Interactive Brokers Client Services
Jun 16 9:59 PM
Security Notice for User k******8: Verify Log In
Fake Interactive Brokers security alert requesting account verification.
Sammy Cemo, Matt Pourcho and Anthony DeLorenzo
Jun 16 4:04 PM
New Pricing | Fortune 40 Credit | STNL Industrial | 11 Yr. WALT | SoCal
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Sammy Cemo and Anthony DeLorenzo
Jun 16 2:03 PM
Single-Story Owner-User Offering in Newport Beach
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
[email protected]
Jun 16 1:43 PM
Action required: Your June booking bonuses expire soon
⚠ PHISHING: phishing subject pattern: 'Action required' from external sender vacationoffer.com
Amazon Payments
Jun 16 12:44 PM
Action requise sur le compte Amazon Payments
Fake Amazon Payments suspension notice in French requesting account verification.
Hims
Jun 16 9:02 AM
Kelvin - action required on your account
⚠ PHISHING: phishing subject pattern: 'action required' from external sender icloud.com
[email protected]
Jun 16 9:02 AM
You have a new estimate
Suspicious medical estimate link from Providence—verify legitimacy before clicking.
Let's Talk Supply Chain
Jun 16 6:01 AM
Are you ready?
Suspicious meeting confirmation from unknown sender with obfuscation.
Benjamin & Williams
Jun 16 5:03 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demanding payment on unknown commercial claim within 24h.
DIRECTV
Jun 16 1:04 AM
Set up your Peacock Premium Incl account
Suspicious DIRECTV email promoting Peacock account setup with obfuscation.
[email protected]
Jun 15 9:19 PM
New logon to your account
Suspicious account logon alert from E-TRADE; verify legitimacy immediately.
Geoff Turbow, Anthony DeLorenzo and Rebecca Perlmutter
Jun 15 5:32 PM
Call for Offers 7/7 - Mission Critical Warehouse/Distribution HQ Opportunity with Credit Tenant | 5.5% Cap | NW Tucson, AZ
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Matt Post, Anthony DeLorenzo and Rebecca Perlmutter
Jun 15 4:04 PM
Recently Renovated 150K SF Distribution Facility | 100% Leased to Hardwoods Specialty | 9.25 Year WALT | Stockton, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Anthony DeLorenzo and Mark Shaffer
Jun 15 1:07 PM
Debt Memo Available | Space Beach R&D Investment | NNN Leased to Astrolab | Hawthorne, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Anthony Patino in Teams
Jun 15 12:14 PM
Anthony Patino sent a message
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is teams.mail.microsoft
Matt Post, Charlie Strouss & Anthony DeLorenzo
Jun 15 11:04 AM
Just Listed | Mission-Critical Industrial Facility w/ Investment Grade Tenant | Bay Area, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Benjamin & Williams
Jun 15 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demanding $19k payment on unrelated commercial claim.
Microsoft Outlook
Jun 14 2:54 PM
Notification: You're invited to share this calendar
Fake Microsoft Outlook calendar invite from spoofed domain; Chinese currency exchange solicitation.
AT&T Account Management
Jun 14 7:11 AM
AT&T payment processed for account ending in 3821
Suspicious AT&T payment confirmation from non-official domain to accounting email.
Benjamin & Williams
Jun 14 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collection notice with 24h payment demand; spoofed sender domain.
Tesla
Jun 13 1:45 PM
Transfer Request of Your Vehicle
Suspicious vehicle ownership transfer request from unauthorized party.
Starlink
Jun 13 1:19 PM
Your Starlink verification code
Unsolicited Starlink verification code — likely credential theft attempt.
Candy Yee in Teams
Jun 13 9:31 AM
Candy Yee sent a message
⚠ PHISHING: employee impersonation: display name matches 'candy yee' but sender is teams.mail.microsoft
Benjamin & Williams
Jun 13 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collection demand with 24h payment ultimatum—domain spoofing, BEC-style pressure.
SharePoint Online
Jun 12 6:32 PM
Sushil Kukreti's files will be deleted on June 19, 2026
Fake SharePoint notification about deleted files—credential theft attempt.
[email protected]
Jun 12 1:57 PM
Action required: Your June itinerary & pending tickets
⚠ PHISHING: phishing subject pattern: 'Action required' from external sender vacationoffer.com
Benjamin & Williams
Jun 12 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collection demand with 24h payment threat to wrong recipient.
Tesla
Jun 11 6:15 PM
Transfer Request of Your Vehicle
Fake Tesla ownership transfer request from unknown sender Yaroslav Kyrylovych.
Matt Pourcho and Anthony DeLorenzo
Jun 11 1:03 PM
Now Scheduling Tours: 100% NNN Leased Industrial | 5.6 WALT | San Diego, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
AT&T
Jun 11 11:36 AM
✨Enter for a chance to win a trip to Walt Disney World® Resort provided by AT&T✨
AT&T Disney World sweepstakes email with hidden Unicode padding — suspicious.
Mark Shaffer, Grant Goldman and Anthony DeLorenzo
Jun 11 11:08 AM
Indicative Financing Terms Now Available | High-Image Owner-User/Medical Opportunity | Encino, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Benjamin & Williams
Jun 11 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demand with 24h payment pressure; spoofed domain.
Vipin Verma
Jun 11 3:55 AM
Fwd: Purchase Order from Bharatiya Janata Party Headquarter, Central office. (Purchase Order #: PO-00664)
Suspicious PO from Indian political party to [email protected] via external consultant.
Cloudflare
Jun 10 10:37 PM
[Action required] Validate dialsight.ai to renew SSL certificates
⚠ PHISHING: phishing subject pattern: 'Action required' from external sender notify.cloudflare.com
TKevin Price
Jun 10 6:37 PM
[Teams oneOnOne] (Teams DM)
Suspicious Teams message with Google Drive link from unfamiliar sender.
Matt Post, Anthony DeLorenzo and Sammy Cemo
Jun 10 4:02 PM
Rare Owner-User HQ Building Near Airport in Napa, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Anthony DeLorenzo and Sammy Cemo
Jun 10 2:03 PM
Iconic Newport Beach Office For Sale
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
UW Connect Finance
Jun 10 1:04 PM
[ UW REF2149367 ] Order #1242 confirmed
Suspicious order confirmation from UW Connect Finance to non-UW email.
TKevin Price
Jun 10 12:45 PM
[Teams oneOnOne] (Teams DM)
Suspicious Teams message with Google Drive link from unknown sender.
Anthony DeLorenzo and Sammy Cemo
Jun 10 9:12 AM
CALL FOR OFFERS TOMORROW - JUNE 11th | Orange County 2-Tenant Net Leased Industrial Investment
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Let's Talk Supply Chain
Jun 10 9:01 AM
Are you ready?
Suspicious generic message with tracking pixels and vague urgency trigger.
Benjamin & Williams
Jun 10 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demanding $19K payment on unrelated commercial claim.
AVIXA
Jun 10 12:06 AM
Reset Password Notification
Unsolicited password reset notification—verify account security immediately.
AVIXA
Jun 10 12:06 AM
Reset Password Activation
Unsolicited password reset request — verify legitimacy immediately before clicking.
Matt Post, Anthony DeLorenzo and Sammy Cemo
Jun 9 7:07 PM
New Pricing | Corner-Lot "Main and Main" Owner-User Opportunity | Carmichael, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
AT&T
Jun 9 11:59 AM
Kelvin, some AT&T updates just for you.
Spoofed AT&T newsletter to [email protected] impersonating personal message.
Benjamin & Williams
Jun 9 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demand with 24h payment threat; spoofed sender domain.
Matt Post, Anthony DeLorenzo and Sammy Cemo
Jun 8 4:04 PM
Ideal Owner-User Office Building - For Sale or Lease | Large Corner Parcel Near Amenities | Sacramento, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Sammy Cemo, Anthony DeLorenzo and Austin Reuland
Jun 8 1:03 PM
100% Multi-Tenant Office with Long-Term Growth | Redlands, CA
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
Matt Post, Anthony DeLorenzo and Sammy Cemo
Jun 8 9:35 AM
New Pricing | Sonoma County Campus with Use Flexibility
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is cbre.com
⚠ PHISHING / FRAUD SUSPECTED
This message may be impersonating a known contact or company.
Do NOT click any links or open attachments.
Detection: Classic phishing: generic greeting, truncated message body (unusual for legitimate bank), vague device/location claim without specifics, unsolicited verification request, and sender using noreply domain with masked account number—all hallmarks of credential-theft attempt targeting financial accounts.
Detection: Classic phishing: generic greeting, truncated message body (unusual for legitimate bank), vague device/location claim without specifics, unsolicited verification request, and sender using noreply domain with masked account number—all hallmarks of credential-theft attempt targeting financial accounts.
Security Notice for User k******8: Verify Log In
AI verdict
phishing
urgent
· confidence: high
· by haiku
“Fake Interactive Brokers security alert requesting account verification.”
Reasoning: Classic phishing: generic greeting, truncated message body (unusual for legitimate bank), vague device/location claim without specifics, unsolicited verification request, and sender using noreply domain with masked account number—all hallmarks of credential-theft attempt targeting financial accounts.