-Smtp-Source: AGHT+IEYT9N7ARURqhvLe9GvfkfkD9nveEGM5VxO9YVh3U3HMAnp5mOjjrxjl8mmKE5X6rB0F8kzaaTseoTQv1x2x4M=
X-Received: by 2002:a17:90b:1a8c:b0:277:37fc:6e85 with SMTP id
 ng12-20020a17090b1a8c00b0027737fc6e85mr16812697pjb.0.1696950504046; Tue, 10
 Oct 2023 08:08:24 -0700 (PDT)
MIME-Version: 1.0
Date: Tue, 10 Oct 2023 08:08:14 -0700
Subject: [External] Premier Toastmasters
Content-Type: multipart/alternative; boundary=000000000000fec50806075e1335
X-Spam-Status: No, score=-4.7 required=5.0 tests=FREEMAIL_ENVFROM_END_DIGIT,
    FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3,
    RCVD_IN_MSPIKE_WL,RCVD_IN_ZEN_BLOCKED_OPENDNS,SPF_HELO_NONE,SPF_PASS
    autolearn=unavailable autolearn_force=no version=3.4.3
X-Spam-Checker-Version: SpamAssassin 3.4.3 (2019-12-06) on
    toastmastersclubs.org
From: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
X-Loop: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: This email address is being protected from spambots. You need JavaScript enabled to view it.
Errors-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Content-Transfer-Encoding: 7bit
To: "This email address is being protected from spambots. You need JavaScript enabled to view it." <This email address is being protected from spambots. You need JavaScript enabled to view it.>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=toastmastersclubs.org;
     h=content-transfer-encoding:content-type:date:from:mime-version
    :reply-to:sender:subject:to; s=default; bh=sBVXUhctqNK/aE717UvDI
    ++bpYbaYUBtTkG0Eken858=; b=qI54rACj7t80E8SohD2ZfryfpgPOP/OmqtbC2
    JOUeZlyJX6Hdeu80na9tLPh6YD0uhRhJPVjgCKPYYBBCHQqsPxQnicZE5XOcxrxL
    eIY34LHcN19xmoMPDP7gLZaR23KRaMfjvGtA0iKZqiCoKMb2krkG/vaLsLiTOEWf
    Ceoopc=
Return-Path: This email address is being protected from spambots. You need JavaScript enabled to view it.
X-MS-Exchange-Organization-ExpirationStartTime: 10 Oct 2023 15:08:29.0357
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 deeaeda0-a12f-4e1e-4abb-08dbc9a2c2a2
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 5c7d0b28-bdf8-410c-aa93-4df372b16203:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 SG1PEPF000082E2:EE_|PUZPR03MB6854:EE_|TY0PR03MB8246:EE_
X-MS-Exchange-Organization-AuthSource:
 SG1PEPF000082E2.apcprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: deeaeda0-a12f-4e1e-4abb-08dbc9a2c2a2
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam: BCL:3;
X-Forefront-Antispam-Report:
 CIP:50.19.253.65;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:toastmastersclubs.org;PTR:toastmastersclubs.org;CAT:NONE;SFS:(13230031)(4636009)(286005)(451199024)(82310400011)(336012)(26005)(1096003)(8676002)(2860700004)(83380400001)(36756003)(1076003)(42186006)(2876002)(6916009)(82960400001)(7596003)(7636003)(356005)(34756004)(86362001)(9036002)(2616005)(33964004)(7846003)(6666004)(491001);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Oct 2023 15:08:28.3014
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: deeaeda0-a12f-4e1e-4abb-08dbc9a2c2a2
X-MS-Exchange-CrossTenant-Id: 5c7d0b28-bdf8-410c-aa93-4df372b16203
X-MS-Exchange-CrossTenant-AuthSource:
 SG1PEPF000082E2.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR03MB6854
X-MS-Exchange-Transport-EndToEndLatency: 00:00:04.2825528
X-MS-Exchange-Processed-By-BccFoldering: 15.20.6863.027
X-Microsoft-Antispam-Mailbox-Delivery:
    ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420103);
X-Microsoft-Antispam-Message-Info:
    =?us-ascii?Q?DmqVcMHcvNC3JIXdj9zx7FlJR7Z+CKSrfKRWac7dGJOxNOUUi0q4U38xzyAT?=
 =?us-ascii?Q?kpexB+61aTtlBaqLqheZves5Vnu3a/sluSq+HMPRX29i902d4ByIYBzIYFe9?=
 =?us-ascii?Q?06fuLZu3PGBS8u4d6N414Yth3pUhrc6LcbF+sCAVvOPUas9TlXMf/E3LCGnW?=
 =?us-ascii?Q?t/62fnQGL2hTY5JxZzZh/8KZgLNJFWz4AeYyIE+51bhwlGnixJM1+BDPygpU?=
 =?us-ascii?Q?zbBCyyCrXiQ5U0wkmkKA22E/8AasnXuCZuOjPL6ZAJDWzOwzeU83o38cwY2Y?=
 =?us-ascii?Q?fxwmCo9BANMSgZe4G+p98FKSKjixw6oONYPkl0MSvUvC4ThvNcfUzy2p/8JP?=
 =?us-ascii?Q?sbWiKOOEZJtvnYhVvCLqVsrU+qI7yQAiNk4TgLjLwdc6Vm/CthjRowdCR8p5?=
 =?us-ascii?Q?BjPyFbXyfdZHaAYQyQmQQ2OIsoOaof9pwFAm5lI1FwpYdw1DukykWB/f6puM?=
 =?us-ascii?Q?ggzJ6tOKQjmGFN/ER7huawBsJVwWLyzpNn1pq7ha3JlZq+DMwVgblFK68+xn?=
 =?us-ascii?Q?tbeLaGrNB4zy8LuxjYr8yjBO3V9izjkhUGBtfGDkf1eWdnjbKSD2TbWVRDu1?=
 =?us-ascii?Q?zYuf27e6qAIHmxGCpGBCOeqOzBna62GGwq58d/JBqdQvB/aRqiU1PDDt82vK?=
 =?us-ascii?Q?IWdRidHm9X/s/3UPCaLRSo52/w6YGDK203JsU7IxG4e5v8xaMLcg0EZOjWHb?=
 =?us-ascii?Q?O/jqB0/amzhD7w6kHMu8twkgb0Rm8HEZisNA/FWUL5EXT2qgHYsxq+SpZVVQ?=
 =?us-ascii?Q?/cS5ndmtN41kQ9zEr863lih/Z52CUAPf8aT0D8PtOuivjFNJF76IAZYILF5D?=
 =?us-ascii?Q?mSTIF4rxeA4zK/N1z1KI5oibQaAVk/hvGM8aKNjyoLGdYo50MzY+mT/StucA?=
 =?us-ascii?Q?kU/RKd32ZRoorlzIQh+MMAbGGU8OMZmM5aWxzwbxXJYA5OXc1vkMHbXNx0cE?=
 =?us-ascii?Q?Dt4AGScUxq76mmvJbJo+WJ88pBrUPYs/SBqcpYVTLgxZauWIUsKHUvibfMbT?=
 =?us-ascii?Q?hiM7g304d637CmISwE/lxWrmtBrjolYDhTX9E2l4kF5Ns3g5MHHQeIPeIV0S?=
 =?us-ascii?Q?HzVyKXuSCLZ3w3KpmZq+PxkANDTnuDs9I9JusN6THsvKfCcp3OvYnv1PlQsE?=
 =?us-ascii?Q?3xFjFi2dnbUL6CsOxK+eWdGZzlMbtAaK8RWqeoKGeQGgPDt4AymQIZV8g2ys?=
 =?us-ascii?Q?KnqdsOVbwbp8US8t7VrVQqQEnFfizqWqdzKcU+rxHeVq8B8pPfqVAVoanXfR?=
 =?us-ascii?Q?AHpfk9OtSwu5WzP4hj3S6Rq4Db5uEn96AfEG+p++UvqFzjjeozInlLJcPMjX?=
 =?us-ascii?Q?sDZugRz8BDqTA2HkbrZpS6gpCI/T7FQnjP89GF8gnY98N85F0FAj27xhxBuJ?=
 =?us-ascii?Q?DWrA6ItqMOfTT6sj2erZKZnWArxxID82uDruc2NSCbkFaCNAcaXWiYQIdvle?=
 =?us-ascii?Q?KhTkVv540Kc+S1Jzeq4Vx5VFCzYaRK18gY7osr1BzJWLXLTSZKDYgEzkc6PZ?=
 =?us-ascii?Q?GVa8MZxq5G+0PqwZ3r8Blww49fgr9gCNVZ7bb0CTNFatpKcuAqfAqq95oZwi?=
 =?us-ascii?Q?WQqctej2TpXzMbaqCljXGaKrjUD+lDdSxsF7DkHlb/vMHf/oNv1nkQqFKguc?=
 =?us-ascii?Q?ttAGjSuOAohqSmz7s3EedLF4Gad7Orh9Qc/uEmPSub0hBBgVipq+gSYX/05B?=
 =?us-ascii?Q?hPZEIw=3D=3D?=

Hi

I was also able to acquire Internet header from a similar email received by another club. Please let me know if you need that posted here as well.
I did not want to paste long content here unless it was needed.

Thanks,
Mayur.

as the spam is coming from a gmail email address, the only thing you can do is block the from: gmail address.