The Anonymous Widower

CFX Group

I’ve just had this e-mail from someone purporting to be the CFX Group.

Dear Customer

Your order has been accepted.

Order id: 879305.

Terms of delivery and the date can be found with the auto-generated msword file located at:


Consult2 Group. Tel./Fax.: (831) 842 06 366

The link which I have replaced with safe xxx’s, pointed to a .zip file, which probably would have infected my computer with who-knows-what!

I have since heard from the owner of the URL and they have said this.

Our website was recently hacked by spammers to distribute malware.

You can safely ignore any email referring to an order placed with us.


We are sorry for the inconvenience caused.

So whatever you do, don’t click the link.

May 6, 2011 - Posted by | Computing | , ,


  1. I too received the CFX email and attachment, which managed to get through Messagelabs. Somewhat disquieting.

    Comment by A N Other Widower | May 6, 2011 | Reply

    • Remember to use the Mark 1 eyeball(s) and the signal processor in between.

      If it looks like spam, tastes like spam and smells like spam, it probably is spam.

      Comment by AnonW | May 6, 2011 | Reply

  2. We also received this attachment – and are very grateful for this posting as it confirmed our suspicion that it was spam! Many thanks!

    Comment by Anony-mouse | May 10, 2011 | Reply

  3. As they say in Private Eye, Knacker of the Yard is involved.

    Comment by AnonW | May 10, 2011 | Reply

  4. […] have just received an almost identical e-mail to the one I received from the CFX Group. […]

    Pingback by Another Scam Like CFX Group « The Anonymous Widower | May 10, 2011 | Reply

  5. Guten Tag,

    Thank you for the order,

    This message is to inform you that your order has been received and is currently being processed.

    Your order reference is 089627.

    Your purchase and delivery information appears below located at:

    Best regards, Tel./Fax.: +31 (0)346 566 20 28

    Comment by df | August 4, 2011 | Reply

  6. I got one too. But it took me a while to figure out what it said because it was in some language foreign to me. AFTER I tried some others the French translator gave me essentially the same message others have listed in English. It was from “CFX Gruppo” but the message was essentially the same as all the above. I did NOT click on it because I had no kind of mail or internet orders outstanding but some might. The foreign language message was as follows:
    Il tuo ordine e stato accettato.
    Ordine id 87373520.
    Termini di consegna e la data puo essere trovato con l’auto-generati file di msword
    trova in (website link removed but it was faked zip file purporting to be on but the link ended in .zip.

    My security hint is ALWAYS check any unknown link for the (dot)zip…surefire tip off its a zip file you are about to open. It doesn’t always appear, can’t count on that red flag being there, BUT when it does, you can assume a scam, no matter what language it comes in!

    Thank you Widower, My condolences on the loss of your wife. Your blog may have been started to help you cope but now, see, you have helped others as well!!

    Comment by gratefulforyourhelp | November 3, 2011 | Reply

  7. Just got this spam today. The italian version: Il tuo ordine e stato accettato (your order has been accepted)…

    Comment by Geoff Coupe | February 21, 2012 | Reply

    • I trust you deleted it.

      They must be reasonably bright spammers as they can translate from English into Italian.
      or it could be, that they are controlled by the Mafia!

      Comment by AnonW | February 21, 2012 | Reply

  8. Salve le email che ho ricevuto io,sono 2, oggi mi dicono di pagare il debito tutto scritto in italiano e di aprire un file,cosa che non ho fatto,per saperne di piu’.Inoltre c’e’ anche un numero telefonico con prefisso della provincia di CA.0700906997 che ovviamente non esiste.Queste email sono state spedite da:robo e da CFX pe rl’avviso

    Comment by sergio | April 26, 2012 | Reply

    • I think you got the Italian version of the scam. Ignore it or forward to Silvio B.

      Comment by AnonW | April 26, 2012 | Reply

  9. Ho da poco ricevuto un E-maill in cui mi si dice che sono in debito di una fattura, di che cosa non so anche perchè l’ antivirus da me installato , come ho provato ad aprire l’ indirizzo zip, l’ ha subito bloccato.
    Ora se tale truffa ( perchè di questo si tratta ) è opera Vostra, vi diffido dal continuare o mi vedrò costretto a ricorrere come già ho fatto in precedenza all’ antitrust .

    Comment by Roberto | August 8, 2012 | Reply

  10. Thank you, i recieved the same mail! I’m relieved that this was just another spam. Phew!

    Comment by Janet | August 14, 2012 | Reply

  11. Spam is certainly one of the downsides to digital bitstream communicating. I get so many attempts each day that if one happens to amuse me by its audacity or level of ignorance, I award it “SPAM of the DAY” and allow it into Comments, with the links removed of course.

    Comment by Invisible Mikey | September 25, 2012 | Reply

  12. Hoy me ha llegado esto y gracias a vosotros no he caído:
    Nos dirigimos a usted para comunicarle que no hemos recibido ninguna transferencia con la cuota a pagar en el ultimo trimestre. Le adjuntamos la correspondiente factura para que tenga en cuenta la cifra a pagar.

    Comment by roberto | September 28, 2012 | Reply

  13. Thank You!

    Comment by Gabriella | November 1, 2012 | Reply

  14. I received similar email purporting to be from cfx group a couple of days ago.Was pretty sure it was scam but nice to have it confirmed

    Comment by Marie Kerr | February 19, 2014 | Reply

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: