Cloud Storage Renewal Scam
If the scammers send out enough emails they are sure to hit targets who have a cloud sync storage account or think they have such an account. All they need to do when you click on one of the links (they all go to the same fake website) is harvest your credit/debit card details and quite literally empty your account.Let's read the email...
E-Mail received:
Date: 29/07/2025, 12:13
From: Storage Safety Group invoice@mail.radarerp.net
To: [Name and Email address redacted]
Subject: Warning: Your Cloud Storage Has Reached Its Limit
Notes: The email comes from the address mail.radarerp.net. Radarerp.net appears to be a login page for a group of Spanish Programmers. The click through website is http://52.168.31.72/hFeyrm3Y4d/offer/002ce/383/d8mgu/2kck/41/77/?signature=4e495a4822e8bd36248d
35ddfded1a26. Seriously the address is suspicious.
The actual Cloud Sync service contacting you is kept deliberately vague so as to trap as many people as possibly in clicking through to their phishing site.
Recomendation: Just delete the email
Another Cloud storage renewal phishing scam. This one included part of a email newsletter if you scrolled way down. Maybe this was an attempt to bypass spam filters by including more text on the email
E-mail received
Date: 23/10/2025, 15:52
From: SafetyGroup notificaciones@foraction.cl
To: [Name and Email address redacted]
Subject: Keep Your Memories lntact+88852
"Hidden text" visible if you scroll way down
Notes: The sender email address is a Chilean domain with a website foraction.cl. The click through webaddress is https://stckg.blob.core.windows.net/dcim/202510211547?lDTl4K9572om/002d2/394/d8mgu/2ppc/41/77/?signature=558be50bf890ea9abeff6cff637b6b53 which looks particularly suspect
Another scam email. Claiming your Cloud storage has reached it's limit and the account will be suspended. You need to login and upgrade your plan.
Date: 19/11/2025, 08:27
From: TicketN.003 noreply@p2-7-8ca54.firebaseapp.com
To: [Name and Email address redacted]
Reply To: noreply@cloudbillings.uk
Subject: #Account-Suspended
Notes: The email comes from the address noreply@p2-7-8ca54.firebaseapp.com which is an unusual email address for a cloud hosting service/provider. The click through web address is https://stckg.blob.core.windows.net/dcim/google.com?9998885/002gz/120/short/128946/41/77 which does not seem a likely cloud hosting provider website.
Michael Fowler
Other articles by Michael Fowler:
Safety Considerations When Interacting With Scammers - Michael Fowler
Safety precautions in dealing with possibly violent Nigerian Scammers. Never use your real name, email address, postal address or telephone number. Create a fictitious identity when engaging with scammers... more >>
Treasury US$10.5 Million Compensation Scam - Michael Fowler
Funds worth $10,500,000.00 each have been approved for disbursement to a few scam victims as compensation by the United States Government in conjunction with the Treasury Department... more >>
Companies House Scam E-Mail - Michael Fowler
If you happen to be a Company Director this very official looking email purporting coming from the UK Business Regulator Companies House might take you in. Look carefully there are the usual "red flags".Let's read what "Companies House" have to say... more >>
