Tuesday, October 7, 2014

EC21 Phishing

Date: 2014/10/07

Dear Valued Member,

Your EC21 Membership needs to be validated due to the new upgrade on our system security server which has been upgrade to protect your member information. Due to this you are required to kindly click on the link below to validate your EC21 Membership.


Failure to validate your EC21 Membership will be suspended by EC21 service team. Thank you for choosing EC21.

Thank you.

EC21 service team

Dynamic Marketplace for Global B2B – EC21
Copyright(c) EC21 Inc. All Rights Reserved.

Email analysis :
NOTE : Received : from cyberia.net.sa (FMBX01.cyberia.net.sa. [])

NOTE : Received : from [] (account info@aplaco.com.sa HELO User)

NOTE : by fmbx01.cyberia.net.sa (CommuniGate Pro SMTP 6.0.5);
NOTE : Return-Path :
NOTE : client-ip=;
NOTE : smtp.mail=zwe.us.infos@ec21.org
NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/html; charset="Windows-1251"
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Priority : 3
NOTE : X-Msmail-Priority : Normal
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2600.0000
NOTE : Message-Id :
NOTE : Membership Update From EC21

Phishing analysis :
OPEN : http://www.bcbg-event.com/EC21.com/index.html

REDIRECT : http://supplier.ec21.com/

bcbg-event.com whois :
Domain Name: bcbg-event.com
Registry Domain ID:
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2013-10-10T07:46:29.0Z
Creation Date: 2009-10-17T11:46:33.0Z
Registrar Registration Expiration Date: 2014-10-17T11:46:33.0Z
Registrar: OVH, SAS
Registrar IANA ID: 433
Registrar Abuse Contact Email: abuse@ovh.net
Registrar Abuse Contact Phone: +33.899498765

(M.T.C.N): 5752202045

we have finalize all the necessary arrangement and your fund ($4.8USD)has been approve by the border directors of ECO Bank,you will be receiving $5000 per day. Furthermore our attorney will go to the inland
revenue tax office to obtain a letter of administration tax clearance approval it will cost only $75 on your behalf from high Court. The most important requirement that we need from you is your full current information well noted and understood.

My name___
My country__
My address___
My Occupation____
My Age/sex__
Your occupation Direct phone number__

MTCN:(5752202045) SENDERS

Contact email: {westreunion84@yahoo.com}

Best Regards
Mr William

Daniel K. Tarullo

Dear Beneficiary,

I am Janet L. Yellen, the newly-sworn Chair, U.S. Federal Reserve Bank. You will get more information about me here. http://www.federalreserve.gov/aboutthefed/bios/board/yellen.htm


I have made it my first point of call since taking office to settle all compensation outstanding payments accrued to individuals/corporations with respect to local and overseas contract payment, debt re-scheduling and outstanding compensation payment. This is to make sure all outstanding payments are settled before the end of the fiscal year 2014. I have your file here in my office and it says that you are yet to receive your fund valued at $8,500,000 (Eight Million Five Hundred Thousand United States Dollars only) as compensation outstanding payment owed to you. This money will now be transferred to your nominated bank account or your preferred payment option. You are advised to kindly reply this email with the below details enclosed to our customer care below to help us process your payment;

Contact Customer Care: Daniel K. Tarullo
Email: jmcnamara@admin.in.th
Tel: +1 646 653-3306

(1) Full Names:
(2) Residential Address:
(3) Current Phone Number:
(4) Age:
(5) Country of Residence:
(6) Occupation:

Thanks for your co-operation as I wait to hear from you.

Janet L. Yellen
Chair, U.S. Federal Reserve Bank

Note: The information contained in this e-mail is private & confidential and may also be legally privileged. If you are not the intended recipient, please notify us, preferably by e-mail, and do not read, copy or disclose the contents of this message to anyone.

Email analysis :

NOTE : Return-Path : < off@jcb.com.br >
NOTE : Return-Path : off@jcb.com.br
NOTE : Received : from mail.kanal-ri.hr (HELO kanal-ri.hr) (

NOTE : Received : from User ([])

NOTE : by kanal-ri.hr with Microsoft SMTPSVC(6.0.3790.4675);
NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/html; charset="Windows-1251"
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Priority : 3
NOTE : X-Msmail-Priority : Normal
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2600.0000
NOTE : Message-Id : < *@kanal-ri.hr >
NOTE : X-Tm-As-Product-Ver : SMEX-
NOTE : X-Tm-As-Result : Yes-90.333700-4.000000-31
NOTE : X-Tm-As-User-Approved-Sender : No
NOTE : X-Tm-As-User-Blocked-Sender : No
NOTE : Dear Beneficiary

Tr: Coucou

Vous ne voulez pas faire de l'argent?

Je vous montrerai comment faire de l'argent sur le net. Il s'agit d'une idée d'affaire simple, engageant peu d'argent. Je vous assure que vous ne perdrez aucun euro, au contraire, vous tirerez profit.
Apprenez comment fructifier vos revenus, avec un investissement dérisoire, en suivant gratuitement et sans aucune obligation une simple documentation.

Cliquez ici pour la vidéo

Vous croyez que c'est une méthode trop compliquée pour vous? Complètement faux! Aucune importance si vous n'avez jamais essayé jusqu'à présent. Et ce n'est pas grave si vous n'avez pas de connaissances économiques. C'est très simple. Suivez 10 minutes la documentation entièrement gratuite pour vous convaincre. Vous n'avez rien à perdre. Pensez qu'elle peut vous changer la vie.

Cliquez ici pour voir la vidéo en direct

C'est justement pour cette raison, que pour des millions de personnes sur la planète, cette méthode de gagner de l'argent est devenue leur principale activité. Y a-t-il des gains substantiels? Peut-on vivre avec? OUI Quel est mon intérêt? Autant être franc, je ne suis pas philanthrope, par contre je gagne un pourcentage de ce que vous allez gagner donc si vous ne gagnez rien, je ne gagne rien non plus! Seulement jusqu'à la fin du mois vous pouvez bénéficier d'un bonus spécial de 100%.


Email analysis :

NOTE : Return-Path : marine@emilistgo.net
NOTE : Received : from front.emilistgo.net (unknown [])

NOTE : Content-Type : text/html
NOTE : X-Vr-Fullstate : 0
NOTE : X-Vr-Score : 50
NOTE : X-Vr-Avstate : No
NOTE : X-Vr-State : 0
NOTE : Tr: Coucou

emilistgo.net whois :

Domain Name: emilistgo.net
Registrar WHOIS Server: whois.1und1.info
Registrar URL: http://1and1.com
Updated Date: 2014-10-02 00:00:00
Creation Date: 2014-10-01 00:00:00
Registrar Registration Expiration Date: 2015-10-01 00:00:00
Registrar: 1&1 Internet AG
Registrar IANA ID: 83
Registrar Abuse Contact Email: abuse@1and1.com

Account update

please,kindly update your Google mail account my downloading the attachment and log in your gmail for update to prevent blocked.

< account update.html >

Email analysis :

NOTE : Ric.ferd
NOTE : Received : from [] by web126106.mail.ne1.yahoo.com via HTTP;

NOTE : Return-Path :
NOTE : Received-Spf : pass client-ip=;
NOTE : X-Yahoo-Newman-Property : ymail-5
NOTE : X-Yahoo-Newman-Id : 561655.23605.bm@omp1020.mail.ne1.yahoo.com
NOTE : X-Mailer : YahooMailWebService/
NOTE : Account update

Information extracted from file :

IMG : http://mailservers.altervista.org/Gmail_files/logo_2x.png
IFRAME : http://mailservers.altervista.org/Gmail_files/CheckConnection.htm
IMG : http://mailservers.altervista.org/Gmail_files/avatar_2x.png
FORM : http://mailservers.altervista.org/yung.php METHOD : POST ID : gaia_loginform
INPUT : < input id="checkConnection" name="checkConnection" value="youtube:488:1" type="hidden" >
INPUT : < input id="checkedDomains" name="checkedDomains" value="youtube" type="hidden" >
OPEN : http://mailservers.altervista.org/yung.php
REDIRECT : https://mail.google.com
OPEN : http://mailservers.altervista.org

Altervista.org whois :

Domain ID: D49746541-LROR
Creation Date: 2000-12-22T18:05:39Z
Updated Date: 2013-07-06T21:01:34Z
Registry Expiry Date: 2015-12-22T18:05:39Z
Sponsoring Registrar:Tucows Inc. (R11-LROR)
Sponsoring Registrar IANA ID: 69
Registrant ID:tuVm7eQpE7LG3n51
Registrant Name:Gianluca Danesin
Registrant Organization:Banzai Media S.R.L.
Registrant Street: Via G.B Vico 42
Registrant City:Milano
Registrant State/Province:MI
Registrant Postal Code:20123
Registrant Country:IT
Registrant Phone:+39.0289631293
Registrant Fax: +39.0289631298
Registrant Email:abuse_rs@altervista.it
Admin ID:tuP2KzISVkzO41sr
Admin Name:Gianluca Danesin
Admin Organization:Banzai Media S.R.L.
Admin Street: Via G.B Vico 42
Admin City:Milano
Admin State/Province:MI
Admin Postal Code:20123
Admin Country:IT
Admin Phone:+39.0289631293
Admin Fax: +39.0289631298
Admin Email:abuse_rs@altervista.it
Tech ID:tucY1EtjdUlek8fW
Tech Name:Gianluca Danesin
Tech Organization:Banzai Media S.R.L.
Tech Street: Via G.B Vico 42
Tech City:Milano
Tech State/Province:MI
Tech Postal Code:20123
Tech Country:IT
Tech Phone:+39.0289631293
Tech Fax: +39.0289631298
Tech Email:abuse_rs@altervista.it


My Dear Friend.

This is to officially inform you that sequel to the recent high rate of criminal acts like scam, fraud, impostors and drug trafficking in Africa and sub-United States of America regions, the United Nations secretary-general has delegated me (Mrs. Carman Lapointe-Young) as the Internal auditor, monitoring & investigation division of the Office of the Internal Oversight services (OIOS). I was delegated and nominated to come down to Nigeria to make sure that fund beneficiaries like you get their funds because the rate at which fund beneficiaries are being treated in this country is not good, some of them has lost everything they have, rendered homeless and some declared bankrupt because the top bank officials continuously ask beneficiaries to pay/send money to them as they claimed that they are from one big offices & will help you get your fund but all these was just lies and deceit to make you believe them. Few days ago I arrived Abuja, the capital territory of Nigeria and I have meet the president Goodluck Ebele Jonathan as directed by the UN secretary-general Mr. Ban Ki-Moon, the president has issued an approvals for me to work in collaboration with the Economic & Financial Crimes Commission to make sure you get your compensation & approved fund urgently, it was resolved by the president and UN Approved the sum of US$48.9 MILLION by the British government and the International Credit Settlement (ICS). Sincerely, as I just arrived the country, I went through your payment file to discover that the top Nigerian & British officials/bank that was supposed to pay you rather decided to embezzle the fund, divert it to their personal account and they are working with some top political officers to frustrate you but you must be rest assured 100% that once I hear from you with the required like your full name and Address / age / telephone/ Occupation/ sex. / you must get your fund. I have been given few weeks to make sure you get your fund, so it will be better if you respond to this email urgently and I will advise you on how best to get your fund urgent after you write us back with your Info needed.

Yours Sincerely,

Mrs. Carman Lapointe Young

United Nations Under-Secretary
General for Internal Oversight.

Email: munitednationsundersecretary@yahoo.com.hk

Email analysis :

NOTE : mrs.carmanlapointeyoungu@yahoo.com.hk
NOTE : Return-Path : < info@mebulbs.info >
NOTE : Received : from dns5.french-connexion.com (
NOTE : Received : from User (ppp-2-25.15-151.iol.it [])

 Scam IP :

NOTE : by dns5.french-connexion.com (Postfix)
NOTE : X-No-Relay : not in my network
NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/html; charset="Windows-1251"
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Priority : 3
NOTE : X-Msmail-Priority : Normal
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2600.0000
NOTE : X-Remote : (dns5.french-connexion.com)

Your Funds

Good Day.

This is Zenith Bank PLC, we have successfully processed your International Certified ATM Card with which you can withdraw your funds value at One Million Seven Hundred Thousand United States Dollars (US$1.700,000.00) bit by bit from ATM Machine in all part of the World until the expiration of the Bank ATM Card in February 2016. This fund is deposited by the newly establish office of the United States and European Union Home Affairs Commission Lagos Nigeria for compensation to all scam victims.

Please take note that cash withdrawals in this ATM Card is minimum of $1000 in anyone instance and a maximum of $5000 in a single day.

Your ATM Card will be delivered to you by the Bank officialcourier Company, Federal Diplomatic Express Services a Courier/Delivery Service Company; with AirWaybill Receipt-7842974786..as soon as you provide details of your Home Address..which you desire it to be delivered to..bear in mind you will also pay the cost of the Shipment to your Destinated Home Address..

Inside the ATM Card parcel is a sealed mailer with your 4-digits Personal Identification Number (PIN) for your withdraws, I strongly advise that you change the PIN immediately you receive your parcel and do not disclose your PIN to anyone under any circumstances, not even to cashiers at payment points.

Please contact the Federal Diplomatic Express Services by email and phone below for the delivery of your Visa ATM Card now;

Federal Diplomatic Express Services

Mr. Wyse Roland, Manager,

International Shipment and Logistics Department

Email analysis :

NOTE : zenithannex@gmail.com
NOTE : zenithoffice01@drivehq.com
NOTE : Received : from s118.n39.n84.n66.static.myhostcenter.com
NOTE : (HELO wowsafety.com) (
NOTE : Received : from User ([]) (authenticated bits=0)
NOTE : by wowsafety.com (8.13.1/8.13.1)

NOTE : Message-Id : <*.*@wowsafety.com >
NOTE : X-Orig : []
NOTE : X-Authentication-Warning : wowsafety.com: nolamax owned process doing -bs
NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/plain; charset="Windows-1251"
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Priority : 3
NOTE : X-Msmail-Priority : Normal
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2600.0000
NOTE : Your Funds