Tuesday, January 6, 2015

Please Confirm (Amazon phishing)


There has been too many login attempts on your account, to continue using the Amazon service you must confirm your account. Please follow the steps in the next window that opens.

Confirm Account

We thank you for your patience regarding this matter, this is done to protect our customers. Failure to confirm will mean suspension of these services.

Processing at Amazon.

Phishing analysis :

CLICK : Confirm Account
OPEN : http://www.processingamazoadmin.website/
RESULT : Phising removed...

Email analysis :

NOTE : Content-Type : multipart/alternative; boundary="----=_NextPart_*"
NOTE : Mime-Version : 1.0
NOTE : X-Msmail-Priority : High
NOTE : Return-Path : < marcos.oliveira@niceveiculos.com.br >
NOTE : Return-Path : marcos.oliveira@niceveiculos.com.br
NOTE : X-Mailer : Smart_Send_3_1_6
NOTE : X-Priority : 1
NOTE : Received : from mailer-1.internext.com.br (mailer-1.internext.com.br. [])
NOTE : Received : from static. (HELO WINHEVSA8GJ7V7mshomenet)
NOTE : (marcos.oliveira@niceveiculos.com.br@

PayPal Phishing

Dear PayPal Customer,

During your regular scheduled accounts maintenance verification procedure, We have detected a slight error regarding your PayPal Account This might be due to Unauthorization access to your PayPal Account...Please verify your information by Downloading the Attachment file and open in a browser to Continue. NOTE: At PayPal, your protection is our top priority and We're committed to keeping your PayPal accounts safe from unauthorized access. IMPORTANT: *If your PayPal information is not verified within 48 hours then your ability you access your PayPal account will be restricted.

Very sincerely,
PayPal Review Department

Copyright © 2015 PayPal, Inc. All rights reserved. PayPal is located at
2211 N. First St.,
San Jose, CA 95131.

Please do not reply to this email because we are not monitoring this inbox. To get in touch with us, log in to your account and click 'Contact Us' at the bottom of any page.

Phishing analysis :

Extract was removed from pastebin...

Email analysis :

NOTE : service@paypal.name
NOTE : X-Mailer-Sent-By : 1
NOTE : X-Mailer-Sid : 10
NOTE : Return-Path : bounce@anatrez.com
NOTE : X-Remote : (static-ip-188-138-65-69.inaddr.ip-pool.com)
NOTE : Mime-Version : 1.0
NOTE : Content-Disposition : inline
NOTE : Content-Transfer-Encoding : 8bit
NOTE : Message-Id : < *@anatrez.com >
NOTE : Received : from static-ip-188-138-65-69.inaddr.ip-pool.com (HELO anatrez.com) (
NOTE : Important: We noticed unusual activity in your PayPal account (Ref #PP-003-627-576-424)



The world statistics shows that the economy of your country is great and investment friendly.

I have a client that want to invest into REAL ESTATE OR INTO ANY PROFITABLE AND LUCRATIVE BUSINESS,and I want to know, if bylaw your country allow investor to come in,And if you can act the-funds manager.Your reply will be highly appreciated and every other details about the funds will be sent to you.You are advise to please reply to(willkbull@yandex.com)

Best regards.
Donald Charlie

Email analysis :

NOTE : mr.bensonjp@yahoo.com
NOTE : zuky45@online24.co.uk

Mr. JohnKelly

Dear Friend ,

We have concluded to effect your payment of $1.7Million, through western union, but the maximum amount you will be receiving each day starting from tomorrow is $4,500.00 daily until the funds is completely transferred.

Kindly Contact Western union Agent:
TEL: +22998359944

Also reconfirm your information to them below

YOUR NAME----------------------
YOUR ADDRESS-----------
YOUR PHONE-------------

Though, I sent $4,500.00 in your name today,but MR. BEN RICHARD said that you should contact first with your information. So contact MR. BEN RICHARD or you call him as soon as you receive this email and tell him to give you the MTCN, sender name and question/answer to pick the $4,500.00 Please let me know as soon as you received all your funds $1.7Million,

Thank you.
Mr. John Kelly

Libya Reconstruction contract bid

Salaam Alaykum,

The Libyan Prime minister has mandated all appointed ministers to take charge in fast reconstructing and re-building of Libya. His present finance minister has mandated me to seek for your confidential cooperation in the supply of various reconstructing equipment's and your products for the rebuilding of Libya.

A consideration also is that your quotation must be CIF Port of commericale GABES Tunisia; we choose this port as result of the present security situation in Libya. We are in need of products for all sectors of our economy. Please email me for more clarification if interested.

Best Regards,

Dr.Mohamed Abdelaziz, PHD
Director of the Minister's Office, Ministry of Finance Libya!

Email analysis :

NOTE : libyaministryoffinance@ovi.com
NOTE : User-Agent : Roundcube Webmail/1.0.1
NOTE : burak.burakotocom@dr.com
NOTE : Received : from unknown (HELO server.mscript.in) (
NOTE : Received : from localhost ([::1]:52081 helo=webmail.boostelectronics.com)
NOTE : by server.mscript.in
NOTE : (envelope-from )
NOTE : Libya Reconstruction contract bid

You can be his next of kin

Dear Good friend,

My name is Mr. Malik Fariz ,I worked as personal Attorney to late Mr. Zulfiqar Ahmed , an expatriate, who was a consultant with PETROLIAM NASIONAL BERHAD (PETRONAS) Malaysia. He died on April 21st, 2009. Since then I have made several inquiries as to locate any of his extended relatives, but all proved abortive.

After several unsuccessful attempts, hence I decided to contact you. I am contacting you to assist in retrieving the money valued at (US$15.5 Million ) that was left behind by my client (Mr. Zulfiqar Ahmed ) with the HSBC BANK BERHAD, Malaysia before it declared un-serviceable account and be confiscated by the bank. Consequently, the bank issued a notice to provide any member of late Zulfiqar Ahmed family or relatives within 10 days or the account will be closed.

I hereby seek your consent to act as relative to late Zulfiqar Ahmed and claim the money US$15. 5 Million from the bank. I will provide the necessary information to be used in convincing the bank that you relate to late Zulfiqar Ahmed . Whoever I present to the bank will claim the money, since I am his personal Counsel before he dies; the bank knows me, because I represent him in all his banking dealings with the bank.

When you claim the money, we share it 50% / 50%. All I require is your honest cooperation to enable us succeed
without any hitch. I guarantee that this will be executed under a legitimate arrangement that will protect us from any breach of the law.

I wait for your urgent reply, send your reply to my private email address fzmk65@outlook.com
l'm sending this mail with my office email address.

Malik Fariz


From Engr. Daniel Peters.
Chairman NNPC Contract Award Committee
Nigerian National Petroleum Corp
Falomo - Victoria Island Lagos.

Dear Friend,


By introduction, I am Engr. Daniel Peters and the Chairman of the Tender Board Committee which awards contract in the Department of Petroleum Resources of Nigeria. I sent you email sometime ago informing you of our plan to transfer the sum of USD$8.6Million (Eight Million, Six Hundred Thousand US Dollars only) to your account, and have been waiting to hear from you ever since, but to no avail you hence this particular message by way of reminder.

I want you to know that these funds originated from an Over-invoiced contract sum which was awarded to a foreign firm in 2004. I and my other colleagues in the Tender Board purposely inflated the actual cost of the contract with the extra value of USD$8.6 Million. However, the original contractor has fully executed the contract, the project commissioned and the contractor paid his actual contract worth, leaving behind the over-invoiced sum which is US$8.6 Million. So, it is based on this that we now want you/your company to come forward to stand in and claim this sum on our behalf.

We are Civil Servants and by law, we are not allowed to operate foreign bank account while still in office, so you are to act as the one who had executed the contract worth the sum of USD$8.6 Million for my Department and you now want your payment settled. Remarkably, this deal is 100% risk free. We are perfectly in charge and had worked out modalities that would guarantee a hitch free transfer of this fund to your account fully free of any illegal act or encumbrances and are clean, clear and non-criminal origin. I will guide you on how to go about it and we shall claim the fund without any difficulty.

If you are interested in the proposal, and you are a trustworthy person who would not sit on this money if it is transferred into your account, kindly indicate by contacting me through my E-mail and you can as well send your bank account details for this transfer. Please note that this deal must be kept absolutely confidential till we have concluded it. We have also mapped out 35% of the total sum for you for your help and assistance while the remaining is for me and my colleagues.

NOTE again that upon completion of this transaction, whereas 35% is mapped out as your compensation for your involvement, we shall visit you immediately to collect and invest our shares in your country. Therefore, you will equally assist us to identify and advise us on any viable business which will have a good return on investment in your country. Please send your response through my private email address: engineer_danielpeters@yahoo.com for my urgent attention.

Thank you as I look forward to your anticipated co-operation.

Yours faithfully,

Engr. Daniel Peters.
Email: engineer_danielpeters@yahoo.com

Truth about your Fund/payment

Dear Victim,

This is to intimate you of a very important information which will be of a great help to redeem you from all the difficulties you have been experiencing in getting your long over due payment due to excessive demand for money from you by both corrupt Bank officials and Courier Companies after which your fund remain unpaid to you.

Due to over rampant internet Banking corrupt activities, and also the High rate of scam on internet, compensation payment was stop. On our information we got about you, we found out that you are among those that have lost money to those internet scammers that claim to have your fund with them. The Board of Trustees decided to cancel the award payment with the bank, This meeting was held in London on 29th of Dec, 2014.

I am Ban Ki Moon Director of international affairs in the United Nation (UN). It may interest you to know that reports have reached our office by so many correspondences on the uneasy way which people like you are treated by Various Banks and Courier Companies Diplomat(s) across Europe to Africa and Asia London UK, and we have decided to put a STOP to that and that is why I was appointed to handle your transaction here in Malaysia.

After the meeting on 29th of Dec, 2014. an official agreement was reached on 30th of DEC, 2014 been Tuesday, between the Board of Trustees and Glasfrew Security Company which took an immediate effects for the Security Company to issue all the Award Winners a Certified International Master Card worth Ten Million Five Thousands United States Dollars (USD 10,500,000.00).

All Governmental and Non-Governmental prostates, NGO's, Finance Companies, Banks, Security Companies and Diplomat(s) which have been in contact with you of late have been instructed to back off from your transaction and you have been advised NOT to respond to them anymore since the United Nation is now directly in charge of your payment. Your fund will be release to you directly from our source with immediate effect and we shall give you further details on how your fund will be released.

You are hereby advice to provide your information as stated below:

Full Name: ...Address:. ...Telephone:....Occupation:.......Age :..........

Name: Ban Ki Moon
Email: un.service0440@post.com

security code? 1985

Note: You can also receive your Funds via Bank Draft Check or Bank Wire Transfer depends on your choice.I hope this is clear. STOP any further communication with ANYONE, any action contrary to this instruction is at your own risk.

Confirm Receipt...


I know that as you read this email, a lot will go through your mind, but i want you to know that this email is for you as i have the feeling that we are meant to do this together. My name is Joshua Andrew and I use to work for a well know bank over here in United Kingdom and i am the one in charge of packaging and also the one in charge of courier for my bank. You might also wonder how i got your contact, I got it through the internet when i was looking for a trust worthy person i can trust to handle a deal i am about to propose to you. A consignments has already been shipped to the United State through me which content $46, 000,000.00USD and all are in $100.00 bill and i will like us to work together in getting the consignments delivered to you. I would want you to help me clear this consignments. It also should be know that this consignments was moved to the United States by our accredited diplomatic agent which all his information will be sent to you when you signify your interest in working with me in this deal. You will be getting 40% of the total sum while I will be getting 50% and 10% will be for any expenses in cure during the delivery. Be rest assured that there are no risk in this deal. My identity should not be disclose for security reason which i know you understand. I would like you to send to me this details. Your full names, Your address, Your Phone No, Date of Birth and occupation. If you and willing to go ahead with this deal you can email me back with the information I requested. Also for security reasons other modalities will be disclose to you as soon as you signify your interest and including the combination code to the consignments will be sent to you too.

Here is my direct phone numbers (+44) 7042048671 AND (+44)7024090979 you can call me at any point in time

Yours Friend,
Joshua Andrew.

Call Me

(+44) 7042048671
(+44) 7024090979

Email analysis :

NOTE : ja443@yahoo.com
NOTE : joshuaandrew9090@yahoo.co.uk
NOTE : X-Msmail-Priority : Normal
NOTE : X-Header-Auth-Local : LOCAL
NOTE : Return-Path : < ja443@yahoo.com >
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2600.0000
NOTE : X-Remote : (61-219-44-181.hinet-ip.hinet.net)
NOTE : Mime-Version : 1.0
NOTE : X-Priority : 3
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : Message-Id : < *.*@servername.embedded.linux.system >
NOTE : X-Header-Auth-Sasl : SASL
NOTE : Content-Type : text/html; charset="Windows-1251"
NOTE : Received : from 61-219-44-181.hinet-ip.hinet.net
NOTE : (HELO servername.embedded.linux.system) (

NOTE : Received : from User (static-173-70-152-79.nwrknj.fios.verizon.net [])

NOTE : by servername.embedded.linux.system (VVV)
NOTE : Confirm Receipt...


My name is Lewis Baach, Attorney at law. Sequel to your non response to my previous email, I am re-sending this to you again thus; A deceased client of mine, that shares the same last name as yours,who died as the result of a heart-related condition on January 28th 2009. I have contacted you to assist in distributing the money left behind by my client which is lodged in the bank.

Lewis Baach

Email analysis :

NOTE : law1@barid.com
NOTE : Return-Path : < test@farakaranet.com >
NOTE : Content-Description : Mail message body
NOTE : Content-Transfer-Encoding : quoted-printable
NOTE : Message-Id : < *.*@jasrasgraphics.securesites.net >
NOTE : Content-Type : text/plain; charset="iso-8859-1"
NOTE : Received : from jasrasgraphics.securesites.net (
NOTE : Received : from [] (host-64-186-51-27.host.ussignalcom.net [])
NOTE : by jasrasgraphics.securesites.net (8.14.5/8.13.6)
NOTE : fyi


Cash Management Dept,
Diamond Bank Plc
Lekki, Plot 10, Block 117, Lekki Penisula


This is to inform you that your contract fund has been approved to be released to you via credit-card delivery and we have successfully registered your credit card with our affiliate courier companies & your parcel registration number is 3852641390700. As regards your payment of three million, five hundred thousand united ($3,500,000.00), the cash management dept (CMD) of diamond bank plc is responsible for the payment of all outstanding debts and services & I am directed by the Bank Group delegates to bring this information to your notice. My office is responsible for issuance of outstanding contract payments,effecting pension funds & repayments on behalf of all other agencies. We are currently verifying details of contractors and we need you to reconfirm your delivery information's for the final reconciliation on payment shipment to your destination. Please reconfirm the below:-

Your Names:
Your Delivery address
Your Mobile/Phone Number:
Name of the closest airport to your residence:

Attach copy of your drivers License/ International Passport.

On a final note, delivery has been ongoing to different destination and to different beneficiary. Payment is programmed to take place from the 5th-30th of December, 2014. So act fast for your parcel to be included in the next batch of delivery. Wishing you a happy Christmas and a prosperous 2015.

Frank Wilson
Cash Management Dept. - Diamond Bank

Email analysis :

NOTE : wilson_f37@yahoo.pt
NOTE : Content-Description : Mail message body
NOTE : Return-Path : < test@danielwireless.com >
NOTE : X-Source-Auth : test@david-fields.com
NOTE : X-Priority : 1 (High)
NOTE : X-Remote : (gator3250.hostgator.com)
NOTE : X-Source-Sender : ([]) []:53358
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : quoted-printable
NOTE : Received : from gator3250.hostgator.com (
NOTE : Received : from [] (port=53358) by gator3250.hostgator.com
NOTE : (envelope-from < test@DANIELWIRELESS.COM >)
NOTE : Sensitivity : Company-Confidential
NOTE : Content-Type : text/plain; charset="iso-8859-1"
NOTE : X-Source-Ip :

NOTE : X-Bwhitelist : no

Rép : Your Abandoned Package For Delivery

Interim Assistance General Manager,
Assistance Inspection Director
Honolulu International Airport
300 Rodgers Boulevard,
Honolulu, HI 96819, USA

Hello Good Friend

Re: Your Abandoned Package For Delivery

I have very vital information to give to you, but first I must have your trust before I review it to you because it may cause me my job, so I need somebody that I can trust for me to be able to review the secret to you. I am Mr.William Emmad, head of luggage/baggage storage facilities (Operations,Maintenance,Transportation) here at the Honolulu International Airport,Hawaii USA. During my recent withheld package routine check at the Airport Storage Vault, I discovered an abandoned shipment from a Diplomat from London and when scanned it revealed an undisclosed sum of money in a metal trunk box. The consignment was abandoned because the Contents of the consignment was not properly declared by the consignee as “MONEY” rather it was declared as personal effect to avoid interrogation and also the inability of the diplomat to pay for the United States Non Inspection Charges which is $3,700USD. On my assumption the consignment is still left in our Storage House here at the Honolulu International Airport,Hawaii till date. The details of the consignment including your name, your email address and the official documents from the United Nations office in Geneva are tagged on the Trunk box. However, to enable me confirm if you are the actual recipient of this consignment as the assistant director of the Inspection Unit, I will advise you provide your current Phone Number and Full Address, to enable me cross check if it corresponds with the address on the official documents including the name of nearest Airport around your city. Please note that this consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delays in concluding the clearance processes so as a result of this, I will not be able to receive your details on my official email account. So in order words to enable me cross check your details, I will advise you send the required details to my private email address for quick processing and response. Once I confirm you as the actual recipient of the trunk box, I can get everything concluded within 48hours upon your acceptance and proceed to your address for delivery. Lastly, be informed that the reason I have taken it upon myself to contact you personally about this abandoned consignment is because I want us to transact this business and share the money 70% for you and 30% for me since the consignment has not yet been returned to the United States Treasury Department after being abandoned by the diplomat so immediately the confirmation is made, I will go ahead and pay for the United States Non Inspection Fee of $3,700 dollars and arrange for the box to be delivered to your doorstep Or I can bring it by myself to avoid any more trouble but you have to assure me of my 30% share. I wait to hear from you urgently if you are still alive and I will appreciate if we can keep this deal confidential. Please get back to me via my private Email:(xxxbent1@yahoo.com) for further directives: You can call me on my telephone number and drop a message.

Thank you.

William Emmad
Interim Assistance General Manager,
Assistance Inspection Director
Honolulu International Airport
300 Rodgers Boulevard,
Honolulu, HI 96819, USA

We receive information from Financial Service Authority that the fund will not be able to transfer to you

Dear Customer!

We receive information from Financial Service Authority that the fund will not be able to transfer to you due to some neccessary transfer document have not been obtain for that reason we have decide to use our affiliated Bank , Bank Of Africa that has the same online banking link to help in making sure you receive your fund without delay. You are advised to contact the below Bank Of Africa Email contact

address: (onlinetransfer1210@outlook.fr)
Bank Name: Bank Of Africa
Contact person: Alhaji.Dr.Suleman Danbaba

As soon as you make contact to them, they will set up online banking in your name for the fund to be transfer online to your account, i will be waiting to hear from you.

Thank you
Mr.Alpha Fiduciary

Miss Kendra Jour


How you doing hope so good, am miss Kendra Jour,I just come across your Face Book profile, I will like to talk with you very important,

Miss Kendra

Email analysis :

NOTE : kendjohn@hotmail.com
NOTE : Return-Path : < rufinalu@yahoo.in >
NOTE : Mime-Version : 1.0
NOTE : X-Yahoo-Newman-Property : ymail-3
NOTE : Content-Length : 1429
NOTE : Received-Spf : none () client-ip=;
NOTE : Received : by; Tue, 06 Jan 2015 05:30:25 +0000

Analysis of rufinalu@hotmail.com data :

Familyname: Amatus
Fullname: Rufina Amatus
Givenname: Rufina
Gender: Female
Facebook: https://www.facebook.com/sarah2b42


Greetings to you .

How are you doing today i hope all is well with you and your family, My name is Ruice Smith, I work as an accountant with the Chase Bank here in the UNITED STATE OF AMERICA, I want to bring to your notice in respect of your compensation worth $2.5m United State Dollars funds coming from Africa in conjunction with the Uk Board of Trustees, This is to inform you that you are kindly advice not to send any money to anyone over there in UK or Africa because your funds is presently here in our bank here in the UNITED STATE OF AMERICA. I will kindly want you to please re-confirm this information and get back to me before i can make a remittance regarding your funds to you.

Note: I will kindly advice you to keep this letter a very confidential one and never let out to anyone until this transfer is been completed because we don't know who is next to you.Less i forget, will want you to kindly get back to my boss head of department with his below information , name of your next of Kin and also a scan copy of your driver License and your phone number.

Head Of Department Details to send the information requested to:

E-Mail Address: barristereliott@gmail.com
Phone Number: (732) 535-7915

I hope to hear from you soonest.

Thanks and Remain Blessed
Ruice Smith
Representing Chase Bank.

Spam Ikea par R-Advertising


Bonjour ,

Félicitations ! Vous venez juste d'être élu comme gagnant potentiel d'un bon d'achat de 500 euros chez Ikea.

Nous sommes heureux de vous annoncer que vous faites partie des sélectionnés finaux pour gagner ce bon d'achat.


Cette offre est limitée.


L'équipe de Bons d'achats.

Les visuels et photographies présents ne sont présentés qu'à titre indicatif et n'ont aucun caractère contractuel.

Email analysis :

NOTE : X-Ec-Messenger-Sender-Domain : bounce.base.information-mode.com
NOTE : Return-Path : < *@bounce.base.information-mode.com >
NOTE : List-Help : complaint@intl.teradatadmc.com
NOTE : Mime-Version : 1.0
NOTE : Message-Id : < *.*@base.information-mode.com >
NOTE : List-Id : *.base.information-mode.com
NOTE : X-Mailer : eC-Messenger Build 6.90.871.3
NOTE : Received : from sxquattuor.alpha.ec-cluster.com ([])
NOTE : Received : from app42.muc.ec-messenger.com (app42.muc.domeus.com [])
NOTE : by mta61.muc.domeus.com (READY)
NOTE : récupérez votre bon d'achat IKEA

Amazon Phishing

Update Billing

We could not verify the billing method we have on record for your account.

If you fail to update your billing you will no longer be able to use the Netflix service.


Phishing analysis :

OPEN : http://processingsupport.website/
REDIRECT : http://processingsupport.website/http.www.secure.login.amazon.com-83/confirm/details.php?userid=***

CLICK : Save & Continue
REDIRECT : http://processingsupport.website/http.www.secure.login.amazon.com-83/confirm/Billing.php

CLICK : Confirm Card
REDIRECT : http://processingsupport.website/http.www.secure.login.amazon.com-83/confirm/confirmed.php?close=***

REDIRECT : http://www.amazon.com/gp/help/customer/display.html?ie=UTF8

Email analysis :

NOTE : Mime-Version : 1.0
NOTE : X-Msmail-Priority : High
NOTE : Return-Path :
NOTE : Return-Path : sales
NOTE : X-Mailer : Smart_Send_3_1_6
NOTE : X-Priority : 1
NOTE : Received : from hostarea52.com (hostarea52.com. [])
NOTE : Received : from unknown (HELO static.
NOTE : (sales@
NOTE : by hostarea52.com with ESMTPA;
NOTE : Received-Spf : client-ip=;
NOTE : Update

Technicals informations :


Google result for : http://processingsupport.website/