Wing Wong Email Scam

Sometimes, a scam looks like a scam and then other times it does not...

From: Wing Wong <wing.w@lsplasticsinc.com>

Date: Tue, 13 Oct 2026 at 22:08

Subject: ITB: DPM #9206 – C-180 SCARFF RD

To:

Dear Partner,

Your firm is invited to submit a proposal for DPM #9206 – C-180 SCARFF RD

Please review the attached project documents (VIEW BID DETAILS.pdf) and submit your proposal no later than October 25, 2026.

Please ensure your proposal includes:

Scope of work

Itemized pricing

Inclusions and exclusions

Assumptions, qualifications, and clarifications

Please reply to this email to confirm receipt of this invitation. If you have any questions or require additional information, do not hesitate to reach out.

Thank you for your continued partnership. We look forward to receiving your proposal.

Best regards

--

Wing Wong
L & S Plastics Inc.
Headquarters: 1120 Oak Hill Road, Mountain Top, PA 18707
Business hours: Mon-Fri, 7:00 am-4:30 pm
Shipping and Receiving hours: Mon- Fri FCFS 7:30 AM - 4:30 PM
Office/Facility Tel: 201-471-2491
Cell: 610-663-2195

So, the email looks fine, the irony here being that it was BCCd to our cyber@lcc.com.au email address, but more on that shortly.  I see this type of email on a regular basis, Gmail will generally pop it into my Promotions or Spam folders, but this one made it through to my Inbox, so given my interest in things which are spammy or scammy, I clicked the VIEW BID DETAILS.pdf link where one might be expecting a PDF document to be displayed, I was.

Now it gets interesting, what happened to the PDF file? We now have something which is pretending to be a Word file?  The idea is that the type of file named in the previous link is quickly forgotten and the user then focuses on the screen in front of them, trying to see the information provided in the email.  Continue is obviously risky, but also the next step...

Clearly I am human, and we humans are used to this kind of check so no biggie. 
What usually goes unnoticed is the rapidly changing URLs, ie the web page addresses, which may not work by the time you read this...

• The PDF link
  https://links.notification.intuit.com/ss/c/u001.dv-TkzBPUcTaya3TWTHxqgJ6QASk-aFuiAhGPu2ARhf01qj8xw-EtWhZu4Q0CkH_JQhBn9ZKdVDjSXsa7SsNcSi6jTadgG-8Ia0-RL6syiI/4uu/T-NbfzsCQF6m5bO3I5sp-A/h1/h001.nUZTt0iSWS4WBOpb_CHSxC4ngmW8GswThuPRh9LI3GA

• The Continue  button
  https://pub-c6c6880717ea4da89dff31701dfc01a8.r2.dev/documentshared.html

• The human verification screen
  https://accounts.veroemo.sbs/?U-2BCv17=cmtwbQ==

• The fake "Google" login screen
  https://accounts.veroemo.sbs/Ny/nbcDAG/dU9FLCbD6m?a329242b4e9098=13e60aae2298b9&482beaab3fdca1=4ae5423768b343&a75e5830550d9b=02aab01b6d3e98&abbdfe2632=8dbb00b08597cf3a1f688c&flowName=GlifWebSignIn&dsh=S-1172331798%3A1791944312524336 

Anyway, lets Slide to verify

Yay! The above message pauses briefly so that one can be satisfied that one is human, and then...

That is a very convincing Google login screen! The scammer is relying on the fact that one has forgotten where this started, in my case, Gmail, so I am already logged in, and since when do we need to login to anything to read a PDF file?  

Again, the web address or URL is a dead giveway, that ain't Google...

This is how scammers get access to mailboxes, even Google, the user may or may not have two-factor authentication setup, and if not, entering the username and password on this page may give the scammer access to your emails where they will hunt for emails which are related to financial transactions and then things get real ugly!

And of course I usually check out the website at the email domain, in this case lsplasticsinc.com and voila! Oh the irony...

For any questions or comments, email greg@lincolncomputercentre.com.au